Investigating the Impact of the Year 2000 Problem

S. Prt. 106-10

The United States Senate Special Committee on the Year 2000 Technology Problem

Senator Robert F. Bennett, Chairman Senator Christopher J. Dodd, Vice Chairman

Investigating the Impact of the Year 2000 Problem

Competing pressures tempt one to believe that an issue deferred is a problem avoided: more often it is a crisis invited. Henry Kissinger

Summary of the Committee’s Work in the 105th Congress

February 24, 1999

INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

TABLE of CONTENTS Page

Executive Summary 1

Introduction 7 Understanding the Problem 8 Critical Infrastructures 11 Formation of the Special Committee 13

SECTORS

Utilities 17 Electric 17 Oil & Gas 27 Water 33

Healthcare 43

Telecommunications 53

Transportation 65

Financial Services 79

General Government 93 Emergency Preparedness 93 Federal Agencies 106 Department of Defense 111 State and Local Government 113

General Business 117 Small Business to Global Corporations 117 Pharmaceuticals 129 Food Industry 129 Chemical Manufacturing 130

Litigation 135

International Preparedness 137

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM iii INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Page

Legislative Activities 147 S. 22 147 S. 1518 147 S. 1671 147 S. 2000 147 S. 2392 (P.L. 105271) 148

Committee Priorities for 1999 149

Appendix I – Recent Events 153

Appendix II – Acronyms Used in This Report 159

Appendix III – Y2K Solution Approaches 163

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM iv INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

EXECUTIVE SUMMARY

The Committee has found that the sonal preparedness cannot be an- most frustrating aspect of addressing swered at this time. the Year 2000 (Y2K) problem is sorting fact from fiction. Reports On the positive side, Y2K awareness from even the most reputable news is growing. In the past year, both sources fall prey to polarizing public and private institutions have forces—either over emphasizing a doubled their efforts to find, evaluate, handful of Y2K survivalists, or down- and address Y2K risk exposure. The playing the event as a hoax de- Committee has seen a significant signed to sell information technology amount of progress since its incep- equipment. tion. However, Senate hearings, interviews, and research have not pro- The Internet surges with rumors of duced convincing evidence that the massive Y2K test failures that turn Y2K problem is well in hand. out to be gross misstatements, while image-sensitive corporations down- The biggest Y2K impact may occur play real Y2K problems. The good internationally. While the U.S. news is that talk of the death of civili- should have started its Y2K prepara- zation, to borrow from Mark Twain, tions earlier, worldwide preparations has been greatly exaggerated. The generally lag even further behind. bad news is that Committee research has concluded that the Y2K OVERALL OBSERVATIONS problem is very real and that Y2K risk management efforts must be in- Many organizations critical to creased to avert serious disruptions. Americans’ safety and well-being are still not fully engaged in find- Y2K is about more than the failure of ing a solution. an individual’s personal computer or an incorrect date in a spreadsheet. For example, over 90% of doctors' As one examines the multiple layers offices and 50% of small- and me- of systems and technologies that dium-sized businesses have yet to support our everyday lives, the po- address the problem. Larger firms tential Y2K problems increase expo- have, in general, grasped how a Y2K nentially. The interdependent nature failure could severely impact their of technology systems makes the businesses and are taking steps to severity of possible disruptions diffi- remedy the problem. Smaller firms cult to predict. Adding to the confu- remain more focused on what they sion, there are still very few overall perceive as more immediate con- Y2K technology compliance as- cerns, which in many cases do not sessments of infrastructure or indus- include Y2K. try sectors. Consequently, the fun- damental questions of risk and per-

1 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Most affected industries and or- troduced the CRASH Protection Act ganizations started Y2K remedia- (S.1518). The Year 2000 Informa- tion too late. tion Readiness and Disclosure Act provided a basic level of protection As a result, many organizations must for Y2K statements made in good exercise "triage"—focusing on what faith. The CRASH Protection Act is critical to sustain the life of the pressured the SEC to require more enterprise as opposed to finding meaningful Y2K corporate disclosure long-term solutions. to shareholders.

Self-reporting has yielded unreli- More legislation may be necessary able assessments for most indus- to address Y2K litigation. Some li- try sectors. With few exceptions, ability cost projections are as high as disclosure of Y2K compliance is $1 trillion. Serious doubts exist as poor. to whether or not the present judicial system could handle a potentially Analogous to letting students grade monstrous wave of litigation. their own tests, self-reporting offers data of varying reliability. Nonethe- The Committee plans to address less, it has become the standard in certain key sectors in 1999 where both private industry and govern- there has been extreme reluctance ment. Industry surveys are currently to disclose Y2K compliance. the most widely utilized tool to measure compliance. Unfortunately, National emergency and security the results of many surveys have planning for Y2K-related systems been kept from public and Special failures is just beginning. Committee view (see "Transporta- tion" in this report). Despite an SEC FEMA contingency plans are in draft rule requiring Y2K disclosure of pub- form, but there is no national, strate- lic corporations, companies are re- gic plan to assure that critical infra- luctant to report poor compliance structures will continue to function. levels. This is partially due to varying levels Fear of litigation and loss of com- of state and local government pre- petitive advantage are the most paredness. State and local govern- commonly cited reasons for bare- ments represent the first line of de- bones disclosure. fense in emergency situations, and emergency planning is difficult with- Although sharing Y2K data could out their full involvement. A recent save time in companies’ remediation Labor Department report stated that and contingency planning efforts, several states are lagging in specific such cooperation has not been forth- Y2K system repairs relating to feder- coming. To encourage greater dis- ally funded programs. closure, the Committee spearheaded a bipartisan effort that passed the Year 2000 Information Readiness and Disclosure Act (S.2392) and in-

2 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Leadership at the highest levels is a whole is configured to handle lacking. interruptions, blackouts, and natural disasters. A prolonged, A misconception pervades corporate nationwide blackout is not likely boardrooms that Y2K is strictly a to occur. However, local and re- technical problem that does not war- gional outages remain a distinct rant executive attention. Some gov- possibility depending upon the ernment sectors lack clear directives overall preparedness of the indi- and policies on Y2K. vidual electric utility serving a given area. SECTOR ASSESSMENTS The nation's electric power industry Since its establishment in April 1998, comprises 3,200 independent utili- the Special Committee has held nine ties. Overall remediation of the hearings on seven critical economic electric power industry is slow. Ac- sectors: cording to NERC, only about 50% of the utilities had completed Y2K re- · Utilities mediation as of December 1998. · Health care Failure of some parts of the electric industry's system is likely, but the · Telecommunications Committee does not expect the in- · Transportation tegrity of the overall power grid to be compromised. Of greatest concern · Financial institutions are approximately 1,000 small, rural · Government electric utilities that may not have the resources to devote to Y2K compli- · General business ance.

Compliance among oil and natural The eighth sector, Litigation, will be gas utilities is also progressing addressed in early 1999. slowly. A survey by the Committee, while limited in scope, indicates a The Committee plans to revisit each lack of contingency planning, overly of the sectors in 1999, with emphasis optimistic assertions that compliance on litigation and the addition of inter- will be complete, and a lack of national concerns to the list of critical knowledge about suppliers' Y2K sectors. The Committee will assess status. the nation's progress toward Y2K compliance and pinpoint problem ar- HEALTH CARE eas. The Committee will also continue to provide recommendations to The health care industry lags sig- Congress for legislative action. nificantly in its Y2K preparations compared to other sectors. Be- UTILITIES cause of limited resources and lack of awareness, rural and inner- While some compliance efforts city hospitals have particularly are behind, the utility industry as

3 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM high Y2K risk exposure. ures. Industry in U.S. and overseas has established warning networks to Health care is the nation's single alert each other of Y2K problems. largest industry, generating $1.5 trillion annually. There are 6,000 hos- TRANSPORTATION pitals, 800,000 doctors and 50,000 nursing homes, as well as hundreds The transportation sector is the of biomedical equipment manufac- linchpin for just-in-time inventory turers and suppliers of blood, drugs, management across most every linens and bandages—and health sector, from health care supplies care insurers—that may be unpre- to food. The Y2K readiness of this pared for the year 2000. sector is critical to our global economy. Planes will not fall out According to a report by the Gartner of the sky, but disruption of flights Group, 64% of hospitals—primarily and global trade between some smaller hospitals—have no plans to areas and countries may occur. test their Y2K remediation efforts. In addition, 90% of physicians’ offices On average, the nation's 670 do- are unaware of their Y2K exposure. mestic airports started Y2K compli- Struggling compliance efforts by ance too late. The Federal Aviation HCFA (the agency that oversees Agency has made great strides in Medicare) and unaddressed con- the past year, but remains at risk. cerns about medical devices are The situation with international air major roadblocks to the industry's traffic control and airports is much Y2K readiness. more severe. The maritime shipping industry has not moved aggressively TELECOMMUNICATIONS toward compliance. Public transit could be seriously disrupted. A massive industry-wide effort is underway to assess the impact of FINANCE Y2K on telecommunications. The initial interoperability testing indi- ATMs are expected to function cates that the U.S. communica- correctly and banks should have tions will transition without sig- adequate cash to meet consumer nificant problems. Currently, demand, based on a Federal Re- more than 80% of public network serve estimate that each American systems have been tested and are household will withdraw an aver- considered compliant. age of $500. The securities industry has responded well to its in- The telecommunications industry ternal Y2K issues and has under- has spent billions on Y2K fixes and taken expansive testing. How- should have 99% of access lines in ever, fund managers and brokers compliance by the fall 1999. Cur- have only recently started to con- rently, industry and government are sider the implication of corporate working together to coordinate con- Y2K vulnerability on investment tingency plans in case there are fail- decisions.

4 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

The financial services sector ranks The federal government also varies ahead of nearly all other industries in widely in its Y2K preparations. The its remediation and testing efforts. Social Security Administration Legislation in Congress and action started early and is prepared, while by the Committee have led to legal other agencies, like the Department requirements on broker-dealers and of Defense, are lagging. To its publicly traded companies to dis- credit, the federal government pub- close compliance information. licly displays its Y2K status through quarterly and monthly reports to the Federal regulators have made con- Office of Management and Budget. siderable progress in tracking compliance among banks, thrifts and GENERAL BUSINESS credit unions, of which 95% have received satisfactory government rat- In general, large companies have ings. dealt well with the Y2K problem, due to greater resources. Very GOVERNMENT small businesses may survive using manual processes until Y2K Several state and many local gov- problems are remediated. How- ernments lag in Y2K remediation, ever, many small- and medium- raising the risk of service disrup- sized businesses are extremely tion. The federal government will unprepared for Y2K disruptions. spend in excess of $7.5 billion and One survey shows that more than will not be able to renovate, test, 40% of 14 million small busi- and implement all of its mission nesses do not plan to take any ac- critical systems in time. However, tion. wholesale failure of federal government services is not likely to The heavily regulated insurance, in- occur. vestment services, and banking industries are furthest ahead in their The Committee’s work in this sector efforts: health care, oil, education, includes national emergency plan- agriculture, farming, food processing, ning as well as federal, state, and and the construction industries are local government preparedness. lagging behind. The cost to regain After a late start, FEMA is now en- lost operational capability for any gaged in national emergency plan- mission critical failure will range from ning in the event of major and minor $20,000 to $3.5 million, with an av- Y2K disruptions. erage of 3 to 15 days necessary to regain lost functions. State and local governments vary widely in their Y2K preparations. LITIGATION Several states are not prepared to deliver critical services such as The prospect of litigation arising from benefit payments. Of greatest con- Y2K-related failures has shadowed cern to the Committee is the ability of the Committee’s work from the very local communities to provide 911 beginning. Some estimates project and emergency services. litigation cost in excess of $1 tril-

5 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM lion. The Committee plans to hold extensive research and held numer- hearings and work closely with the ous hearings in 1998, but still cannot Judiciary and Commerce Commit- conclusively determine how exten- tees to make legislative proposals in sive the Y2K disruptions will be. The this area. Committee has no data to suggest that the United States will experience INTERNATIONAL nation-wide social or economic col- lapse, but the Committee believes Several U.S. trading partners are that some disruptions will occur, and severely behind in their Y2K re- that in some cases Y2K disruptions mediation efforts. For example, may be significant. The international the Gartner Group estimates that situation may be even more tumultu- Venezuela and Saudi Arabia (two ous. of the largest U.S. oil importers) are 12 to 18 months behind the There are reasonable steps individu- U.S. in their Y2K remediation ef- als may take to prepare for the Year forts. 2000. Consumers are urged to keep copies of financial statements and The Committee is greatly concerned ask local banks what efforts are be- about the international Y2K picture. ing made toward Y2K compliance. The U.S. is dependent on a healthy Individuals should research compa- global economy. It is in the interest nies' compliance levels before mak- of the U.S. to encourage Y2K reme- ing investment decisions. The Y2K diation worldwide. problem has been likened to a winter storm, with the implication that simi- * * * * * lar preparation is appropriate. Americans should prepare for Y2K The challenges posed by the Y2K based on facts and reasonable pre- problem are numerous and daunting. dictions about the problem's effects The Special Committee conducted on vital services.

6 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

INTRODUCTION

The Year 2000 (Y2K) technology that a new system could accept four- problem started as an innocuous digit years and still exchange infor- short-term solution to the oppres- mation with two-digit based systems, sively high cost of computer memory the extra effort required slowed the in the 1950s and 1960s. Program- changeover process. Additionally, mers expected that the problems the equipment that earlier computer created by the limited, two-digit experts predicted would fall into ob- method of date storage solescence long before would solve themselves FIFTY YEARS AFTER 2000 survived through as companies, govern- layers of programming THE BIRTH OF THE ments and other updates and computer-owners COMPUTER, Y2K modifications. Instead of updated their hardware HAS DEVELOPED solving itself, the Y2K and software. Fifty years INTO A WORLDWIDE problem self-propagated after the introduction of COLLECTIVE CRISIS. around the globe. the computer, the Y2K problem has the potential Just as programmers to develop into a worldwide crisis. found it easy to follow the tradition of Two common human failings con- using a two-digit date field, man- tributed to the crisis—the tendency agement and leadership have found to follow a path of least resistance it easy to defer addressing the Y2K and the reluctance to champion diffi- problem. Y2K competes poorly cult and complex against issues such as issues. The Y2K trade agreements, Y2K, AS THE FIRST problem does not have military operations, to be a story of failure, CHALLENGE OF THE market share and however. If addressed INFORMATION AGE, MUST product development. successfully, Y2K may LEAVE A LEGACY OF It lacks familiarity, and encourage political and INCREASED AWARENESS in a results-driven corporate leaders to AND APPRECIATION OF economy, Y2K reme- better understand and INFORMATION diation costs are protect the critical difficult to justify to infrastructure. TECHNOLOGY’S ROLE IN taxpayers or SOCIAL AND ECONOMIC shareholders. As memory costs fell ADVANCEMENT. Additionally, few dramatically, software wished to be writers and hardware manufacturers associated with the potential reper- did not immediately expand date cussions of a failed Y2K re- variables. Newer versions of hard- mediation attempt. ware and software needed to interface with older versions. While At the heart of the problem lies a se- some programs were modified so rious disconnect between those

7 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM who use technology and those who rect a range of accumulated errors create it. On a worldwide scale, while searching for the source of the leaders of corporations and countries problem. are struggling to understand the Y2K problem. In the process, they are Why is two digit notation defec- receiving a crash course in the frag- tive? ile mechanics of information technology. To save memory in the early days of computing, programmers repre- The Committee feels strongly that sented four-digit years with only two Y2K, as the first widespread chal- digits. For instance, 1968 or 1974 lenge of the information age, must would be stored and processed as leave a legacy of increased aware- 68 and 74, respectively. The num- ness and appreciation of information ber 19, indicating years in the 1900s, technology’s role in social and eco- was implied, much as personal nomic advancement. checks once had the number 19 preprinted on the dateline.

UNDERSTANDING THE This worked smoothly until users PROBLEM started to input dates occurring after December 31, 1999. Computers ran The goal of this section is to provide into problems when required to cal- background on the Y2K problem and culate a number based on the answer common Y2K questions. difference in two dates, such as the interest due on a mortgage loan. What is the Year 2000 computer Computers continued to assume that technology problem? the prefix 19 was implied, so dates such as 00 or 01 were treated as The phrases the “Year 2000 Com- 1900 or 1901. Consequently, computer Technology Problem,” the puters could not correctly calculate “Millennium Bug,” the “Century Date the difference between a year in the th st Change,” or simply, “Y2K”1 all refer 20 century and a year in the 21 to the same problem—a defect that century. exists in millions of computer programs worldwide that causes For example, we know that the time erroneous handling of date (i.e., day, between July 1, 1998, and July 1, month and year) information if not 2005 is exactly 7 years. However, a corrected. The effect of the Y2K flaw computer with a Y2K problem could on computer systems is not easily calculate an answer of either 93 predictable. It may bring a computer years or -7 years, depending on the to a crashing halt. It may cause the specific program. Calculations that computer to generate obviously in- used either of these results would be correct outputs. Or alternatively, it in error and may themselves cause could allow the computer to produce subsequent problems. invalid data that will not be detected Another Y2K problem occurs in the until much later, forcing users to cor- storage of information. Many kinds

8 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM of data are organized and processed private sector, loss of business sys- by date, such as driver’s license rec- tems means that a company may ords and credit card accounts. have difficulty managing its finances, Computers have had problems proc- making or receiving payments and essing credit cards that have tracking inventory, orders, production expiration dates after December or deliveries. In the public sector, 1999. Due to two-digit dating, com- government organizations may be puters have thought that cards severely hindered in performing ba- expiring in 2000 or later had expired sic functions such as paying almost a century ago. retirement and medical benefits, maintaining military readiness, re- What is the scope of Y2K prob- sponding to state and local lems? emergencies, controlling air traffic, collecting taxes and customs and The Y2K problem affects two general coordinating law enforcement efforts. classes of equipment. The first class comprises business systems or Y2K problems in embedded systems mainframe systems. These comput- have the potential to affect public ers perform a variety of data- health and safety. Problems that intensive calculations—balancing need to be fixed have already been accounts, making payments, tracking detected in medical treatment de- inventory, ordering goods, managing vices, water and electricity personnel, scheduling resources, distribution and control systems, air- etc. The second class of equipment port runway lighting and building has several common names, includ- security systems.2 Other suspect ing embedded chips, embedded areas are pipeline control systems processors and embedded control and chemical and pharmaceutical systems. Many aspects of modern manufacturing processes. society rely on microchip-enhanced technology to control or augment How was the Y2K mistake made? operations. Examples are ubiqui- tous. Automatic teller machines, toll Several factors explain the creation collection systems, security and fire of the Y2K problem. In the early detection systems, oil and gas pipe- days of computers, computer mem- lines, consumer electronics, ory was very expensive. In the IBM transportation vehicles, manufactur- 7094 of the early 1960s, core mem- ing process controllers, military ory cost around $1 per byte. systems, medical devices and tele- Today’s semiconductor memory communications equipment all costs around $1 per million bytes. depend on embedded chip- Thus, there was a very strong eco- technology. nomic incentive to minimize the amount of memory needed to store a Y2K related failures in business program and its data in the com- systems will generally cause an en- puter’s memory. terprise to lose partial or complete control of critical processes. In the

9 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Additionally, early computer pro- on data collected quarterly from over gramming was highly time- 15,000 firms and government or- consuming. Programs and data ganizations in 87 countries. Gartner were recorded and entered into estimates a rapid increase in prob- computers via 80 column punch lems in 1999 with a peak sometime cards. Each of the 80 columns could after January 1, 2000. Problem oc- contain exactly one byte of informa- currences will drop off after 2000, but tion, which corresponded to one of will still occur for another 3 to 5 years the four digits needed to represent a at a lower level. Finally, the Informa- year. The cumbersome nature of tion Technology Association of punched cards encouraged using as America has reported that about half few of them as possible. the major corporations in America have already experienced some form Although programmers and manag- of Y2K disruption as of March 25, ers knew they had built software with 1998.4 latent defects in it, no one thought that software written in the 60s and How can we fix Y2K and how long 70s would survive to the Year 2000. will it take? Compounding the problem, newer software had to interface and share It is beyond the scope of this report data with the older software. Al- to cover the technical nuances of though the new software could have these various solutions. However, handled dates internally in four digit various techniques are briefly de- formats and swapped data in two scribed in Appendix III. digit formats with the older software, to do so added complexity and How much are Y2K fixes going to hence added cost to new software. cost? The net result was that the two-digit standard for representing years con- There is no generally agreed upon tinued much longer than anyone answer to this question. The Gartner would have guessed. Group’s estimate of $600 billion worldwide is a frequently cited num- When will Y2K problems start? ber. Another number from a reputable source is that of Capers Y2K problems have already surfaced Jones, Software Productivity Re- in many places. Cap Gemini, a search, Inc. of Burlington, MA. technology consulting firm, reported Jones’ worldwide estimate is over that as of December 1997, 7% of a $1.6 trillion.5 Part of the difference is group of 128 large U.S. companies that Jones’ estimate includes over had experienced Y2K related prob- $300 billion for litigation and dam- lems.3 By March 1998, that number ages but Gartner’s does not. A leaped to 37%. The Gartner Group, sense of the scale of the cost can be an information technology research gained from looking at the Y2K costs company, has developed a model to of six multinational financial services predict the rate of occurrence of Y2K institutions; Citicorp, General Motors, problems. This prediction is based Bank America, Credit Suisse

10 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Group, Chase Manhattan and J.P. grams7 is an enormous task difficult Morgan. These six institutions have to automate. collectively estimated their Y2K costs to be over $2.4 billion. Additionally, The embedded processors pose an- the estimated cost of Y2K repairs is other problem. Although the increasing, as shown in figure 2. percentage of embedded chips with a Y2K problem is estimated to be Figure 2. Y2K Repair Estimates6 relatively small, potentially millions of chips exist that may have to be re- Company Past Est. New Est. placed. Unfortunately, most of them (millions) (millions) are not readily accessible or easily Aetna $139 $195 modified. ATT $300 $900 Bankers Trust $180-$230 $220-$260 Where can I learn more about the Cendant $25 $53 Y2K problem? Chase Manhatt. $300 $363 General Motors $400-$500 $890 McDonald’s $8 $30 Many solid references can be found Merrill Lynch $375 $560 in the endnotes of this section and Sears $63 $143 elsewhere in this report. An enor- Xerox $116 $135 mous amount of Y2K information resides on the Internet. However, legitimate information is buried Can’t we develop an easy Y2K fix? among overstated rumors and half- truths. As with most other informa- Popular sentiment suggests that a tion derived from Internet sources, technological quick fix will appear Y2K information must be verified for just in time to kill the millennium bug. accuracy. So far, “quick fix” claims have proved to be claims for a particular product Additional information can be ob- that may show promise in one par- tained through the Committee’s ticular application, for example, website at www.senate.gov/~y2k and finding where the actual dates and the President’s Council on Year date processing routines are hidden 2000 Conversion’s website at in a program. www.y2k.gov. Software programs and computer hardware vary too greatly to be fixed CRITICAL by one solution. Currently, there are INFRASTRUCTURES over 500 programming languages in use. A universal or broadly applica- Critical infrastructures can include ble Y2K solution would have to be both computerized services and compatible with many or most of physical services essential to mini- these languages. Additionally, find- mum functioning of economy and ing all the dates and date processing government. More than abstract in an estimated 36,000,000 pro- systems, critical infrastructures enable the average person to use an

11 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

ATM, make a phone call and fly on comprehensive attack” against criti- an airline. In the past, many of these cal systems.8 key infrastructures or sectors were separate. However, advances in in- It is absolutely vital that the owners, formation technology have caused operators and regulators of the na- many of these systems to be inter- tion’s critical systems continue to be connected and linked through aware that Y2K may provide an op- networks. The Committee has ap- portunity for those with malicious proached the critical infrastructures intent. Sandia National Laboratories by examining the Y2K work occur- warned the Committee that: ring both vertically within specific sectors and horizontally across dif- “Thinking that we will be so preoccu- ferent interrelated sectors, such as pied with Y2K that we would not banking and telecommunications. notice deliberate malicious intent, terrorists, hackers and other crimi- Recognizing that the Y2K problem nals might see Y2K as a prime could have serious implications on opportunity to attack pieces of our the smooth functioning of our de- infrastructure. Or they might use fense and economy, Senator Y2K-induced infrastructure failures Moynihan wrote President Clinton in as cover for theft, arson, bombings, July of 1996 and suggested a special etc. We must be watchful of such Y2K commission. While Senator groups in the months leading up to Moynihan’s suggestion was not Y2K and we must be especially taken, Executive Order careful when 13010 created the THE QUESTION IS NOT monitoring the crisis as President's Commission WILL THERE BE it occurs to discern on Critical Infrastructure DISRUPTIONS, BUT HOW deliberate intent.” 9 Protection. The SEVERE THE Commission was not DISRUPTIONS WILL BE. Current national tasked to study Y2K, but security and emer- -SENATOR DODD it recognized the poten- gency preparedness tial for the Y2K problem to cause policies are not designed for the long-term problems in the infra- challenges of the information age. structures. Due to late starts, many The U.S. needs a system or process organizations have contracted out whereby the government can coordi- work on sensitive systems. In some nate responses with the privately cases, organizations are sending owned and operated critical infra- code overseas to foreign firms. The structures. We must build the broad correction of code overseas could based contingency plans necessary lead to increased incidents of corpo- to ensure that the national security rate espionage and intentional cyber and emergency preparedness pos- disruptions. The broad scope of Y2K ture of the U.S. is not compromised corrections could allow an adversary by Y2K. The U.S. must remain to build an exceptional understand- ready to mitigate the (economic, ing of sensitive systems thus emergency or security) effects that enabling it to “design a subtle or could be caused by Y2K.

12 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

· The Federal Reserve Board Y2K is an opportunity to educate (FRB) ourselves first hand about the nature of 21st century threats. Technology · The Federal Deposit Insurance has provided the U.S. with many ad- Corporation (FDIC) vantages, but it also creates many new vulnerabilities. Recognizing · The Office of Thrift Supervision shifts in the technological topography (OTS) of the nation requires vision. Re- verting to a world without microchips · The National Credit Union Ad- or technology-dependent systems is ministration (NCUA) not only undesirable, but also impossible. Instead, we, as a nation and · The Office of the Comptroller of as individuals, need to consider the Currency (OCC) carefully our reliance on information technology and the consequences of · The Securities and Exchange interconnectivity, and work to protect Commission (SEC) that which we have so long taken for granted. Shortly after the Committee inquiry, the Federal Financial Institutions Ex- amination Council (FFIEC), an inter FORMATION OF THE agency body made up of FRB, FDIC, SPECIAL COMMITTEE OTS, NCUA and OCC, issued guidelines for the financial institutions and federal examiners to focus Senator Robert Bennett first identi- on issues they must address to avoid fied the Year 2000 as an issue for major service disruptions due to the legislative agenda in 1996 as the Y2K.10 Senate organized for the 105th Con- gress. He shared his concerns with Individual agency responses re- Senator Alfonse D’Amato, Chairman vealed varying degrees of readiness. of the Senate Banking Committee, The SEC's response detailed exten- who urged Senator Bennett to take sive plans for remediation and up the issue in his new role as testing, while other agencies demon- Chairman of the Subcommittee on strated little more than a general Financial Services and Technology. awareness and initial response to the problem. Many of the regulatory The Subcommittee naturally focused agencies deferred to statements its first efforts on the regulators’ ef- published by FFIEC without provid- forts to ensure Y2K compliance. In ing any substantive information February 1997 and again in April about their own progress. These re- 1997, Senators D’Amato and sults prompted Senator Bennett to Bennett requested information on conduct the first hearing on financial Y2K preparations from the following services and the Year 2000 on July financial regulatory agencies: 10, 1997.

13 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

At the end of the first hearing, bulletins emphasizing the application Senator Christopher Dodd quickly of disclosure law to the Y2K issue, recognized the importance of the the level of information disclosed in Y2K issue and voiced his support for March 1998 was disappointingly low. additional hearings on Y2K. The Indeed, some companies overlooked Subcommittee held another eight Y2K entirely under the premise that hearings to investigate the scope Y2K did not present a material threat and severity of the Y2K problem and to their businesses. Meanwhile, off- to prompt action in the financial the-record discussions with Sub- community. committee staff suggested that many corporations preferred to incur SEC On November 10, 1997, Senator fines than a drop in their stock Bennett introduced the Computer prices. The Subcommittee invited Remediation and Shareholder Pro- the SEC to a June 1998 hearing, tection Act of 1997 (CRASH which led to additional guidance in Protection Act), which required the the form of an interpretive release on Securities and Exchange Commis- Y2K disclosure. However, the point sion to increase its disclosure was made that the Subcommittee on regulations relative to Y2K readi- Financial Services and Technology ness. With the threat of the CRASH simply did not provide the scope Protection Act looming, the SEC re- necessary to adequately address the doubled its efforts to raise breadth and depth of the Y2K prob- awareness of Y2K implications. lem.

Also in November 1997, Senator Voicing this concern, Senators Bennett wrote President Clinton to Bennett and Dodd met with the Sen- express concern over a lack of na- ate leadership. Senate Majority tional leadership in the Y2K arena. Leader Trent Lott recognized the im- The Senator suggested the appoint- portance of Senate leadership in the ment of a Y2K “czar” to oversee the Y2K arena and with the assistance Y2K compliance of the federal gov- of Minority Leader Tom Daschle, ernment and initiate a public-private cleared the way for the creation of Y2K action. Three months later, the Special Committee on the Year President Clinton issued Executive 2000 Technology Problem. Order 13073, creating the Presi- dent’s Council on Year 2000 On April 2, 1998, the U.S. Senate Conversion. Subsequently, John unanimously voted to establish a Koskinen was tapped to chair the new committee to address the Y2K new council. technology problem. The Special Committee on the Year 2000 Tech- During these events, the Subcom- nology Problem was authorized mittee struggled to reach industries through February 29, 2000. The outside of banking. SEC disclosures Majority Leader named Senator provided a tool, albeit blunt, to raise Bennett to serve as its Chairman. Y2K awareness and planning within Committee membership included: public companies. Despite staff

14 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

· Vice-Chairman Senator · Senator Robert Byrd (D-West Christopher Dodd Virginia) ex-officio (D-Connecticut) Because the Committee does not · Senator Jon Kyl (R-Arizona) have legislative authority, each of the members was carefully selected · Senator Susan Collins (R-Maine) based on membership on other committees, such as Judiciary, · Senator Gordon Smith Armed Services and Government (R-Oregon) Affairs.

· Senator Daniel Patrick Moynihan According to the legislation that cre- (D-New York) ated it, the Senate Special Committee on the Year 2000 Tech- · Senator Jeff Bingaman (D-New nology Problem will exist until Mexico) February 29, 2000, after which it will permanently disband. · Senator Ted Stevens (R-Alaska) ex-officio

1 Y2K is an acronym that stands for the Year 2000. The letter K is scientific shorthand for 1000.

2 “Year 2000 Recession?,” Edward Yardeni, Version 9.1, November 2, 1998, chapter 3, http://www.yardeni.com/y2kbook.html.

3 “Year 2000 Survival Guide,” Edmund X. DeJesus, BYTE Magazine, July 1998, p. 57.

4 ITAA Press Release, March 25, 1998, http://www.itaa.org/y2kpr.htm.

5 “The Global Economic Impact of the Year 2000 Software Problem,” Capers Jones, version 5.2, January 23, 1997, Software Productivity Research, Burlington, MA, pp. 57-58.

6 Business Week, December 14, 1998, p.39.

7 “The Global Economic Impact of the Year 2000 Software Problem,” Capers Jones, version 5.2, January 23, 1997, Software Productivity Research, Burlington, MA, p. 20.

8 Critical Foundations: Protecting America’s Critical Infrastructures (PCCIP report, October 1997).

9 Testimony of Sandia National Laboratories before the Special Committee on the Year 2000 Technology Problem, United States Senate, July 31, 1998.

10 Richard M. Nunno, “The Year 2000 Computer Problem: Activity in the 105th Congress,” Congressional Research Service, October 1, 1998.

15 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

UTILITIES

The Committee has taken a broad- power is the number one concern for based approach to utilities—aggre- all other sectors. gating electrical power, gas and oil, and water (drinking and wastewater) Overview in this sector. Telecommunica- tions—is discussed separately in There are about 3,200 independent another section of this report. electric utilities in the United States including about ELECTRIC UTILITIES · 250 investor-owned or private utilities, One of the most often asked ques- · 10 government-owned utilities, tion concerning Y2K is, “will the · 2,000 other publicly owned utili- lights stay on?” In general, the an- ties, and swer is yes. However, progress in · 900 cooperatives. assessing, remediating, and testing is insufficient to ELECTRICAL Nearly 80% of the nation’s answer this question POWER IS KEY TO power generation comes absolutely. As with other from the 250 investor- sectors, some general EVERY OTHER SECTOR: THE owned public utilities. The conclusions can be drawn. federal government First, the large corporations, LIGHTS MUST generates another 10% of or bulk power producers, STAY ON! the nation’s power, are spending vast resources primarily through large to get the Y2K problem under con- facilities such as the Tennessee trol. However, each of the 3200 Valley Authority and the Bonneville electric utilities is at a different stage Power Authority. There are another of remediation, and many may expe- 2,000 non-utilities, or privately rience problems. All of the evidence owned entities, that generate power seems to indicate that there may be for their own use and/or for sale to isolated and diverse electrical out- utilities and others. ages across the country. The questions now are: Where will they Electric power is generated from the occur, how long will they last, and following sources: will they be significant enough to affect the overall grid? · 51% by coal · 20% by nuclear energy The Committee made electric utilities · 15% by gas, its top priority because of its critical importance to everything else—with- · 10% by hydro, and out electric power little else will work. · 4% by other sources. As a result, the status of electric The approximately 900 cooperatives

17 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

generally have limited power- out in Maine, affecting power in generation capacity and focus pri- Florida. marily on distribution systems. The basic structure of an electric The electric power industry is com- power transmission and distribution plex and highly automated. It is system consists of a generating made up of an interconnected net- system, a transmission system, a work of generation plants (nuclear, sub-transmission system, a distribu- fossil fuel, gas, hydro, etc.), trans- tion system, and a control center. mission lines (commonly referred to Power plant generation systems may as the “grid”), and distribution facili- include steam turbines, diesel en- ties. There are three independent gines, or hydraulic turbines interconnections or grids that provide connected to alternators that gener- electricity to every household and company in North America (See figure 1.)

In its simplest form, each of these grids operates as a single machine, constantly making adjustments to balance the amount of power being generated with the amount being used. These adjustments are critical because electric power cannot be stored. Too much power could Figure 1: North American “Grids” literally melt transmission and distribution lines; too little power ate AC electricity. This configuration could result in brown outs. is illustrated in figure 2.

It takes a high degree of automation In most respects, the electric indus- to operate the grid. On one hand, it try faces the same Y2K challenges is this high degree of interconnect- as every other industry. Y2K edness that gives the system its anomalies could lead to the malfunc- unprecedented reliability and effi- tion of software programs on ciency. On the other hand, the mainframe computers, servers, PCs, interconnectedness makes the grid and communications systems. Cor- fragile and susceptible to Y2K disrupted data could be passed from ruptions. An outage in one part of one application to another causing the grid can cascade causing ripple erroneous results or shutdowns. This effects on other parts of the grid. For means computer programs used for example, a generation plant could go accounting, administration, billing,

18 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Figure 2: Electric Power Components and other important functions could without knowing the ultimate appli- experience problems. cation of the chip. A single circuit board can have 20–50 of these chips Of greater concern to the electric from various manufacturers. Be- power industry are embedded com- cause of the diversity of chip puters—small electronic chips or suppliers, one vendor may use a control devices. These chips are different mix of chips even within de- used extensively in all parts of the vices labeled with the same name, electric power industry including model number, and year. Many of generating plants, transmission lines, these chips have built-in clocks that distribution systems, and power may experience date change control systems. Even though only a anomalies associated with Y2K small number of these embedded devices will have a Y2K problem, it is There are numerous mission critical impossible to tell which ones until systems essential to the production, each chip has been checked and transmission, and delivery of electric tested—a time consuming venture. power. Y2K risks in electric power can be grouped into five areas. Making matters worse, electronic chips are generally mass-produced

19 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

1. Power Production Systems ent on time signal emissions from Global Positioning Satellites. Be- Generating units must be able to op- yond the 200 operating centers, erate through critical Y2K periods there are hundreds of additional without disruption. Units that are control centers used to manage sub- scheduled to operate must be able to transmission and distribution sys- start up and deliver electricity as tems. These systems are typically planned. The threat is most severe in operated using a subset of an en- power plants with Digital Control ergy management system, called Systems (DCSs). Many older plants Supervisory Control and Data Acqui- operating with analog controls may sition (SCADA). be less problematic. Numerous control and protection systems within 3. Telecommunications Systems the DCS use time-dependent algorithms, which may result in Electric power systems are highly generating unit trips when encoun- dependent on microwave, telephone, tering a Y2K anomaly. Digital VHF radio, and satellite communica- controllers that have been built into tions. If the control centers are the station equipment, protection relays, “brains” of the electrical grids, com- and communications may also pose munications systems are the risks. “nervous system.” Telecommunica- tions is the single most important 2. Energy Management Systems area in which the electric systems depend on another industry. Many There are approximately 200 bulk of the telephone, microwave, and electric control centers in North network services used for communi- America. From these control cen- cations in the electric industry are ters, system operators monitor and provided by telephone companies control the backbone of the electrical and other communications and net- systems and dispatch generation to work service providers. The meet demand. Computer systems dependency of electric supply and within these control centers use delivery systems on external service complex algorithms to manage the providers is a crucial factor in suc- operations of transmission facilities cessful performance during Y2K and to dispatch generating units. At transition periods. any moment in time, a percentage (usually 10–20%) of generating units 4. Substation Control Systems may be on automatic control for the purpose of following load and regu- Throughout electric transmission and lating interconnection frequency. distribution systems there are sub- Many of the control center software stations that contain control applications contain built-in time equipment such as circuit breakers, clocks used to run various power disconnect switches, and transform- system monitoring, dispatch, and ers. Remote terminal units (RTUs) control functions. Some energy in substations serve as the commu- management systems are depend- nications hubs for the substations,

20 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM allowing them to communicate with the Department of Energy’s (DOE) the control centers. Substations also whose mission is to formulate a contain most of the transmission and comprehensive energy policy en- distribution system protection relays, compassing all national energy which serve to operate circuit break- resources, including electricity; and ers to quickly isolate equipment the Federal Energy Regulatory should an electrical fault occur on a Commission (FERC), an independ- line, transformer, or other piece of ent agency overseeing the natural equipment. gas industry, the electric utilities, non-federal hydroelectric projects, 5. Distribution Systems and oil pipeline transport. Other federal agencies that oversee the Distribution systems deliver electric- electric power transmission and dis- ity from the transmission network to tribution industry include customers. There is a lot of com- monality in the types of substation · the Nuclear Regulatory Commis- equipment in distribution compared sion (NRC), to transmission. Distribution sys- · the Rural Utility Service (RUS), tems have additional equipment · the Environmental Protection outside substations (for example, Agency (EPA), and along a distribution feeder) that may · the Securities and Exchange have electronic controls. Examples Commission (SEC). include reclosers (relays that open and close a feeder in rapid succes- At the request of DOE, the North sion to allow a fault to clear), American Electric Reliability Council capacitors, voltage regulators, and (NERC)—a non-federal entity—has special monitoring devices. assumed the primary role in monitoring the overall Y2K preparedness Although the five areas outlined of the electric power industry. NERC above focus directly on the produc- is a logical choice for this role be- tion and delivery of electricity, other cause it is the organization most support systems are essential to involved in keeping the lights on in sustained operations of the electrical North America. service provider. These systems Formed in 1968 in response to a have been grouped under the head- cascading blackout that left almost ing “Business Information Systems” 30 million people without electricity, in this report. They include among members are drawn from all owner- others customer service call centers, ship segments of the industry— supply and inventory systems, and investor-owned, federal, state, accounting systems. municipal, rural, and provincial. NERC is a nonprofit corporation Major Players composed of ten regional councils.

