Exactly a month out from when the Census Bureau will roll out its internet self-response platform for the 2020 population count, the Government Accountability Office has flagged significant IT challenges, “including those related to addressing cybersecurity weaknesses in a timely manner.”
While the bureau successfully deployed five IT systems last month that support recruiting and hiring activities, Nick Marinos, GAO’s director of IT and cybersecurity, said the bureau faces challenges rolling out five of the remaining 11 systems, including four that support internet-self response.
Insight by Micro Focus Government Solutions: Learn from agency and industry executives as they explore why protecting data requires a comprehensive approach involving every part of the IT chain – people, policy, infrastructure and applications in this exclusive executive briefing.
All told, the bureau will rely on 52 IT systems for decennial count operations.
GAO auditors, in a report released Wednesday, also found that the bureau recently identified a scalability issue that prevented it from meeting its goal of having up to 600,000 users on the self-response site at any time.
As a result, the bureau, according to GAO, decided last week that it would use its backup systems to manage internet self-response.
“Late design changes such as a shift from one system to another can introduce new risk during a critical moment,” Marinos told members of the House Oversight and Reform Committee at a hearing Wednesday.
By the bureau’s own estimates, the self-response site won’t need to support that much traffic at any moment during operations.
At a Census Scientific Advisory Committee in March 2019, Michael Thieme, the assistant director for decennial census programs, systems and contracts, said that based on the models the bureau worked on for the past six years, it expects a maximum of 120,000 concurrent users will respond to the census online at any time.
However, the bureau planned to build the platform to handle up to 600,000 concurrent users, even though it remains unclear if the site will ever encounter that volume of traffic.
“It’s kind of like the Brooklyn Bridge, you build it five times stronger than you need it to be, and it’ll last a hundred or 200 years,” Thieme said at the meeting.
The bureau has worked closely with the Department of Homeland Security and its Cybersecurity and Infrastructure Security Agency to tackle challenges that include addressing cyber vulnerabilities, protecting the privacy of census responses and curbing disinformation about the count online.
However, GAO has previously recommended that the bureau address concerns on its cyber to-to list “in a more prioritized and timely way,” Marinos said.
“The technology innovations that the bureau plans to rely on for the 2020 census create opportunities for increasing efficiency and effectiveness of the count. However, they also bring with them significant IT and cybersecurity risks,” he added. “Ultimately, the success of operations in the upcoming months will be directly tied to how the bureau continues to manage these risks.”
GAO’s findings raised concerns from members about the integrity of the upcoming population count.
Committee Chair Carolyn Maloney (D-N.Y.) said the Trump administration’s efforts to prepare for the 2020 count have been “woefully inadequate” and could jeopardize efforts to secure a complete and accurate count.
Meanwhile, Del. Eleanor Holmes Norton (D-D.C.), citing issues raised by GAO and