Several federal organizations are in- The members of the regional coun- volved in various aspects of the cils are electric utilities, independent electric power industry. Primary are power producers and electricity

21 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM marketers that account for most of nen, Chairman, President’s Council the electricity supplied in the United on Year 2000 Conversion; Elizabeth States, Canada, and Mexico. Moler, Deputy Secretary DOE; Shirley Ann Jackson, Chairman, State public utility commissions NRC; Michehl Gent, President, (PUCs) play the most significant role NERC; and Dr. Charles Siebenthal, regulating the electric power indus- Manager Y2K Programs, EPRI. In try. PUCs control the rate structure addition, because of the lack of data for all municipal utilities, investor- on the overall status of the electric owned utilities, and rural electric co- power industry, the Committee con- operatives that own, maintain, or ducted a survey of large electric and operate an electric generation, gas and oil utilities. transmission, or distribution system within a state. By controlling what The Committee’s survey results constitutes an allowable charge, clearly indicated that electric utilities classifying accounts, and structuring did not have an accurate picture of rates, the PUCs can exert significant their current state of Y2K readiness. influence over utilities. The PUCs Most utilities had just begun to as- also regulate reliability for both op- sess their systems and embedded erational and emergency purposes, devices oversee territorial agreements, and resolve territorial disputes between John Koskinen outlined the structure utilities. of the President’s Y2K Council and reported that DOE would head the Other significant Y2K players in the electric power sector. electrical power industry include the: DOE testified that it lacked the · American Public Power Associa- regulatory authority to force industry tion (APPA) compliance. DOE asked NERC for · Electric Power Research Institute help in building an understanding of (EPRI) Y2K efforts in the electric power in- · National Rural Electric Coopera- dustry. NERC also assumed tive Association (NRECA) responsibility for surveying the in- · Edison Electric Institute (EEI) dustry. · Nuclear Energy Institute (NEI) · Canadian Electric Association APPA, where members include (CEA) many state and local municipal electricity providers, is coordinating Major Initiatives information sharing and surveys of its members, as well as smaller non- The Senate Year 2000 Committee member public power utilities. APPA held its first hearing on energy utili- is assisting NERC in the industry- ties on June 12, 1998. We received wide readiness review of electric testimony from Administration offi- distribution systems. cials and key players in the electrical power industry including John Koski-

22 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

EPRI is focusing its Y2K program on embedded systems and the associ- Based on the survey results, the ated Y2K technical and project Committee concluded that the utili- management issues. Over one hun- ties were proceeding in the right dred companies are participating in direction, but the pace of remedial the EPRI information-sharing pro- efforts was too slow and there was gram, representing over 74 percent so much remaining to be done that of the electric power consumed in there was significant cause for con- North America. cern. Only two of the eight firms reported completion of assessment, EEI represents investor-owned utili- making assertions of Y2K compli- ties. It has established a program to ance by December 1999 highly address Y2K technical, regulatory, suspect. Committee concern was and liability issues. EEI is also as- heightened because the most diffi- sisting in the readiness review of cult tasks—renovation and testing— electric distribution systems. were yet to come.

NRECA is coordinating Y2K readi- The utilities’ lack of information re- ness assessments and information garding Y2K compliance of their sharing among its membership, major suppliers, vendors, and serv- which includes nearly 1,000 rural ice providers created additional electric systems. concerns about the utilities assertions of readiness. The survey NEI is coordinating the assessment results raise significant levels of con- of Y2K readiness of U.S. nuclear fa- cern given that the firms surveyed cilities and is providing that informa- were among the largest utilities and tion as part of the NERC surveys. were dedicating many resources to Y2K (collectively over $400 million). CEA is assisting NERC by coordi- Smaller firms with fewer resources nating efforts in Canada, particularly are presumably further behind in to address the readiness of electric their Y2K remediation efforts. distribution systems and Canadian nuclear facilities. On September 17, 1998, three months after the Committee’s hear- Assessment ing, NERC issued its first comprehensive report of electrical At the time of the hearing, there was power industry readiness based on a lack of industry-wide survey data of survey data collected at the end of the electric power industry. As a re- August. It has issued two monthly sult, the Committee staff surveyed updates since that time. Participation five large electric and five large gas by the 200 bulk electric operating and oil companies to obtain cursory entities increased from 144 in August readiness information. Figure 3 be- to 155 and 188 in the September low displays the result of the survey. and October surveys, respectively.

23 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Company Date Establish Assessment Percent Status of Legal or Contingency Contacts Contacts Will You Aware Formal Complete Systems Service Liability Plans Complete By by Finish Project Mission Providers/ Concerns Creditors Investors In Time Critical Vendors

1 1995 Yes No 54 ? Yes No Yes - Yes

2 1995 Yes Yes 5 ? Yes No Yes Yes Yes

3 1996 Yes No ? ? Yes No No Yes Yes

4 1992 Yes No 30 ? Yes No Yes Yes Yes

5 1995 Yes Yes 50 ? No No Yes Yes Yes

6 - Yes No ? ? Yes No Yes Yes Yes

7 1996 Yes No ? ? Yes No Yes Yes Yes

8 1996 Yes No 25 ? No No Yes Yes Yes

9 1996 Yes No 35 ? Yes No Yes Yes Yes

10 1996 Yes No 18 ? No No Yes Yes Yes

Figure 3: Committee Survey Results About 2,200 of the 3,000 distribu- ticular concern is that, with only a tion entities, i.e., the actual electric little over a year to go, 34% of the utilities have participated in the firms are operating without a written NERC process by responding to plan. data gathered by APPA and NRECA and providing it to the appropriate In addition, the assessment phase is bulk electric operating entity. only 75% complete (federal agencies NERC‘s overall survey results are are 99% complete with this phase). depicted in figure 4. Remediation and testing is only 36% complete. Given that Y2K experts While the NERC surveys clearly contend that between 40 and 70% of show progress in August, Sep- the total effort will be expended in tember, and October, the question testing alone, there may not be suffi- is whether there is sufficient time cient time to complete this. to complete Y2K remediation efforts. The data presented in the The highly interconnected nature of NERC report do not seem to support the grids raises concern about cas- the optimistic tone contained in the cading failures. This in turn obviates report’s executive summary. Of par- the need for contingency plan-

24 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

While these Y2K STATUS OF ELECTRIC problems should POWER INDUSTRY not affect plant safety, they could 100 cause serious 90 electricity pro- 80 70 duction problems. PERCENT 60 While NRC has COMPLETE 50 legal authority Aug-98 40 only to address 30 Sep-98 20 Oct-98 plant safety is- 10 sues, it is working 0 closely with NEI to assess nuclear P lan P lan Cont Assess plants. NRC Rem /T est Inventory plans detailed Figure 4: NERC Monthly Status Reports Y2K assessments of 12 of ning, particularly plans for address- the nearly 70 nu- ing capacity shortages and clear facilities. It has completed as- overages—of which only 13% of the sessments on six of these plants, firms surveyed have in place. and has issued reports on the first three. These reports are publicly Although nuclear plants are ad- available on NRC’s web site. dressed in the overall NERC study, public concern about their safety Concerns dictates that the Committee provide specific information regarding the · While complete power grid failure overall Y2K preparedness of these and prolonged blackout is highly plants. Nuclear facilities are lagging unlikely, failure of at least some behind other electric facilities in their parts of the electric power indus- Y2K assessment and remediation try, e.g., local or regional efforts. outages, is possible. The 3200 electric utilities are at various In general, nuclear facilities contain stages of remediation. The likeli- very old analog technology and, as a hood of outages in a given area result, have fewer Y2K issues than is directly related to the overall the more digital and modern fossil preparedness of the individual fuel facilities. Nevertheless, as- electric utility serving that area. sessments to date have revealed varying degrees of problems in areas · Overall Y2K remediation prog- such as plant process control, feed ress has been slow due to the water monitoring, refueling, turbine industry’s late start, the complex- control, and building security and ac- ity of the power grids, and the cess control. magnitude of the problems. As a result, power companies must

25 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

step up their efforts, and develop essential link to the overall suc- workable contingency plans in cess of the industry. the event their best efforts fall short. · State public utility commissioners must play an active role in en- · The interconnectivity of the elec- suring that the electrical utilities tric generation and transmission under their purview are taking entities making up the grids is a appropriate Y2K remediation, risk strength and a weakness. On the reduction, and contingency plan- one hand, interconnectivity pro- ning actions. In addition, they vides flexibility in that electricity should keep the public informed can be routed around trouble about the status of the utilities. spots. On the other hand, outages in one part of the grid could · Nuclear plants are at various affect power in other parts of the stages of Y2K remediation. grid. There are no comprehen- Some have only recently begun sive studies concerning the to assess the systems within their number of entities that would plants. Even if for no other rea- have to fail to put the entire grid son than to allay public concern, at risk, but some experts suggest NRC needs to expand its detailed that it may be a very small per- Y2K assessments to include all centage if in key locations. nuclear plants. In addition, not withstanding the NRC charter of · The interrelationship of the elec- addressing safety issues only, it tric power sector with other needs to broaden the scope of its sectors it depends on—telecom- Y2K assessments to include op- munications, natural gas and oil erational issues as well. supplies and pipelines, and rail transportation for coal supplies— · The electric industry is in the requires close coordination. middle of a major restructuring to There are signs that this coordi- introduce wholesale and retail nation is beginning, but efforts competition for electricity. Atten- need to be stepped up so that the tion has been on competing in electric utilities can engage in the marketplace, cutting costs, more meaningful contingency mergers, reorganizations, and planning. survival. The industry must find a way to ensure that all of this re- · The bulk power entities are structuring activity does not spending large amounts of interfere with the more immediate money on Y2K remediation and concerns of timely Y2K remedia- most are making good progress. tion. Of greater concern are some of the smaller and medium-sized distribution entities that may not have sufficient resources to devote to the problem. Each is an

26 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

dustry. Survey results published by OIL & GAS UTILITIES the Federal Energy Regulatory Commission (FERC) in September This sector covers both oil products 1998 show that this industry, like and natural gas, however, the Com- many others, started its Y2K efforts mittee’s hearing focused primarily on late. natural gas as the principle source of residential heating. Oil provides According to the survey, most of the about 40 percent of the energy critical systems in this industry are Americans consume, including home still in the inventory and assessment heating. In addition, about 60 million phase, leaving little time for the more American homes and businesses difficult phases of Y2K remediation use natural gas for heating, cooking, and testing. As a result, the industry and other applications. is not likely to complete repairs of all of its system in time, which in turn Gas and oil utilities face a variety of means that possible disruptions in Y2K problems in their administrative the production, transportation, and systems, as well as the microproc- distribution of gas and oil are possi- essors or computer chips embedded ble. in the production, transportation and distribution systems used in this in-

Figure 5

27 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Automation and, thus, Y2K concerns Asphalt 1.3 are prevalent throughout both the Petrochemicals 1.2 gas and oil industries. As depicted Lubricants 0.5 in figure 5, FERC published a ge- Kerosene 0.2 neric diagram that maps out the Other 0.3 elements of gas and oil production, *Totals more than 42 gallons due to transmission, and distribution that processing gains. must be checked for Y2K problems. Almost 60 million American homes Note: This year, the Committee and businesses use natural gas for plans to increase attention to the oil heating, hot water, cooking and other industry, particularly the international applications. Natural gas comes Y2K implications on oil imports. The through a 1.3 million-mile under- U.S. gets nearly 50 percent of its oil ground system. The U.S. has about from imports, and several key oil 58,000 miles of gathering lines in the producing countries are behind in gas production areas, 260,000 miles their Y2K remediation efforts. If of long-distance pipelines, and these countries are unable to sustain nearly 1 million miles of distribution the level of imports because of Y2K lines operated by local gas utilities failures in the pumping, refining, or that must all be checked for Y2K transportation of crude oil, the impli- problems. cations on the price of gasoline may be significant. Thousands of embedded systems in millions of miles of pipelines all must Overview be checked and, if necessary, replaced. Vulnerable systems include Nearly all Americans rely on oil and distributed control systems, pro- gas in their everyday lives. Oil pro- grammable logic controllers, digital vides about 40 percent of the energy recorders, control stations, record- Americans consume. Besides the ers, meters, meter reading and obvious gasoline, diesel fuel, and calibration software, and SCADA. home heating oil, petroleum products PC-based applications such as con- are used in everything from tooth- trol and work management software paste to raincoats. A barrel of crude within a utility may also possess Y2K oil (42 gallons) is refined into vulnerability. Any date-dependent application, system or component may experience problems that result Product Gallons* in complete system or station shutdown. Gasoline 19.5 Fuel oil 9.2 The President’s Council on Year Jet fuel 4.1 2000 Conversion assigned FERC Residual fuel 2.3 responsibility for the gas and oil Liquefied gas 1.9 sector. Other federal agencies in- Still gas 1.9 volved in this sector include the Coke 1.8 Department of Energy, the De-

28 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM partment of Transportation (pipelines In his testimony, Mr. Hoecker indi- are a form of interstate transporta- cated that the Y2K status of the gas tion), the Department of the Interior, and oil industry is essentially un- and the General Services Admini- known. He was especially stration. concerned about small and medium sized companies and focused on the Trade associations representing the need for the gas and oil industry to various gas and oil entities are also share Y2K testing and compliance playing a key role in Y2K remedia- information. He indicated that Y2K tion efforts for this industry. 1 readiness information might be difficult to obtain because of fear that the Major Initiatives information may be commercially sensitive, that certain liability issues The Committee’s energy utility may arise, or that collaboration on hearing was held on June 12, 1998. this problem may expose companies As described in the previous section, to anti-trust actions. both electric utilities and oil and gas utilities were addressed. Gas and oil The Committee was key to passing witnesses included, the Honorable Y2K information disclosure legisla- James Hoecker, Chairman, FERC, tion and obtaining clarification from Mr. James Rubright, Executive Vice the Justice Department to exempt President, Sonat, Inc. representing Y2K information exchange from anti- INGAA, and Gary Gardner, Chief trust laws. Mr. Hoecker also sug- Information Officer, AGA, and Lou gested that a Y2K database be Marcoccia, energy industry consult- established. API has since set up ant. such a database.

The hearing better defined the Y2K Mr. Rubright, representing the inter- problem in the gas and oil sector, state gas pipeline companies, heightened awareness, and mobi- highlighted the extensive use of em- lized an industry that was not yet bedded chips in the computerized fully engaged in addressing the Y2K devices instrumental to the operation problem. and monitoring of gas and oil pipelines. According to him, most pipeline companies contend they will 1 The American Petroleum Institute (API), the Natural be Y2K ready by October 1999, but Gas Council (NGC), the American Gas Association are concerned over both upstream (AGA), the American Public Gas Association (APGA), the Gas Research Institute (GRI), the Interstate Natural and downstream suppliers, as well Gas Association of American (INGAA), the Independent as utilities and telecommunications Petroleum Association of America (IPAA), the Associa- tion of Oil Pipelines (AOPL), the Gas Processors providers on which they rely. He Association (GPA), the National Gas Supply Associa- also expressed concern over litigation (NGSA), the Gas Industries Standards Board (GISB), the National Petroleum & Refiners Association tion risks, the large number of (NPRA), the National Propane Gas Association congressional electronic commerce (NPGA), the Petroleum Marketers Association of America (PMAA), and the Petroleum Technology initiatives, and anti-trust issues. Transfer Council (PTTC).

29 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Mr. Gardner, representing gas information, process control, auto- utilities, focused on the complexity of mation and instrumentation systems, gas distribution systems. He indi- as well as concerns about other cated that a gas utility will typically companies in the supply chain. API have between 50 and 100 systems has also created a database to allow with embedded processing located in companies to share information such areas as storage fields, gas about the readiness status of com- control and management operations, puter software and hardware, metering and facilities, and SCADA telecommunications networks, proc- systems. His industry’s experience ess control and electrical equipment, suggests that the process of identi- and embedded systems used by the fying, replacing or upgrading, and petroleum industry. testing takes 12 to 18 months to complete. AGA, a trade association of almost 300 natural gas transmission, distri- The Committee’s hearing was in- bution, gathering and marketing strumental in motivating the companies, and 181 local natural President’s Council on Y2K Conver- gas utilities that deliver gas to 54 sion to create an oil and gas working million homes and businesses, has group. The kick-off meeting for the also been actively involved in Y2K. oil and gas group was held at FERC AGA members account for more in June 1998. than 90 percent of natural gas delivered in the United States. FERC has held subsequent meetings on July 14, 1998, September 3, AGA sponsors business television 1998, and November 13, 1998. series, joint information technology Minutes of the Oil and Gas Working conferences, and other forums to Group meetings and other proceed- inform its membership of Y2K solu- ings and events are publicly tions. available on FERC’s website. Assessment API, a national trade association representing all phases of the oil and The Committee’s survey, depicted in gas industry, provides direct assis- figure 3, included both electric and tance to FERC in managing the gas and oil utility companies. Con- working group. In 1997, the API cerns resulting from the survey formed a Year 2000 Task Force to expressed in the electric utility sec- facilitate Y2K readiness across the tion of this report also apply to the petroleum industry. The API Year gas and oil utilities. Progress is slow 2000 Task Force currently repre- progress, assertions that they will sents over 50 industry companies complete Y2K remediation efforts in and meets every 6 to 7 weeks. time are overly optimistic, the industry lacks knowledge about suppliers’ One of API’s primary functions is to Y2K status, and contingency plan- alert and educate industry members ning is deficient. about the potential impact of Y2K on

30 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

The Committee’s survey, although The Committee can only conclude limited in scope, was the only avail- that, despite claims to the contrary, able survey at the time. Since then, many companies in the gas and oil FERC released its first overall assessment of the Y2K status and preparedness of the gas and oil industry on September 18, 1998. AGA in coordination with the Gas Re- search Institute and the Interstate Natural Gas Association of America collected and analyzed surveys of its members to assess the industry's compliance with Y2K requirements. These surveys form the basis for the FERC assessment. Assessment re- Figure 6 sults are depicted in figure 6 for business systems and figure 7 for embedded systems.

The survey was sent to over 8,000 gas and oil companies. Only 638 or less than 10% responded. Although the response was disappointing, it did represent 45% of oil and gas production, 78% of refining capacity, 70% of crude and product pipeline deliveries, and 43% of U.S. service stations. Figure 7 The survey asked companies to indi- industry will not complete Y2K reme- cate the stage their companies were diation efforts in time. This in for business systems and for em- conclusion is based on the fact that bedded systems. This required only companies with the most robust companies to summarize information programs typically respond to Y2K at too high a level to be meaningful. surveys. Y2K consultants estimate In reality, a company may have hun- that remediation and testing are the dreds or even thousands of business most difficult phases, often consum- and embedded systems each at a ing up to 40 to 70% of the entire Y2K different stage of remediation. Nev- effort. ertheless, the survey results are still alarming. The survey indicates that Survey respondents all contend that 45% of companies who responded they will be Y2K ready in time—76% consider themselves to be in the as- by June 1999 and the remaining sessment phase or earlier for 24% by December 1999. However, business systems, and 60% for em- based on the progress to date, and bedded systems.

31 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM the experience regarding the amount that must be checked and re- of time and resources it takes to paired and the proliferation of complete the remaining phases, this embedded chips and processors contention may be unrealistic. The throughout the industry’s produc- Committee recommends that the tion, transportation, and companies who are lagging this far distribution systems make failure behind, i.e., are still in the assessment phase or Country Percent Y2K Status Risk of U.S. Imports (Months Be- Disruption earlier, devote significant hind U.S.) resources to contingency Venezuela 16.2 12-18 High Canada 15.5 0-3 Low planning because they will Saudi Arabia 14.4 12-18 High not have sufficient time to Mexico 12.9 12 Medium Nigeria 7.3 12-18 High repair and test all of their Angola 4.2 Unknown ? mission critical systems in Colombia 3.0 12-18 High the limited time remaining. Algeria 2.9 Unknown ? Kuwait 2.9 12-18 High Virgin Islands 2.9 Unknown ? One of the biggest areas of Norway 2.3 12 Medium Iraq 2.2 Unknown ? concern for the Committee Gabon 2.0 Unknown ? is the Y2K status of United Kingdom 2.0 0-3 Low countries from which the Ecuador 0.9 12-18 High Argentina 0.9 12-18 High U.S. imports oil. Nearly All Others 7.5 Unknown ? 50% of the oil used in the Figure 8: Imported Oil Country Y2K Status U.S. comes from foreign sources. Yet, as depicted in figure 8, many of the countries are of at least some mission-critical significantly behind the U.S., and systems possible. The industry thus, have a high risk of failure. In- needs to step up its efforts and deed, 3 of the top 5 countries from focus on developing contingency which the U.S. imports oil are, ac- plans. cording to the Gartner Group, 12 to 18 months behind the U.S. in their · The dependence of the gas and Y2K remediation efforts. This means oil industry on other sectors— that oil production and transportation electric power and telecommunica- may be at risk in these countries. tions—dictates better Any disruption to oil imports could coordination with these sectors. significantly impact oil availability and, thus, prices in the U.S. The oil · While the large gas and oil com- industry and the federal government panies are spending large need to monitor this situation closely. amounts of money on Y2K remediation, the Committee is Concerns concerned about some of the smaller and medium-sized com- · Y2K remediation in the gas and panies in this industry, including oil sector began too late and is those up and down the supply progressing too slowly. The chain. These small companies thousands of miles of pipeline could be the linchpins for the

32 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

overall success of this industry. There are over 30 community water systems serving populations in ex- · A Y2K assessment of oil produc- cess of one million people. ing countries is needed to determine the likelihood that U.S. Although the community water sys- oil imports will be disrupted, and, tems collectively serve a large if so, what contingency planning number of people, most community will be needed. water systems serve less than 3,300 people. Many of those systems are privately owned and operated. WATER UTILITIES A transient non-community water Overview system serves transitory customers in non-residential areas such as Water: campgrounds, motels, and gas stations. Approximately 57 percent of There are approximately 200,000 public water systems are transient public water systems (PWSs) regu- non-community systems. (Sources: lated under the Safe Drinking Water EPA Report to Congress, EPA-810- Act that serve 243 million people in R-93-1. September 1991, and the United States. The remaining AWWA/AMWA/NAAW 1998 Survey.) population obtains their drinking water from private wells. Wastewater:

PWSs are defined as community Seventy-two percent of the U.S. water systems, non-transient, non- population (190 million people) is community, or transient systems. served by centralized wastewater Approximately 60,000 of the 200,000 treatment facilities; the remainder is public water systems are classified served by on-site systems (e.g., as community water systems. A septic systems). community water system provides water to the same population year There are 16,000 wastewater treat- round. There are 3,687 community ment facilities nationwide, with water systems in the U.S., which operations ranging from less than serve a population of 10,000 or 100,000 gallons per day (about 1/3 more, and provide water to a total of of the total number of facilities) to 204 million people. systems that treat over 100 million gallons per day (less than 1% of the Approximately 75 percent of the systems). American public is served by large community water systems covering Systems such as Prince William populations of 100,000 or more. County, Virginia, and Independence, Missouri, treat approximately 10 million gallons of sewage a day, while the largest systems, such as

33 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM those of New York or Chicago, treat groups and the Environmental Pro- approximately 1.5 billion gallons of tection Agency (EPA). The sewage per day. Committee also interviewed numerous industry experts, surveyed water Nationwide, approximately 42 billion and wastewater company Y2K pre- gallons of sewage are treated per paredness, and monitored other day. industry surveys recently administered by the major water and About 31% of the U.S. population is wastewater industry associations. served by facilities that provide secondary treatment of waste and The Committee staff has also par- another 31% is served by facilities ticipated with the EPA in tours of five that provide better than secondary. local Washington, D.C. area water Fifty percent of the design capacity and wastewater treatment plants and of existing treatment plants allows for worked with the major water and better than secondary treatment. wastewater industry associations. These include The remaining population is served either by plants that have no dis- · the Association of Metropolitan charge or by individual on-site Water Agencies (AMWA), disposal systems. · the National Association of Water Companies (NAWC), Municipal governments own 95% of · the American Water Works Asso- wastewater treatment facilities, either ciation (AWWA), as part of a local government’s pub- · the Water Equipment Manufac- lic works department, or as a turers Association (WEMA), and separate authority or utility district. · the Association of Metropolitan Sewerage Agencies (AMSA). Typically, in small to medium-sized cities, the water utility and wastewa- On December 18, 1998, the Com- ter treatment systems are operated mittee held a field hearing on Y2K jointly. In larger cities they are usu- 2 preparedness in the water and ally separate operations. wastewater industry in Anaheim, California. The City of Anaheim Major Initiatives Public Utilities Department hosted this hearing. The witnesses were The Committee assessed the Y2K Dana Minerva, EPA Deputy Assis- vulnerability of the water and waste- tant Administrator for Water; James water, and took steps to increase Brainerd, Chief Information Officer, awareness about Y2K issues in this Los Angeles Department of Water vital sector of service. These include and Power; James Ellisor, Director of staff networking with the major water Information Systems, Las Vegas and wastewater industry association Water District; Patrick Miles Informa- tion Technology Director, Orange 2 Congressional Research Service Briefing to Commit- tee Staff on 06/02/98 County Sanitation District; William Hetland, District Manager, El do-

34 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM rado Irrigation District; and James ment to a company’s ability to easily Bell, Vice President; Technical switch to the manual mode of opera- Services, Smith and Loveless, Inc., tion. The possibility of creating some (a leading manufacturer of water and type of “reserve force” that could as- wastewater and pumping equip- sist companies in need of additional ment). Following the hearing, personnel in the event of the need to Senator Bennett toured the City of default to manual mode was dis- Anaheim Water Services Lenain cussed. It was concluded that Water Filtration Plant. operation of water and wastewater plants in the manual mode requires One of the major topics of discussion skilled and certified operators. Con- during the hearing was the need for sequently, a pool of unskilled water and wastewater companies to reservists from outside of the water obtain assurances from their electric industry would probably not provide power providers that they will be an effective solution to the man- considered “uninterruptable” or prior- power shortage problem. ity customers in the event power supply problems occur. Currently, no It should also be noted that each legal authority exists to require that water and wastewater treatment power utility companies consider system requires operators to pos- water and wastewater companies as sess a body of knowledge specific to priority customers. Such agree- those individual systems. Mr. Bill ments have customarily been Hetland, General Manager of the El negotiated on a case-by-case basis Dorado Irrigation District, stated that between power and utility compa- most agencies would have to look to nies. their own internal resources to solve the Y2K problem, that it would be Mr. Jim Ellisor, Director of Informa- unrealistic to think that a pool of la- tion Systems for the Las Vegas bor would be available to assist in Valley Water District, noted in his Y2K. He also stated that staffing testimony that some variability exists would become an issue for his in water systems’ reliance on elec- agency if manual operations were tricity, depending on system design. required for an extended period of He noted that some systems rely time. completely on gravity and require little or no electricity for their opera- Mr. Hetland stressed the importance tion, including some large systems. of providing information to the community about the problem. He also During her testimony, EPA Deputy described the progress his agency Assistant Administrator Dana Min- had made and said such information erva noted that the EPA does not is vital to community preparedness. consider reliance on switching to the He also expressed concern about manual mode of operation as the regulatory compliance and the liabil- preferred solution to Y2K problems. ity issue. Manpower limitations were cited during the testimony as one impedi-

35 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Deputy Assistant Administrator despite the fact that a confidentiality Minerva testified about EPA’s im- pledge was made to all survey re- plementation of a new policy aimed cipients. The results indicate that of at encouraging Y2K testing in the the 11 companies that responded to water and wastewater industry. This the survey, slightly over 25% stated policy waives penalties if violations that it was unlikely they would be occur during Y2K testing, provided Y2K compliant by January 1, 2000. specific conditions are met. Deputy More than 50% of the respondents Assistant Administrator Minerva had not yet completed the initial as- further stated that testing and sessment phase, and 36% did not preparation would be taken into ac- have contingency plans in place. count if Y2K-related enforcement Of the 64% that had contingency violations occur on January 1, 2000 plans in place, the contingency con- or other “problem dates.” According sisted of either switching to manual to Ms. Minerva, EPA cannot rule out operations or utilizing parent com- any enforcement pertaining to Y2K pany operations. The table at the problems, however it will take efforts end of this section displays the re- to resolve the problem into account. sults of the Committee’s survey.

The new EPA policy is limited to In July and August 1998, the Ameri- testing-related violations disclosed to can Water Works Association EPA by February 1, 2000. The policy (AWWA), the Association of Metro- is subject to conditions which include politan Water Agencies (AMWA), the need to design and conduct the and the National Association of Wa- tests well in advance of the dates in ter Companies conducted a joint question and to correct any testing- survey of their memberships re- related violations immediately to en- garding Y2K readiness. sure the protection of human health Approximately 725 of the 4000 and the environment. members of these associations responded to this survey. The General Accounting Office, at the request of this Committee, is cur- · About 81% of the respondents rently preparing a survey of state expect to complete their internal regulatory agencies with jurisdiction Y2K work on time. over public water and wastewater utility companies. This survey will · About 89% of the community determine the extent to which state public water systems serving regulatory agencies are assessing populations ranging from 100,000 the Y2K readiness of public water to 1 million people expect to have and wastewater utilities. Y2K compliance work completed on time. In July 1998, Committee staff surveyed 20 water and 20 wastewater · About 87% of the systems serv- companies regarding their Y2K pre- ing between 10,001 and 100,000 paredness. About 25% of those people expect to complete their contacted responded to the survey, work on time.

36 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

ceived 76 responses to its survey. · About 76% of the systems serv- Results indicated the following: ing less than 10,000 people expect to be completed on time. · The level of automation within each agency averaged 54%. (Not · Only 26% of the respondents re- all aspects of each agency’s op- ported having fully assessed the eration are automated, i.e., an compliance status of vital busi- agency may utilize automated ness partners such as power and billing but its operational plant telecommunications service pro- processes may be manually con- viders and vendors upon whom trolled.) they rely. Eighty-eight percent of the respon- · About 83% of the respondents dents reported that they currently reported that they had not com- utilized some form of Supervisory pleted their Y2K contingency Control and Data Acquisition System plans. (SCADA) in their operations. It should be noted that while an · About 39% of the respondents agency might use SCADA in one as- reported that they expect to pect of its operation, such as spend less than $10,000 on their monitoring a remote pumping sta- Y2K programs. tion, this does not mean that its entire system is automated. These · About 26% expect to spend systems are pervasive in the power $10,000 to $50,000 on their pro- and water and wastewater utility in- grams. dustries and typically collect and transmit data about flow, pressure, · About 80% expect to spend and temperature. Computers can be $50,000 to $100,000. utilized at any point in the system where measurements are made re- · About 10% expect to spend garding pressure, water quality, $100,000 to $1 million. chemical content, treatment, time, or billing. · About 4% expect to spend over $1 million. · Nearly 100% of the respondents reported that they use computers In June 1998, the Association of for process control, laboratory re- Metropolitan Sewerage Agencies search, industrial compliance, (AMSA) conducted a survey of its billing systems, and other ad- 202 members. AMSA is a coalition of ministrative purpose, such as publicly owned wastewater treatment finances, inventory, and mainte- agencies. Its member agencies are nance management. responsible for collectively treating and reclaiming over 18 billion gallons · Ninety percent of the respon- of wastewater each day. AMSA re- dents have developed a plan to

37 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

assess and address the Y2K is- 12, regarding the Y2K problem and sue. electric power utilities.

· Forty-five percent of the respon- While some water and wastewater dents reported estimated Y2K utilities can generate their own elec- costs ranging from $0 to tricity in the event of a power outage, $100,000. Fifteen percent re- the ability to do so for an extended ported estimated costs in excess period of time would depend upon of $1 million, with two respon- the availability of a steady supply of dents reporting estimates of $15 diesel or other alternative fuel to million. Most of the agencies re- power the utilities’ independent gen- porting costs in excess of $1 erators. In general, the larger water million were relatively large sys- and wastewater utilities do maintain tems, but 17 % of those reporting the ability to generate their own costs in excess of $1 million were source of back-up electricity, but the agencies which served under duration for which this can be done 250,000 people. Most agencies varies widely within the industry. estimated Y2K costs between 0 and 2 percent of their operating There is no interconnectivity built into costs. the water distribution system as with the electric power grid. Nevertheless, · Approximately 95% of the re- some citizens could be facing inter- spondents reported they had ruptions of water utility service on begun to implement Y2K solu- January 1, 2000 if water utility com- tions, and 26% reported they panies do not adequately address were complete or nearly com- the Y2K problem. plete in their Y2K preparation. Water industry Y2K issues are · Approximately 55% of the re- broader and more complex than spondents reported having a simply whether electric power will be backup plan should all or a por- available to run the pumping station of their systems fail as a tions. For example, wastewater result of Y2K. treatment facilities and water supply utilities are interrelated. Upstream Concerns contamination caused by a malfunc- tioning wastewater treatment plant With very few exceptions, the ability would have a direct impact on a of the water utilities to supply fresh, fresh water treatment facility located clean drinking water and to effec- downstream. tively treat wastewater is linked directly to the utilities’ ability to obtain The EPA identified six major areas in a continuous and reliable source of water and wastewater treatment fa- electric power. This fact under- cilities where embedded computer scores the importance of the topic of chips might be located. These are this Committee’s hearing on June communications infrastructure, instrumentation, facilities and sup-

38 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM port, materials tracking, production deliver their services. The stockpil- and process, and process controls. ing of some of these chemicals prior The list included 51 individual de- to the Year 2000 has been proposed vices that potentially could contain by some as a means of alleviating embedded chip technology. concerns about supply chain interruptions. However, some of the Of primary concern in the water and chemicals used in the industry rep- wastewater industry is the vulner- resent a public health hazard if ability of sensitive SCADA systems accidentally discharged into the envi- utilized in automated water and ronment. The risk to public safety wastewater processes would be greatly multiplied if some of these chemicals were stockpiled. The degree of automation in water and wastewater systems varies Committee staff has reviewed nu- widely throughout the country, de- merous recent examples of pending upon both the age and size computer-related or computer- of the individual systems. Many induced failures in the water and older systems are not highly com- wastewater industry. While the cases puter dependent. reviewed are not believed to be the result of Y2K induced problems, they The Committee is concerned about clearly illustrate the sensitive and the inability of some wastewater important role which computers play treatment facilities to properly oper- in the water and wastewater services ate in the event of power outages of area. Numerous water or wastewa- even moderate duration. Committee ter companies could be confronted staff reviewed numerous cases in by similar computer-related failures which electrical power interruptions on January 1, 2000, if proper steps led to the discharge of untreated are not taken now to address the wastewater or raw sewage into rivers Y2K issue. or the ocean. Such discharges currently occur on a sporadic basis Numerous representatives of the throughout the country due to power water and wastewater industry of- outages and excessive rainfall. fered assurances to Committee staff that they could switch their opera- As is true in all other aspects of the tions to the manual mode in the Y2K problem, the water and waste- event of a Y2K disruption. In their water industry is also vulnerable to response to the AMSA survey, most supply chain interruptions. Water wastewater agencies pointed out treatment plants in particular rely on that switching to the manual mode a regular supply of chlorine and would present little if any problems other chemicals that are required in since many automated processes the water treatment process. Long- run in parallel with manual instru- term interruptions in the means of mentation and control. Switching to production or delivery of these items the manual mode of operation may due to other Y2K problems would represent a viable alternative to directly impact the utilities’ ability to computer-controlled processes

39 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM under ideal conditions and in a controlled environment. However, the Analysis of the July 1998 joint conditions that might require transi- AMWA/NAWC/AWWA July 1998 tion to a manual mode of operation survey of water agencies reveals are likely to be neither controlled nor that 14% of responding companies ideal in the case of Y2K. serving populations over 100,000 people reported that they would not On its face the survey data cited have their Y2K compliance work here appear to present a somewhat done on time. The exact impact that optimistic picture of the Y2K readi- this will have on their operations is ness of the water and wastewater not clear, as it is unknown whether industry. However, attention must this includes any of their mission- be paid to the fact that the response critical systems. Of the 11 compa- rate for each of these surveys was nies who responded to the relatively low, and the status of those Committee’s survey, over 25% indi- agencies that did not respond re- cated that they did not expect to be mains largely unknown. Y2K compliant by January 1, 2000.

40 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Water Utility Sector Survey Conducted by Special Committee Staff

Company Type Date Aware Date Formal Is Your As- Percent Contacted Legal or Contingency Contacted Contacted Will You of Y2K Project sessment Systems Service Liability Plans Com- by by Finish Problems Started Complete Mission Providers/ Concerns plete Regulators Investors In Time Critical Vendors 1 water 1996 1996 80% 50% Y Y Y Y Y Y 2 water 1997 1997 N 90% N N Y Y Y Y 3 water 1997 1997 Y 50% N Y Y N Y Y 4 water 1996 1998 N unknown N Y N Y Y N 5 water 1996 1998 N unknown N N N Y Y unknown 6 waste water 1995 1996 Y 0% N N Y Y N Y 7 water/waste 1996 1997 Y 20% Y N Y N Y Y 8 water/waste 1996 1997 Y 100% Y Y Y N Y Y 9 water/waste NR NR NR NR NR NR NR NR NR Y 10 water/waste 1996 1996 N unknown Y N N Y N Y 11 water/waste 1996 1996 Y 90% Y N Y Y Y N Notes:

* MC = mission critical, NR = no reply. C Only 27.5% of all water and wastewater companies surveyed responded. C The 8 companies that reported their costs, project that they will spend over $86 million collectively on Y2K. C Of the 11 companies who responded, 27% reported they would probably not be Y2K compliant. C More than 50% of the 11 respondents have not finished their companies’ initial assessment of compliant. C Of the 11 water and wastewater companies, 36% do not have contingency plans in place. The 64% who do intend to either use their parent company’s system or operate manually.

41 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM Investigating The Impact of the Year 2000 Problem

HEALTHCARE

subsequent medical treatment activities, including the results OVERVIEW of all diagnostic tests, are automatically computer r e- Healthcare is the largest single i n- corded. This insures comm u- dustry in the United States. It is a nication between medical sp e- giant of an industry: 750,000 phys i- cialties, the carrying out of cians, 5200 hospitals, annual expe n- doctor's orders, and the cre a- ditures of $1.5 trillion, patient utiliz a- tion of an audit trail to protect tion census of 3.8 million daily inp a- the patient and the caregivers. tient visits and 20 million daily outp a- tient visits, a federal Medicare pr o- · Health claim billing systems gram treating 38 million seniors at an are the principal means of f i- annual cost of $300 nancing the huge cost billion. Additionally, Y2K COULD PUT THE of health care. Americans consume $90 HEALTHCARE INDUSTRY Consequently, the 4 billion worth of IN INTENSIVE CARE. million daily medicare medications and medical health claims supplies per year. But, the SENATOR DODD amounting to over $1 most important statistic is billion are 85%-98% that average life computer generated and expectancy has increased from age processed in an Electronic 47 in 1900, to age 76 in 1998. Today, Data Interchange (EDI) mode 70% of Americans will live to be 65, between provider and payor. versus 20% in 1910. · Pharmaceutical research, Industry Technical Dependency manufacturing and distribution The increase in life expectancy is the systems are the basis for pr o- result of many factors: scientific, ec o- viding the patient with effective nomic, public education and a host of medications. These systems others. But an underlying cause is electronically link the drug technological improvement in every wholesaler to its pharmaceut i- aspect of healthcare. These medical cal supplier and distribution technologies are susceptible to the outlets, principally retail pha r- Y2K problem in three ways. macies and hospitals. Finally , national direct mail order pr e- 1. Software scription services operate as both wholesaler and retailer. · Patient data systems start with admission of a patient to a 2. Embedded microprocessors hospital and the determination of insurance eligibility. All · Biomedical devices are the

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM 43 Investigating The Impact of the Year 2000 Problem

core of medical technology, factories, and automated order used by hundreds of millions of activities in warehouses. To l- units. These devices occur in erances in most of its product every kind of diagnostic test are dependent on micropro c- equipment (e.g. blood chemi s- essors to achieve them. try analyzers, MRI, X-ray etc.) and therapy (e.g. radiation) 3. Electronic interconnections or i n both inpatient and outpatient. terfaces Additionally there is a heavy usage (8 to 10 thousand per These are the most prolific and p o- hospital) of bio-medical d e- tentially the most likely cause of Y2K vices in in-patient hospital failures. For example, a doctor o r- care. The health care industry ders, through the hospital information currently relies on manufactu r- system, that a patient be given an ers’ Y2K compliance data r e- intravenous feeding. The micropro c- ports to determine whether the essor controlling the patient's infusion device will function appropr i- pump is connected to the same ho s- ately when the date changes. pital information system. The infusion Many device manufacturers pump records the patient’s ID, the have published these reports, quantity of the intravenous solution, indicating Y2K compliance and the date and time of the trea t- status by model and serial ment. The patients could be in jeo p- number of each device they ardy If the hospital system and the sell. But some medical device biomedical devices are neither Y2K companies still have not i n- compatible nor compliant. formed FDA of the Y2K risks. Committee Vice Chairman, · Business partnerships are Senator Chris Dodd , formally electronically linked throughout published the names of these the industry. Consequently, a companies in the Congre s- critical part of Y2K remediation sional Record on September is to determine if all the bus i- 23, 1998. ness partners of a healthcare entity are Y2K compliant. · Infrastructure operations use microprocessor controls in MAJOR INITIATIVES hospitals, clinics and medical office buildings controlling heating, ventilation, security The Special Committee on the Year and air-conditioning, as well as 2000 Technology Problem held two power and water hearings dealing with healthcare i s- sues. The first hearing was on July · Process control and analytical 23, 1998, "The Year 2000 Computer devices are critical for mana g- Problem: Will the Health Care Indu s- ing quality control in laborat o- try Be Ready?" The second hearing, ries, manufacturing flow in dealing with Y2K problems of general

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM 44 Investigating The Impact of the Year 2000 Problem business, was held on October 7, ance. Users are often unaware or 1998. This hearing included a panel unknowledgeable about the impact of dedicated to the pharmaceutical i n- the microprocessors inside these s o- dustry with witnesses from a major phisticated machines. For example, pharmaceutical company, a large surgical suite machines such as a wholesale drug company, the national $40,000 blood gas analyzer could association representing wholesale close down operating rooms if they druggists, and an independent pha r- cannot function on January 1, 2000. macy. Every major medical organization testified that they were experiencing Industry Y2K Perspective : significant problems with biomedical device manufacturers. In many cases, The Gartner Group, a survey research manufacturers were unable or unwil l- company, issued reports stating the ing to comment on their product’s healthcare industry lags behind others ability to function after the millennium in dealing with the Y2K problem in change. managerial attention, technical r e- sources available, financial resources · After 2 letters of request, only 500 committed and remediation monito r- out of 2700 companies responded ing. to an FDA survey.

An additional problem is a highly d e- · The Committee requested the FDA centralized system is used to process legal counsel to respond to this i s- health claim payments, the underpi n- sue: Does the FDA have legal ning of healthcare financing. It is authority to require publication of comprised of a government-insurance biomedical devices? The FDA r e- industry mechanism that electronically sponded that it does not have processes nearly 4 million Medicare blanket authority to require all d e- claims worth over $1 billion daily at vice manufacturers to submit Y2K over 70 separate locations. Third compliance reports. But, FDA ind i- party payors for private health claims cated that in the interest of patient utilize a similar type of electronic safety, manufacturers should i n- claims process. form the FDA of device problems and corrections. HEARING SUMMARY · The Veterans Health Administr a- tion sent letters of request to 1600 firms for information on purchased The following issues arose during the medical devices. After three course of the hearings. mailings, 233 firms failed to r e- spond. 1. Biomedical Devices · The Health Industry Manufacturers These devices are the Trojan horses Association (HIMA) initially said in the health care industry's compl i- that it preferred for each man u-

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM 45 Investigating The Impact of the Year 2000 Problem

facturer to work with each cu s- to achieve Y2K compliance. Third, tomer rather than publicly publish these hospitals are more likely to Y2K compliance data. But subs e- have older medical equipment, which quently, HIMA informed the Co m- may be disproportionately subject to mittee that they encouraged their Y2K problems. members to work with FDA in pr o- viding public disclosure of Y2K · The Committee requested dire c- compliance data. tion from the American Hospital Association (AHA) on handling the · The Committee called upon all rural-inner city hospital Y2K pro b- manufacturers of biomedical d e- lem. The AHA stated in corr e- vices to publish relevant and a c- spondence, it did not have ad e- curate Y2K data for their machines quate data at present to know the in a central repository, the FDA ultimate cost. AHA stated that a Internet web site. coalition of smaller hospitals is being formed to share Y2K info r- · The Committee requested that the mation. Food and Drug Administration publish a list of biomedical man u- · The Committee stated its concern facturing companies that have not with the American Medical Ass o- replied to FDA requests for Y2K ciation (AMA), AHA and FDA data by July 30, 1998. about the need of a contingency plan for all hospitals. Rural and i n- · The Committee stated if the bi o- ner city hospitals in particular medical manufacturers were u n- need a fall back if Y2K compliance willing to respond voluntarily to is incomplete. The associations providing data that can save p a- stated the Joint Commission on tients’ lives, the Congress will e n- Accreditation of Health Care O r- act legislation promptly making ganizations (JCAHO), the hospital mandatory the publication of such licensing body, already requires data. In response, device man u- disaster and contingency plans be facturers began providing compl i- in place. However, the Committee ance data to FDA for publication does not believe JCAHO requir e- on their Internet website. ments adequately anticipated the extent of Y2K problems. Also 2. Rural and Inner City Hospitals: JCAHO only reviews hospitals on a triennial basis. Rural and inner city hospitals have unique Y2K problems. First, because 3. Medical Health Claims Payment - these types of hospitals tend to have Medicare limited financing, the expensive di s- covery, renovation, and testing pro c- The 38 million Medicare recipients, ess is beyond their means. Second, 5200 hospitals and 780,000 phys i- these institutions do not have access cians depend on 4 million Medicare to the highly skilled personnel needed claims for $1 billion in daily payment.

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM 46 Investigating The Impact of the Year 2000 Problem

Any significant failure or delay of Medicare payments would have a · The Blue Cross/Blue Shield disastrous cash flow effect on their (BC/BS) representative assured employees, suppliers and commun i- the Committee that their organiz a- ties. The Healthcare Financing A d- tion, the largest Medicare co n- ministration (HCFA), the agency r e- tractor, would be ready on time for sponsible for Medicare disburs e- the December deadline. However, ments, gave an unsettling report on the OMB report referenced above, how they recently discovered 30 mi l- raises questions of completion lion more lines of code that needed dates. The GAO report of Febr u- remediation. ary 24, 1999 indicates Y2K problems continue at all BC/BS · The Committee asked the HCFA sites. Administrator how the agency was going to handle a workload that · The Committee raised the issue of had grown by two and one half contingency planning for Medicare times since a July 7 briefing to the payment processing in the event Committee staff. The Administrator of contractor failure in meeting the responded that the remediation Y2K deadlines. The HCFA admi n- would be the most extensive and istrator and BC/BS were requested expensive in the history of Med i- to tell Congress about specific care and HCFA was taking e x- contingency plans when they are traordinary steps to meet Y2K available. At present only general deadlines. contractor directions for planning are available in lieu of specific · The Committee asked the HCFA plans. Administrator the current level of Y2K compliance of the external 4. The Domino Effect of Y2K Fai lure Medicare payment systems mai n- tained by contractors - the core of Perhaps the most disturbing Y2K Medicare payments. The most r e- revelation to the Committee was the cent data supplied by the Office of disclosure of the domino effect of Y2K Management and Budget (OMB) failure. It can occur in both the use of on November 13, 1998 demo n- biomedical devices and in Medicare strates that HCFA has tested only payments. 8 out of 108 external systems. However, the HCFA staff, in a late · If one biomedical device malfun c- November meeting with the Co m- tions, it can potentially shut down mittee, indicated substantial pro g- an operating room. Or even worse, ress since the OMB report. Med i- one device can pass erroneous care renovation was to be co m- data onto other devices creating pleted by December 31, 1998 and adverse patient conditions. In full testing in the spring of 1999. other words, Y2K mistakes can r e- None of these systems are Y2K verberate throughout the health compliant as of February 24, 1999. care system.

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM 47 Investigating The Impact of the Year 2000 Problem

reported to be selectively stockpiling · An exhibit displayed at the hearing basic medical ingredients that could showed the pathway for Medicare be in short supply. This assures that hospital claims, 98% of which are the industry will be capable of meeting processed electronically. Each strict FDA requirements for controlling claim must pass through a series batch source inputs to all medications. of steps beginning with patient el i- However, pharmaceutical companies gibility at the hospital through final face potential problems. Medicare payments. A Y2K pro b- lem at any step in the process, The first problem is the dependency could either delay payment or fail on foreign suppliers and subsidiaries. to remit payment. The drug industry operates manufa c- turing plants worldwide that supply the U.S. market . Some suppliers exist in ASSESSMENTS countries where basic infrastructures lack Y2K preparedness. A further Based on Committee hearings in July complication is the high concentration and October, subsequent meetings of some drug production in foreign with healthcare industry personnel, countries. Denmark, for example, and the October 17, 1998, Gartner produces 70% of the world’s supply of Group Report, healthcare lags in its insulin. Additionally 80% of the basic progress towards Y2K preparedness. ingredients for pharmaceutical pro d- Assessment is broken into the five ucts produced in the U.S. come from portions of the industry: pharmaceut i- abroad. cals, large hospitals and hospital chains, health claim billing systems, The just-in-time (JIT) inventory pro c- rural and inner city hospitals, and ess presents another problem. JIT doctors’ offices. has replaced the large wholesale drug warehouses of the past with much Progress Of Healthcare Industry more efficient Electronic Data Inte r- Segments change (EDI) ordering and billing processes. JIT requires smaller war e- 1. Pharmaceuticals houses and saves money. If adequate drug inventories are to be maintained The Pharmaceutical segment of the locally, pharmaceutical products must industry appears best prepared to be delivered promptly from a man u- meet Y2K challenges. As an industry, facturer to a wholesale drug company, pharmaceuticals benefited from an then to retail pharmacists and hosp i- earlier start, their far-sightedness tals. This can only occur if the tel e- partially due to a long time-to-market communication/transportation infr a- horizon for their products. Furthe r- structure functions. more, top management recognized Y2K as a business risk and provided Finally, pharmaceutical companies the necessary management and r e- have a myriad of business partners, sources to address it. This industry is which must be Y2K compliant to be

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM 48 Investigating The Impact of the Year 2000 Problem

effective. Testing all of these ele c- that finance colossal healthcare e x- tronic relationships is a challenging penditures. Progress is moving very assignment for the industry. slowly.

2. Large Hospitals Medicare (responsible for 40%-50% of all payments), has zero Y2K compliant While not as prompt as pharmaceut i- payment programs, according to the cals in responding to Y2K, large ho s- most recent GAO report. Medicaid, pitals are dedicating considerable the federal-state health care payment resources towards fixing the problem. system, has widely varying stages of They have all the usual Y2K problems Y2K remediation progress that differs of healthcare plus building manag e- from state to state. A General A c- ment concerns. They have to provide counting Office report dated Nove m- water and power, heating, ventilating ber 6, 1998 indicates that only 17 and air conditioning, plus maintain states have completed the renovation elevators and security systems. Ho s- phase. No state has claimed victory in pitals must also address Y2K pro b- meeting Y2K goals. lems in biomedical devices and patient data systems. All of the above The private sector has also exper i- must function in harmony for the p a- enced difficulties. In a recent public a- tient to be adequately protected. Ho s- tion of Securities Exchange Commi s- pital management is playing a catch sion (SEC) 10Q financial reports, one up game. of the largest private insurers recently set aside nearly $200 million to ren o- As of October, a Gartner Group R e- vate its Y2K health care billing sy s- port indicates that 64% of hospitals do tems. This indicates that significantly not plan to test their Y2K software more Y2K remediation is r equired. remediation - a disquieting fact which hearings in 1999 will attempt to verify. 4. Rural and Inner City Hospitals Second, many hospitals are relying solely on producers of medical d e- Rural and inner city hospitals depend vices to certify their Y2K compliance. on older equipment much more than Based on known inaccuracies of some large well-endowed hospitals do. On producers’ compliance certification, the plus side, low tech equipment may this could be a serious mistake. Third, not have any Y2K exposure. On the Y2K contingency planning is in its negative, older versions of bill pa y- infancy at hospitals. ment software are more likely to be non-compliant. The concern for rural 3. Health Claim Billing Systems and inner city hospitals stems from their lack of resources to prepare or Automated billing is the underpinning test for Y2K problems. Additionally, it of the healthcare system. This $1.5 is unclear how aware rural and inner trillion industry is almost totally d e- city hospitals are of Y2K problems. pendent on third party payors (insu r- ance companies, Medicare/Medicaid) 5. Doctors' Offices

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM 49 Investigating The Impact of the Year 2000 Problem

and death matter for patients depen d- Because the nation’s nearly 800,000 ent on drugs for survival, such as doctors work out of thousands of insulin for 10 million diabetics. Since separate offices, detailed data on the some of these life saving drugs have extent of the Y2K problem in this area a short shelf life, how will the is unavailable. (Gartner Group R e- healthcare system be structured to ports are uncertain on the status of ensure availability of life dependent this healthcare area.) Offices have all medications? the Y2K problems similar to hospitals on a smaller scale but without the The Committee recognizes that med i- comparable access to technical and cal malpractice insurance is the financial resources. Since diagnostic means by which both hospitals and testing depends upon biomedical medical doctors protect themselves devices, potential problems may exist. against substantial loss. The insu r- Patient data systems are not widely ance industry has already demo n- used in doctors' offices today, but strated an unwillingness to subject electronic health claims billing sy s- itself to Y2K liability. But hospitals tems are nearly universal for Med i- and medical practitioners cannot care. If doctors have to return to function without liability insurance. paper billing because of Y2K failures, insurance companies and Medicare The Committee is also concerned that would be hard pressed to accomm o- Y2K prepared hospitals may not fo l- date the resulting volume of health low proper documentation of remedi a- claims. tion efforts. Compounding the pro b- lem, due diligence standards in this area have not been set. CONCERNS The healthcare industry is faced with There are substantial indications that increased costs of Y2K remediation in in some healthcare settings , insuffi- 1999 and the possibility of extensive cient attention is being paid to Y2K litigation after January 2000. How can issues. The October 17, 1998 Gartner costs affecting patient care services Group Report paints a dismal picture be controlled? of healthcare industry preparation for Y2K. Top management needs to e n- Excess supplies of non-compliant gage this problem as a group, pe r- medical equipment will be available haps by formalizing compliance pr o- prior to, and after January 2000 due grams through governing bodies or to replacements with compliant sy s- industry groups. tems. How will patient care be protected Based on a 1996 National Institutes of when this excess equipment is di s- Health Report, nearly 40 million posed of either domestically or inte r- Americans are chronically ill or phys i- nationally? cally impaired. Maintenance of ad e- quate drug inventories can be a life Healthcare managers are currently

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM 50 Investigating The Impact of the Year 2000 Problem considering contingency planning within hospitals is staggering. How will programs. What is the optimal use of all the paths be tested adequately for this approach in protecting patient patient safety? What testing sta n- care considering the multiple risks dards are being employed to ensure that can occur in any single facility? the results will protect patient safety and financial accuracy? Healthcare systems are trying to r e- duce Y2K exposure by excluding Contingency planning includes di s- high-risk business partners from f u- aster recovery plans. Will contingency ture deals. The cumulative impact of planners accomplish their work soon this practice in healthcare and other enough to be of practical assistance industries could negatively impact to the continuity of operations for p a- smaller firms irrespective of their tient safety and proper medical fun c- competence or cost competitiveness. tions? What can be done to insure that a "flight to quality" will include Y2K Several of the national associations compliant smaller firms? that represent the health care industry were impressive in their assistance to Rural and inner city hospitals could be the Committee and the country. They endangered as a result of Y2K issues helped the Committee explain the cited above. In many communities extent and depth of Y2K compliance they are the center of health activities issues in their industry. It is obvious because of the low-income status of from the hearing however that no their patients. Furthermore, in rural single organization or groupings of communities these hospitals are fr e- healthcare organization, are working quently the largest employer. What together to assure the American pu b- public policy actions need to be taken lic that the major issues are being promptly before the window of oppo r- addressed adequately. Can this i n- tunity closes on solutions prior to the dustry unify quickly enough to insure Year 2000? that healthcare will become Y2K co m- pliant before the Year 2000? How do the healthcare payment o r- ganizations (Health insurance comp a- Testing of renovated biomedical d e- nies and Medicare/Medicaid) plan to vices, patient data systems and function if their own payment systems healthcare billing systems is in its are not working or their customers early stages. The credibility of the test (hospitals and doctors' offices) cannot results is dependent on the quality of produce EDI health claims? the testing criteria and processes. The Committee has not seen any data or The volume of electronic interfaces discussion dealing with this ultimate (paths) between biomedical devices measure of Y2K compliance. and patient data and billing systems

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM 51 INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

TELECOMMUNICATIONS

critical personnel. While these fai l- ures were not Y2K related, some OVERVIEW think they are indicative of the types of inconveniences that may result The telecommunications industry is from the millennium rollover. not immune from the Y2K threat. Y2K-related problems in telecomm u- Our critical dependence upon co m- nications could have serious cons e- munications certainly suggested an quences for both national and ec o- industry wide response. However, nomic security. One-third of all ele c- fears of competition and liability pr e- tric power controls, the nation’s f i- vented a formal coordinated indu s- nancial transactions and over 90% of try-wide approach until late in 1998. defense communications rely on the smooth functioning of public tel e- Telecommunications used to mean communications. Telecommunic a- switched voice communications. tions also make possible the remote However, the synthesis of computers control of pipelines and transport a- and telecommunications has broa d- tion systems like air traffic control. ened the way in which we think about telecommunications. The The 99.9% availability of teleco m- public switched network (PSN) can munications in the U.S. can make it be defined as any switching system easy to forget how much we depend or voice, data, or video transmission upon this critical system that is used to 1 infrastructure. THE provide communication However, the failure of TELECOMMUNICATIONS services to the public AT&T’s frame relay (e.g., public switched INDUSTRY IS NOT system in April 1998 networks, public data and the loss of IMMUNE FROM THE Y2K networks, private line PanAmSat’s Galaxy IV THREAT. services, wireless satellite in May 1998 services, wireless remind us just how much we take systems, and signaling networks). 2 telecommunications for granted. Many layers of hardware and sof t- When AT&T’s nationwide frame r e- ware enable the seamless commun i- lay system for data transmission cations, which allow us to make crashed, one bank lost over 1000 phone calls, surf the web, and tran s- ATM sites and a national retailer e x- act business. perienced problems in over 2300 stores. When Galaxy IV disco n- The PSN can be divided into three nected 40 million people from their components: pagers, the effect was felt strongly throughout the economy, including · PSN elements healthcare which could not page

53 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

· support systems (operations, ples of these types of functions i n- administrative and maintenance clude billing, provisioning of services, systems of the service provi ders) network surveillance and maint e- · customer premise equipment nance, and other network manag e- ment and administration functions. Public Switched Network El e- ments The disruption of a carrier’s oper a- tions, administration, and maint e- Public switched network elements nance functions could cause some include many different confusion for devices (any one of Getting a basic dial- consumers with inacc u- which can have Y2K tone at midnight on rate billing and delays problems) that connect January 1, 2000 is in the service requests. There is a concern that calls between less likely to be a networks. Switches, a buildup of errors the most common problem than disrup- could eventually begin 3 telephone equipment, tions in billing… to degrade service. establish connections between two telephones when a call According to a report from a high is made, with multiple switches r e- level federal advisory committee r e- quired for long distance calls. leased September 10, 1998, Y2K Switches record the starting and problems could impact telecommun i- ending times of a call, including the cations in the fo llowing ways: day and the year (which is necessary for calls that cross time zones). If · Platform operation (hardware). some of the switches used in placing Hardware clocks may not recog- a call are Y2K compliant and others nize the year 2000. are not, or if the renovations are not · Operating system functionality. performed in a consistent way for the Date functions may return the different types of switches made by wrong year to applications different manufacturers, the systems · Scheduling of events. Errors in may not be able to work together. calendar dates can prevent scheduled events (e.g., report Support Systems updates, testing, designing, provisioning, or billing) from running In testimony before the Committee and can result in incipient fail- Dr. Judith List, Vice President- ures. Integrated Technology Solutions at · Historical data. Historical data Bellcore, explained that there is little may not be available from 1999, date sensitive information in the fu n- or 1999 may be re-ordered, with damental call processing or data events occurring in 1999 se- routing capabilities of networks. quenced after 2000. "Where we do see date sensitive i n- · Sorting and searching algo- formation is in the operations, a d- rithms. Dates after 1999 will be ministration, and maintenance fun c- ordered before 1999; searching tions of networks," she said. Exa m- algorithms intended to include

54 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

dates in 2000 (e.g., “Where date fore 1996 has only a 50% chance of > 1997”) will exclude them in- transitioning to the year 2000 without stead. needing to be upgraded or replaced. · Password expiration. All pass- Gartner also cautioned that local words may expire (which would area networks (LANs) can be i m- prevent authorized users from pacted by Y2K in a number of diffe r- performing legitimate functions), ent ways including total failure and or they may never expire (which denying management access. 5 In could diminish the protection of- view of their projection that 20% of fered by password aging).4 the web servers installed prior to 1997 could fail to function properly Customer Premise Equipment through January 2000, the Gartner Group also warned disruptions might Customer premise equipment (CPE) ultimately deny 5 percent of Internet is also vulnerable to Y2K problems. user connectivity. Gartner is also CPE includes: projecting that 90% of web users could experience delays. In addition, · Private branch exchange 30% may find sites unreac hable. equipment (PBX) · telephone equipment Competition for resources in January · cellular phones 2000 may make it difficult for small · fax machines and medium-sized business to s e- · private data networks cure help. It is imperative that bus i- · public service answering points nesses and other organizations make communications a priority now. Many small and medium sized bus i- nesses may not be aware that their Y2K INITIATIVES IN privately owned communications TELECOMMUNICATIONS equipment may fail because of Y2K problems. If businesses do not take Numerous Y2K initiatives are cu r- a proactive approach by contacting rently underway in the telecommun i- vendors and obtaining the manufa c- cations industry, including strong e f- turer’s compliance information, they forts by the Federal Communications could have difficulty maintaining Commission (FCC), the Network R e- normal business functions due to the liability and Interoperability Council failure of their own communications (NRIC), the Telco 2000 Forum and equipment. The good news is CPE Alliance for Telecommunications I n- will not cause disruptions in the pu b- dustry Solutions (ATIS), the National lic network. However the economic Communications Systems (NCS), impact on businesses with failed and the President’s National Security telecommunications systems may be Telecommunications Advisory equally as damaging. Committee (NSTAC).

According to the Gartner Group, networking equipment produced b e-

55 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

The FCC In March 1998, Senator Jon Kyl Since 1934, the FCC has regulated wrote to the Chairman of the FCC interstate and international comm u- and expressed his concern about nications, including radio, television, the absence of an industry-wide wire, satellite and cable. In July telecommunications effort to test 1997, the NRIC, the FCC’s federal for interoperability, or an accurate advisory committee presented its assessment of the industry of findings and recommendations on how Y2K may affect the Public the implementation of the Teleco m- Network (PN). 8 Senator Kyl also munications Act of 1996 in a report suggested that if NRIC was entitled Network Interoperability: The tasked by the FCC , it could pro- Key to Competition . The report ob- duce an accurate and much served that “interconnectors must needed assessment of how the ensure that their year 2000 conver- Y2K problem could affect the PN. sion efforts are compatible.” 6 How- This assessment could look b e- ever, NRIC made no specific re c- yond the traditional switched ne t- ommendations for an industry-wide work and consider other comm u- response to the problem. nication technologies including cellular and satellite among ot h- In the summer of 1997, the Y2K ers. Such a report could well problem was viewed as a due dil i- provide the basis for building gence effort, which only needed to contingency plans to ensure that be addressed by individual comp a- communications vital to national nies. There did not appear to be a and economic security could be role for the FCC or a need for a c o- maintained. ordinated industry-wide response the Y2K problem. The lack of strong n a- On April 28, 1998, before the Senate tional leadership made it very easy Commerce Committee, FCC Chai r- to defer the problem. Commissioner man William Kennard testified that Michael Powell was appointed to the the NRIC would be asked to exa m- FCC in December 1997. In his role ine the implications of Y2K on co m- as the FCC Defense Commissioner, munications. On July 30 th, a day he began an aggressive Y2K awar e- before presenting testimony to the ness outreach to the industry. Y2K Committee, the FCC a n- nounced that Michael Armstrong, “Despite carriers’ best efforts to cor- CEO of AT&T, would chair the newly rect Y2K problems and carrier as- re-chartered federal advisory group surances that telephone service will to look at Y2K. The NRIC met to be available on January 1, 2000, the propose a comprehensive plan e x- FCC, most industry analysts, and amining three main a reas: even some carrier representatives conceded that some failures are still · Y2K Impact on the Ne tworks 7 likely to occur.” However, the types · Y2K Impact on Customer Pre m- of problems that could result remain ise Equipment unclear. · Network Reliability.

56 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Telco 2000 Forum amined the impact of Y2K fixes and interoperability on: One of the earliest and best- organized efforts to test for · Emergency services interoperability in the PN was the · Basic, enhanced, and intelligent Telco Year 2000 Forum. Collectively services representing about 145 million a c- · Network management systems cess lines, The Forum diligently · Data networks sought to overcome the complexity of sharing information and antitrust The tests were concluded succes s- concerns in the highly charged legal fully at the end of 1998. A report is atmosphere of 1997 and 1998. The expected by the end of January Forum, a voluntary group of eight 1999. The early initiative of the F o- local exchange carriers, was the first rum and its commitment to business telecommunications initiative to b e- continuity will play a major role in a l- gin identifying possible problems of leviating public co ncern. interoperability. The Forum me m- bers include: According to expert testimony from Gerry Roth of GTE, “ Despite the fact · Ameritech Corporation that this network cannot be 100 per- · Bell Atlantic cent tested in advance of the Year · BellSouth 2000, we believe our individual and · Cincinnati Bell collective actions in Year 2000 re- · GTE mediation and subsequent test and · SBC validation provide a basis for contin- · Southern New England Tel e- ued confidence that the telephone communications Corporation and data networks will continue to · US West operate and provide the outstanding services we have come to expect.”9 In an effort to reduce the possible risk of network failures, the Forum Alliance for Telecommunications began testing in July 1998 and co m- Industry Solutions pleted testing in January 1999. The Forum completed 1700 tests and On January 4, 1999 ATIS began found only seven problem areas, five scheduled internetwork inter- of which have already been rem e- operability testing to evaluate the died. The Forum tested 16 separate impact of the Year 2000 date change configurations of network elements on the PSN. Companies participa t- and data transactions and 40 unique ing in the testing include Ameritech, network management configurations. US West, GTE, AT&T and Sprint, as These test configurations were made well as six wireless service providers up of 82 commonly used teleco m- (Aerial Communications, AirTouch, munications products from 21 su p- AT&T Wireless, Bell Atlantic Mobile, pliers. The Forum specifically e x- BellSouth and SBC).

57 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Planning and implementation of the management and control. Year testing procedures began several 2000 testing will continue through months ago. Efforts included ident i- February 12, with results made pu b- fication of the test's scope, gener a- licly available to interested parties on tion of appropriate test scripts, and April 14, 1999. obtaining participants to donate lab equipment and the appropriate r e- ASSESSMENT sources. Interconnected services to be tested on the network include toll free services; Local Number Por t- During 1998, there were no publicly ability (LNP); the Government Eme r- released comprehensive studies or gency Telecommunications System assessments of how Y2K could a f- (GETS); and wireline-to-wireless and fect the telecommunications infr a- wireless-to-wireline interconne ctions. structure. However, it is generally believed that Y2K will not cause All testing is being conducted off- prolonged disruptions. The absence line to ensure no disruption of exis t- of any comprehensive assessment ing services to the PN. This testing sparked considerable uneasiness effort will be accomplished by rolling among business sectors and the forward the dates of the interco n- public in general. The general view nected switches in a laboratory env i- was that companies were working ronment to simulate the following hard to address Y2K, but little factual date rollovers: information was available.

· December 31, 1999 to January 1, On January 14, 1999, NRIC released 2000 its preliminary assessments demo n- · February 28 to February 29, 2000 strating that the telecommunications · February 29 to March 1, 2000 industry was meeting the Y2K cha l- · December 31, 2000 to January 1, lenge. NRIC estimates that the m a- 2001 jority of the industry is on target to meet its self-imposed goal of Y2K During each simulated rollover, the readiness by June 1999. According signaling network will be monitored to the FCC Advisory Committee, l o- to ensure that the PN responds in a cal, exchange carrier, long distance satisfactory ma nner. carrier and small telephones comp a- nies all seemed to be making good ATIS will be testing the interne t- progress. However, small phone working aspects of the PN. ATIS companies tend to lag approximately has designed special test scripts that 10-15% behind larger local e x- will focus on time - critical network change carriers in fixing Y2K pro b- events on 31 December – 1 January lems. The local exchange comp a- to model and monitor potential ne t- nies participating in the NRIC (a p- work congestion and the transmi s- proximately 99% of all the switched sion of voice and data from local e x- access lines in the U.S.) were pr o- change to inter-exchange carriers, jecting to have completed 76% of ‘‘800’’ number access, and network their Y2K renovations by Dece m-

58 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM ber 1998. The three major long di s- puter systems that may not have tance carriers participating in NRIC-- been upgraded over the last 10 or 15 AT&T, MCIWorldcom and Sprint-- years. According to INTELSAT, represent 82% of the market rev e- these users may have a more limited nues. These companies are pr o- knowledge of computers because jected to have reached 81% read i- they only repair the computer system ness by December 1998. The NRIC when it breaks. They may or may assessment is an important first not be fully aware of the Y2K issue, step. and they may or may not be rem e- diating any Y2K issues. The users Rural Telephone Companies that have outdated systems do not have money to remediate any Year The readiness of the 1271 small 2000 issues and sometimes don’t companies, who provide about 1% of even have the money to recognize the access lines in the U.S., remains that they have a Y2K problem. Many unclear. Some people within the ru- of the earth stations throughout the ral telephone companies, contrary to world have several hundred pieces popular press, pride themselves on of computer equipment from various maintaining the latest equipment. manufactures that control their ability Some rural companies, for example, to receive telecommunications i n- claim to have been the first to offer formation. For example, if antenna digital switching. Approximately 75% control units fail the antenna could of the rural market is already sche d- not point to the satellite and no i n- uled for Y2K upgrades. Only 2% are formation could be sent or r eceived. not expected to be Y2K ready. 10 “A significant part of INTELSAT’s Satellite Communications international communications is a two-way communication that uses an Ramu Potarazu, Chief Information INTELSAT satellite between country Officer (CIO), INTELSAT, testified A and country B. If country A’s before the Committee that commun i- ground network is Year 2000 com- cations satellites do not reference a pliant; and INTELSAT, being the time and a date; rather, a satellite supply chain in the middle, is also references what is commonly r e- compliant; and country B’s ground ferred to as ‘‘satellite local time,’’ that network is not Year 2000 compliant, is a reference to the sun. When then you will have a failure of the there is a technological reference to complete chain.”12 the sun, there usually is no reference to a specific year. INTELSAT’s own Cable, Mass Media and Wir eless analysis found that the primary problems reside in ground systems Not much is known about the state of that fly, command and control, and the cable, mass media or wireless monitor satellites.11 industries. The FCC’s Cable Bureau is in the second phase of its survey. INTELSAT expressed concern about The survey was sent to companies ground station users who have co m- accounting for approximately 78

59 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

percent of the market share of cable Solutions Business Unit, Bellcore subscribers. The first survey began noted the following: in April 1998 and found that while most of the companies surveyed had “Finally, there will be problems, and started assessments, there is a level of there was little It is critical that uncertainty in this area progress in contingency and that makes it difficult to remediation. In Nove m- disaster recovery predict where the ber 1998, the Cable planning and problems will be. In the Bureau began its training be software industry today, second survey that implemented. the best in class covers about 90% of companies find 95 all cable subscribers. percent of code Response should be back and a s- anomalies before the software ever sessed some time in the first quarter gets to the field. That means that 5 of 1999. It is also expected that the percent of software anomalies are Mass Media and Wireless Bureaus found after the code is operational. will have completed initial asses s- Furthermore, according to the Soft- ments by the first quarter of 1999. ware Engineering Institute, a new defect is introduced with every approximately 4 1/2 fixes of software CONCERNS code. Both of these statistics suggest that, given the pervasiveness and extent of Year 2000 elements, The Committee has three outstan d- there will be problems. Furthermore, ing concerns in communic ations: Y2K contingency planning and disaster recovery needs to address increased contingency planning plans differently than traditional among carriers business continuity plans because backup systems are likely to have increased attention to Y2K sec u- the same Year 2000 problems, is- rity concerns sues may be more widespread across a number of industries, and international co mmunications problems may last for a longer period of time. Contingency Pla nning In October 1997, the President’s Carriers have undertaken massive Commission on Critical Infrastructure code corrections, which will be in Protection expressed concerns : “The place by the end of 1998. The large unbundling of local networks man- number of code corrections increase dated by the Telecommunications the possibility of disruptions from the Act of 1996 has the potential to cre- 13 introduction of new errors. In tes- ate millions of new interconnections timony before the Committee, Judith without any significant increase in List, Ph.D., vice president and ge n- the size or redundancy of network eral manager, Integrated Technology plants. Unbundling will be imple-

60 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM mented at a time of rapid and large- tems. Additionally, these organiza- scale change in network technolo- tions could not offer guarantees of gies. The interaction of complexity the adequacy of Y2K internetwork and new technologies will almost interoperability testing.”15 certainly expand the universe of ways in which system failure can oc- In July 1998 the NSTAC testified cur, and, unlike natural disasters, about the findings of its widespread there is no assurance that such fail- outage report and highlighted the ures will be localized.”14 fact that the industry has had limited experience with systemic, wid e- Telecommunications in the U.S. has spread network failures. Both the one of the most highly developed NCS and the NSTAC believe that the systems of infrastructure assurance. probability for Y2K-related wid e- In 1963, the NCS was created to e n- spread outages is extremely low. sure the federal government has e n- However, because of our reliance on during communications. Composed communications the cost would be of 23 federal agencies, the NCS extraordinarily high for commerce works closely with the telecommun i- and defense. In testimony before cations industry and maintains a c o- the Committee, NSTAC expressed ordinating center to resolve failures concern about the lack of an indu s- in the networks that could impact n a- try-wide plan to facilitate intercarrier tional security or emergency prepa r- coordination for recovering from a edness. widespread outage of this nature. Most carriers have internal plans and The NCS works closely with the N a- processes for maintaining the inte g- tional Security Telecommunications rity of their own networks. Looking Advisory Committee (NSTAC), an further at contingency planning and advisory committee created in antic i- recovery from a widespread outage, pation of the AT&T divestiture. the NSTAC questioned whether e x- Composed of 30 chief executive off i- isting communication and coordin a- cers from telecommunications, i n- tion mechanisms among service formation technology, aerospace and providers were adequate for efficient banking companies, the NSTAC reconstitution of service. It was u n- makes recommendations to the clear whether the existing agre e- President on issues critical to pr o- ments, communications systems, tecting the U.S. communications i n- and coordinating mechanisms in the frastructure. In September 1998, the industry could mitigate a severe NSTAC released the first report that widespread service outage. examined the impact of Y2K on the assurance of national security and During reconstitution, a means of emergency preparedness commun i- communication and coordination cations. The NSTAC report noted between and among critical centers that “no organization, either private would be indispensable. The NCS or government could offer a guaran- works closely with the industry and is tee of total Y2K problem eradication uniquely positioned to collect ne t- from its networks, services, or sys-

61 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM work outage information for Y2K di s- telecommunications resources. The ruptions. 16 JTRB met in January 1999 for the first time in several years to dete r- As part of its normal contingency e f- mine how it might respond to a ser i- forts, the NCS maintains a private ous Y2K related event in commun i- communications network, which is cations. independent from the PN and pr o- vides connectivity to the FCC, all of Security the regional Bell operating comp a- nies, GTE, Sprint, and switch The Committee has repeatedly e x- manufacturers. In preparing for Y2K pressed concern about the number and other threats to the communic a- of code corrections that are taking tions infrastructure, the NCS is co n- place in foreign countries and the sidering expanding its network to i n- long-term security risks that this clude the Critical Infrastructure A s- could cause for information assu r- surance Office, and the National I n- ance in the U.S. In response to frastructure Protection Center. The Committee questions about the private network could facilitate r e- threat of malicious code, Dr. List r e- constitution efforts in the event of s e- sponded: rious disruptions. As an additional backup, the NCS maintains high fr e- “There is the possibility that security quency (HF) radio communications risks can be introduced into any with major telecommunications pr o- code that is being remediated, not viders and can also access over just code that is corrected in foreign 1000 HF radio sites around the countries. Programmers can, for ex- world. ample, introduce trap doors or back doors for non-malicious reasons, for Chairman Bennett remained co n- example, to make it easier for them cerned that the administration was to maintain the code. These trap not developing the necessary policy doors or back doors can then be to respond to an unanticipated Y2K used for other purposes to obtain disruption in the U.S communic a- unauthorized access to the software tions infrastructure. In August 1998, program. In other instances, security Senator Bennett wrote to the Dire c- problems can be introduced for di- tor of the Office of Science and rectly malicious purposes during the Technology Policy (OSTP), and code remediation process. To date, asked what role the Joint Teleco m- I know of no easy way to assess munications Resources Board 17 code to ascertain the existence of (JTRB) would play in the event of a these types of security risks. It re- Y2K-related emergency . The As- quires labor intensive examination of signment of National Security Eme r- the code, line by line. Companies gency Preparedness Telecommun i- can work to protect themselves from cations (Executive Order 12472), such risks by conducting adequate tasked the Director of OSTP to due diligence of employees, con- maintain a JTRB to advise the Pres i- tractors, and service providers that dent on the emergency allocation of they may hire to remediate Y2K

62 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM problems. In addition, implementing sharing of information. In addition, various policies (such as code in- the ITU has encouraged the sharing spections) to monitor the code re- of Y2K readiness information with mediation process also can help re- customers. The ITU has had three duce risk.”18 main goals:

International Communications · promote Y2K best pra ctices

Today global telecommunications is · facilitate global interoperability a growing $800 billion industry. I n- testing dustry analysts note that 75% of all traffic originates or terminates in one · provide specific guidance on of six countries: France, Germany, business continuity planning. Italy, Japan, U.K. and the U.S. In addition, 90% of all call traffic comes The ITU’s global assessment is from 20 countries. Forty percent of somewhat sketchy at this point. the global traffic touches the U.S., However, according to the ITU, the 20% Europe, and 15% through Asian U.S., Japan, China, Germany, hubs.19 Telecommunications rev e- France and the U.K. account for 53% nues in the U.S. are about $300 bi l- of wireline infrastructure, and all are lion a year, with the majority of rev e- reported to have Y2K programs in nues coming from the provision of place. The ITU task force also services. pointed out that 20 territories a c- counted for 80% of the world’s wir e- At the United Nations’ “National Y2K lines, but there were still no details Coordinators Meeting” on December from Italy, Taiwan (Republic of 11th 1998, the International Tel e- China) or Ukraine. Throughout the communication Union’s (ITU) Year first quarter of 1999, the ITU will o r- 2000 Task Force outlined global e f- ganize workshops as needed in sp e- forts to ensure Y2K readiness in cific locations including Russia, India telecommunications. and Asia, to promote awareness and to increase knowledge of Y2K read i- The ITU established a Y2K task ness. force in March 1998 to raise the awareness of operators and carriers Some initial testing in September by providing information on potential 1998 did not uncover any specific Y2K problems. The ITU considers Y2K problems. However, the lack of one of the greatest obstacles to information about the readiness of global readiness is the lack of global communications remains a awareness and action at the go v- serious concern. U.S. carriers are ernmental level to pressure tel e- concerned that if foreign companies communications operators to share are not prepared, call completion information about their Y2K read i- could be impacted. ness. Part of the ITU’s effort has been to recommend compliance standards and also promote the

63 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

TRANSPORTATION

Like most other sectors of the eco n- OVERVIEW omy, transportation has become highly automated and dependent on The transportation sector is a co m- information technology to transport plex and diverse mixture of public people and goods safely, quickly, and private enterprises. This sector and economically. However, such includes three divisions: aviation, automation has made this sector surface transportation and maritime vulnerable to Y2K concerns and i s- entities. Within sues seen in YEAR 2000 MALFUNCTIONS IN each division, di s- other sectors by tinct “modes” exist. TRANSPORTATION ARE AT THEIR the Committee. For example, rai l- BEST AN INCONVENIENCE, BUT These include roads and trucking THEY MUST NOT AND CANNOT PUT obtaining assu r- ance of Govern- are both surface OUR CITIZENS AT RISK. modes, but are ment services such as air-traffic separate industries SENATOR CHRIS DODD in their own right. control and cus- SEPTEMBER, 1998 To keep the scope toms processing, of the Committee’s investigation wide variations in manageable, the Committee s e- individual firms’ Y2K preparedness, lected areas having a major impact a profusion of rumors and misinfo r- on public safety or the nation’s mation, and a general uncertainty economy. Y2K problems may also about the risk presented by embe d- exist in areas not covered in this i n- ded microchips. In addition, the vestigation. transportation sector raises many concerns about international Y2K Transportation and Y2K Issues preparations. These included the Y2K readiness of international air In pursuing this investigation, the traffic control, non-U.S. airports, and Committee staff conducted inte r- non-U.S. ports, all of which affect views with a wide variety of know l- U.S. travelers, businesses, and co n- edgeable parties including: federal sumers. agencies that regulate and provide services to transportation system The Committee has found that all the operators, system operators the m- major transportation players—the selves, associations representing a biggest operators, the largest facil i- broad cross-section of the industry, ties, the federal agencies, etc.—have equipment manufacturers and facility substantial Y2K programs underway. operators (e.g. airports and ports). A In all these programs, the emphasis complete list of organizations inte r- is first on safety. All of these entities viewed is appended to this se ction. are well on the way to being ‘Y2K ready’ on their own. In addition,

65 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM parties show a willingness to coo p- system will continue to operate erate with each other in transport a- safely and efficiently during and after tion: large airports have reached out the millennium date change, less to smaller feeder airports and rai l- attention has been focused on the roads have shared information about readiness of the nation's ai rports. Y2K problems. However, there is reason to be concerned about the The Senate Committee on Co m- readiness of smaller players in this merce, Science and Transportation sector, as has been the case in other has requested the U.S. General A c- sectors. For e x- counting Office Highlights of U.S. Aviation ample, there are (GAO) to review thousands of city the Y2K status of -13 major U.S. airlines and county gov- the systems and -34 national airlines ernments in the equipment inte- -52 regional airlines U.S. that are re- gral to the oper a- -670 certified airports sponsible for o p- tion of the na- -550 million annual U.S. passe ngers erating and tion’s airports. At -$100 billion total operating revenues maintaining the issue are sys- local surface tems for lighting transportation infrastructure. The runways, controlling access to s e- Y2K planning of these governmental cured areas, handling baggage and entities has been very slow. A good fueling aircraft. Breakdowns in these example is highlighted by the Se p- vital systems could disrupt an ai r- tember 1998 survey from the com p- port’s ability to move aircraft and troller of the state of New York, who travelers efficiently and safely and found that a disturbingly large nu m- could ripple throughout the entire ber of cities, towns and villages in NAS, thus creating system gridlock. that state had not, at that time, made any assessment or planning for the As part of its review, GAO is su r- Y2K problem. veying more than 400 of the nation’s airports to determine progress made toward ensuring that operations will not be seriously affected by Y2K MAJOR INITIATIVES malfunctions. The specific research questions guiding this review are: GAO Airport Survey · How will the safety, security and Airports are a critical component of efficiency of the NAS be affected U.S. aviation operations, often r e- if the airports' Y2K preparations ferred to as the National Airspace are not adequate? System (NAS). Airports are the e n- · What conditions will affect the try and exit points to the NAS for outcome of airports' Y2K prep a- most travelers. While much attention rations? has been centered on the Federal · What progress have airports Aviation Administration’s ability to made to ensure that their co m- guarantee that its air traffic control puters and electronic equi p-

66 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

ment will function on and after IATA’s membership should provide January 1, 2000? reasonable assurance that an airline will not be flying unknowingly into a The survey data will be suppl e- non-compliant airport in January mented with site visits to a cross- 2000. section of airports in order to gather more in-depth knowledge of the ICAO Status Tracking challenges faced by airport mana g- ers. The report is expected to be The International Civil Aviation O r- available in February 1999. ganization (ICAO) was established in 1947 “in order IATA Survey Railroad Highlights that international civil The International -Over 700 U.S. Railroads aviation may Air Transport A s- -Over 220,000 miles of track be developed sociation (IATA) is -20,000 locomotives in a safe and the major body for -$32.7 billion in operating revenue orderly manner coordinating in- -Over 265,000 employees and that inter- terairline cooper a- -20 million intercity passengers national air tion. It currently -48 million commuter passengers transport has 260 member services may airlines from over 130 nations. IATA be established on the basis of equal- has been working with its members ity of opportunity and operated since 1996 to cope with the mille n- soundly and economically.” In the nium bug. IATA members are same year, ICAO became a specia l- spending over $1.6 billion to resolve ized agency of the United Nations. Y2K problems inte rnally. ICAO now encompasses 185 n a- tions. In an effort to ensure that In 1997, IATA released a survey of worldwide air traffic control and i n- 44 of its member airlines on their ternational airport operators are fully Y2K preparations and concerns. aware of the scope of the Y2K pro b- This survey revealed that 61% of the lem, ICAO has developed an action airlines participating in the survey plan that it is currently implementing. rated the Y2K problem critical to the To date, three ICAO “state letters” industry and another 32% rated it (advisory letters to member cou n- fairly serious. IATA’s next initiative tries) have been distributed: the first has focused on airports around the on December 1997, the second in world. IATA has targeted 100% of May 1998 and the last in November the international airports and Air 1998. This is part of an ongoing e f- Traffic System (ATS) providers ou t- fort to alert ICAO contracting states side of North America and used by to the extent of the problem, to i n- IATA members. Although IATA is form them of action being taken by keeping its survey results private to ICAO and to request additional i n- its member companies, and the pu b- formation. lic will not be privy to its survey r e- sults, the comprehensiveness of

67 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

While ICAO has no regulatory cluded both their computer systems authority over its member states, it (often referred to as Information does serve as an adviser to the air- Technology or IT) and embedded traveling public. In this capacity, systems, such as controllers int e- ICAO had said that Trucking Industry Highlights grated into it would publish transportation “status reports on vehicles or -84,212 fleets of 10 or more trucks the progress among facility control -9.5 million people employed in trucking States in order to -$346 billion in gross revenues and monitor- provide confidence -Serves every U.S. community ing systems. to the travelling In order to -77% of all communities rely solely on public and aircraft facilitate trucking operators.” How- honest and -$27 billion paid in highway taxes ever, ICAO has at candid an- this time dropped its swers to sur- plans to publish these assessment vey questions, respondents were reports. given a pledge of confidentiality. Significant items learned from the survey include: ASSESSMENTS · 62% of the respondents reported Transportation sector survey that they had not completed their conducted by Committee staff. Y2K assessment process. This is disturbing given the short time In preparation for the September 10, remaining until December 31, 1998 hearing on transport ation- 1999. By comparison, the Office related Y2K issues, the staff of the of Management and Budget d i- Special Committee on the Year 2000 rected all Federal agencies to Technology Problem conducted a complete their assessments by survey of large companies and June 1997. service providers in the transport a- · Six of the eight who answered a tion sector. The results of this su r- question on mission critical sy s- vey are summarized in a table a t- tems reported that 70% or more tached to this section. of their systems are mission crit i- cal. To sample the transportation sector, representatives were selected from · 100% of the respondents r e- major airlines, airports, railroads, ported that their contingency maritime shippers, trucking comp a- plans are incomplete. Even more nies and metropolitan transit author i- disturbing, over half reported that ties. The Committee staff asked they were not even working on survey respondents for information contingency plans at this time. on their automated systems used to · 94% reported their total expected manage and operate their respective Y2K expenditures. The total transportation systems. This i n-

68 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

projected cumulative costs at this ing overall air travel are not Y2K time are over $650 mi llion. compliant, the system will be s e- verely limited in its overall capacity, · 50% of the respondents reported leading to lost revenue for the ai r- they anticipated being involved in lines, lost productivity in the eco n- litigation due to the Y2K problem. omy and significant public dissati s- · 94% report Public Transit Highlights faction with the they will fin- air transporta- ish their Y2K -6,000 U.S. transit agencies tion system. preparations -$7 billion in annual capital expenses on time. The -$19 billion in annual operating e xpenses The transporta- Committee tion firms sur- -8 billion trips annually staff feels -3.7 billion miles and 246 million hours of veyed did not this is overly become aware annual service optimistic -300,000 employees of Y2K prob- given that lems until 1995 most of them have not yet co m- or later. Almost all have reported pleted the process of fully a s- establishing a formal Y2K office sessing the scope of their Y2K and/or project within their company. problem. Companies are making the best pr o- gress on their mainframe and client- Other studies have concluded that medium and small enterprises are server applications and are furthest behind on the embedded chip a s- not as advanced in their Y2K pr e- paredness as their larger counte r- sessment and remediation aspects of the problem. parts. Hence, since this study f o- cused on large transportation firms, Costs varied widely across survey the results presented here probably represent the best-prepared portion responses. In an attempt to explain this disparity, the Committee found a of the industry. marked lack of uniform accounting for Y2K expend itures. The survey raises many concerns about aviation given the dispropo r- A little more than half the surveyed tionally poor response rate to the survey of both airports and airlines. parties were worried about becoming party to litigation brought by Y2K Given the concern that already exists about the readiness of the Air Traffic failures or upsets. Still more had concerns about the potential for Control system, this will add to the general unease about air travel. The business partners to fail to deliver expected products or services. Ot h- Committee staff finds the case for the Y2K flight readiness of comme r- ers felt that they could plan for these contingencies. cial jetliners convincing. Planes will not literally “drop out of the sky” on Organizations were also asked what January 1, 2000. But, if the ground- based information systems suppor t- Congress could do to facilitate Y2K efforts in the transportation sector.

69 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

By far, the most common answer the FAA. In addition, Y2K planning (from about 50% of respondents), kits have been sent to over 400 ai r- was to produce legislation that su p- ports that the ATA team could not ports good faith sharing of Y2K i n- visit. formation and limits the liability o r- ganizations are exposed to by Y2K Testing for Y2K readiness is either problems, upsets, or underway or soon failures. Several Maritime Highlights to begin with the other actions were Dallas-Fort Worth mentioned by more The port industry, port users and Airport, the Sea t- than one respondent: capital expenditures for maritime tle-Tacoma Air- (1) Congress should equipment provides: port and United lead in the discovery -16 million jobs nationwide Airlines. Results and dissemination of -$154 billion in Federal taxes of ATA activity valid Y2K information -$783 billion of GDP and testing were to offset the misi n- -70% of U.S. Customs rev enues not available at formation widely di s- the time of this seminated today, (2) antitrust pr o- report, but a major readiness a n- tection is needed for companies who nouncement is expected from the normally are competitors but who FAA, ATA and several airlines in the cooperate on Y2K programs and (3) early part of 1999. Congress should continually oversee the Y2K programs of federal age n- Two major issues have been raised cies and service providers important in the airport assessments. The first to all industries, such as power util i- is that airports are often bound by ties and telecommunic ations. many cumbersome rules when a c- quiring equipment or services. ATA Survey These rules can be loosened during emergencies and the Committee The Air Transportation Association feels that the FAA, the airports and (ATA) is the sole trade organization governing authorities should begin of the U.S. major airlines. The 28 looking at Y2K as an emergency and members include all the large U.S. expedite airport remediation pr o- passenger and cargo airlines as well curements. The second issue is the as associate members from Canada, disparate nature of airport oversight Mexico and Holland. ATA members and funding. This unfortunately collectively transport over 95% of all means that no one general program air passengers and cargo in the U.S. will work for all airports and Y2K programs will have to be tailored to After concern was raised about ai r- the specifics of an ind ividual airport. ports by early surveys and the ai r- lines, ATA has focused an initiative on domestic airports. To date, it has completed 158 awareness and a s- sessment visits in coordination with the Airports Council International and

70 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

The major airlines interviewed have CONCERNS substantial Y2K programs and seem to be making significant progress General Concerns with domestic air operational read i- ness. However, they expressed Several general concerns were concerns about FAA Y2K readiness. raised by parties interviewed for this Although the airlines stated that the sector including domestic and fo r- FAA is moving much more delibe r- eign partner readiness, and federal ately now than a year ago, the ai r- government readiness. Examples of lines are concerned that the FAA still the first category include airline co n- has a long way to go. One airline, cerns about airports and airport co n- which reported doing an independent cerns about jet fuel pipelines. In the assessment, said it was satisfied second case, the most common with the validity of the recent FAA concerns were about the Y2K read i- announcement that the very impo r- ness of the FAA’s Air Traffic Control tant “HOST” computer for the e n- systems and U.S. Customs Service’s route air traffic control centers was automated import and export sy s- not Y2K vulnerable. tems. The Committee staff met with the General Accounting Office and However, GAO testified before Co n- the Department of Transpiration I n- gress as recently as August 6, 1998 spector General on the FAA’s Y2K that the FAA will not be fully ready by progress and came away with the January 1, 2000. Significant risks in general sense that the FAA is ma k- the FAA remediation program sited ing substantial progress but still has by the GAO included: significant challenges ahead. The Committee also interviewed the U.S. · Ineffective management of exte r- Customs Service on its Y2K prep a- nal data exchange analysis and rations. The material presented remediation efforts. As of August showed that they were making very 6, 1998 half the exchanges were good progress in bringing into co m- still not examined for date sens i- pliance its “Automated Commercial tive data; of the 25% found to System,” which clears and tracks have date sensitive data, over imports and exports, Y2K compl iant. 90% of those needed repairs. · Poor coordination to date on i n- Aviation-Specific Y2K Issues ternational air transportation i s- sues. Aviation is by far the most complex · Reliance on a telecommunic a- and automated transportation sector. tions infrastructure that is not t o- In the words of one interviewee, “Ai r- tally within its control and may not lines and airports along with FAA be renovated on time. and air traffic service providers rely · Missteps in business continuity heavily on Y2K infested technology” and contingency planning. The and “If today were January 1, 2000, National Air Traffic Controller’s the world’s airline system would fail.” Association (NATCA) has crit i- cized the current version of

71 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

FAA’s plans for being ambiguous pipeline were to fail on January 1, in responding to outages of crit i- 2000, the airports in New York could cal facilities. The FAA testified at only operate for four to seven days the August 6, 1998 hearing that with the fuel supply on hand. Two finalized contingency plans would surveys are underway on airport be available by August 31, 1998, readiness: the ATA is surveying d o- but that date slipped at first until mestic airports and the IATA is co v- September 30 and then slipped ering airports abroad. Preliminary again. At the time of this report, information from the ongoing ATA only a draft version of the FAA’s survey indicates that 38% of the 63 Y2K contingency plan is believed airports surveyed do not have a Y2K to exist and it has not been plan. In addition, concerned U.S. widely distributed in the aviation airlines are individually raising Y2K community or seen by the Senate awareness on their initiative because Committee. of the late start that IATA had in its efforts. Airlines can be affected by Y2K in a number of ways other than the loss Concerning aircraft, the Committee of Air Traffic Control (ATC). They interviewed the Boeing Commercial are heavily dependent on scheduling Aircraft Group (BCAG) that provides programs for aircraft, crews and re s- the preponderance of planes to U.S. ervations. The aircraft themselves carriers. Boeing has done a tho r- must be flight ready. Airport facilities ough analysis of all makes and mo d- under their control must be compl i- els of Boeing aircraft and aircraft ant. Moreover, external utilities (e.g., from the recently acquired McDo n- electric power, telecommunications nell Douglas Corporation (maker of and aviation fuel) must be available. models such as the DC-9s and MD- However, the major airlines inte r- 11s). BCAG contends that a few m i- viewed by the Committee appear to nor “nuisance” vulnerabilities have be managing their internal Y2K been detected in Flight Management preparations well and are surveying Systems on older aircraft. However, their external providers (e.g., foreign the most recent models are all Y2K airports) for the purpose of develo p- ready. Boeing has issued service ing contingency and business cont i- bulletins and service letters on these nuity plans. nuisance factors. Hardware and/or software upgrades are available. In Airports have many dependencies addition, BCAG maintains that these on information technology that may problems will in no way impact the be Y2K vulnerable. Areas that must air-worthiness of the aircraft. The be assessed include runway lighting Committee staff received the same systems and jetway security sy s- information from an independent and tems. One airport official has credible source during a subsequent claimed that only one pipeline, orig i- interview with a major U.S. carrier. nating in Houston, Texas, supplies aviation fuel to most of the airports on the eastern seaboard. If this

72 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Y2K Issues in Other Transpo r- switches have manual overrides (no tation Areas source could identify one which didn’t). Concerning signaling and Railroads warning systems, there didn’t appear to be any date-dependent functions Railroads (long haul and short haul) that would interfere with their safe appear to have fewer Y2K transpo r- operations. These devices are event tation equipment problems. As with driven, not date or time dependent. other large businesses, major inte r- Even in the unlikely event of a Y2K- nal business systems have to be related failure in this equipment (e.g., analyzed and fixed. Concerning o p- a power outage), work-around pr o- erational safety, the short haul rai l- cedures are in place for continued roads have little automation and b e- safe operation of the railroad, a l- lieve they will not be affected by the though with diminished capacity. century date change. The major rai l- roads interviewed have ongoing Y2K Maritime Transportation programs and are fixing problems. The most commonly cited oper a- Y2K awareness within the maritime tional problem is in train dispatching community is low to moderate. software, but the Committee staff Maritime cargo shipping (containe r- was informed that even if all of this ized, bulk, tanker, etc.) is somewhat software were not repaired, the ou t- unique from other transportation come would pose a capacity pro b- modes in that each ship is virtually lem, but not a safety concern. custom built. Thus, each must be individually inventoried and a s- In earlier testimony before the Se n- sessed for Y2K problems. Maritime ate Banking Committee, it was r e- shipping operational safety is at ported that virtually none of the e x- greatest risk during entry and exit isting railroad switches are manually from ports. To avoid increasing that switchable. The witness contended risk due to possible Y2K problems, that the railroad switches are fully the concept of keeping ships from automated and controlled by e m- entering and exiting ports during the bedded chips, which are likely to change of century is being consi d- pose substantial Y2K problems. The ered by shipping operators. If Y2K threat this could pose to economic prevents ports from operating for a stability in the U.S. is disconcerting. lengthy period, there will be a high However, it is the propose of this r e- economic cost to U.S. companies. port to identify and debunk myths However, given that the millennium like that of the automated railroad change will occur on New Year’s switches with embedded chips. As Eve, a short “stand down” period will the Committee has learned, co n- have minimal economic impact. Due cerns about automated railroad to the long lifecycle of ships, major switches and signaling systems a p- maritime shipping companies’ ship pear to be ill founded. The Commi t- inventories often include a variety of tee staff heard from multiple sources ages and automation among ships. that essentially all automated

73 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Committee investigation into co n- that rely on a dependable stream of cerns about the automation of oil up-to-date information in order to tankers did not yield any major Y2K- effectively service custo mers. related safety or environmental i s- sues. There is a large amount of The trucking industry has become embedded chip technology in mat e- highly time sensitive and uses a s o- rial handling equipment at ports. phisticated level of computer sof t- However, assessments of that ware to manage its workload. The equipment is still incomplete and it is load management systems of these too early to identify significant i s- companies involve the transfer of sues. Along with revenue systems, electronic data between shippers, cargo tracking, maintenance and brokers, merchants and the trucking scheduling systems are a major co n- companies. This includes transmi s- cern, since most use commercial, sion of shipping status notices, bills off-the-shelf (COTS) software. F i- of lading and payment forms. I n- nally, interviewees did not have an dustry automation extends to a d- accurate sense of the status of inte r- vanced on-board vehicle systems national ports. However, it is widely that enable a company to remotely believed that they are far behind in monitor a truck's engine performance their Y2K efforts. While Y2K impacts and speed, and global positioning on the maritime industry may pote n- systems that track a truck's location. tially interrupt commerce, safety is Computer technology is also used in less an issue than in some other i n- advanced weigh-in-motion devices, dustries. inspection systems and safety record databases. Trucking Public Transit There are over 400,000 trucking companies registered with depar t- In the Public Transit area, the Co m- ment of motor vehicle agencies in mittee staff interviewed the Was h- the United States. Eighty percent of ington, DC and New York Metr o- these employ fewer than 20 trucks politan Transit Authorities and the within their operations. The Amer i- American Public Transit Association can Trucking Association represents (APTA). The Washington MTA pr o- approximately 45,000 individual gram started late and is only in its trucking companies. The trucking initial phases. The New York pr o- industry has become increasingly gram started much earlier. New more reliant on information techno l- York’s size creates a challenge, but ogy and electronic data interchange it also benefits from a much less in the everyday conduct of business automated and therefore less Y2K transactions. The pro cess of just-in- vulnerable system. Finally, APTA time inventory management has has surveyed about 364 of its me m- drastically reduced r eliance on long- bers. The response rate was about term warehouse storage. Cons e- 50%. To quote from the report: quently, trucking companies have in a sense become mobile warehouses

74 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

“… further examination of the data if the sector is going to maintain its reveals conflicting responses. This productivity after January 1, 2000. raises concern about the ability of transit systems in dealing with Year The most disturbing findings in this 2000 issues and their under estima- sector that the Committee has found tion of Year 2000 problems.” are:

Conclusions · Domestic airports have (on a v- erage) started very late to get The transportation sector is the lif e- ready for Y2K. blood of our modern economy. · The FAA, although it has made Daily, it provides millions of Amer i- great strides in the past year, has cans and American businesses with a long way to go to be ready for safe, rapid and economical transport Y2K and remains a high risk. of their people and goods. It has been working so well and efficiently · The situation with international air that it has turned boats, trucks, trains traffic control and airports is and even planes into mobile war e- much worse than in the U.S. and houses that efficiently deliver goods some level of flight rationing is to factories and cu stomers on a just- highly possible for some foreign in-time basis. destinations. · The maritime shipping industry Segments of the transportation se c- has not moved aggressively on tor work hand in hand as goods and Y2K. Disruptions to global trade people transfer from one mode to are highly likely. another. This coupling of modes a l- lows the best mode to be used at · Public transit systems may not be any given time, but it creates a d e- taking the Y2K problem seriously pendency linkage that leaves the enough to be ready for the Year whole system vulnerable if just one 2000. link goes down. Thus it is important that all major segments of transpo r- tation be Y2K ready at the same time

75 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

TRANSPORTATION SECTOR INTERVIEWS

Transportation Sector Overall Railroads

Department of Transport ation (DOT) Federal Railroad Administration (DOT) Inspector General’s Office Association of American Railroads U.S. Customs Service (Treasury) American Shortline Railroad Ass o- MITRE Corporation ciation CSX Aviation in General Amtrak Burlington Northern-Santa Fe General Accounting Office Federal Aviation Administration (DOT) Shipping IBM Maritime Administration (DOT) Airport representatives U.S. Coast Guard (DOT) American Association of Port Authorities American Ass’n of Airport Executives Officials Seattle-Tacoma Airport Authority Crowley Maritime Dallas-Fort Worth Airport Authority Sea Land (CSX) New York-New Jersey Port Authority Chevron Airports Council International New York/New Jersey Port Authority

Airlines representatives Trucking & Highways

Air Transport Association (ATA) Intelligent Transportation Society International Air Transport Association American Trucking Association American Airlines American Association of State Highway SABRE Technology Solutions and Transportation Officials United Airlines Federal Highway Administration (DOT) Delta Airlines New York/New Jersey Port Authority Schneider National Aviation manufacturers

Boeing Commercial Aircraft Mass Transit Agencies

Washington MTA American Public Transit Association New York MTA

76 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

TRANSPORTATION SECTOR SURVEY CONDUCTED BY YEAR 2000 SPECIAL COMMITTEE STAFF

Company Type Date Aware Date Formal Is Your As- Percent Contacted * Legal or Contingency Contacted Contacted Will You of Y2K Project sessment Systems Service Liability Plans Com- by by Finish Problems Started Complete Mission Providers/ Concerns plete Creditors Investors In Time Critical Vendors 1 Airline 1995 1995 N NR Y Y N Y Y Y 2 Airline 1995 1995 N 75% IT Y Y N Y Y Y 38%emb 3 Airline 1995 1996 Y 30% Y N N Y Y Y 4 Airport 1996 1996 N 70% Y Y N N N Y 5 Railroad 1995 1995 N NR Y Y N Y Y MC only 6 Railroad 1996 1997 N NR Y N N Y N Y 7 Railroad early 90's NR Y NR Y N N Y Y Y 8 Railroad 1994 1995 Y NR Y N N Y N Y 9 Shipping 1995 1996 Y 100% IT Y Y N Y N Y ?% emb. 10 Shipping 1996 1996 Y 85% Y Y N N N Y 11 Transit 1995 1995 N 75% Y Y N Y Y Y Authority 12 Trucking 1995 1995 70% Unknown Y N N Y Y Y 13 Trucking 1995 1995 N NR Y Y N NR N Y 14 Trucking 1995 1995 Y NR Y Y N Y N Y 15 Trucking 1994 NR N 75% Y N N N N Y 16 Trucking 1996 NR N 30% Y N N N N Y Notes: * Respondents were asked about potential Y2K legal exposure caused by vendor/supplier failure. Some respondents chose to answer more generally about their overall legal exposure. • MC = Mission Critical, NR = No Reply, IT = Information Technology (systems), emb. = Embedded (systems) • For the 15 companies that reported their costs, they project to spend over $650 collectively on Y2K.

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM 77 INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

FINANCIAL SERVICES

OVERVIEW: and Congressional oversight, the f i- nancial services sector ranks ahead Both the Subcommittee on Financial of virtually all other industries in its Services and Technology and the remediation and testing efforts. Special Committee on the Year 2000 Technology Problem examined the Even in this sector, however, much financial services sector during the additional work will be required, pa r- 105th Congress. Consequently, it ticularly in the areas of contingency has been the subject of more ove r- planning, and international oper a- sight than any other industry. tions and information exchange.

The financial services industry is MAJOR INITIATIVES particularly susceptible to the Y2K problem. The industry uses compu t- ers to calculate interest and mor t- Regulatory Survey gage payments, process stock trades and access account inform a- In February and again in April 1997, tion. Without reliable systems, inte r- both Senators Bennett and D’Amato est could be miscalculated, stock cosigned letters to each of the six trades could vanish, and customers federal financial institution regulatory could have difficulty agencies asking accessing their A CONSUMER LOSS OF FAITH that they provide account balances or IN EITHER THE SOUNDNESS OF information about using their credit or THEIR INVESTMENTS OR THEIR the Y2K readiness of their own debit cards. Such FINANCIAL SERVICE problems, even if computer systems PROVIDERS COULD THROW only temporary, could as well as those in create the type of THE ECONOMY INTO TURMOIL the industry sectors uncertainty and EVEN WITHOUT MAJOR Y2K under their chaos that has been DISRUPTIONS. supervision. The r e- responsible for major sponses raised economic downturns in the past. serious questions Therefore, it is important not only to about Year 2000 readiness in the assure that the computer systems in financial services sector and the this industry are remediated and Chairman decided to use the hearing tested, but that financial services o r- process to investigate fu rther. ganizations avoid consumer panic by communicating effectively with cu s- Hearings tomers and bus iness partners. July 10, 1997: HEARING ON As a result of early attention to the FINANCIAL SERVICES AND THE problem and significant regulatory YEAR 2000 PROBLEM

79 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

· The "silver bullet" that defeats the In the first hearing, the Subcommi t- Y2K problem is not technology, tee solicited testimony from a variety but solid project management. of individuals experienced in working This includes engaging in triage with the Y2K issue. The issues to identify mission-critical sy s- raised in this first hearing would tems and contingency planning, reemerge consistently throughout especially in smaller institutions the following hearings. or those bodies that THE "SILVER BULLET" have yet to initiate Highlights: THAT DEFEATS THE Y2K Y2K remediation. PROBLEM IS NOT Time for a complete · Large banks TECHNOLOGY, BUT SOLID Y2K fix is rapidly d i- started their Y2K minishing. preparations well in PROJECT MANAGEMENT. advance of other Although the hearing industry sectors. However, inte r- on U.S. Financial Institutions and dependency, industry consolid a- Federal Regulatory Agencies Ma n- tion, external vendor reliance and agement of the Year 2000 Computer a greater proportion of mission- Problem had already been sche d- critical systems makes the fina n- uled for July 30, the July 10 hearing cial services industry particularly affirmed the Subcommittee's concl u- susceptible to Y2K pro blems. sion that regulators would play a critical role in Y2K prepare dness. · The panel endorsed direct and immediate federal and regulatory JULY 30, 1997: HEARING ON U.S. action. The Bank Administration FINANCIAL INSTITUTIONS, AND Institute was given as an exa m- FEDERAL REGULATORY ple of how industry groups could AGENCIES MANAGEMENT OF positively support the Y2K effort. THE YEAR 2000 COMPUTER As one panelist stated, the Year PROBLEM 2000 has the potential of falling prey to the tragedy of the co m- As a result of the letters sent by mons—it is everyone's problem, Senators D'Amato and Bennett in therefore few are willing to take February and April of 1997, the responsibility for it. heads of the six financial institution regulatory agencies were prepared · Businesses have a special r e- to address the concerns of the Su b- sponsibility to inform the public of committee. While the Office of Thrift their Y2K preparedness. Loss of Subervision (OTS) claimed it could faith by consumers in either the trace Y2K concerns back to thrift e x- soundness of their investments or aminations in 1994 and the Gove r- their financial service providers nors of the Federal Reserve Board could throw the economy into (FRB) pointed to the consolidation of turmoil even without major Y2K the FRB mainframe 5 years ago as disruptions. the beginning of the FRB's Y2K awareness, most agencies started

80 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM to actively engage the Y2K issue in tee warned that information held June 1996 in response to a Federal by regulators, and not appropr i- Financial Institutions Examination ately distributed to the public Council statement. This statement promptly, would increase the lik e- "strongly encouraged depository i n- lihood of panic. stitutions to complete an inventory of core computer functions and to set · The securities industry also d e- priorities for compliance changes, fended its current disclosure keeping in mind that laws, while suggesting testing should be INFORMATION NOT that individual underway for mission- APPROPRIATELY consumers and critical systems by DISTRIBUTED TO THE investors would most December 31, 1998." PUBLIC IN A TIMELY influence disclosure. Almost a year later, in MANNER WILL INCREASE Arthur Levitt, Jr. of the May 1997, FFIEC Securities and THE LIKELIHOOD OF issued a second Exchange Commission statement which PANIC. (SEC) claimed that provided some current laws in place guidance for banks and examiners were "sufficient at this time to on Y2K project management. A n- cover reporting obligations co n- other, more detailed guidance cerning any material impact of statement was issued in December the Year 2000 on operations or 1997. costs." Moreover, "market forces are such that there is no regul a- Highlights: tory action that would be as s e- vere as the reaction of the ma r- · While examination information is ketplace." confidential by law, the Subco m- mittee asked the regulators to · Senators Bennett and Dodd pr e- consider ways in which they sented the idea of "safe harbor" could disclose Y2K preparedness legislation that would encourage levels to the public. As a whole, institutions to focus on fixing the the regulators' opinion fell to the Y2K problem by offering some side of maintaining the status protection from Y2K liability for quo. Defining Y2K as a safety companies that demonstrate Y2K and soundness issue, regulators due diligence. The panel was argued that the examination r e- reluctant to comment on an u n- sults should remain confidential written bill, but generally ind i- in accordance with current law. cated that self-interest should be Financial institutions that fail to sufficient encouragement to a d- comply with Year 2000 regulatory dress Y2K problems. guidelines will be subject to fo r- mal enforcement actions which, While commending the agencies' e x- in contrast to examination r e- cellent Y2K efforts, the senators r e- ports, the regulators are required quested regular progress reports , to publish by law. The Commi t- especially to address certain

81 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

weaknesses identified in the hearing. damage awards in Y2K-related Two such areas were the under- cases amending the Copyright preparedness of small institutions Act to allow businesses to adapt and international institutions. Sen a- software without acquiring l i- tor Dodd also took the occasion to censes, and adapting a safe ha r- disagree with the SEC's view on di s- bor law which would provide closure, stating, "by the time the some liability protection upon the market reacts…we may have a businesses' good faith pursuit problem on our hands." and implementation of a Year 2000 remediation plan. OCTOBER 22, 1997: HEARING ON THE YEAR 2000 LIABILATY AND · It was reported that institutions DISCLOSURE are severely constrained from sharing Y2K-related information Continuing the debate on liability and and possible solutions due to l i- disclosure that started in the prev i- ability concerns. "They [bus i- ous hearing, the October 22 hearing nesses] are very concerned sought the perspective of a different about leaving a smoking gun in set of witnesses: two lawyers int i- the file where they may be seen mately involved in Y2K, the president as instructing another party as to of Information Technology Associ a- what it takes to interface with tion of America whose constituents their systems and, falling short, may have significant Y2K liability e x- they may have missed som e- posure, and a professional inves t- thing." (President of LaBoeuf ment analyst. The Chairman co n- Computing Technologies, Inc.) sidered the need to protect comp a- nies from excessive Y2K-related lit i- · Banks and insurance agencies gation, balanced with a concern that can pressure businesses to a d- public companies did not adequately dress Y2K issues by factoring disclose their Y2K efforts. The D i- Y2K preparedness into applic a- rector of the Division of Corporate tions for credit or insurance co v- Finance for the SEC was asked to erage. Banks have started to respond to this last criticism, esp e- consider Y2K risk in credit appl i- cially in light of Senate Bill 1518, cations, but have not yet disco v- which would require specific Y2K ered a solution for Y2K exposure disclosure for public co mpanies. in their loan portfolios. Due to a soft market, Property and Cas u- Highlights: alty insurers have been much slower to factor Y2K into insu r- · Corporations could face liability ance coverage. However, rei n- risks from a range of sources at surers are excluding Year 2000 an aggregate cost of $1 trillion. liability in their reinsurance tre a- The degree to which protection ties. from litigation may be needed or warranted is unclear. Sugge s- · The SEC reiterated its position tions included prohibiting punitive that current guidelines are

82 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

sufficient to compel Y2K discl o- necessary. In his testimony he sure, while acknowledging the stated, "The current disclosure sy s- need for further awareness. A c- tem simply will not provide policy- cording to the SEC represent a- makers with the information they tive, "[t]here appears to be a need as soon as possible to antic i- problem in the sense that we pate and to prepare for plausible aren't getting as many discl o- worst-case scenarios." sures as we would expect…there is a concern that companies may FEBRUARY 10, 1998: HEARING not understand that this is a n- ON FDIC’S YEAR 2000 other issue that's impacted by the PREPAREDNESS federal securities laws." The fifth hearing of the Subcommi t- The Chairman finished the hearing tee provided a public forum for e x- by informing the Subcommittee of amining the results of GAO's a s- the results of a GAO report asses s- sessment of the Federal Deposit I n- ing the National Credit Union Ass o- surance Corporation’s Y2K efforts. ciation (NCUA). The report, r e- While the report noted that the FDIC quested just after the previous hea r- had made significant strides in its ing, indicated that the NCUA was not Year 2000 project, it still lagged b e- as far along in its assessment of hind OMB and GAO guidelines. The Year 2000 compliance as the Office FDIC acknowledged its shortco m- of Management and Budget and ings and provided the Subcommittee GAO guidelines recommended. He with details regarding its ongoing encouraged the NCUA to accelerate and future Y2K efforts. The Su b- its Y2K activities, and warned the committee discussed the idea of a other regulatory agencies that GAO "drop dead" (i.e., shutdown) date for would visit them soon. noncompliant institutions and the need to provide customers with NOVEMBER 4, 1997: HEARING ON meaningful disclosure on their banks’ MANDATING YEAR 2000 Y2K readiness. DISCLOSURE BY PUBLICLY TRADED COMPANIES FEBRUARY 17, 1998: FIELD HEARING IMPLICATIONS OF THE The fourth hearing of the Subco m- YEAR 2000 COMPUTER PROBLEM mittee featured the testimony of E d- ward Yardeni, Chief Economist at Senator Dodd chaired the sixth Deutsch Morgan Grenfell. The hearing in Hartford, Connecticut to hearing was one of many steps illustrate the breadth and pervasiv e- taken to pressure public companies ness of the Y2K problem. Seven to provide greater Y2K disclosure. witnesses described their Y2K pr o- Yardeni, who gave an estimated grams and the implications for their 40% chance of a worldwide rece s- customers in a variety of areas, i n- sion in 2000 lasting at least 12 cluding banking, insurance, medical months, felt very strongly that a new, facilities and airway transportation. comprehensive disclosure law was Participants reaffirmed the inte r-

83 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM dependent nature of business and On June 10, 1998, Chairman encouraged consumers to ask their Bennett called the SEC back to the product and service providers about witness table to report on the pro g- their Y2K efforts. ress of its efforts to improve Y2K disclosure among publicly traded MARCH 18, 1998: HEARING ON corporations. After the introduction OFFICE OF THRIFT SUPERVISION of Senate Bill 1518, the Computer YEAR 2000 PREPAREDNESS Remediation and Shareholder (CRASH) Protection Act, the SEC The Subcommittee heard a positive requested the opportunity to address report from GAO on OTS's Y2K e f- the problem of disclosure on its own, forts, with particular praise directed without additional legislation. In the at OTS's internal systems work. The months that followed, the SEC a t- OTS was criticized for not having tempted to improve the quality of completed its conti n- disclosure by educating gency plans, and i g- THE SEC AND OTHER publicly traded comp a- noring the interrel a- EXPERT WITNESSES nies about their oblig a- tionships between its AGREED THAT WHILE THE tions under existing law. internal systems. QUANTITY OF Unfortunately, the SEC's However, the OTS DISCLOSURES IMPROVED, efforts were only mo d- had improved on erately successful. The THE QUALITY DID NOT. NCUA's and FDIC's SEC and other expert initial member a s- witnesses agreed that sessments, and therefore had a while the quantity of disclosure i m- better base from which to determine proved, the qua lity did not. its regulated entities’ preparedness levels. At the time, OTS estimated Highlights: less than 22% of its regulated ent i- ties "needed improvement" and · The SEC reiterated its commi t- around 1% were "unsatisfactory" in ment to improving Year 2000 di s- their Y2K efforts. closure. It promised to heighten its efforts by releasing specific During the course of the hearing the guidance on Y2K disclosure. Chairman asked whether the FFIEC This interpretive release "may had become a bottleneck for info r- form the basis of enforcement mation. Although the OTS repr e- action regarding their Year 2000 sentative hesitated to agree, she did issues," and "will remedy the a p- mention that the OTS would issue its parent misconception that costs own testing guidance in the following relating to fixing Year 2000 pro b- weeks, and contingency planning lems must be disclosed only if guidance toward the end of April. these costs are material. It will clarify that companies must d e- JUNE 10, 1998: HEARING ON termine materiality based on the DISCLOSING YEAR 2000 potential consequences of their READINESS failure to resolve their Year 2000 readiness."

84 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

themselves to Senator Kyl, who is · Supporting the need for better the Chairman of the Judiciary Su b- disclosure, Triaxsys Research committee on Technology, Terro r- provided the Subcommittee with ism, and Government Information for statistics from a survey of the further discussion. largest 250 publicly held comp a- nies. As of April 17, 1998, nearly JULY 6, 1998: FIELD HEARING IN half of these companies di s- ASSESSING THE YEAR 2000 closed no information, or so little PREPAREDNESS OF FOREIGN information that it was impossible COUNTRIES AND DETERMINING to glean anything meaningful JUST WHERE AND HOW THE about their Y2K progress. A n- UNITED STATES MAY BE other witness observed that the VULNERABLE Y2K disclosure of many instit u- tions looked as if lawyers had In this hearing, representatives from heavily edited them. "Clearly, the U.S. financial services arena corporations have vi o- confirmed that intern a- lated the SEC guideline tional preparedness requiring specifics rather CLEARLY, poses a real, but unqua n- than boilerplates." tified, risk to U.S. comp a- CORPORATIONS nies. Witnesses could HAVE VIOLATED · The Subcommittee di s- point to such international cussed the possibility of THE SEC efforts as the Joint Year changing the incentive GUIDELINES 2000 Council (sponsored structure so that comp a- REQUIRING jointly through the Basle nies would be biased t o- SPECIFICS RATHER Committee, the G-10 Central Bank Governors' ward the disclosure of THAN BOILER- information. Disince n- Committee on Payment PLATES. tives, such as the use of and Settlement Systems, disclosed information the International Associ a- against a company in litigation, tion of Insurance Supervisors, and abound. Tying limits on Y2K l i- the International Organization of S e- ability and litigation to disclosure curities Commissions), but little ta n- of information and efforts to fix a gible information was available. The company’s problem may be one few pieces that were available were way to neutralize the disince n- disheartening. Quoting a Moody's tives to disclose. investment report, one witness noted that 49 Japanese banks planned to Although not directly within the spend $249 million as a group on scope of the Subcommittee’s juri s- Y2K compliance. This amount is diction, the hearing finished with a only a fraction of Citicorp's planned debate on the pros and cons of pr o- $600 million program. viding liability protection to corporate boards and senior management. SEPTEMBER 17, 1998: HEARING The Chairman requested that the ON Y2K AND PENSIONS AND participating legal experts avail MUTUAL FUNDS

85 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

(CRASH) Protection Act of 1997, Since pension and mutual funds are was introduced on November 10, the primary vehicle through which 1997. Americans invest in the stock ma r- ket, the Committee held a hearing on S. 1671, the Examination Parity and fund managers' efforts to address Year 2000 Readiness for Financial the Year 2000 problem. The a t- Institutions Act, was introduced on tending pension and mutual fund February 24, 1998. company representatives reported that their internal systems were well S. 2000, was introduced on April 29, on their way to compliance. They 1998. also indicated that they were not i m- pressed with disclosure efforts made Regulatory Briefings by public companies. However, several witnesses conceded that At the second Subcommittee hearing many analysts as well as fund ma n- on July 30, 1997, Chairman Bennett agers had just started to include Y2K asked the six federal financial inst i- risk in their evaluation of stocks. tution regulatory agencies to report Additionally, they emphasized that back to the Subcommittee on a their position required an equal regular basis on the progress of Year evaluation of all risk. Chairman 2000 remediation in their own oper a- Bennett countered that the Commi t- tions and in the industry sectors they tee had no intention of asking an a- supervise. Since that time, the Su b- lysts to change their evaluation of committee has worked with the other risks. Instead, the Chairman House Banking Committee to esta b- warned that the failure to inform lish a regular schedule of quarterly stockholders of Y2K risks would r e- briefings. Each quarter, the regul a- sult in significant long-term risks. tory agencies file written reports with The Committee wanted to preserve the Subcommittee on their progress confidence in the market by ensuring and meet with Congressional staff to that analysts recognized Y2K as an respond to questions raised by the important risk. reports.

Legislation General Accounting Office Stu d- ies In the 105th Congress, Chairman Bennett introduced the following In August 1997, Chairman Bennett three pieces of legislation to further asked GAO to conduct an indepen d- the goals of Year 2000 readiness in ent review of the Year 2000 rem e- the financial services industry. D e- diation efforts at each of the six f i- tailed summaries of the bills are nancial institution regulatory age n- found in the Legislation section of cies. GAO has concluded several of this report. those reviews and has reported back to the Chairman. The results of S. 1518, the Year 2000 Computer those reviews are incorporated, as Remediation and Shareholder appropriate, in the "Assessment"

86 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM section of this report, as well as in meet the OMB's March 1999 impl e- the hearings where the GAO r e- mentation date for their mission- ported its findings. critical systems.

Correspondence and Industry Very few institutions should fail due Outreach to lack of Y2K planning. On-site e x- aminations performed by four of the Chairman Bennett maintains regular regulators (FRB, FDIC, Office of the contact with government officials and Comptroller of the Currency and industry representatives involved in OTS) resulted in approximately 95% the Year 2000 remedi a- of institutions surveyed OF THE INSTITUTIONS tion and risk manag e- receiving satisfactory ment processes. These EVALUATED UNDER ratings. Less than 1% contacts include both THAT SYSTEM, of institutions surveyed formal speeches and APPROXIMATELY 95% received an unsatisfa c- informal meetings. He RECEIVED tory rating. has written op-ed pieces SATISFACTORY for the New York Times, Smaller institutions are RATINGS. FEWER involved himself heavily more likely to lag in their in the Annual Confe r- THAN 1% OF preparations. NCUA, ence on Financial Ser v- INSTITUTIONS RECEIVED which regulates a di s- ices and Technology in AN UNSATISFACTORY proportionate amount of Utah, spoken with CEOs RATING smaller institutions, r e- of top technology firms ports a slightly larger at the Comdex convention, and a d- percentage of unsatisfactory instit u- dressed the National Press Club, tions. among other a ctivities. The Committee is pleased that the Subcommittee and Special Commi t- regulators are considering the needs tee staffs meet regularly with indu s- of consumers in their Y2K prepar a- try representatives to continually a s- tions. Besides an FFIEC release on sess progress in the se ctor. Year 2000 customer awareness pr o- grams, the FRB has planned to i n- crease the amount of currency either ASSESSMENTS in circulation or in Federal Reserve vaults by approximately 14% over Financial Institutions and Their current levels by the end of 1999. Regulatory Agencies This inflow of currency will permit f i- nancial institutions to provide the e x- Based on GAO reports and constant tra cash customers may demand contact with industry representatives, during the century roll over. the Committee feels comfortable with progress that regulators have made Financial institutions have started to in remediating and testing their inte r- evaluate the Year 2000 prepare d- nal systems. However, regulators ness of their material customers and must continue to push themselves to include Year 2000 preparedness

87 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM in their underwriting and loan review The Committee remains positive standards. This process is just b e- about these tests, although e x- ginning, however, and there are no panded testing is necessary to e n- reports of customers being rejected sure that more firms are Y2K ready. for loans or of loans being dow n- graded as a result of Year 2000 The SEC has made a commendable questions. The Committee will e n- effort to promote Year 2000 prepa r- courage the industry to pursue this edness within the securities industry analysis in the coming year. and keep investors informed. SEC initiatives include: The regulators need to develop plans for when and how they will · A frequently asked question deal with those institutions likely to sheet on the SEC's web site experience significant failures after containing a list of frequently the millennium date change. On e n- asked Y2K questions for inve s- couragement from the Chairman, tors. formal enforcement actions have been taken where appropriate. In · Numerous statements to publicly the case of the Putnam-Greene F i- traded companies, broker- nancial Corporation, the FDIC and dealers, and investment advisers FRB issued coordinated cease-and- to promote disclosure of Year desist orders citing inadequate Y2K 2000 information. (Available at preparations. Continued monitoring www.sec.gov.) is imperative. As a result of an early and vigorous The Securities Industry start, the securities industry is well positioned for the Year 2000. The securities industry has led the financial services sector in its Year Failures 2000 remediation efforts. The reality of information technology The securities industry scheduled is that glitches can occur without industry-wide testing in 1999, but in user discovery until well after the July 1998, the Securities Industry fact. A case in point is the recent Association (SIA) conducted a r e- failure of a data collection company hearsal or so-called "beta test." In for the financial services industry. testimony before the Special Co m- Portions of the firm’s database were mittee on September 17, 1998, Don processed using the old MS-DOS Kittell of the SIA reported that 28 s e- operating system. This was not Y2K curities firms participated in the test, compliant. When January 1999 along with 13 exchanges and s e- rolled around the system assumed lected utilities. The results of the “9” meant end of file, a common pr o- testing were generally positive and grammer protocol for older systems. the firms were able to process a Fund managers receiving this data complete cycle of trades over a encountered an array of N/As spri n- simulated millennium date change. kled throughout the data tables

88 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM that list financial metrics such as tual fund providers. Initiatives i n- cumulative return rates, 12-month clude the following: yields and price-to-book ratios. In fact these were indications that · PWBA published a pamphlet e n- January 1999 data were not i n- titled, “Fiduciary Questions and cluded. The benchmark S&P 500 in- Answers about the Year 2000.” dex was incorrect. Some customers (Available at 1-800-998-7542 or were not notified about the problem www.dol.gov/dol/pwba.) until three weeks later. If financial decisions were made based on i m- · The SEC has worked with the I n- precise data, then potential negative vestment Company Institute (ICI) consequences could have resulted. to monitor progress. An ICI su r- This example is an indication of the vey revealed that 80% of r e- kind of problems that can befall the sponding mutual fund companies financial industry where seemingly expected to finish internal rem e- trivial mistakes can have undesirable diation by year end 1998. consequences. However, considerably more effort is Retirement and Mutual Funds necessary to convince investment advisers from both groups that por t- Retirement and mutual funds, though folios should be examined for Y2K regulated by separate entities (the risk, and that Y2K risk should be di s- Pension and Welfare closed to underlying i n- Benefits Administration IN THIRD QUARTER vestors. (PWBA) and the SEC, RESULTS TABULATED BY respectively), face THE SEC, 10% OF An investment in a co m- similar Y2K problems. 15,000 COMPANIES pany that may not be Testimony before the Year 2000 compliant FAILED TO DISCLOSE Special Committee r e- could be detrimental to vealed that both THEIR YEAR 2000 plan participants and groups have focused COSTS. consequently expose more on preparing the plan fiduciary to l i- their own internal systems than ability. Therefore, the Special Co m- evaluating their external exp osure. mittee has urged all pension plans to evaluate their inves tments. Some pension and mutual fund plans have undertaken comprehe n- Publicly Traded Corporations sive Y2K-specific surveys of the companies in which they invest. The Committee is disappointed to However, many others have been report that despite substantial i m- slow to incorporate Y2K exposure provement in the number of public into their evaluation of inves tments. companies now mentioning Y2K in their SEC disclosures, very few The Committee recognizes that companies have provided the type of regulators have not been silent on meaningful disclosure necessary to the Y2K issue for pension and m u-

89 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

assess the potential impact of Y2K tions. U.S. firms operating around on their business. the world also must rely on tel e- communications and power services Having studied the problem, the in foreign countries in order to tran s- Committee agrees with economist act business. As a result, even if Edward Yardeni, who testified that U.S. financial services firms have the Year 2000 problem would have a converted their own systems su c- material impact on companies that cessfully, they still face enormous do not make adequate Y2K prepar a- international risk. Experts testifying tions. before the Subcommittee and Sp e- cial Committee consistently have While data suggests that many U.S. stressed that while there is much u n- companies, especially large corpor a- certainty about Year 2000 readiness tions, are working diligently to a d- around the world, one fact is clear — dress their Y2K issues, companies most foreign countries lag behind the appear to be avoiding Y2K discl o- U.S. in their conversion activities. sure by taking the position that either 1) Y2K will not have a material i m- Senator Bennett has urged financial pact on them, 2) it is too early to a s- services firms and their regulators to sess the possible impact of Y2K fai l- assess the Year 2000 situation of the ures, 3) such disclosure would reveal countries in which they operate and proprietary information and/or place to develop contingency plans to mit i- them at a disadvantage against gate the effects of failure in those competitors, or 4) their counsel had jurisdictions. The Special Committee advised them to share as little info r- also has asked the GAO to assess mation as possible while still co m- the Year 2000 situation abroad. plying with the letter of the law. That study is ongoing at this time.

Whether the situation will improve in Contingency Planning the remaining reporting periods r e- mains unclear. Failing to address With their remediation efforts on Y2K exposure could have a disa s- track, financial services companies trous effect on a company, and fu r- must now address the more complex ther pressure may be needed to en- issue of contingency planning. Firms sure that public companies disclose have been slow to address this issue that risk to investors. as a result of competing priorities and the lack of meaningful inform a- tion about the Year 2000 readiness CONCERNS of outside companies and other sectors. Nevertheless, financial International services firms and their regulators must plan for how they will maintain Financial services firms in the United their operations if unexpected fai l- States are linked closely to their ures occur. Financial services firms counterparts in other parts of the are particularly vulnerable to power world through electronic transa c- or telecommunications failures as

90 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM well as to the risk that a material systems, they are just beginning to customer or business partner will fail, assess and manage the risks attri b- as a result of the computer pro b- utable to third party relationships. lems, to meet its obligations. The Financial institutions must assess Special Committee plans to question the Year 2000 readiness of their financial services firms about their material customers in order to avoid contingency planning efforts in 1999. suffering major loan losses. Mutual funds and pension funds must co n- Disclosure sider the readiness of their portfolio companies in order to guard against Promoting meaningful disclosure of unnecessary and foreseeable losses companies' Year 2000 readiness has and shield themselves from the l i- been the cornerstone of Senator ability associated with those losses. Bennett's efforts. Without meanin g- The process of examining the Year ful disclosure, it is impossible for 2000 preparedness of third parties firms to properly assess their own has been hindered somewhat by the risks and develop necessary conti n- lack of substantive disclosure. The gency plans. Disclosure is also i m- SEC's Interpretive Ruling and the portant in the context of congre s- passage of the Information Read i- sional oversight. The Special Co m- ness and Disclosure Act should mittee will continue to promote this make the information necessary for important goal in 1999. such an analysis more avai lable.

Cost Security

According to disclosure reports filed Financial service providers have by financial services firms in recent shipped massive quantities of code months, the costs of Year 2000 to overseas correcting facilities. In compliance are rising. Most comp a- the process, core legacy systems nies have found that while the cost of have been mapped and doc u- remediation has flattened out, the mented. This brings some real costs of contingency planning e x- benefit to institutions that may have ceed their estimates. Based on otherwise been ignorant of the inner these results, it is possible that the workings of their own systems. U n- cost of remediation could have a fortunately, it also provides the o p- negative impact on earnings in the portunity for unscrupulous individuals financial services sector. D e- to learn about the inner workings of pressed earnings in the financial corporations’ security systems. services sector could adversely i m- pact the U.S. economy. Additionally, the Committee is co n- cerned about the potential for code Third Party Relationships tampering during the remediation process. A British computer society While financial services companies claims that some code returned from lead many other industries in the overseas processing already has conversion and testing of their own been found to contain “trap

91 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM doors,” or secret electronic entry once the unsuspecting company is points into a computer system. Trap running on its new, “cleaned” data. doors could be implanted by pr o- grammers during Y2K remediation and then accessed at a later date,

92 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

GENERAL GOVERNMENT

swering Points (PSAP), are highly automated, particularly in the case of EMERGENCY enhanced 911 systems. Enhanced PREPAREDNESS 911 systems are those which automatically provide the caller's location Overview and phone number to the 911 op- erator. According to the FCC, the When an individual is confronted by Association of Public Safety Com- a personal emergency in the United munications Officials (APCO) has States, he or she can be confident identified 50 pieces of equipment that any 911 call for assistance will within a PSAP that have Y2K vulner- be answered promptly, and that a abilities. There are approximately competent authority will respond 4,500 PSAPs located throughout the rapidly. Y2K presents two essential United States. threats to our emergency service Modern emergency and disaster pre- “THERE ARE THINGS THAT CAN dispatch facilities paredness agen- SPAWN PANIC AND PANIC often incorporate cies. First, it DOESN’T HELP PREPARATION. sophisticated threatens to inter- WE NEED TO PREPARE, NOT Computer-Aided rupt the ability to PANIC.” Dispatch (CAD) properly process systems into their and respond to operations. CAD calls for assis- SENATOR GORDON SMITH systems provide tance. This threat important benefits is present at all to public safety levels, from the potential interruption communication systems, including: to a citizen’s call for fire or police assistance to delays in a state’s ability · improved call-taking service to to request emergency or disaster as- the public, sistance from the federal govern- · provision of greater accuracy, ef- ment. Second, due to lack of expe- ficiency, and speed in responding rience with anything like the possible to calls for service, affects of the disruptions we may · enhanced officer safety by pro- face, it presents a novel challenge to viding detailed information on call those who must devise Y2K emer- locations, and gency response strategies unlike · increased officer productivity and those they have formulated in the resource management and provi- past. sion of additional system capacity due to growth or crisis. Most 911 emergency dispatch centers, known as Public Safety An-

93 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

CAD systems are especially vulnerable to Year 2000 problems due The Federal Bureau of Investigation to the fact that they perform time and (FBI) is responsible for the admini- date calculations on the time an ini- stration of NCIC and has assured the tial call for assistance was received, Committee staff that this system will when a unit was dispatched, the time fully meet its Year 2000 challenge, that it arrived and how long it took to successfully maintaining its links to resolve the emergency. These sys- the systems of all 50 states. The tems are in widespread use in all ar- challenge for local law enforcement eas of local emergency service, in- agencies is to be sure that their own cluding police, fire and emergency links to NCIC and NLETS via state medical services (EMS). maintained connections and any other similar systems operated on a Sophisticated information technology regional or agency-wide level are systems serve as important tools for compliant and compatible with the emergency service agencies today, larger systems. Also, at the local particularly for law enforcement. agency level, there often is a great Systems such as the National Crime deal of "interconnectivity” between Information Center (NCIC), the Na- the emergency service department's tional Law Enforcement Telecom- systems and those of other city munications System (NLETS), agencies, such as the court system, Automated Fingerprint Identification the corrections department, and Systems (AFIS) and individual crimi- even local utility companies, thereby nal information data systems oper- increasing the potential for Y2K-re- ated individually by all 50 states en- lated problems in this area. able officers to obtain the most up- to-date information on wanted per- As is true in other areas, Y2K's pres- sons, stolen vehicles, criminal histo- ence is insidious in the area of ries, and department of motor vehi- emergency services. One major cle records. The ability to access police department related to the this information dependably and Committee staff that its city's gov- quickly is essential both to officer ernment was required to remediate safety and to the speedy and effec- its gasoline pumps in order to ensure tive administration of justice at all that gasoline would continue to flow levels. A recent survey conducted to its patrol cars on January 1, 2000. on the effectiveness of NCIC indi- This problem had the potential to cates that during a one year period, affect the entire fleet of city govern- 81,750 wanted persons were found, ment-owned vehicles. In this par- 113,293 individuals were arrested, ticular case, the computerized gaso- 39,268 missing juveniles and 8,549 line pumps perform a time and date missing adults were located and calculation based upon the last time 110,681 stolen cars valued at over a particular gas credit card was used $570 million were recovered as a re- to fuel a vehicle and therefore the sult of NCIC's use. pumps were Y2K vulnerable.

94 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

emergency management organiza- In another case, the sheriff of a large tions, volunteer organizations and a western county related that his de- coordinated network of federal re- partment was currently examining its sources available when state and computerized detention files which local resources are exhausted or track in and out time of inmates at overrun. The Y2K problem bears the the county jail facility and hearing potential to affect all layers and sec- date information for inmates. Addi- tions of this safety net. In the event tionally, a consultant specializing in of serious Y2K-related disruptions, Y2K public safety problems provided many of the organizations that com- the Committee staff with a list of over prise the safety net will be called 35 items of technical equipment upon to respond. commonly used in law enforcement According to the Bureau of Justice that could potentially be vulnerable Statistics, there are over 17,000 po- to embedded chip problems. These lice and sheriffs departments in the items included patrol car mounted U.S. The International Association video equipment, mobile data sys- of Fire Chiefs estimates that there tems and electronic prisoner moni- are 32,000 fire departments in this toring devices used in home deten- country. Additionally, approximately tion and probation. 65 % of our country's EMS agencies reside within the organizational In addition to the technical aspect of structure of our nation's fire depart- Y2K vulnerabilities, emergency ments. service departments must also consider the possibility that January 1, Statistics provided by the National 2000, may bring with it an enormous Emergency Number Association in- increase in the demand for their dicate that over 300,000 911 emer- services, depending on the degree of gency calls are placed in this country disruption experienced. This must daily. (Approximately 110 million be considered as part of Year 2000 calls for emergency assistance per emergency planning at the state, year). An additional 83,000 calls for county, and local levels of govern- emergency assistance are placed via ment. cellular phones. Ninety percent of the U.S. population is covered by U.S. Emergency Services Struc- 911 service. ture Each of the 50 states and U.S. terri- The U.S. emergency service and tories encompass an emergency disaster response sector is a multi- management department headed by layered safety net consisting of local, a state emergency manager. The county, and state police depart- governors in each respective state ments, local and county fire depart- appoint many of these managers. ments, emergency medical service The emergency manager serves as agencies, local, county, and state the chief disaster preparedness and

95 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

response coordinator in the state. The Federal Emergency Manage- Twenty-four states and one U.S. ter- ment Agency (FEMA) was estab- ritory are currently signatories to the lished in June 1979 by President Emergency Management Assistance Carter to improve the responsive- Compact. The Compact provides for ness of the federal government to mutual assistance between the catastrophes in the United States. states in managing any disaster or FEMA provides financial and techni- emergency that is duly declared by cal assistance to states and localities the governor of the affected state, overwhelmed by disasters. FEMA whether arising from natural disaster, administers policies related to emer- technological hazard, man-made gency management and planning, disaster, resource shortages, com- evacuation, and matters associated munity disorders, insurgency or en- with civil defense, disaster relief, fire emy attack. This compact also pro- prevention, earthquake hazard re- vides for mutual cooperation in duction, emergency broadcasting emergency-related exercises, test- services, flood insurance, mitigation ing, or other training activities. While programs and dam safety. The prin- on its face it would appear that this cipal federal authority for the provi- compact would hold the promise of sion of disaster relief is the Robert T. being well-suited to address the Stafford Disaster Relief and Emer- many problems that may arise from gency Assistance Act (the Stafford the Year 2000 problem, discussions Act). The act authorizes the Presi- with a number of emergency man- dent to issue major disaster or agers reveals otherwise. During her emergency declarations, sets out testimony before the Committee on eligibility criteria and specifies the October 2, 1998, Ms. Ellen Gordon, types of assistance the President President of the National Emergency may authorize. Aid is provided to Managers Association (NEMA), ex- meet urgent housing needs, pur- plained that mutual aid between the chase necessary personal items and states might not be possible in the obtain legal services needed as a event that all states are affected in a result of disasters. Aid is provided to significant manner. state and local governments and non-profit organizations to repair or Individual states might not be able to reconstruct damaged or destroyed spare limited resources or be in a infrastructure, remove debris and to position to lend other mutual aid. construct protective measures. In One state emergency manager told addition to the assistance provided Committee staff that he would be by the Stafford Act, federal disaster hesitant to release any of his own assistance is also provided by other resources to another state because federal agencies (see description of of the degree of uncertainty about the Federal Plan). potential Y2K disruptions.

96 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

The Federal Response Plan1 ESF #2 - Communication: U.S. National Communications System The Federal Response Plan (the Stafford Act) established the author- ESF #3 - Public Works and Engi- ity for the federal government to re- neering: U.S. Department of De- spond to disasters and emergencies fense in order to provide assistance to save lives and protect public health, ESF #4 - Firefighting: U.S. De- safety, and property. It is applicable partment of Agriculture to natural disasters such as earth- quakes, hurricanes, typhoons, torna- ESF #5 - Information and Plan- does and volcanic eruptions; tech- ning: FEMA nological emergencies involving ra- diological or hazardous material re- ESF #6 - Mass Care: American leases; and other incidents requiring Red Cross federal assistance. ESF #7 - Resource Support: The Plan establishes the architecture General Services Administration for a systematic, coordinated and effective federal response to disas- ESF #8 - Health and Medical ters or other emergencies. It con- Services: U.S. Department of Health centrates the provision of federal as- Human Services sistance a state is most likely to need under 12 Emergency Support ESF #9 - Urban Search and Res- Functions (ESF). Each ESF is cue : U.S. Department of Defense headed by a primary agency, which has been selected based on its ESF #10 - Hazardous Materials: authorities, resources, and capabili- Environmental Protection Agency ties. The 12 ESFs are the primary mechanism through which federal ESF #11 - Food: U.S. Department response assistance is provided to of Agriculture the affected state. ESF #12 - Energy: U.S. Depart- Emergency Support Functions ment of Energy

ESF #1 - Transportation: U.S. The Plan describes federal actions to Department of Transportation be taken in providing immediate response assistance to one or more

1Public Law 93-288 was amended by Public Law 100-707 and retitled as the Robert T. Stafford Disaster Relief and Emergency As- sistance Act (Public Law 93-288, as amended).

97 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

affected states.2 Response assis- federal law enforcement assistance tance includes those actions and ac- from the U.S. Attorney General. If tivities which support state and local the request is approved, federal law government efforts to save lives, enforcement assistance may be pro- protect public health and safety, and vided to include equipment, training, protect property. In some instances, intelligence or personnel. a disaster or emergency may result in a situation that affects the national Our national security is dependent security of the United States. In upon our ability to assure continuity those instances, other national secu- of government, at every level, in any rity authorities and procedures could national security emergency situation be used. that might confront the nation. Ex- ecutive Order 12656, the Assign- Each state has general responsibility ment of Emergency Preparedness for law enforcement, using local and Responsibilities, broadly outlines the state resources, including the Na- role of FEMA’s director and the Na- tional Guard. In some cases, a state tional Security Council in response to government may experience a law national security emergencies. Ex- enforcement emergency (including ecutive Order 12656 defines a na- one in connection with a disaster or tional security emergency as “any emergency) in which it is unable to occurrence, including natural disas- adequately respond. For example, it ter, military attack, technological may be an uncommon situation that emergency or other emergency, that requires law enforcement assis- seriously degrades or seriously tance, one that is or threatens to be- threatens the national security of the come of serious or epidemic United States.” It establishes the (large-scale) proportions, and one in role of the President in national se- which state and local resources are curity emergency preparedness. inadequate to protect lives and prop- Pursuant to the President's direction, erty of citizens or to enforce the the National Security Council is re- criminal law. In the event such a law sponsible for developing and admin- enforcement emergency exists istering our national security policy. throughout a state or part of a state (on behalf of itself or a local unit of Our national security policy dic- government), the governor may, in tates that all national security accordance with the Federal Re- emergency preparedness activi- sponse Plan, request emergency ties shall be consistent with the Constitution and laws of the United States and with preserva- 2 Under the Plan, a State means any State of the tion of the constitutional govern- United States, the District of Columbia, Puerto Rico, Virgin Islands, Guam, American Samoa, ment of the United States. Trust Territory of the Pacific Islands, Common- wealth of the Northern Mariana Islands, Feder- Effective national security emer- ated States of Micronesia, or Republic of the Marshall Islands. gency preparedness planning re-

98 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

quires identification of the functions nation’s commitment to democracy that would have to be performed and our own constitutional system of during such an emergency, devel- government, which is grounded in opment of plans for performing these the rule of law. functions and development of the capability to execute those plans. As the aforementioned information illustrates, a well coordinated, pre- Executive Order 12656 establishes existing network exists through that the director of FEMA shall serve which appropriate emergency or disas an adviser to the National Secu- aster assistance may be rendered rity Council on issues of national se- from the federal government down curity emergency preparedness, in- through the states and local govern- cluding mobilization preparedness, ments when the states request such civil defense, continuity of govern- assistance. Such assistance is ren- ment, technological disasters, and dered within the context of existing other issues, as appropriate. It also legal authority, and in accordance states that the director of FEMA also with pre-existing structures as previ- shall assist in the implementation of ously described. The Committee national security emergency prepar- strongly believes the emergency and edness policy by coordinating with disaster response structures as de- the other federal departments and scribed within this report to be the agencies and with state and local appropriate mechanism through governments, and by providing peri- which any necessary federal re- odic reports to the National Security sponse to Y2K-related disruptions Council. would be provided.

The public has voiced its concern to Major Initiatives the Committee regarding the role that the federal government will play On October 2, 1998, the Committee in responding to Y2K-related emer- held a hearing to assess the Year gencies. Numerous misguided ru- 2000 readiness of government at the mors and outright falsehoods are federal, state, and local level to con- being circulated in some quarters on tinue to provide without interruption the Internet about the possibility that vital emergency services, such as “martial law” will somehow be de- police, fire and emergency medical clared by the federal government in services. The Committee also in- response to Y2K emergencies. quired into the ability of emergency These rumors and falsehoods will response personnel to respond to serve only to incite unwarranted potential Year 2000-related disrup- public panic and to needlessly tions, such as interruptions or heighten public fear and misunder- anomalies in the utility, communica- standing about the Y2K problem. tions and transportation sectors. Such irresponsible and reckless speculation has no basis in fact, and The hearing examined the role of it disregards the long history of our FEMA in coordinating the execu-

99 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

tion of the Federal Response Plan, tend to increase Y2K awareness, and the role the Plan could play in and other communications on mounting a federal response to po- Y2K such as letters, public no- tential Y2K-related interruptions. tices, web site information, and Also, it explored the extent to which brochures. FEMA plans to post FEMA has considered potential Year this information on its web page. 2000 disruptions as events that might require a coordinated federal · The United States Fire Admini- response. stration, which reports to FEMA, has initiated a multi-phased plan The hearing examined the state of to raise awareness and assess FEMA's readiness to carry out its readiness on the Y2K technology mandate under the Stafford Act in problem. The Fire Administration light of the Year 2000 problem and staff issued a suggested article focused on FEMA's outreach to the for the fire and emergency serv- state emergency preparedness ices publications on Y2K prepar- agencies and non-governmental or- edness, and FEMA has devel- ganizations that help respond to dis- oped a list of frequently asked asters. questions about Y2K in a Y2K brochure. FEMA has distributed Lacy Suiter, Executive Associate Di- the brochure to participants in the rector of FEMA’s Response and Re- National Fire Academy, major fire covery Directorate, provided testi- service organizations, and state mony about the state of FEMA’s in- fire marshals. FEMA is in the ternal Y2K preparedness, its out- process of conducting a direct reach to state and local emergency mailing of the brochure to ap- management and emergency serv- proximately 32,000 individual fire ices agencies, and FEMA’s plans to departments nationwide. FEMA coordinate the federal response to has also distributed materials to Y2K-induced emergencies. associations of fire and emergency service equipment manu- FEMA’s other Y2K initiatives, as de- facturers and distributors re- scribed both in Mr. Suiter’s written questing information on actions statement and testimony before this their members are taking to en- Committee are summarized as fol- sure that their products are Y2K lows: compliant.

· FEMA is working with other · FEMA is pursuing outreach ac- agencies in the emergency serv- tivities with state and local gov- ices sector to develop an out- ernments through the National reach plan that will include Emergency Management Asso- meetings on Y2K convened by ciation (NEMA) and the Interna- federal agencies, outside meet- tional Association of Emergency ings that federal officials will at- Managers (IAEM). The focus has

100 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

been to heighten awareness of pate in Y2K preparedness activi- state and local government about ties. the seriousness of the problem and to provide Y2K emergency · FEMA is in the process of plan- preparedness guidance and in- ning a series of regional “table- formation. top” exercises to ascertain the needs of the states resulting from · NEMA has identified Y2K as a a Y2K-related emergency. priority area and has initiated a Y2K dialogue with its members. · FEMA will coordinate a nation- NEMA has assigned its Prepar- wide “table top” exercise some edness, Training, and Exercises time in the spring of 1999 to con- Committee to review and coordi- duct an operational simulation of nate efforts with FEMA. FEMA is its response to a Y2K emer- working in partnership with gency. NEMA, IAEM and other organizations to develop preparedness · FEMA is hosting monthly meet- guidance for the entire emer- ings with primary Federal Re- gency preparedness community. sponse Plan agencies to monitor progress on the Y2K compliance · FEMA’s regional directors have status of the 12 emergency sup- been asked to contact the state port functions. emergency management directors in their region to reinforce the · FEMA is developing a “Y2K Sup- importance of preparedness and plement” to the Federal Re- compliance at the state level, to sponse Plan based on input from emphasize the necessity of state the Federal Response Plan outreach to local governments, agencies and their regional and to help identify areas where counterparts. Assessments from additional assistance is needed. the emergency services sector and the President’s Council on · FEMA’s Emergency Management Y2K conversion will influence the Institute has incorporated a “Y2K composition of the supplement. Show-of-Hands Survey” to gauge FEMA plans to publish the sup- the level of Y2K awareness of its plement by July 1, 1999. The participants. supplement will include a basic plan and annexes for each of the · In November 1998, FEMA’s as- emergency support functions. sociate director for preparedness, training, and exercises addressed Beginning in July 1998, the Com- the IAEM 46th Annual Conference mittee staff began discussions with in Norfolk, Virginia, to urge local FEMA to determine what authority emergency managers to partici- the federal government would have to act in case of serious Y2K disrup-

101 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

tions, and how FEMA specifically ensure that requests for such aid plans to respond in the event that from state and local governments such disruptions do occur. In his are channeled to the appropriate testimony, Mr. Suiter emphasized public/private coordination entities that FEMA programs represent a established by the President’s Coun- “bottoms up” approach in which fed- cil on Y2K Conversion. FEMA cur- eral response comes “by invitation rently has no plans to pre-position only,” upon a specific request from resources prior to January 1, 2000, the governor of an individual state, in but will activate the interagency response to specific and identifiable Emergency Support Team at FEMA emergencies and disasters. This headquarters and its 10 interagency response is requested by and coor- Regional Operations Centers, begin- dinated through the governor, and ning on December 29, 1999, and never independently by the federal continuing through January 4, 2000. government. This fact is in stark FEMA will also place on alert its contrast to some of the reckless as- Emergency Response Support De- sertions appearing on the Internet, tachments during that time. claiming that Y2K events would serve as an “excuse” for a massive Other Y2k Emergency Services marshaling of federal forces or the Initiatives suspension of civil legal authority to deal with possible disruptions. During the summer of 1998, Federal Communications Commission Com- Sufficient legal authority currently missioner Michael Powell began exists under the Stafford Act to allow playing a very active role in promot- federal resources to be utilized in re- ing awareness about potential Y2K- sponse to a Y2K-related disruption if, related communications problems in upon application from a state’s gov- the public safety community. Com- ernor, an “emergency declaration” is missioner Powell authored an article made by the President of the United entitled “Protecting Public Safety States. While FEMA has no author- Communications from the Year 2000 ity to respond to the causes of Y2K Bug,” which was published in the disruptions or to provide technical bulletin of the Association of Public assistance for “Y2K fixes,” it can re- Safety Communications Officers In- spond to the physical consequences ternational. In June, the FCC held a of Y2K disruptions if they constitute a public safety roundtable which at- threat to lives, property, public health tracted many experts in the field of and safety pursuant to the Presi- public safety communications. Dur- dent’s “emergency declaration.” ing the International Association of Chiefs of Police (IACP) Conference Although FEMA cannot respond to held in Salt Lake City October 17-22, requests for technology support, it 1998, John Clark, FCC deputy chief could use the federal response sys- for public safety in the Wireless tem to provide a backup network to Telecommunications Bureau, ad-

102 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

dressed the major city police chiefs special needs of agency employees on Y2K issues. On November 16, during the time of impact. 1998, the FCC sponsored a forum entitled “Year 2000: Maintaining During its August 1998 conference in Emergency Response Communica- Albuquerque, New Mexico, APCO tions.” The goal of the forum was to conducted Y2K seminars to address examine the implications of the Y2K the broad array of issues confronting problem for various segments of the public safety agencies. The IACP emergency response communica- Communications and Technology tions system. Committee included Y2K on its agenda at the IACP conference this The State of Texas sponsored a 2- year. day national conference on October 15 and 16, 1998, for correctional fa- First Alert System cilities, law enforcement, and emergency services on the topic of the In preparing for the October 2, 1998 Year 2000 and embedded systems. Hearing on General Govern- ment/Emergency Services, the In his written statement to the Com- Committee staff formulated the con- mittee, Sergeant John Powell, Uni- cept of a Year 2000 problem early- versity of California Police Depart- warning system dubbed the “Y2K ment, Berkeley, California, detailed First Alert.” Similar to the National several initiatives that the Associa- Weather Service’s storm warning tion of Public Safety Communica- and monitoring system, the Y2K First tions Officials International (APCO) Alert would provide American citi- and the IACP are conducting on zens with the earliest possible Y2K. warning of Y2K events that may threaten public safety or national in- Sergeant Powell reported that APCO frastructure. Senators Bennett, and the National Institute of Justice Dodd, and Collins jointly expressed were discussing the development of their support for the development of a series of short Y2K seminars tar- this concept during the opening re- geted at public safety chief officers marks of the October 2, 1998 hear- and upper-level management to ad- ing. dress four key Y2K impact areas. These areas are internal systems; First Alert would give citizens of the potential disruption of outside serv- eastern United States up to 17 hours ices such as power, 911 service, and advanced warning of the effects of supply chain interruptions; the addi- the Year 2000. Other Americans will tional workload that could confront have proportionately more warning agencies due to heightened fears the farther west they live. For exam- about the problem and the advent of ple, citizens in Utah will have up to the actual problem itself; and the 19 hours of advanced notice while citizens of Hawaii and some citizens

103 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

of Alaska will have almost a full day's The Committee believes it is impera- notice. This system would be most tive to use this advance notice that useful for problems that occur at or the United States has for the good of very near midnight, December 31, the nation. For instance, it would be 1999, which could be referred to as very useful to know that utility and Y2K "prompt effects." These effects transportation problems are likely to could occur in embedded systems in occur based on our Y2K First Alert utilities, transportation, telecommuni- system before large segments of the cations and other applications that population are away from their had not been repaired. They could homes celebrating on New Year's also occur in mainframe or informa- Eve. The Committee has called for tion technology systems that serve a the government to implement this control or supervisory role that had concept by coordinating the re- not been fixed. When the century sources of the Departments of State change occurs, a Y2K prompt effect and Defense as well as other de- may very quickly cause problems partments and federal agencies that that might lead to some disruption of have resources and expertise to an important service. contribute to the system.

The Y2K First Alert concept is feasi- Since the Committee issued its call ble because of the arrangement of on October 2, 1998 several parties international time zones. A new day have acted. FEMA has begun ex- begins in the middle of the Pacific ploring the implementation of the Ocean, 17 time zones earlier than concept. The telecommunications Eastern Standard Time in the United industry has begun developing a States. If the Y2K bug is potent similar, private-sector concept enough to cause immediate prob- named "Follow the Sun," and it now lems or “prompt effects” in informa- appears that the U.S. Air Force is tion systems and embedded chips, pursing a related concept to meet its the effect will not occur worldwide all mission needs. Finally, the Cana- at once. Rather, the problems will dian government announced in happen repeatedly in one time zone January 1999 that it plans to imple- after another for one full day. For ment a similar concept. example, Y2K problems that occur at precisely 12:00 a.m. on January 1, Assessments 2000, in Wellington, New Zealand, are occurring while it is still only 7:00 In accordance with the President’s a.m. on December 31, 1999 in the Council on the Year 2000 outreach eastern United States. Systems and program, the U.S. Fire Administra- technology vulnerable to Y2K prompt tion has been charged with monitor- effects in the eastern United States ing the progress of the fire response will not be affected for another 17 agencies. Outreach to the law en- hours by the century rollover. forcement sector of public safety has been assigned to the Department of

104 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Justice. other criminal justice agencies. These agencies have a broad range While there was a high level of Y2K of contact with criminal justice and awareness among the limited num- law enforcement organizations at the ber of representatives of individual state and local level of government emergency service agencies con- and bear the potential to make a tacted by the Committee staff in positive impact on the Y2K problem preparation for the October 2, 1998, in the emergency service sector. As hearing, the major emergency serv- the available survey data indicates, ice professional associations were there is a startling lack of prepared- just beginning to coordinate Y2K ness at the state and local levels of awareness programs. During her government. All efforts to alleviate opening remarks to the International this problem should be pursued. Association of Chiefs of Police Con- ference in Salt Lake City, Utah, in Almost all of the command-level October 1998, Attorney General emergency service personnel con- Janet Reno made no mention of tacted by the Committee staff ex- Y2K. Some federal agencies that pressed serious concerns about a have regular contact with state and perceived lack of Y2k awareness on local criminal justice agencies were the part of emergency service agen- just beginning to promote awareness cies in general. To date, there has about the Y2K problem among the been no known large scale attempt state and local agencies. The Na- to gather any meaningful survey data tional Institute of Justice and the Bu- to measure the overall level of reau of Justice Assistance reported awareness or preparedness of this no specific or focused Y2K initiatives vital sector. in progress as of the October 2, 1998, hearing. The National Institute Concerns of Justice reported that it was in the process of developing a Y2K aware- While it is clear that an effective ness bulletin, and that it had incorpo- mechanism exists at the federal level rated a Y2K compliance stipulation to coordinate resources in the event into its grant agreements with state of Y2K related emergencies or dis- and local agencies. ruptions, there is still concern about the Y2K awareness and prepared- As part of the Justice Department ness levels of emergency service charged with outreach to the law providers at the county and local enforcement community under the levels. The strong leadership role President’s Council, both the Na- that FEMA has recently assumed in tional Institute of Justice and the Bu- the area of Y2K emergency prepar- reau of Justice Assistance could be edness should have a positive im- playing a more active role in pact on the state and local emer- spreading Y2K awareness among gency management network and state and local law enforcement and hence on the nation’s overall ability

105 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

to respond adequately to Y2K- the possible increase in public fear related emergencies. The overall toward the end of 1999. Of great Y2K preparedness status of state concern to the Committee is the and local emergency service agen- need for effective dissemination of cies remains unknown, as does the credible information to the general extent to which these agencies have public about the expected level of considered Y2K as an event for severity of Y2K disruptions. Gov- which they must creatively plan. ernments at all levels must work constantly over the next year to ob- In his testimony before the Commit- tain accurate information in order to tee, Mr. Bob Cass, city manager of dispel irrational and unwarranted Lubbock, Texas, described the Y2K fears about the potential impact of emergency simulation exercise that Y2K disruptions. Lubbock had conducted just 2 days prior to the date of the Senate hear- FEDERAL AGENCIES ing. This exercise gained major nationwide media attention and served as an excellent example of the type Overview of emergency planning activity that local, county and state governments On the whole, federal agencies have should replicate. Bruce Romer, been slow out of the gate in the race Chief Administrative Officer of Mont- to cross the finish line for Y2K ef- gomery County, Maryland, also testi- forts. In this race, even though one fied about Montgomery County’s agency or another may at times lead plans to conduct a similar exercise in the pack, all agencies must cross the December 1998. Mr. Romer has finish line together in a tie. As the stated to the Committee staff that race enters the home stretch, agen- Montgomery County plans to acti- cies must pick up the pace and vate its Emergency Operations sense of urgency. Although much Center prior to December 31, 1999, progress has been made this year, and said that in the event of a Y2K the home stretch of this course is emergency, he “doesn’t want to be daunting. looking around for people they will need.” Both Lubbock, Texas and As expected, those that started the Montgomery County, Maryland rep- earliest generally lead the pack. The resent model cases of effective Y2K Social Security Administration and emergency preparation. Small Business Administration are notable agencies in front that started In his written statement to the Com- in the late 1980s. Considering the mittee, Sergeant Powell emphasized lead these agencies have over those the difficulty of accommodating the that started in 1996, one can only additional demand for emergency conclude that late starters face a services that may accompany the formidable task. The most notable century date change, due in part to agencies that have found themselves in that unenviable posi-

106 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

tion include the Departments of En- · The first guide, Year 2000 Com- ergy, Defense, and Health and Hu- puting Crisis: An Assessment man Services. Guide, was published in Septem- ber 1997. This guide walks step- All federal agencies are addressing by-step through the five-phase the problem via a five-phased proc- process and provides a program ess: awareness, assessment, reno- assessment checklist. vation, validation, and implementation. The next milestone occurs in · An exposure draft of the Year January 1999 when agencies should 2000 Computing Crisis: A Testing complete the validation phase. The Guide was released in June 1998 last milestone, completion of imple- and was published in November mentation, occurs in March 1999. 1998. This guide provides a Y2K Due the tremendous scope and per- testing step-by-step framework. vasiveness of potential Y2K prob- As with the conversion model de- lems, federal agencies have man- scribed in the first guide, the test aged the problem through a triage model consists of five steps: process. They have identified those testing infrastructure, software systems that are ‘mission-critical’ to unit testing, software integration their ability to perform core capabili- testing, system acceptance test- ties. This triage process is decep- ing and end-to-end testing. tively complicated due to the interconnectedness of today’s systems. · The final guide in the series, Year The total effort comes down to risk 2000 Computing Crisis: Business management, mitigation, and avoid- Continuity and Contingency ance. Planning, was published in August 1998. This guide recog- Although agencies are focused on nizes that not all systems will be mission-critical systems, many other fully remediated through the five- systems are too important to be phase process before there is a completely ignored. These systems Y2K impact. Additionally, as al- are being tracked and actively ways, the unexpected and unan- worked on at a lower priority, ac- ticipated must be planned for cording to agencies’ reports. even when systems have completed all five phases of remedia- Initiatives tion. An excerpt from the guide notes, “Every federal agency General Accounting Office must ensure the continuity of its core business processes by GAO has developed and published identifying, assessing, managing three guides that address the Y2K and mitigating its Year 2000 problem. These guides are available at www.gao.gov/y2kr.htm. A short risks. This effort should not be limited to the risks posed by Year description of each follows: 2000-induced failures of internal information systems, but

107 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

must include the potential Year lease of any of its $1.1 billion emer- 2000 failures of others, including gency funds for Y2K. business partners and infrastructure service providers.” The House Committee on Government structure described in this guide Reform‘s Subcommittee on Govern- covers four phases: initiation, ment Management, Information, and business impact analysis, contin- Technology and the House Com- gency planning and testing. mittee on Science’s Subcommittee on Technology Emergency Supplemental Funding During the 104th Congress, the Included in the Omnibus Consoli- House held the first hearings to re- dated and Emergency Supplemental view and investigate the federal gov- Appropriations Act, 1999, Public Law ernment’s preparedness for Y2K. Its 105-277, were provisions for $2.25 efforts have provided critical over- billion for non-defense agencies and sight and stimulation of agency ef- activities. The Department of De- forts. To have the broadest impact fense received a separate allocation possible, both Senators Bennett and of $1.1 billion. These monies are to Dodd consciously narrowed our remain available until September 30, Committee’s primary focus to con- 2001. The purpose of these funds is centrate on the private sector and to provide for expenses necessary to those federal agencies that provide a ensure that the information technol- service to crosscutting segments of ogy that is used or acquired by the the private sector. Detailed informa- federal government meets the definition on Representatives Horn’s and tion of Year 2000 compliant and to Morella’s activities is found at meet other criteria for Year 2000 www.house.gov/reform/gmit/ and compliance as the head of each de- www.house.gov/science/y2k.htm. partment or agency considers appropriate. Office of Management and Budget

At the time this report was written, OMB is responsible for monitoring two submissions for release of agency progress and efforts in ad- emergency supplemental funds for dressing Y2K. Its strategy to ensure non-defense agencies and activities agency Y2K compliance is based on had been made: November 6, 1998, agency accountability. Progress is and December 8, 1998. The total monitored through agency goals for amount identified in these submis- compliance of mission-critical sys- sions is $1.23 billion, $891 million tems, progress on the status of mis- and $338 million respectively. This sion-critical systems, status of mis- accounts for almost 55% of the total sion-critical systems being repaired, emergency funds available for non- and agency Y2K cost estimates. defense agencies and activities. The Progress reporting of federal agen- Department of Defense has yet to cies is on a quarterly and/or monthly submit any documentation for re- basis depending on the tier that

108 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

the agency is assigned to by OMB. departments or agencies, seek mu- The three-tier system that OMB is tual solutions where possible and using consists of share best practices.

Tier 1 agencies: NOT making The Information Technology Man- adequate progress, agement Reform Act established a CIO Council to review and provide Tier 2 agencies: making prog- guidance on crosscutting information ress, but with concerns, and technology (IT) issues. During No- vember 1996, the CIO Council des- Tier 3 agencies: making sat- ignated the Year 2000 Interagency isfactory progress. Committee as an official subcommittee and renamed it the CIO Subsequent to agency submission of Council Subcommittee on Year quarterly status reports to OMB, 2000. The Subcommittee was in- OMB generates a consolidated re- strumental in assisting OMB’s devel- port based on agency self-reported th opment of the Y2K quarterly status information. OMB’s 7 Quarterly Re- report. port was issued on December 8, 1998. It is based on data as of No- President’s Y2K Conversion Council vember 15, 1998. Executive Order 13073 established Efforts by OMB to provide oversight the President’s Council on Year are often augmented by internal 2000 Conversion in February 1998. audit organizations within agencies The Council has the mandate to and by GAO. oversee agencies’ activities to assure that their systems operate CIO Council Subcommittee on Year smoothly through Y2K. It is respon- 2000 sible for coordinating the federal government’s Y2K efforts. Repre- Among the Federal Government’s sentatives from more than 30 major Y2K initiatives, formation of the Chief federal executive and regulatory Information Officers (CIO) Council agencies comprise the Council. Subcommittee on Year 2000, for- These executive representatives are merly the Year 2000 Interagency sufficiently senior so as to have 1) Committee, is the oldest. The com- extensive knowledge of their agen- mittee was born in November 1995 cies’ Y2K efforts and external or- when it held its first meeting. The ganizational relationships and 2) Year 2000 Interagency Committee authority to commit their agencies. was an informal committee headed by Kathy Adams from the Social Se- The Council has established over 30 curity Administration. The Commit- sector groups with coordinators from tee’s purpose was to raise Y2K the appropriate federal agencies awareness, address crosscutting is- charged with outreach into the public sues affecting many or all federal and private sectors, both do-

109 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

mestically and internationally. Look- Currently, of 24 major agencies that ing internally at federal systems, the comprise the federal CIO Council, Council’s oversight includes ensuring six are in Tier 1, seven in Tier 2 and that adequate financial and person- 11 in Tier 3. Table 1 identifies these nel resources are committed to fed- agencies by tier. This is based on eral Y2K efforts and that they are self-reported progress on mission- used effectively. critical systems.

Assessments

Cost estimates continue Tier Agencies to be on the rise for federal agencies. Since One DOD, DOE, HHS, DOS, DOT and AID August, estimates have risen $1 billion to $6.4 bil- Two USDA, DOC, Education, DOL, DOJ, lion. Over 80% of the in- Treasury and OPM crease is attributable to three departments: Health Three DOL, VA, EPA, FEMA, GSA, HUD, NASA, and Human Services NRC, NSF, SBA and SSA (HHS), Treasury, and Defense. HHS hiked its Table 1: Current Status of Federal Agencies estimate $165 million for Concerns potential contingencies in fiscal year 2000, Treasury increased its esti- The Committee is very concerned mate by $53 million for increased about current agency progress. De- testing and validation and Defense spite an apparent increase in activity, jumped $591 million for increased it is still not enough. Many schedules independent verification and end-to- show a steep improvement curve end testing. With much testing to go just before key OMB milestones. and schedules closer to possible Both internal audit reporting and slippage, it is likely that these cost GAO reporting support the concern estimates will continue to rise. over schedule. Furthermore, hearings by the House specifically fo- Sixty-one percent of federal mission- cused on the federal government’s critical systems are now reported as preparedness continue to raise compliant. This is a 10% increase warning flags. The federal govern- since August. The remaining 39% is ment has never received a passing scheduled for completion by March grade on any of the six report cards 1999. Unfortunately, slippage is al- issued by Congressman Stephen ready apparent. Ten percent of mis- Horn. Additionally, a large portion of sion-critical systems did not reach testing, known to be one of the larg- the renovation milestone of Septem- est portions of the overall Y2K effort, ber 1998. As we move further into is yet to come. Several agencies 1999, the risk of schedule slippage stand out as ones that require fo- will increase.

110 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

cused oversight and stepped up ef- amounts disbursed. Given the ex- forts due to the risks associated with treme volume of transactions that their current pace of progress: occur daily to support these pro- Healthcare Finance Agency (HCFA), grams, a contingency plan consisting Federal Aviation Administration of manual processes would not suf- (FAA), Department of Energy (DOE) fice. and Department of Defense (DOD). In light of these risks, these agen- Finally, half of the emergency sup- cies’ business continuity and contin- plemental funds for non-defense gency plans become even more im- agencies have already been re- portant. leased within the past 2 months. These funds were intended to stretch The area of system interfaces is an- over a 3-year period, which suggests other concern that requires addi- that little will remain for true emer- tional attention. These interfaces gency requirements. It is not clear exist internally within each federal that OMB scrutinized funding re- agency; they exist between different quests as closely as the Committee agencies, between agencies and would have hoped. While OMB is state governments, and between experienced in overseeing budgetary agencies and local governments. requests, another entity more in- Generally, these interfaces support volved with the Y2K issue, such as government revenue collection sys- the President’s Council, might have tems and benefits payment systems. been better fit to evaluate the Y2K Often, it is not clear who is responsi- funding requests. Unfortunately, ble for interfaces among federal, suggestions from the House to give state and local governments. Fur- more authority and responsibility to thermore, the testing is complicated the President’s Council have yet to by the need to test these interfaces take root. as a portion of the overall testing strategy. DEPARTMENT OF DEFENSE One prime example is HCFA, which is one the farthest behind in its criti- In addition to the concerns ex- cal systems remediation efforts. pressed above, the Department of HCFA manages Medicare, Medicaid Defense (DOD), as the largest fed- and Child Health programs serving eral agency with nearly half of the over 74 million Americans. Prob- federal government’s computer as- lems with federal systems combined sets, faces a monumental manage- with Y2K failures state and local ment challenge in addressing Y2K. government systems, or the inter- The department relies on computer faces between them, could result in systems to conduct nearly all of its delayed benefit payments, payments functions, including strategic and not being received at all or delivered tactical military operations; sophisti- to the wrong party, eligible recipients cated weaponry; intelligence collec- not receiving payments or incorrect tion, analysis, and dissemina-

111 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

tion; security efforts; and more rou- been inconsistent, leading to false tine business operations such as starts and uncoordinated efforts. payroll and logistics. GAO also found that DOD’s contingency plans, developed in the event The breadth of the problem con- of systems failures, are frequently fronting DOD is enormous: it has not executable. more than 1.5 million computers, 28,000 automated information sys- DOD’s Inspector General and other tems and 10,000 networks. Its in- internal audit offices have issued formation systems are linked by over 130 reports that similarly ques- thousands of interfaces that ex- tion the department’s management change data within DOD and across of its Year 2000 program. These organizational and international audit reports repeatedly revealed lines. Furthermore, DOD’s reliance many of the same findings as those on computer systems is increasing reported by the GAO, as well as as technology changes the tradi- problems experienced in assessing tional concepts of warfighting and inventorying systems, effectively through improved intelligence and determining and allocating re- rapidly modernized command and sources, and accurately testing and control. Successful defense opera- certifying systems’ Year 2000 com- tions will depend greatly on the de- pliance. The department’s audit re- partment’s ability to ensure that its ports also revealed that much of systems and the systems with which DOD’s base level infrastructure, they interface are Year 2000 compli- such as security systems, telephone ant. switches, traffic control systems, and water and sewage treatment sys- According to the U.S. General Ac- tems are vulnerable to Year 2000 counting Office (GAO), which pub- problems. lished a series of reports last year on DOD’s overall efforts to address the These findings and risks are re- Year 2000 problem, the depart- flected in the Office of Management ment’s efforts pose considerable and Budget’s assessment of DOD as risks. DOD still does not have reli- a “Tier 1” agency, i.e., an agency able, timely information on program showing “insufficient evidence of status, because information being adequate progress.” DOD senior reported up-the-chain is not vali- management has been responsive to dated for accuracy or completeness. the GAO and internal audit findings GAO found instances in which de- and has taken an active, highly visi- fense components’ reports on sys- ble interest in implementing correc- tems compliance were often inaccu- tive actions. The senior manage- rate. In addition, GAO found that ment team has improved its over- guidance issued by the department sight of the Year 2000 program so to its components on issues such as that it can more effectively assess interfaces, testing, and reporting has program direction and take actions

112 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

based on this assessment and Several of the largest intergovern- known problems. However, DOD mental councils and professional or- remains behind schedule in com- ganizations are actively engaged in pleting its systems remediation and Y2K awareness programs. The Na- is at considerable risk of being un- tional League of Cities, the National able to successfully meet the Year Association of Counties, and the In- 2000 deadline. ternational City/County Management Association, in conjunction with Pub- lic Technology, Inc., are sponsoring STATE AND LOCAL a Y2K awareness program entitled GOVERNMENT “Y2K and You.” The Metropolitan Washington Council of Governments Overview has published a Year 2000 Best Practice Manual. These programs In addition to the 50 state govern- are good examples of what an effec- ments, there are 3,068 county gov- tive dialogue between state, county, ernment jurisdictions and approxi- and local governments can achieve. mately 87,000 other local government jurisdictions within the United In his testimony before the Commit- States. tee on October 2, 1998, the Honor- able Michael O. Leavitt, governor of These state, county, and local gov- Utah and vice chairman of the Na- ernments deliver the majority of the tional Governor’s Association (NGA), essential services upon which citi- described several NGA initiatives zens rely each day. These include aimed at assisting the states with police, fire, and emergency medical Y2K preparation. In July 1998, the services response; financial support NGA held a “Year 2000 State Sum- networks, including welfare and mit” which focused on state, local, Medicaid payments; unemployment and private-sector coordination and insurance payment systems; disabil- on establishing a common agenda to ity claims; and basic utilities, such as increase public confidence in state water and wastewater, sanitation, services. The NGA has also pub- and local transportation systems. lished an issue brief entitled “What While the prospect of preparing fed- Governors Need to Know About eral government systems is daunt- Y2K,” which Governor Leavitt stated ing, the challenge of assuring the “outlines the steps governors should Y2K preparedness of these other take as chief executive officers, sectors of government is even more guarantors of public safety, and pub- mammoth. The consequences of lic leaders.” Both the State of Texas failures in this sector are as poten- and the State of Pennsylvania have tially grave to the public as failures in been recognized as having two of the vital sectors of power and tele- the most extensive and well- communications. developed state Y2K programs. New York State Governor George Initiatives Pataki has also been leading the

113 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

call for Y2K preparedness in his states with all aspects of mission- state. critical legacy systems ranged individually from under 10% complete, to Assessments more than 90% complete. According to the NASIRE survey results, just The assessments of Y2K progress in under half (24) of those responding the sector of state and local govern- had completed remediation of at ment are not optimistic. least 50% of their mission-critical systems. Mr. Flynn noted that no The National Association of State state had declared itself 100% com- Information Resource Executives plete as yet. (NASIRE) is conducting a continuing survey of individual state Y2K pre- Data provided by the Gartner Group paredness. The Gartner Group has indicate that only 50% of the states also conducted a state government are evaluated as at Level III Status Y2K survey. The National Associa- under the Gartner Group’s scale. A tion of Counties (NACO) recently Level III rating indicates that the commissioned National Research, state has completed its project plan; Inc. to conduct a random survey of has assigned resources; has com- the Y2K status of county govern- pleted a detailed risk assessment, ments. The General Accounting Of- remediated; and has tested 20% of fice (GAO) is examining the status of mission-critical systems, conducted federal to state data exchanges. vendor reviews and has completed These include the vital connections contingency plans. Thirty percent of through which funding from the fed- the states are listed at Level II, indi- eral government is provided to the cating that they at least have devel- states for various aid programs. oped an inventory of operational dependencies. Ten percent of the Unemployment, for example, is fed- states are evaluated as Level I, indi- erally funded, but state administered. cating that they have begun their The Department of Labor reported in projects, are aware of the problem, December that the following states and have begun conducting their in- were behind in remediating their un- ventories. The remaining 10% are employment systems: Connecticut, evaluated as “uncertain,” indicating Delaware, the District of Columbia, they were unaware of their Y2K pre- Hawaii, Illinois, Kansas, Louisiana, paredness status. Massachusetts, Missouri, Montana, New Hampshire, New Mexico and The GAO has advised that as of No- Vermont. vember 1998, 33 states had completed 75% of their verification of In his testimony before the Commit- federal data exchanges. GAO found tee on October 2, 1998, John Tho- that as of June 30, 1998, approxi- mas Flynn, CIO of the State of Cali- mately one half of the state disability fornia, and president of NASIRE determination systems had not been stated that compliance among the 50 renovated, tested, and certified

114 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Y2K compliant. Additionally, over smallest population group (popula- 90% of state Medicaid, 70% of state tion below 10,000) had one. The 500 Temporary Assistance for Needy survey respondents reported a total Families and 75% of the state Food cost estimate of over $283 million for Stamp Program systems were not Y2K compliance. Y2K compliant as of August 1998 according to GAO statistics. A survey published by the Office of the New York State Comptroller in Survey data recently released by September 1998 indicates that 100% NACO, collected from 500 counties, of New York’s counties have made indicate that only 50% of the respon- preparations for Y2K. Twenty-six dents have countywide plans to ad- percent of the cities, 54% of the dress Y2K issues. Of the 16 coun- towns, 48% of the villages and 61% ties with populations over 500,000, of the fire districts reported that they all but one have a countywide plan. had not made Y2K preparations. Seventy-four of the 119 counties having populations below 10,000 re- Concerns ported that they have not prepared a Y2K plan. The Committee has serious concern about the Y2K readiness of state and Fifty-four percent of the counties local governments. surveyed reported that they have no contingency plans for Y2K disrup- This concern is supported by all of tions. Twenty-two percent reported the previously cited surveys, which, that they had prepared Y2K contin- when taken, together indicate a vast gency plans. Fifty percent of the disparity in the readiness level of the largest counties in the survey stated individual states, and a disturbingly that they have contingency plans, low overall level of preparedness on while only 19 of 119 counties in the the part of county and local government jurisdictions.

115 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Year 2000 Status of the 50 States*

50% 45% Note: Data includes assessment of 40% information systems owned and 35% managed by state governments for 30% purposes such as law enforcement, public 25% health and education programs. It does not 20% include private sector or county- and local- 15% government 10% computers or other infrastructure. 5% 0% Uncertain Level I Level II Level III Level IV Level V

Rating is done with GartnerGroup “COMPARE” methodology. Levels of readiness are defined as: • Level I - Getting started, champion identified, awareness, begin inventory • Level II - Develop detailed inventory of operational dependencies • Level III - Project plan completed, resources assigned, detailed risk assessment, remediate and test 20% of mission-critical systems, vendor reviews, complete contingency plans • Level IV - Complete remediation and testing of remaining 80% of mission-critical systems, contingency strategies implemented for mission-critical dependencies • Level V - Remaining systems and dependencies completed and policies in place to avoid non-compliant issues after compliance is reached

* Note: These data are provided courtesy of the Gartner Group, Stamford, CT. 9/30/98 116 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

GENERAL BUSINESS

The general business sector portion of this report is organized into sev- SMALL BUSINESS TO eral sections. First, the small busi- GLOBAL CORPORATIONS ness to global corporations section serves to set the stage for business and Y2K in generic terms. The overview provides a look at the supply Overview chain in general and highlights the As is the case with ever-increasing interdependencies among links of aspects of daily life, business has the chain. Major initiatives within this grown more dependent on technol- section address activities of this ogy – especially information technol- Committee, an October committee ogy. Not only has it changed our hearing and a field hearing in Ore- daily lives, it has changed our daily gon; activities of the Manufacturing business. Competition in local, Extension Program; state, regional and in- and United States De- "I BELIEVE THAT AS ternational business partment of Agriculture BUSINESSES REVIEW markets has shrunk (USDA) activities. In THEIR SUPPLY CHAINS profit margins for all addition to the status FOR Y2K PREPAR- businesses – from information provided in small independent discussion of the two EDNESS WE WILL SEE A businesses to global Committee hearings, a ‘FLIGHT TO QUALITY’.” conglomerates. separate section looks Shrinking profit mar- at two assessments of SENATOR BOB BENNETT gins have motivated business. Finally, this companies to reduce expense and section of the report focuses on sev- increase efficiency. Information eral important industries not already technology enables companies to addressed in the Committee’s other regain a solid hold on profitability seven sectors: pharmaceuticals, and stimulate growth. food and chemical manufacturing. Each of these industries has its ob- American business has developed vious importance to the public’s and adopted just-in-time inventory as health, welfare, and well-being. The the standard. Lean manufacturing is consequences to the public of any central to the success of most large, one of these industries having sig- complex factory operations. Preci- nificant disruptions due to Y2K is un- sion farming has led to increased acceptable. Therefore, “urgent” ef- production with fewer resources. The forts for preparedness must in- supply chain from raw material/basic crease. ingredient production/provider, to

117 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

preliminary processing, to manufac- Although it may seem contrary to turer, to distributor, to wholesaler or what one would normally think, a retailer, and ultimately to final cus- system that actually crashes due to a tomer, has become ever tighter and Y2K problem causes a better situa- shorter. The ripple effect from a tion than one that does not. In the problem at any point in this chain case of a crashed system, it is clear can be felt throughout the length of there is a problem and a system di- the chain. Information technology agnosis can reveal the cause. Tech- provides the backbone that fuses the nicians can fix the problem and bring chain at each link often via electronic the system back on line. commerce/electronic data interchange (EC/EDI). If a system experiences a Y2K related problem but does not crash, Market and legal pressures continue the system may continue to operate to drive the majority of the decisions with the problem going unnoticed. made within System users will business, including "WE MUST GET THE AT- likely continue to use Y2K decisions. A TENTION OF TOP MAN- the system trusting it National Federation AGEMENT AND RECOGNIZE is operating correctly of Independent THAT THIS IS NOT AN IT and the data or Business (NFIB) calculations it yields PROBLEM … THIS IS A Y2K study correctly are correct. By the noted that “informa- MANAGEMENT CHALLENGE time the problem is tion describing the THAT MUST BE ADDRESSED identified, data may [Y2K] problem BY THE HIGHEST CEO have been corrupted, needs to address IMMEDIATELY.” business processes consequences of incorrectly run, and inaction if it is to SENATOR BOB BENNETT -- so forth. The impact stimulate action.” JUNE 2, 1998 of a Y2K problem Although this study such as this may far provides an assessment of the pre- outreach the offending system to paredness of small business, there is those systems with which it inter- no community-wide assessment of faces. Interfaces provide a conduit Y2K preparedness within overall where one system’s errors could business. However, as has been the propagate through numerous others. case in previous Committee hearings, the larger companies that have Alan Arnold, a senior Ernst and adequate resources to address the Young manager, cites some person- issue are generally in a better posi- ally observed examples of Y2K tion regarding their Y2K efforts than problems. He notes that orders did small- and medium-sized compa- not process correctly, supply chan- nies. nels failed, accounting reports aged incorrectly and invoice systems billed incorrectly. Certainly payroll

118 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

systems are date-sensitive as they man safety, defense, and well-being. perform trivial to complex salary- This clearly was one of the Commit- related calculations. These are only tee’s first tasks as it established its topical examples of the Y2K prob- eight sector areas: utilities, health lem. services, telecommunications, transportation, finance, general government, general business and litigation MAJOR INITIATIVES (in priority order). Concerns about litigation were heard numerous times both in the context of limiting frivo- lous lawsuits and providing protec- Northwest Year 2000 Summit tion for statements made in good Key Oregon businesses and indus- faith. Certainly, the latter was ad- tries provided expert testimony on dressed when the Year 2000 Infor- mation and Readiness Disclosure July 1, 1998, at the Northwest Year th 2000 Summit held in Portland, Ore- Act became law on October 19 . gon. Senator Gordon Smith, a mem- Finally, the issue of compliance cer- ber of the Special Committee on the tification validity was raised. This is- Year 2000 Technology Problem, ini- sue has yet to be resolved. However, tiated and presided over the event the Committee continues to empha- geared toward assessing the poten- size the need for audits as well as tial impact of Y2K on both small and independent verification and valida- big businesses. Additionally, Senator tion as a crucial element of a sound Smith focused on the question “What Y2K program. role, if any, should the federal government play with respect to Year 2000 technology issues?” A Hearing -- Small Businesses to Global Corporations: Will They Sur- Following testimony from Integrated vive the Year 2000? Measurement Systems, Intel Corpo- ration, WRG Design Company, On October 7, 1998, the Special Providence Health System, and Committee on the Year 2000 Tech- Bank of America, the audience ac- nology Problem held a hearing fo- tively participated. The audience cusing on areas within the general consisted of individuals from the business sector. As with previous American Electronics Association, sector hearings, the purpose of the local business groups and the Tu- hearing was to increase awareness alatin Valley Economic Development and disseminate reliable prepared- Corporation. ness information as well as facilitate and stimulate solutions. Committee The testimony emphasized the need work supports polls showing only a to prioritize efforts to concentrate on small percentage of the American those issues that are critical to hu- population has even heard of Y2K.

119 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Awareness is a continual process the pharmaceutical industry. Without that will extend up to and past Janu- a daily supply of medication and the ary 1, 2000. coordinated efforts of healthcare providers, Ms. West will die due to During the hearing, a reoccurring the residual effects of a brain tumor theme appeared throughout the ex- and a postoperative infection. She amination of the supply chain, from has 34 years experience within global corporations to small- and healthcare: 20 as a registered nurse medium-sized business. Witnesses and, most recently, 14 years devel- talked about a move from high-risk oping and implementing medical in- vendors to lower risk vendors. formation systems. Her primary Senator Bennett concluded, “as a message was that many Americans result of Y2K, we are going to see would feel the impact of medication significant shifts in where people go supply and distribution disruptions for materials, where people go for that are possible from Y2K. During markets. It will produce some very her testimony, she explored issues challenging social problems all over related to stockpiling medication for the world. Those countries and com- those dependent upon regular drug panies that survive and thrive as a doses. result of the long-range planning that they have done will be called upon to Testimony from pharmaceutical rep- provide aid and assistance in those resentatives later in the hearing re- parts of the world where those chal- sponded to Ms. West’s supply chain lenges exist. I think the social impact issues. Richard Carbray, General of this is beyond anything we had Manager of Pleton’s Pharmacy and previously thought it might be.” Home Health Centers, noted that at the pharmacy level, it is possible to Witnesses at this hearing provided identify groups of patients through testimony that looked at the overall their systems to ensure plentiful and business community preparedness, sufficient quantities of medication are both domestically and internationally, on-hand for each particular group. At of small and large business, and the same time, he cautioned that in- used the pharmaceutical industry as dividuals getting an excess supply a case study. Opening the hearing, a unnecessarily might cause the avail- special witness highlighted the pos- able supply to change drastically. Dr. sible personal and dramatic nature of Charles Popper, CIO of Merck & Co., the Y2K problem. Laurene West echoed the caution noting that shared her story and concerns to stockpiling an excess supply would bring a human face to the Y2K likely cause more harm than good. problem. Dr. Popper believes that a more focused approach will aid in under- West’s personal testimony dramati- standing what steps are necessary cally depicted the critical depend- to cover this situation. However, ency that many Americans have on good data are necessary. The

120 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Vital Signs 2000 survey will facilitate tween companies and countries.” identifying supply chain sensitivities From an international perspective, and risks. Gartner Group’s research indicates key foreign government agencies will Despite tremendous progress in re- likely experience significant failures. solving Y2K problems throughout This fact highlights the critical nature 1998, much work remains in the lim- and risk exposure of the interrela- ited time available. Almost a quarter tionship between our government of all companies worldwide, regard- agencies and militaries. less of size or industry, has yet to start any Y2K effort, according to Shifting the focus to small business, testimony by Lou Marcoccio, Rre- the Honorable Fred Hochberg, Dep- search Director for the Gartner uty Administrator, Small Business Group. While the heavily regulated Administration (SBA), testified that to insurance, investment services and some extent, all of the nation’s 23.6 banking industries are the most ad- million small businesses may be af- vanced in their efforts, the fected by Y2K. Their exposure is due healthcare, oil, education, agricul- to their reliance on office automation ture, farming, food processing and – hardware, software or equipment construction industries are lagging with embedded chips – any of which dangerously behind. may be non-Y2K compliant. To assist the nation’s small businesses as Closely tied to the issue of failures is they cope with Y2K, the SBA em- a misunderstanding of the Y2K phasizes a three-step program: problem. Many mistakenly think that Y2K problems will only manifest 1) conduct a self-assessment themselves at the stroke of midnight to identify possible affected on December 31, 1999. However, computer hardware and Y2K problems have been occurring software in addition to any over the years and will continue to equipment using embedded increase in occurrence as we ap- chips, proach January 1, 2000. Further- more, they will continue to arise at a 2) take action immediately, and diminishing rate in the months following January 2000. 3) stay informed about Y2K issues. Included in this proc- Mr. Marcoccio ended his testimony ess are efforts to assess the focusing on specific risks to the Y2K status of businesses’ United States, stating, “from a do- suppliers and distributors as mestic perspective, the risks that we well as contingency plan have identified or highlighted as be- development. ing most important are the interruptions or failures due to interdepend- Although it may be “too late to start encies and interconnections, be-

121 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

early,” it is not too late to start. sary steps to ensure that the technologies they and their business When questioned about the avail- partners depend upon are Y2K ability of loans for small businesses ready. The program core consisted to initiate Y2K efforts, Mr. Hochberg of hundreds of educational events noted that all of SBA’s loan pro- hosted by federal government field grams today are available for Y2K offices. Participating entities in- remediation work. Senator Gordon cluded the following: Smith concluded from further expla- nation, “there is really no reason · SBA’s 69 district offices, 935 people should not be doing this small business development [taking action on Y2K] in small busi- centers, 65 business infor- ness.” mation centers, 35 women’s business information centers The NFIB report, “Small Business and 18 tribal business in- and the Y2K Problem,” sponsored by formation centers; the Wells Fargo Bank, is discussed in the assessment section below. · the Department of Com- Later in this section, the Manufac- merce’s 400 manufacturing turing Extension Program (MEP) extension partnership offices Y2K toolkit is covered as a resource and 65 minority business to small manufacturing businesses development centers; for Y2K information. Representatives of both the NFIB and MEP testified · USDA’s 3,100 county exten- during the hearing. sion offices;

· the Social Security Admini- National Y2K Action Week stration’s 1,350 field offices; and The President’s Council on Year 2000 Conversion designated Octo- · the Department of Trans- ber 19 - 23 as “National Y2K Action portation’s 120 field offices. Week.” While many large firms have grasped how a Y2K failure could se- These offices helped managers as- verely affect their futures, smaller sess their businesses’ Y2K vulner- firms seem more focused on their abilities, develop strategies for re- immediate problems. Therefore, on mediation and replacement work, th October 19 , the President’s Council find technical resources for ad- on Year 2000 Conversion and more dressing the problem and formulate than 100 private sector organizations contingency plans. To further ad- launched “National Y2K Action dress concerns of businesses, SBA Week.” The goal was to motivate has a small business answer desk, managers of small- and medium- 1-800-827-5722, which provides sized companies to take the neces-

122 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

personalized response and assis- Phase IV covers remediation plan- tance. ning and management.

Although this Y2K tool does not Manufacturing Extension Program solve the Y2K problem for a busi- (MEP) - Conversion 2000 ness, it puts a business well on the road to soundly addressing Y2K, MEP is a ready resource for small- providing a roadmap of sorts. Fur- and medium-sized manufacturing thermore, documentation produced businesses. As a non-profit program from the use of Conversion 2000 will of the Department of Commerce’s assist in application processing for National Institute of Standards and SBA fast track loans for Y2K. Technology (NIST), MEP has over 400 centers located throughout the 50 states and Puerto Rico. There are Cooperative State Research, Educa- some 2,000 MEP engineers avail- tion, and Extension Service able nationally through these centers (CSREES), USDA - Y2K Community and field offices. They work directly Awareness Outreach with area firms to provide tailored expertise and services. Specifically CSREES is designed to be an agent targeting Y2K, NIST and the national for change and an international MEP office developed a Y2K toolkit research and education network. that manufacturing businesses that Part of CSREES’ mission is to desire assistance can use. Thus, promote informed decision-making they are a prepositioned resource by producers, families, communities available to assist in completing a and other customers through thorough Y2K assessment and in partnerships with public and private initiating an appropriate plan to sectors that maximizes limited remediate, test, and implement Y2K resources’ solutions. effectiveness. Included in The Y2K self-help tool, Conversion CSREES are 2000, leads a small business over 9,600 through four phases of assessing local extension and structuring a Y2K program. agents working Phase I facilitates the internal in- in 3,150 ventory of hardware, software, and counties nationwide; farm safety embedded systems. Next, in Phase education programs in all 50 states II, a business criticality assessment and Puerto Rico; as well as is conducted and initial criticality in international education programs addition to confidence ratings are taught by over 200 extension calculated. Phase III activities in- professionals in 17 countries. volve contingency planning. Finally, As part of National Action Week,

123 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

CSREES rolled out its recently de- ASSESSMENTS veloped Y2K Community Awareness Outreach Toolkits. Five thousand of these “toolkits” were distributed to all county extension offices, USDA For- National Federation of Independent eign Agriculture Service’s Agricul- Business (NFIB) tural Attaches, State Agriculture Commissioners, National Agricultural On May 26, 1998, William Dennis, Statistics Service State Directors, the Senior Research Fellow for NFIB, Land-Grant University System, 1994 published the report Small Business Tribal Colleges and the Hispanic and the Y2K Problem. One of the Serving Institutions. most telling findings of the report was that over 80% of American small Each “toolkit” consists of fact sheets, businesses are potentially exposed a media and information plan, a to Y2K problems. In Dennis’ October press release 7th testimony, he further described the template, public serv- “TO STIMULATE ACTION, general assessment of ice announcements YOU MUST FIRST IDENTIFY (both written and small business. “A fifth THE CONSEQUENCES OF recorded), a general of them do not public brochure, talking INACTION.” understand that there points and frequently is a Y2K problem. . . . asked questions. The MR. WILLIAM DENNIS, They are not aware of fact sheets include: NFIB it. A fifth of them are “Creating a Year 2000 currently taking action. Computer Action Plan,” “Is Your A fifth have not taken action but plan Computer Ready for Y2K,” “Prepar- to take action, and two-fifths are ing for the Year 2000 Computer aware of the problem but do not plan Challenge” and “The Y2K Problem to take any action prior to the year and Embedded Systems.” 2000.”

During the kick-off of National Y2K Approximately 330,000 small busi- Action Week, USDA Deputy Secre- nesses that are computer dependent tary Richard Rominger noted that a fall into this last two-fifths category. memorandum of understanding Dennis suggests that if they lose (MOU) between the Departments of their computers or if their computers Agriculture and Commerce had been malfunction, it will result in a produc- signed. The MOU focused on the tion or sales loss of 85%. They will needs of small businesses and be out of business, effectively, until manufacturers. As an outcome, it is they fix the problem. likely that CSREES’ “Y2K Toolkit” may merge with MEP’s Conversion Over 82% of small businesses have 2000 to form a single, more compre- some level of direct Y2K exposure hensive “toolkit.” due to their reliance on information

124 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

technology and automation. The identified in NFIB’s report. This ex- large majority of them, 81%, indicate posure is probably smaller yet, since, awareness of the exposure. How- as an industry, financial institutions ever, only half have taken or plan to are generally considered to be out take action in response to the expo- front in their Y2K efforts. sure. The lack of action apparently comes from 77% of small busi- Medium-sized businesses may actu- nesses not considering Y2K to be a ally face the greatest overall Y2K serious problem. exposure. Small businesses are likely to have less technology inser- Indirect exposures to tion within the business Y2K are sometimes 30-50% OF ALL community. In many overlooked. Figure 1 COMPANIES cases, they may have identifies some of the the capability to go back WORLDWIDE WILL sources of indirect ex- to manual processing, if posure that small EXPERIENCE AT LEAST necessary. Even businesses face. These ONE MISSION-CRITICAL though small exposures result from FAILURE businesses generally electronic interaction lack the resources to with business partners. Seventy-five adequately address Y2K issues, the percent of small businesses deal impact of a failure is likely to be electronically with partners and thus moderate. Medium-sized busi- are exposed to possible Y2K impacts nesses, on the other hand, are more if their partners are not prepared for likely to depend heavily on technol- Y2K. Exposure due to electronic in- ogy. Manual processing may no teractions with financial institutions is longer present a viable option for clearly the smallest of those sources medium-sized businesses. They may also lack the appropriate resources to remediate affected systems and devices. Given All that small and me- Suppliers dium-sized businesses provide over 51% of Customers the private sector out-

Y2K Exposure put, the lack of action Source of Indirect Financial Inst. on their part may 0 20 40 60 80 translate into a larger ripple that moves Percent through the closely linked supply chain. Figure 1: Small Businesses With Indirect Y2K Expo- sure The NFIB report Small Business and the

125 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Y2K Problem is being updated. Data pectations are correct. The horizon- collection is complete for the update tal axis indicates the size of com- and its analysis is underway. The pany and government agencies. The update should indicate the success vertical axis indicates the percentage of National Y2K Action Week. of all companies or government agencies of a particular size that are expected to experience at least one The Gartner Group mission-critical failure. The Gartner Group bases its research and analysis on data gathered from 15,000 companies in 87 countries. Data is updated every 90 60 days. The Gartner Group’s research 50 has concluded that of all companies 55 and government agencies, 23% 40 45 have yet to begin any Y2K action. Of 30 these companies, 83% fall into the 20 category of small companies. 10 15 of Companies/Gov’t Agencies Lou Marcoccio explained during the 0 October 7th hearing that “a mission- Small Medium Large critical failure means that a business Size interruption is likely to occur. It could affect revenue and will likely affect Figure 2: Predicted Mission-Critical Failures the continued operation of that business.” The Gartner Group predicts that 30% to 50% of all companies Shifting to looking at predicted mis- worldwide will experience at least sion-critical failures by industry sec- one mission-critical failure. Within tor, some logical conclusions can be the United States, that percentage drawn. Those industries that are drops to 15%. The typical amount of most likely to have experienced a time that one of these critical failures Y2K related problem earliest gener- is expected to last is at least 3 days ally began to address the problem at at a recovery cost of between that time. However, it is interesting to $20,000 and $3,500,000 (this esti- note that often they did not begin mated cost does not include any addressing the problem from a total costs related to possible litigation). business perspective. Frequently, only those areas of the business that Figure 2 graphically portrays the experienced the failure or were most number of companies expected to closely related to it were addressed. experience at least one mission- critical failure. Gartner predicts there Heavily regulated industries also are is an 80% probability that these ex- generally in a better position with

126 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

their Y2K efforts than those without may occur either simultaneously or regulation. Gartner’s research covers nearly simultaneously, the situation companies and organizations across is much more serious. 27 industries. As with its predictions for mission-critical systems based on Data provided by the Gartner Group size (figure 2), it has developed fail- and depicted in figure 3 clearly ure predictions for companies within demonstrate that much work remains these 27 industries. To characterize as we approach Y2K. For example, these predictions, Gartner estab- 50% of companies within the trans- lished four risk categories. portation industry will experience at least one mission-critical failure. Each risk category, identified in the Thus, the figure highlights those in- far-right column of figure 3, de- dustries critical to our country’s infra- scribes the percentage, in the far-left structures that must continue to ag- column of figure 3, of companies in gressively execute their Y2K plans industries within the category that as well as develop realistic and fea- will experience at least one mission- sible contingency plans. critical system failure. Taken alone, one mission-critical system failure does not sound like much. However, when you understand that thousands to hundreds of thousands of failures

Insurance, Investment Services, Banking, Pharmaceuticals, 15% Computer Manufacturing 1

Heavy Equipment, Aerospace, Medical Equipment, Software, 33% Semiconductor, Telecom, Retail, Discrete Manufacturing, 2 Publishing, Biotechnology, Consulting

Chemical Processing, Transportation, Power, Natural Gas, Water, Oil, Law Practices, Medical Practices, Construction, 3 50% Transportation, Pulp & Paper, Ocean Shipping, Hospitality, Broadcast News, Television, Law Enforcement

Education, Healthcare, Government Agencies, Farming & 66% Agriculture, Food Processing, Construction, 4 City & Town Municipal Services

Figure 3: Failure Predictions by Industry

127 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

and Scandinavia, European coun- CONCERNS tries have taken a strikingly relaxed attitude to Y2K. A main-board di- th In preparation for the October 7 rector of a leading French bank said, hearing, the Committee staff con- “The year 2000 question is a conducted interviews with a variety of spiracy cooked up by the Americans knowledgeable parties. Interviewees and the British to create a smoke- included federal agencies with pur- screen and distract attention away view over many aspects of business, from preparations for the single especially those related to small European currency.” The situation in business and the food industry; large Russia and China is even worse businesses in manufacturing, distri- than in Europe. bution, and retail; and trade organizations representing a cross section of the business community. Small and Medium Business (Fewer Than 500 Employees)

International Business In a recent article by the president of NFIB, possible consequences for All global corporations obviously small- and medium-sized businesses have dependencies on other coun- were outlined: automatic funds tries of the world, certainly to export transfers and direct deposits may be their products, but also to import key disrupted, fail, or occur at the wrong supplies and raw materials for end time; telephonic voice mail may fail; products produced in the U.S. Ex- and fax machines may cease to amples of these dependencies are properly transmit to and receive from automobile parts from Southeast customers. Mr. Dennis, the NFIB Asia, oil from Venezuela and insulin hearing witness, has stated that from Denmark. Y2K information is “more than 330,000 firms risk closing sparse, both on the international their doors until the problem is fixed, companies themselves as well as and more than 370,000 others could the infrastructure of the countries be temporarily crippled.” where they reside. The U.S. is pur- portedly the leader in Y2K remedia- Another example of how critical Y2K tion. This suggests that other coun- preparation by small- and medium- tries are dangerously behind. Many sized businesses has become was have not even begun to address the published in a recent issue of CIO problem. Thus, we should remain Communications, Inc publication. very skeptical about our ability to buy The example highlights the possible or sell goods from certain parts of indirect consequence of failure to the world. act. Sears Roebuck links 5,000 vendors into their EDI/ telecommunica- With the main exception of the tions network. Of those, only 18% United Kingdom, the Netherlands have been identified as critical to

128 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Sears’ business processes. Thus, leagues in allied businesses to be 82% of their current business part- Y2K prepared. ners – primarily small businesses – were deemed non-critical. As a triage approach to looking at work pri- FOOD INDUSTRY oritization and resource allocation in addressing potential Y2K problems is necessary, this same approach is A $25 billion (U.S. $) international being applied by larger business as food retailer with chain stores in the they assess Y2K related risk associ- U.S., Europe, Latin America, and ated with their vendors. Once a ven- Asia described a Y2K experiment dor has not passed muster in this that was conducted in one of its context, it is possible it will lose the stores. It set the date for the store’s business relationship permanently computers to Y2K. The effect was resulting in a devastating impact on “the computers shut down the store its business. in 5 minutes. Everything was shut down. The security systems, the temperature controls, the safes, the front end. Everything.” PHARMACEUTICALS The Food Marketing Institute pub- While generally considered to be one lished a Y2K white paper that further of the leaders in the Y2K remediation illustrated possible consequences of effort, pharmaceuticals are caught in failure to act: the classic squeeze of dependency on suppliers and distributors. Be- · ordering systems will ship the cause of FDA regulations intended to wrong products and incorrect protect the public, pharmaceutical quantities due to date errors in companies must have a pre- complex calculation routines, approved ingredient supplier whose product is registered upon arrival for · point-of-sale systems will have a particular drug product batch. This wrong prices because the host means that a constant supply source system selects the wrong item is critical to the drug manufacturing maintenance records, process. On the sales/distribution side, the companies sell 80% of their · customers will be frustrated by product through wholesale drug frequent shopper systems that firms, thus requiring minimal direct don’t provide expected rewards sales. It is essential for success that due to failures in purchase history both sides of the equation function date calculations, effectively through this Y2K window of risk. The pharmaceutical compa- · credit cards will be rejected if nies are encouraging their col- their expiration dates are beyond Y2K,

129 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

· food manufacturers will label nesses for hearings met significant products with incorrectly calcu- resistance. This resistance and non- lated “sell by” dates, causing po- responsiveness came from both in- tential illness, dustry trade organizations/associations as well as major · pharmacy systems will cancel corporations within the retail and prescription benefits due to date manufacturing sides of the food in- problems and dustry. Both food retailers and manufacturers cited numerous rea- · security systems will allow suspi- sons for their resistance. cious activity to continue due to date tracking errors. As of the 105th Congress, the general preparedness of the food indus- Any interruption within the farm-to- try is not clear. The reluctance to fork chain can result in a direct loss provide public witness is certainly to those who supply food, likely disturbing. Put in the context of the translating into food shortages and Gartner Group’s assessment of the price increases. As is the case with food processing and farm- many businesses, food suppliers are ing/agriculture status, it is possibly increasingly dependent on comput- alarming. Gartner predicts there is a erized processing and information better than 66% chance of at least exchange. For example, farmers one mission-critical failure within and ranchers use electronic equip- each of these industries (see figure ment irrigation systems, animal feed 3). In testimony, Gartner’s Marcoccio systems and transport systems. stated, “An industry highly over- Processors rely on automated sys- looked is agriculture (farming, food tems that help prepare and package processing, transportation/ distribu- consumer-ready products. Distribu- tion, and import and export of foods tors, wholesalers and retailers de- and food bi-products). Several agri- pend on computer-driven equipment culture sub-industries are lagging far to transport, deliver, store, display behind.” and sell food products, and inventory and accounting systems. They rely further on equipment with time- CHEMICAL MANUFACTURING dependent embedded computer chips, such as harvesting equipment; grain elevators; plant, warehouse Overview: and truck refrigeration systems; store Virtually every consumer product is and plant security systems; and critically dependent on the chemical heating, ventilation and air condi- manufacturing industry. Cars and tioning (HVAC) systems. trucks, for instance, depend on thou- Committee efforts to coordinate in- sands of chemicals – from polyure- terviews as well as to secure wit- thane seat cushions and neoprene

130 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

hoses and belts to air bags and ny- An example has already occurred. lon seat belts. “At midnight on New Year's Eve 1996 at Tiwai Point in South Island, Chemical manufacturing is also vital New Zealand, all [660] of the smelt- to the overall U.S. economy. In ing potline process control comput- 1997, $69.5 billion in chemicals were ers stopped working instantly, si- exported, which was multaneously, and 10 cents of every ex- “THOSE MOST AT RISK without warning. The port dollar. This Bell Bay plant in ARE SMALL AND MEDIUM topped agriculture’s Tasmania shut down $55.9 billion of ex- SIZED COMPANIES.” two hours later - mid- ports and aviation’s night local time.” $38.3 billion. In SENATOR GORDON SMITH meeting the demands Major Initiatives of the of U.S. industry, in 1997, the chemical industry While the large companies have shipped $392 billion of goods. This substantial ongoing Y2K programs, was 2.1% of the total U.S. economic at this time, the only major initiative output, more than any other manu- across the industry that the Com- facturing sector. Finally, over 1 mil- mittee is aware of is a community lion Americans were employed by workshop convened at the Commit- the industry in 1997. tee’s request on December 18, 1998. The committee has requested Y2K Vulnerabilities in Chemical that the United States Chemical Manufacturing Safety and Hazard Investigation Board (CSB) investigate Chemical manufacturers are highly dependent on computers to manage · the extent of the Y2K problem in businesses operations and to control the automation (both supervisory manufacturing processes. Thus, control systems and embedded they are susceptible to the Y2K systems) that monitors and con- problem as well. To quote from the trols the manufacture of toxic and Chemical Process Industries’ (CPI) hazardous chemicals; leading publication, Chemical Engi- neering, “Left unchecked, the Year · the awareness of large, medium 2000 problem – called Y2K, for short and small companies within the -- could be catastrophic for the industry of the Y2K threat; chemical process industries (CPI). The date glitch could cause innu- · CPI progress to date in address- merable shutdowns and horrific ac- ing the Y2K problem; cidents. Indeed, a manufacturer's process-control system could be · the impact of this problem on the stymied by "00" and shut down alto- “Risk Management Plans” re- gether on New Year's Eve.” quired in June 1999 under the

131 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Clean Air Act of 1990; · a significant litigation expense or loss or · the role the Federal agencies are playing in preventing disasters · Significant loss of customers or due this problem; and revenue.

· actions to prevent major disasters The Chemical Manufacturer’s Asso- due to toxic or hazardous chemi- ciation (CMA) met with Committee cal releases as the Y2K ap- staff following the October 7th hear- proaches. ing and related that they were prompted by Gartner’s testimony to Assessments do their own, independent industry survey. Their survey has begun, but There are very few general Y2K as- no results are available at this time. sessments of the CPIs. The Gartner Group provides one that surfaced in Concerns the Committee’s investigations. Gartner develops its predictions on The Committee currently has two Y2K from a quarterly survey of over concerns about CPI. First is the po- 15,000 companies in 87 countries. It tentially great public health risk organizes its survey output into 26 posed by the accidental release of industries, one of which is CPI. At toxic or hazardous chemicals. The the October 7, 1998 Hearing on Committee is optimistic that from General Business and the Year 2000 what it has learned, the very large Problem, Lou Marcoccio of the Gart- CPI companies are well along in ner Group placed CPI in Gartner’s their Y2K preparations. However, as category III rating. In this category, in other areas the Committee has Gartner predicts that about 50% of looked into, small to medium firms the companies will experience at are most likely unprepared. What’s least one Y2K mission-critical failure. most bothersome here is that a small Gartner’s definition of a mission- firm may be processing, transporting critical failure is any business de- or storing enough dangerous chemi- pendency, which, if it were to fail, cals to be a health or safety threat to would cause any of the following: a sizable population.

· a shutdown of business, produc- The second concern has to do with tion, or product delivery opera- the publicly disclosed risk manage- tions, ment plans required of firms in this industry in April 1999. These plans · health hazard to individuals, were required by the amended Clean Air Act of 1990 to provide citizens · considerable revenue loss, with accurate information about potential chemical hazards in their communities. These plans were ini-

132 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

tiated before the country was paying The Committee is hopeful that the attention to the Y2K problem. The President's Council on Year 2000 Committee feels that if Y2K is not Conversion’s assessments, the considered as a potential cause of CSB-convened workshop in Decem- accidental release of chemicals that ber 1998, and the Chemical Manu- may be toxic or hazardous, these facturers Association survey will pro- plans will not be credible or accepted vide more assurance in the first by the public reviewing them. quarter of 1999. The Committee will be watching these developments In summary, the Committee is con- carefully and will be taking further cerned that at this moment the im- action if more information is not pact of Y2K on chemical process forthcoming. safety may be a neglected issue.

133 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM Investigating The Impact of the Year 2000 Problem

LITIGATION

The prospect of litigation arising from As the 105 th Congress came to an Y2K-related failures has been di s- end, it became clear that disclosure of cussed since the Committees’ first Year 2000 readiness information is hearing. Both Chairman Bennett and only one part of the problem. Many Vice-Chairman Dodd recognized that businesses are likely to have Y2K- the Y2K problem represents an a t- related failures. Since our economic tractive target for abusive lawsuits. sectors are inextricably intertwined, one companys’ inability to fulfill its From the beginning, various sectors of business contracts opens it and all the industry told us they are hesitant to companies that depend upon it to disclose and exchange information liability. The result is a litigation about their Y2K readinessinformation— domino effect, which allows the Y2K that would help others in the remedi a- failure of one company to topple all of tion processbecause— they fear la w- its business partners. A broad range suits if their disclosures prove inacc u- of businesses and individuals will rate. suffer some kind of economic injury, and many will undoubtedly seek r e- With the support of the White House, course by filing la wsuits. and in cooperation with the Senates’ Judiciary Committee, Chairman In 1999, the Committee plans to work Bennett and Vice-Chairman Dodd together with the Senates’ Judiciary introduced S. 2392, the Year 2000 and Commerce Committees in co n- Information Readiness and Disclosure sidering legislative proposals that Act. The Act encourages the discl o- would provide limited liability prote c- sure and exchange of information tion in Y2K-related matters. The about the Year 2000 computer pro b- Committee plans to hold hearings on lem by limiting the liability of comp a- the Y2K litigation issue in order to nies that provide good faith Y2K di s- gather facts to assist the Congress in closure. S. 2392 was signed into law making any decisions on such legisl a- on October 19, 1998. tive proposals.

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM 135 INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

INTERNATIONAL PREPAREDNESS

Assessing the Y2K preparedness of OVERVIEW the international community has presented a special challenge to the Committee. While the Committee The Committee has tapped a num- can call on federal regulators and ber of sources for information on in- industry representatives to report on ternational Y2K preparedness. the status of their respective areas, it Within the government, agencies is very difficult to get acceptable as- such as the State Department, De- sessments from foreign countries. partment of Commerce, Department of Defense, U.S. Information Agency The Committee has legitimate and and Central Intelligence Agency, compelling reasons to have access to inter- seek information re- THE U.S. HAS A RE- national information garding the status of its SPONSIBILITY AS A WORLD via their respective neighbors and trading LEADER TO ENCOURAGE A overseas operations. International organi- partners. Besides the POLITICALLY AND interdependent nature of zations, such as the ECONOMICALLY STABLE the U.S. and world World Bank, United economy already em- ENVIRONMENT. Nations and NATO, phasized in multiple have provided vary- sections of this report, the U.S. has a ing degrees of insight. Finally, responsibility as a world leader to some private sector consultants encourage a politically and economi- have released reports rating the pre- cally stable environment. paredness levels of certain countries. Alerting countries to potential Y2K danger by encouraging the ex- With the exception of private sector change of information is one way the consultants, most sources have U.S. fulfills this role. hesitated to divulge specific information about foreign countries. The Furthermore, the nation may be reasons for this are numerous. In called upon to assist its neighbors in many cases, the least prepared cases of severe Y2K impact. The countries are those that depend U.S. has traditionally been one of the heavily on foreign investment and strongest supporters of humanitarian multinational companies to supple- aid around the globe. It is unlikely ment their economies. Panic over that we will turn our back on the in- Y2K concerns may cause investors ternational community in the after- to withdraw financial support. Lack math of Y2K. Therefore, the Com- of confidence in a country’s infra- mittee advocates a proactive ap- structure could cause multinational proach now so that Y2K-related re- companies to close their operations. percussions are reduced later. The results could topple a fragile

137 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

economy or a struggling foreign gov- The Department of Defense has ernment. concerns similar to those of the State Department, since many military personnel are stationed abroad and are dependent on their host coun- MAJOR INITIATIVES tries’ infrastructures. The Depart- ment of Defense, in conjunction with The State Department recognizes the State Department, is communi- the potential difficulties that embas- cating with its foreign counterparts to sies and foreign posts may face raise awareness and generate inter- come January 1, 2000. As a result, national forums to address the Y2K the State Department sent a survey problem. This includes such possi- to 260 posts around the world, the ble actions as inviting Russian and results of which will be used to pin- Chinese representatives to witness point troubled areas. The Y2K situa- the millennium change from moni- tions will be monitored throughout toring stations within the U.S. the duration of 1999, and, in cases of severe problems, the State Depart- The State Department Office of the ment will issue travel warnings, or Inspector General (OIG) is also en- encourage American nationals living gaged in Y2K assessments of se- abroad to return home. The State lected countries. Countries covered Department has already issued an to date include the following: edict stating that all embassies must be prepared to be self-sufficient for Latin America: Mexico, Chile and 30 days by January 1, 2000. More Panama; afflicted areas may necessitate longer-term plans. Africa: South Africa, Gabon, Cam- eroon and Ethiopia; In addition, the State Department chairs the International Relations Southeast Asia: Thailand, Hong Working Group of the President’s Kong, Singapore and the Philippines. Y2K Council. This working group plans to engage the U.S. embassies The OIG has planned the following in Y2K assessments of their host assessments for the upcoming countries and summarize results in a months: database that has been established by the U.S. Information Agency December: Mumbai and New Delhi, (USIA). Other federal agencies and India; the private sector are also expected to contribute to this assessment da- January: Europe—Frankfurt, Bonn, tabase, but the State Department is Berlin, Rome, Paris, Athens, London, still working out a process for gath- Moscow, Kiev and Warsaw; and ering and synthesizing all of this information. March: To be confirmed later, but may include China, Japan, Korea

138 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM and Vietnam, as well as Bolivia, short, the Committee has interpreted Paraguay and Brazil. forecasts with some skepticism.

ASSESSMENTS International organizations such as the World Bank and the United Na- tions have also engaged in Y2K out- The Committee feels comfortable reach programs. From June through commenting on the preparedness of October, the World Bank conducted countries only in general terms. As a high-level national and regional result, the Committee plans to focus seminars in developing countries. its attention on international prepar- The World Bank is providing plan- edness in the upcoming session. ning and implementation grants, as well as a tool kit for managing the Top-Tier Countries Y2K problem. Besides issuing a June resolution encouraging interna- At present, Canada, Australia, and tional Y2K cooperation, the United the United Kingdom have consis- Nations hosted a program in New tently appeared on the top of prepar- York City with representatives from edness lists. close to 100 countries on December 11, 1998. In order to encourage Canada: In 1997, Canada estab- participation, as well as induce lished a government-industry task countries to appoint Y2K project force to address Y2K issues across managers, countries too poor to key sectors of the economy. Can- send a Y2K coordinator could re- ada is encouraging compliance by ceive World Bank funding for travel providing small business tax relief for expenses. Y2K repairs. Additionally, a Sep- tember Organization for Economic Private sector consultants have used Co-operation and Development re- a range of data to speculate on the port stated that: Y2K status of countries. Consult- ants often have special relationships · 70% of businesses are taking ac- with corporate clients, including action, cess to proprietary data from multiple industries within a country. As a re- · 94% of medium and large firms sult, they can create models based are addressing the problem, and on assumptions supported partially by hard numbers and partially by in- · Close to one-third of Canadian sider experience, and make fairly businesses indicate that their credible estimates. However, most systems are ready. consultants will not reveal specific client information, making model Australia: Besides an internal Year verification difficult. Additionally, 2000 Project Office, the Australian even the most well-thought-out as- government established the Year sumption can prove incorrect. In 2000 National Strategy with $6 million (U.S.$) to alert private sector

139 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM businesses to Y2K danger. Australia only four departments and agencies, also took a strong position on Y2K responsible for 7 of the 48 mission- disclosure for public companies, in- critical functions, had made “good” sisting on Y2K disclosure for all pub- progress. lic Australian companies by June 30, 1998. As of July 1998, the following In Australia, PriceWaterhouse Coo- percentages of critical systems have pers reported recently that while been repaired1: business and government Y2K spending had increased 47% in the · 60% of underlying delivery of past year, average expected project health and national services, completion dates slipped from De- cember 1998 to May 1999. · 48% of social welfare and employment, The U.K. also faces problems. Prime Minister Blair’s attempt to · 33% of revenue collection, raise an army of 30,000 “bugbusters” fell short by 29,900 bodies, as of a · 40% of national security (not in- mid-September report. The low turn- cluding defense) and out throws doubt on the U.K.’s Action 2000 project’s ability to galvanize the · 34% of business critical functions private sector. in defense. This information on Canada’s, Aus- The United Kingdom: The U.K. has tralia’s and the U.K.’s Y2K programs put considerable effort into convinc- cannot begin to represent the sub- ing its European neighbors that the stantial efforts that these and other Y2K problem needs attention. In countries have made. Unfortunately, March of this year, Prime Minister even countries that have received Tony Blair stated that the U.K. was the best rankings still carry consider- dedicated to bringing Y2K to the top able Y2K risks, including the U.S. of the international agenda. Besides conducting surveys through its em- Europe Overall bassies, the U.K. pledged $16.7 million (U.S.$) to the World Bank to Cap Gemini, a consulting group with support Y2K efforts in developing a strong business relations through- countries. out Europe and the U.S., conducts regular Y2K assessments of Norway, Even among the most Y2K consci- Finland, Denmark, Italy, Belgium, entious countries, problems exist. Sweden, France, the Netherlands, Canadian Auditor General Denis De- the U.K., Germany, the U.S. and sautels submitted a report to his Spain. Cap Gemini has taken the government on December 1, 1998. task of sizing the Y2K problem, using The report acknowledged improve- self-reported estimates of anticipated ment since a 1997 audit, but ex- costs versus dollars spent. To com- pressed concern that work still pare countries of vastly different lagged in areas. As of June 1998, size, Cap Gemini reports data as

140 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

percentages of annual information technology spending. The Committee is not convinced that American companies have not over- Cap Gemini’s October data indicate estimated their preparedness as that the U.S. still leads in remedia- well. According to Cap Gemini, 5 out tion efforts as a percentage of esti- of 6 U.S. organizations express con- mated Y2K budget spent (61%). fidence in their business critical sys- While the Committee is pleased to tems. Somewhat disturbingly, virtu-

Cap Gemini's 99% 100 Y2K as a Percentage of IT Budget Estimated v. Spent 89% 81% 80

70% 65%

60 52% 55% 55% 48% 44% 41% 37% 40 Y2K as a Percentage of Annual IT Spending

61%

20 52% 37% 47% 52% 49% 57% 55% 46% 40% 55% 39%

0 Norway Finland Denmark Italy Belgium Sweden France Netherlands UK Germany USA Spain Country

% of Total Y2K Budget spent to date Total Y2K Budget as % of 1 Year's IT spending (Oct. 1998)

see this indication of progress, we ally all European countries express recognize that dollars spent do not confidence in their systems. Fortu- necessarily equate directly to com- nately, 98 % of surveyed American pleted work. companies are creating contingency plans, versus only 60% of European For example, Cap Gemini has ex- companies. These numbers do not, pressed concern that some Euro- however, include companies with pean countries have underestimated fewer than 100 employees. Y2K, and therefore have completed a smaller percentage of the neces- Further bad news was released in sary Y2K work than suggested by December 1998 from the European Cap Gemini’s research. Commission. The report warned

141 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

member countries that efforts to country, projecting a country’s vol- bring systems in line with Y2K are ume of Y2K repairs based on the not sufficient. The Commission also make-up of a given country’s econ- criticized the lack of information omy and estimating preparedness available about certain sectors and levels through in-country interviews, administrations, with the exception of surveys and personal contacts. the U.K. It is a sophisticated and time- Worldwide Comparison consuming process that results in imprecise data, at best. However, Data become increasingly specula- the Committee feels that even im- tive outside of the previously dis- perfect data provide more benefit cussed countries. Forecasts lever- now than perfect data 12 months age such techniques as estimating from today. computing personnel within a given

Estimated Y2K Estimated Y2K Soft- Total Repair ware Repair Cost Cost Percent of Systems Robbins/Rubin Y2K Country (% 1996 GDP) “Work in Progress” Schedule Indicator The USA $187,921,430,000 2.5% 0.83 0.87 Sweden $ 6,191,702,000 2.5% 0.78 0.86 The UK $ 42,931,317,000 3.7% 0.82 0.85 Canada $ 18,129,243,000 3.1% 0.81 0.85 Japan $105,964,254,000 2.3% 0.78 0.85 France $ 42,379,656,000 2.8% 0.78 0.84 Germany $ 60,544,165,000 2.5% 0.79 0.84 Belgium $ 7,232,049,000 2.7% 0.78 0.84 India $ 4,037,957,000 1.2% 0.75 0.84 Russia $ 32,246,348,750 7.3% 0.58 0.83 Netherlands $ 10,199,431,000 2.6% 0.77 0.83 Australia $ 9,894,632,000 2.5% 0.73 0.81 Italy $ 33,731,929,000 2.8% 0.77 0.79 Portugal $ 4,899,455,000 4.9% 0.69 0.79 Argentina $ 8,292,548,000 2.8% 0.58 0.79 China $ 4,442,256,500 0.5% 0.55 0.78 Korea $ 22,614,322,500 4.7% 0.68 0.78 Brazil $ 35,832,775,000 4.8% 0.61 0.78 Spain $ 17,328,201,000 3.0% 0.72 0.77 Mexico $ 19,250,198,000 5.7% 0.62 0.76 AVERAGE $ 33,703,193,508 3.3% 0.72 0.82 TOTAL $674,063,870,150

Using such techniques, Dr. Howard Group, has put together a table that Rubin, Chair of the Computer Sci- provides an indicator of Y2K prog- ence Department at Hunter College ress. The Robbins/Rubin Y2K and Research Fellow for the Meta Schedule Indicator quantifies the

142 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM current level of progress versus the projected state of progress. A score Japan: While scoring a respectable of 1.00 indicates that a country’s 0.85 on the Robbins/Rubin Indicator, Y2K progress is on schedule. A Japan has placed far lower on other value over 1.00 indicates that a rankings, such as the Gartner Group country is ahead of schedule and a rankings. value of less than 1.00 indicates that a country is behind schedule. By Dr. Despite significant improvement in Rubin’s calculations, no country is the past year, Japan may have un- ahead of or on schedule. The U.S. derestimated the scope of the Y2K score, 0.87, still indicates that the problem. According to a Bank of Ja- U.S. is 13% behind schedule. On pan survey, the majority of Japanese average, the countries included in banks have neither engaged in con- this study scored 0.82, indicating that tingency planning, nor checked the they have made 82% of their pro- Y2K exposure of customers and jected progress in addressing the counterparties. Since banking has problem. According to Dr. Rubin, proved to be one of the most ag- 0.75 is an important cutoff score— gressive sectors in addressing the after a project falls 25% or more Y2K problem around the globe, un- behind schedule, it becomes virtually derestimation on the part of the impossible to bring it back on Japanese banking sector may indi- schedule. cate even less awareness in other sectors. The Robbins/Rubin Indicator supports the Committee’s sense that the France and Germany: France and U.S., the U.K., and Canada are in Germany share a relatively high 0.84 relatively good shape to face the Robbins/Rubin rating, and both re- millennium. Results from other ceived praise in the Cap Gemini re- countries are more surprising, espe- port for significant improvement over cially when compared to the results the past 6 months. of the Gartner Group is research. However, qualitative reports suggest The Gartner Group leverages its that France and Germany have yet worldwide business network to col- to espouse a risk management ap- lect information from 87 countries proach to Y2K. The Committee feels and 15,000 companies. In the Gart- strongly that Y2K is not just a tech- ner Group’s third quarter estimates, nology problem, and worries that countries that ranked in the top of countries that simply focus on fixing Gartner’s four tiers will see at least the problem will fail to assess Y2K in one mission-critical failure in 15% of a broad enough scope, and may fail all companies and government to engage in contingency planning. agencies. Third- and fourth-tier countries are predicted to see over France and Germany may also suf- 50% of their systems experience fer from a preoccupation with the some level of interruption. conversion to the euro. In spring 1998, a survey by Neaman Comparing Results

143 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Bond, a consulting group, reported France and Germany may have led that both French and German com- the way in euro conversion at the panies ranked the euro conversion expense of Y2K remediation. as more important than Y2K preparations. As two of the most ardent supporters of a unified currency, Gartner Group Predictions of Failure for Countries

Australia, Belgium, Bermuda, Canada, Denmark, the Netherlands, 15% Ireland, Israel, Switzerland, Sweden, the U.K., and the U.S.A. 1

Brazil, Chile, Finland, France, Hungary, Italy, Mexico, New Zealand, 33% Norway, Peru, Portugal, Singapore, South Korea, Spain, and Taiwan 22

Argentina, Armenia, Austria, Bulgaria, Columbia, Czech Republic, Egypt, Germany, Guatemala, India, Japan, Jordan, Kenya, Kuwait, 50% Malaysia, North Korea, Poland, Puerto Rico, Saudi Arabia, 33 South Africa, Sri Lanka, Turkey, U.A.E., Venezuela, Yugoslavia

Afghanistan, Bahrain, Bangladesh, Cambodia, Chad, China, Costa Rica, Ecuador, El Salvador, Ethiopia, Fiji, Indonesia, Laos, 66% Lithuania, Morocco, Mozambique, Nepal, Nigeria, Pakistan, 44 Philippines, Romania, Russia, Somalia, Sudan, Thailand, Uruguay, Vietnam, Zaire, and Zimbabwe

Note: Countries listed in alphabetical order

Spain: Spain is behind in its Y2K remediation as indicated by all three of the Y2K problem. As Y2K proj- research reports. Worth noting, ects organize themselves, estimates however, is the pattern Spain’s Y2K tend to fall as managers realize that efforts seem to be taking. a focused approach can save time and money. Between April and October 1998, the percentage of Spain’s estimated Y2K This phenomenon highlights the im- budget jumped from 22% to 99%, portance of managerial guidance. indicating a dramatic increase in While a technology department can awareness among surveyed institu- fix a Y2K problem, it usually cannot tions. Cap Gemini explained this make decisions about work prioriti- tremendous change in terms of hu- zation, end-to-end testing and con- man nature. Companies are inclined tingency planning without support to panic and overestimate expendi- from high-level management. tures when first faced with the scope Spain’s massive jump in antici-

144 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

pated spending suggests that Span- 10.1%. While Canada falls in Gart- ish managers may have just discov- ner’s top tier, Japan and Mexico are ered the Y2K problem and have yet in the second and third tier, respec- to consider time- and resource- tively. saving options, such as triage and contingency planning. The Committee would also like to investigate the availability of critical imports, such as oil, in the light of CONCERNS potential Y2K disruptions. For example, the largest supplier of im- According to Gartner, the majority of ported oil to the U.S. is Venezuela, disruptions will be minimal. Only which Gartner reports as 9 to 15 10% of failures are expected to last months behind the U.S. in its Y2K more than 3 days. The question preparation. The Committee plans then becomes, which areas will face to seek more information on critical disruptions longer than 3 days and imports and trading partners. how severe will the impact of these failures be? This is the overall ques- As information on the impact of Y2K tion that the Committee hopes to ad- on the international front becomes dress in the following months. more substantial, the Committee may consider the need to recom- Specifically relating to the interna- mend certain governmental actions, tional sector, the Committee has a such as targeted outreach programs, special concern for the status of criti- or post-Y2K recovery efforts. How- cal U.S. trading partners. The top ever, the Committee cannot know trading partner of the U.S., Canada, the direction that its involvement will accounts for 20.5% of the U.S. world take until it examines the interna- trade (imports and exports). Japan tional sector more closely. accounts for 12% and Mexico

1 OECD Report, The Year 2000 Problem: Im- pacts and Actions.

145 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

LEGISLATIVE ACTIVITIES

S. 22, Commission on the Year enforceable, Commission-level 2000 Computer Problem Act release published on August 4, Introduced September 1996 1998.

This bill was the first legislative S. 1671, The Examination Parity attempt to address the Y2K problem. and Year 2000 Readiness for It called for the establishment of a Financial Institutions Act commission to study the Y2K Introduced on February 24, 1998 problem and report the results to the President. The study would propose procedures for addressing federal, The legislation gave the Office of state and local government computer Thrift Supervision and the National systems, as well as recommend Credit Union Administration (NCUA) levels of appropriation for explicit authority to examine and remediation efforts . service corporations and subsidiaries owned by the insured institutions to the same extent that other financial S. 1518, The Year 2000 Computer institution regulatory agencies were Remediation and Shareholder permitted to do so. The legislation (CRASH) Protection Act of 1997 also required NCUA to take certain Introduced on November 10, 1997 actions to enhance remediation efforts within the credit union sector. The Committee staff has already The bill sought to require publicly seen the positive results of this traded companies to disclose five legislation, as regulators’ judiciously categories of information related to use the threat of cease and desist their Y2K remediation and risk orders to keep financial institutions management status without regard from doing business with unsound to materiality. The introduction of software contractors. this legislation prompted the Securities and Exchange S. 2000, A bill to ensure that Commission to publish Staff Legal businesses, financial markets and Bulletin No. 5 (January 12, 1998), a the Federal Government are reminder to public operating taking adequate steps to resolve companies, investment advisers and the Year 2000 computer problem investment companies to consider Introduced on April 29, 1998 their disclosure obligations relating to anticipated costs, problems and In introducing this legislation, uncertainties associated with the Chairman Bennett sought to amend Y2K issue. The staff legal bulletin the Employee Retirement Income was later superceded by Interpretive Security Act of 1974 (ERISA) to Release No. 33-7558, an require fiduciaries of employee

147 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM benefit plans to consider the Y2K Y2K computer problem by limiting computer problem in making the liability of companies that investment decisions. The provide good faith Y2K disclosure. legislation also would have codified S.2392 passed the Senate the creation of the President's (amended) on September 28, 1998 Council on Y2K Conversion. The and was signed into law October 19, Chairman felt that it was critical for 1998 (P.L. 105271). the administration to dedicate more than a task force to this complex job. Specifically, in all civil litigation He wants the council to be vested including certain antitrust actions, the with actual power, authority, and act limits the extent to which Y2K accountability. statements can be the basis for liability. It also prevents certain S.2392, Year 2000 Information evidentiary uses, against the maker, Readiness and Disclosure Act of a subset of such statements. Introduced July 30,1998 However, the act ensures that only responsible, good faith information- Chairman Bennett intended to sharing receives such protection. encourage the disclosure and exchange of information about the

148 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

COMMITTEE PRIORITIES FOR 1999

For the remainder of 1999, the · Identifying national and intern a- Committee will continue to focus tional security issues and co n- primarily on the seven industries a d- cerns. dressed by this report. A renewed focus will be brought to bear on the SECTOR-BASED ISSUES crosscutting effects of increased lit i- gation and the overall health of the world economy. In 1998, the Committee focused pr i- The Y2K problem is a dynamic one, marily on domestic Y2K issues. The and predicting with any certainty Committee investigated critical infr a- which new issues may arise is i m- structure and industry sectors—util i- possible. Nevertheless, there are ties, healthcare, telecommunications, certain areas that will be a high pr i- transportation, financial institutions, ority for the Committee in 1999. government and business—in an These areas include: attempt to assess the Y2K status of each. Broad-based assessments · Revisiting the domestic industry were practically non-existent, making and infrastructure sectors first fact-based conclusions impossible. examined in 1998; In that regard, Chairman Bennett’s words seem even more appropriate: · Placing increased emphasis on “We are flying blind into the Year international Y2K preparedness;

· Monitoring federal government Additional information requested by preparedness, but turning more the Committee on the status of var i- attention to state and local go v- ous national and international indu s- ernment prepare dness; tries is expected to be available in early 1999. The Committee will, · Evaluating contingency and therefore, continue its investigations emergency preparedness pla n- and conduct hearings in each of ning; these sectors throughout the first half of 1999. · Determining the need for add i- tional Y2K legislation, or delaying Rather than a mere continuation of implementation dates of new the broad-based hearings conducted regulations; in 1998, future hearings will be smaller and will focus on specific · Examining litigation issues su r- problem areas or industries in a rounding the Y2K problem; a nd given sector.

149 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

The Committee is concerned that INTERNATIONAL ISSUES many state and local governments are not doing enough, either b e- Even if the U.S. could remediate all cause they are unaware of their vu l- of its systems and embedded pro c- nerabilities or because they have i n- essors in time (which it cannot), it sufficient resources. The Committee would, in an economic sense, still be will continue to examine these issues at the mercy of the rest of the world. in greater detail in 1999, and work with individual House and Senate The U.S. is part of, and dependent members to take corrective actions on, the global economy. Like the where needed. suppliers and partners within any given industry supply chain, Ame r- ica’s vulnerability to the Y2K problem CONTINGENCY PLANNING extends to other countries. The Committee’s research into each i n- The Committee will continue to frastructure and industry sector hig h- monitor the Y2K status of critical i n- lights U.S. dependence on other dustry and infrastructure sectors, but countries, from Venezuela for oil to will turn its attention to contingency Denmark for insulin. and emergency preparedness pla n- ning in the last half of 1999. The Committee will turn its attention to countries economically and polit i- The Committee will conduct hearings cally important to the United States. and make recommendations based It will examine various sources of on the results of its industry and i n- information to determine the state of frastructure assessments conducted readiness of these countries and if in the first half of the year. The warranted, will recommend actions Committee’s goal will be to ensure to assist in their remediation efforts the availability of basic emergency or to reduce the risks unprepared services and active contingency countries pose to the United States. plans in the event of Y2K disru p- tions. GOVERNMENT PREPAREDNESS LEGISLATION

The federal government openly The Committee will continue to e x- shares information on its own Y2K amine the need for legislation or preparedness. While not all of the modifications to existing statutes and findings are good, at least the info r- regulations. The intent of such le g- mation is available. Less visible is islation must be to provide incentive the status of preparedness of state for greater remediation efforts, to e n- and local governments. Their status sure scarce resources are devoted of readiness will directly affect most to remediation, and to encourage Americans, because this is where both greater sharing of information they will turn if there is a failure in and a fair approach to the litigation basic services, such as util ities.

150 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM that might arise from Y2K pro blems. sues such as the status of nuclear, chemical, and biological weapons LITIGATION and our ability to protect U.S. pe r- sonnel and interests here and abroad are of utmost concern to all The Committee will continue to Americans. monitor and hold hearings on Y2K litigation issues. It will support e f- The Department of Defense has forts to minimize the impact of Y2K monumental Y2K problems, and it is litigation on the court system while severely behind in addressing them. continuing to hold individuals and It is at risk of not completing rem e- companies responsible for their a c- diation of all of its mission-critical tions. systems in time. In addition, its i n- frastructure of more than 550 bases NATIONAL SECURITY around the world may not be ready. For these reasons, the Committee intends to foster continuous and The Y2K computer problem could considerable attention on national pose a risk to our national security if security issues during 1999. not properly addressed. Broad i s-

151 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM APPENDIX I APPENDIX I

INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

RECENT EVENTS

Several key events have occurred not make this deadline, including since the close of the 105 th Con- one-third of the nuclear power- gress. The following is a partial list. generation facilities.

PRESIDENT’S YEAR 2000 HEALTHCARE COUNCIL · The stockpiling of medications to · On January 7, 1999, the Pres i- insure that 26.5 million chron i- dent’s Council on Year 2000 cally ill citizens are protected Conversion released its first during the Y2K period remains an quarterly summary of asses s- open issue. The Special Co m- ment information from its mittee’s Vice Chairman, Senator numerous industry-sector wor k- Christopher Dodd, has requested ing groups. This report almost that the President’s Council on exclusively described the coord i- the Year 2000 develop a policy nation processes at work in the and procedural solution by May various sectors and revealed little 1, 1999. quantitative information on Y2K readiness. TELECOMMUNICATIONS

UTILITIES · On January 14, 1999 the Network Reliability and Interoperability · On January 11, 1999, the North Council presented its initial fin d- American Electric Reliability ings on the remediation efforts of Council (NERC) issued its se c- the telecommunications industry ond quarterly report (fourth which revealed that the industry quarter 1998) to the Department plans to be Y2K ready by June of Energy. It boasted a 98% pa r- 1999. ticipation rate in its survey and reported steady progress in Y2K · The Teleco Forum completed its remediation. However, 56% of network testing and plans to r e- the nation’s 3,200 electric utilities lease its report in February 1999. have yet to complete the most The Forum found no major difficult phase of remediation and interoperability problems in the testing with less than 5 months to network configurations tested. go to NERC’s self-imposed dea d- This testing focused heavily on line of June 30, 1999. The report the networks providing local indicates that several utilities will

153 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM APPENDIX I APPENDIX I

INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

phone service. · The American Public Transport Association, the major trade a s- · The Alliance for Telecommunic a- sociation of American mass tions Industry Solutions (ATIS) transit organizations, convened a began testing for inter-network Y2K workshop in Houston in interoperability with results e x- January 1999. Over 100 org ani- pected by the end of the first zations were represented. quarter of 1999. This testing will However, this was a small pe r- focus primarily on long distance cent of the over 6,000 mass phone service. ATIS will also be transit organizations in the U.S. testing the Government’s Eme r- Frank presentations at this gency Phone System. meeting revealed that major me t- ropolitan transit operations were · In January 1999, the Joint Tel e- not going to be completely ready communications Resources for January 1, 2000. Conti n- Board (JTRB), which advises the gency Planning and Continuity of President on emergency tel e- Business Plans are a must for communications allocations, met many entities in this sector if to discuss what role it would play major disruptions in public transit in a Y2K emergency. This was systems are to be avoided in the the first meeting of the JTRB early part of 2000. during the Clinton admin istration. FINANCIAL SERVICES TRANSPORTATION · The results of third quarter SEC · The December 1998 U.N. mee t- filings of public companies were ing of Y2K leaders from over 100 mixed. While a far larger pe r- countries identified ports and centage of public companies maritime shipping operations addressed Y2K in their filings, around the world as an area of many disclosures revealed little in great concern. There is very little the way of significant i nformation. known about the Y2K readiness of this sector, which greatly i n- GENERAL GOVERNMENT fluences the global economy. In the U.S., over 95% of imports and exports go through U.S. · The United States Fire Admin i- ports. To raise the visibility of the stration is currently conducting a seriousness of this issue worl d- survey of 4300 Public Safety A n- wide, the International Maritime swering Points to assess the Organization, a U.N. affiliate, will readiness of 911 Systems nation host a major conference and wide. Less than ten percent of workshop on this topic in London those surveyed have responded during March 1999. to date, and no firm concl u-

154 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM APPENDIX I APPENDIX I

INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

sions can be reached about the initial assessment of Y2K and the data at this point. food supply. The assessment covered three areas: domestic · FEMA has commenced the first food supply; imports and exports; of a series of ten regional Y2K and transportation. The report Preparation and Consequence said, “the state of readiness Management Workshops. These within the food industry is e n- workshops are intended to pr o- couraging. An interruption in the vide a forum where emergency food supply so severe as to management and fire services threaten the well-being and basic communities can discuss initial comfort of the American public is Y2K compliance assessments, unlikely.” The assessment is potential consequences of Y2K based on a December 11, 1998, disruptions, and coordination of report by the Gartner Group on local, state and federal r e- behalf of USDA. sponses. These workshops are in preparation for the national- · The National Federation of Ind e- level Y2K consequence ma n- pendent Businesses, released agement exercise scheduled in the report, “Small Business and Washington, DC in June 1999. the Y2K Problem, Part II,” on January 5, 1999. It concludes · FEMA made significant strides in that for most small business preparing the nation’s emergency owners Y2K is not a priority. For services by initiating the process those that have taken action to to amend the national Federal address Y2K, the cost has been Response Plan to account for minimal. potential Y2K disruptions and events. This plan coordinates the · On December 16, 1998, Food Federal government’s response Distributors International (FDI) to major emergencies and di s- completed their second survey asters. FEMA also initiated a intended to measure their me m- series of regional contingency bers’ Y2K readiness. Both planning meetings in February to surveys indicated that all respo n- coordinate Federal and local Y2K dents had a Y2K compliance preparations. program. However, the second survey highlighted two areas of GENERAL BUSINESS concern: late Y2K program target completion dates and the lack of plans to perform business cont i- · In December 1998, the Food nuity or contingency planning. Supply Working Group, chaired FDI plans to repeat this survey at by the US Department of Agr i- six-week intervals. culture, of the President’s Council on Y2K Conversion released an

155 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM APPENDIX I APPENDIX I

INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

· On February 5, 1999, the Senate did indicate increased confidence Special Committee on the Year in respondent’s ability to meet 2000 Technology Problem held their own internal Y2K goals. its first hearing of the 106 th Con- gress. This was the first of two INTERNATIONAL hearings focusing on the Y2K preparedness of the food supply – from ‘farm-to-fork’. Senator · On December 11, 1998, the Richard Lugar, Chairman of the United Nations sponsored a Senate Agriculture, Nutrition, and daylong international Y2K event. Forestry Committee; The Honer- Over 120 member nations sent able Daniel Glickman, Secretary representatives. For many n a- of the Department of Agriculture; tions, this represented an Tyrone Thayer, Corporate VP & opportunity for coordination with President of Cargill Foods; Allen their neighbors and trading par t- Dickason, CIO of Suiza Foods ners. Unfortunately, for others, it Corp; and Ken Evans, President marked the beginning of their of the Arizona Farm Bureau pr o- countries’ Y2K remediation e f- vided expert testimony at the forts. hearing. Testimony indicated significant progress has been · On January 26, 1999, the World made since October 1998 within Bank released the results of its the United States food supply survey of 139 developing cou n- chain. However, it also showed tries. Only 54 countries had that there is much remaining to initiated national Y2K programs, be done in the remaining months and just 21 were taking concrete of 1999. The second hearing is steps to remediate their compu t- scheduled for March 2, 1999 and ing systems. The World Bank will include witnesses from concluded that developing cou n- SUPERVALU, Kroger, Kraft, tries face serious hurdles in Nestle, the Food Marketing Inst i- addressing their Y2K problems, tute, and Grocery Manufacturers including lack of awareness, of America. funding, and available IT profe s- sionals. · On February 17, 1999, FDI r e- leased the results of their third · A survey by Taiwan’s Y2K office Y2K member survey. As with the indicated that 40% of one million previous two surveys, both late small- and medium-sized bus i- Y2K program target completion nesses have taken no action to dates and the lack of plans to remediate their computer sy s- perform business continuity or tems. contingency planning are a co n- cern. However, the responses

156 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM APPENDIX I APPENDIX I

INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

PENDING LEGISLATION The bill establishes a program under which the government, · S. 96 - The Y2K Act (Introduced through the Small Business A d- January 19, 1999) ministration, will guarantee loans made to small businesses to The bill intends to regulate inte r- remediate their Y2K problems state commerce by providing for and to provide relief for a su b- the orderly resolution of disputes stantial economic injury incurred arising out of Y2K-based pro b- by the small business as a direct lems. Among other things, the result of Y2K problems. bill provides that a Y2K action may not proceed to trial unless · H.R. 179 The Businesses Unde r- the defendant has been given the going the Glitch (BUG) Act opportunity to fix the problem; (Introduced January 6, 1999) imposes a cap on punitive da m- ages; and sets forth liability rules The bill provides a tax deduction that apply to product sellers, from gross income for the Year renters, and lessors. 2000 computer conversion costs of small businesses. The aggr e- · S. 174 - The Y2K State and Local gate amount allowed as a Government Assistance Pr o- deduction is limited to $40,000. grams (GAP) Act of 1999 (Introduced January 19, 1999) · H.R. 192 - The Year 2000 Co n- sumer Protection Plan Act of The bill provides funding for 1999 (Introduced January 6, states, through grants, to help 1999) states and local governments make programs they administer The bill provides judicial and a d- Y2K compliant. Grant applic a- ministrative proceedings for the tions must describe a proposed resolution of Year 2000 proces s- plan for the development and i m- ing failures. Among other things, plementation of an applicable the bill requires the clerk of the Y2K compliance program, along court receiving a Y2K-related with a proposed budget, a r e- complaint to refer that complaint quest for a specific funding to a mandatory arbitration pr o- amount, and an identification of a ceeding, sets forth a standard of funding source for completion of proof for recovering damages for the plan if applicable. Y2K-related failures, and places a cap on punitive damages. · S. 314 - The Small Business Year 2000 Readiness Act (Intr o- duced January 27, 1999)

157 SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM APPENDIX II APPENDIX II

INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

ACRONYMS USED IN THIS REPORT

AGA American Gas Association AHA American Hospital Association AMA American Medical Association AMSA Association of Metropolitan Sewerage Agencies AMWA Association of Metropolitan Water Agencies AOPL Association of Oil Pi pelines APCO Association of Public Safety Communications Officials APGA American Public Gas Association APPA American Public Power Association APTA American Public Transit Association ATA Air Transportation Association ATC Air Traffic Control ATIS Alliance for Telecommunications Industry Solutions ATS Air Traffic System AWWA American Water Works Association BCAG Boeing Commercial Aircraft Group CAD Computer Aided Dispatch CEA Canadian Electric Association CEO Chief Executive Officer CIO Chief Information Officer CMA Chemical Manufacturers Association COTS Commercial Off-The-Shelf Software CPE Customer Premise Equipment CPI Chemical Process Industries CRASH Computer Remediation and Shareholder CSB Chemical Safety and Hazard Investigation B oard CSREES Cooperative State Research, Education, Extension Office DCS Digital Control System DOC Department of Commerce DOE Department of Energy DOJ Department of Justice EC Electronic Commerce EDI Electronic Data Interchange EEI Edison Electric I nstitute EMS Emergency Medical Services EPA Environmental Protection Agency EPRI Electric Power Research Institute ERISA Employee Retirement Income Security Act FAA Federal Aviation Administration

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM 159 APPENDIX II APPENDIX II

INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

FCC Federal Communications Commission FDA Food and Drug Administration FDIC Federal Deposit Insurance Corporation FERC Federal Energy Regulatory Commission FFIEC Federal Financial Institutions Examination Council FRB Federal Reserve Board GAO General Accounting Office GETS Government Energy Telecommun ications System GISB Gas Industries Standard Board GPA Gas Processors Association GRI Gas Research Institute GSA Government Service Administration HCFA Healthcare Finance Agency HF High Frequency HIMA Health Industry Manufacturers Association HUD Housing and Urban Development HVAC Heating, Ventilation and Air Conditioning IATA International Air Transport Association ICAO International Civil Aviation Organization ICI Investment Company Institute INGAA Interstate Natural Gas Association of America IPAA Independent Petroleum Association of America IT Information Technology ITAA Information Technology Association of America ITU International Telecommunications Union JCAHO Joint Commission Accreditation of Healthcare Association JIT Just in time LANs Local Area Networks LNP Local Number Portability MEP Manufacturing Extension Program MOU Memorandum of Understanding MTA Mass Transit Agencies NACO National Association of Countries NAS National Airspace System NASA National Air and Space Admi nistration NASIRE National Association of State Information Resource Executives NATCA National Air Traffic Controllers NATO North American Treaty Organization NAWC National Association of Water Companies NCS National Communications System NCUA National Credit Union Administration NEI Nuclear Energy Institute NERC North American Electric Reliability Council

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM 160 APPENDIX II APPENDIX II

INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

NFIB National Federation of Independent Business NGA National Governors Association NGC National Gas Association NGSA National Gas Supply Associ ation NIST National Institute of Standard and Technology NPGA National Propane Gas Association NPRA National Petroleum and Refiners Association NRC Nuclear Regulatory Commission NRECA National Rural Electric Cooperative Association NRIC Network Reliability and Interoperability Council NSF National Science Foundation NSTAC National Security Telecommunications Advisory Committee OCC Office of the Comptroller of the Currency OECD Organization for Economical Cooperation and Development OIG Office of the Inspector General OMB Office of Management Budget OPM Office of Personal Management OTS Office of Thrift Supervision PBX Private Branch Exchange Equipment PCCIP President’s Commission on Critical Infrastructure Protection PMAA Petroleum Marketers Association of America PN Public Network PSAP Public Safety Answering Points PSN Public Switch Network PTTC Petroleum Technology Transfer Council PUC Public Utility Commission PWBA Pension and Welfare Benefits Administration PWS Public Water System RUS Rural Utilities Service RTU Remote Terminal Units SBA Small Business Administration SCADA Supervisory Control and Data Acquisition SEC Securities Exchange Commission SIA Securities Industry Association USDA United States Department of Agriculture VA Veterans Administration WEMA Water Equipment Manufacturers Association

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM 161 APPENDIX III APPENDIX III

INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

Y2K SOLUTION APPROACHES

There are multiple solutions to the problem. · Redevelop software: Redo the Each has some merit, such as quick application software so that it implementation time, and some drawbacks, becomes compliant. such as limited ranges of applicability. For a · Year interception: Catch all date relative comparison of these techniques and calculations and replace erroneous 1 how long they take to implement, see figure 1 . results with correct ones. · Windowing: Choose an appropriate · Data-date expansion: Convert all two-digit year, for example 1950, and process dates to four digits in the data files. all years between 50 and 99 as 20th · Software-date expansion: Handle the date century dates, all years between 00 expansion requirements in the software and 49 as 21st century dates. doing the calculation. · Year shifting: Use the 28-year cycle · Compliant commercial software: Purchase of the calendar and shift dates until Y2K compliant software that meets your all dates that need to be processed needs. are in the same century. · Binary date encoding: Modify the software to · Manual: Reinstitute non-automated represent dates at the bit level. Two bytes, processes. or 16 bits, can account for over 65,000 years. 1 “Year 2000 Survival Guide,” Edmund X. · Database duplication: Develop two- and DeJesus, BYTE Magazine, July 1998, p. 53. four-digit versions of databases to work with compliant and non-compliant software. 0 Year Interception Manual Compliant 12 Year shifting commercial software Windowing Redevelop Binary date software (sm) encoding 24 Redevelop Software-date software (lg) expansion Months to Implement Database 36 duplication

Data-date expansion 48 Lowest Performance/Reliability Highest

Figure 1. Relative Comparison of Y2K Solutions

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM 163 APPENDIX III APPENDIX III

INVESTIGATING THE IMPACT OF THE YEAR 2000 PROBLEM

SENATE SPECIAL COMMITTEE ON THE YEAR 2000 TECHNOLOGY PROBLEM 164 1 NRIC Network Interoperability: The Key to Competition,, July 15, 1997.

2 NCS report

3 Testimony of Dr. Judith List, July 31, 1998.

4 The President’s National Security Telecommunications Advisory Committee, The Network Group Report on Y2K &Telecommunications, September 10, 1998, page 2.

5 Year 2000- The Enemy within the Network (GSA Conference Presentation November 1998) Steve Prentice.

6 NRIC Network Interoperability: The Key to Competition, July 15, 1997.

7 Assessment of the Year 2000 Impacts on the Public Network, The National Communications System, October 1998.

8 Letter from Senator John Kyl (R-AZ) to FCC Chairman William Kennard, March 30 1998.

9 Testimony of Gerard Roth before the Special Committee on the Year 2000 Technology Problem, July 31, 1998.

10 In April 1998, the Minnesota Department of Public Service surveyed 100 telephone utilities and received 84 responses. The results were encouraging: 75% had a Y2K project manager and 55% had developed detailed plans. Scott Reiter, National Telephone Cooperative Association, GSA Conference, October 21, 1998.

11 Ramu Potarazu, INTELSAT, Testimony before the Special Committee on the Year 2000 Technology Problem, July 31, 1998.

12 Ibid.

13 Louis Lavelle, “Programmers Racing to Head Off Computer Doomsday;” The Bergen Record, Bergen, New Jersey, Sunday, January 25, 1998. “Our customers have a lot to worry about,” he said. “The thing about this whole year 2000 problem is we can get it right. But if everybody else doesn’t get it all right, what is the point? We are only one link in the chain…we all have to get it right.” (John Pasqua, AT&T.)

14 The President’s Commission Critical Infrastructure Protection, October, 1997.

15 Ibid.

16 Ibid.

17 The JTRB membership includes senior staff from the FCC, NCS, Department of Defense, State, Commerce, Federal Emergency Management Agency, and General Services Agency.

18 Dr. Judith List, Bellcore.

19 Jack Grubman, “Financial Analyst See End to Market Turmoil,” Communications Daily, October 7, 1998, pp. 7-8.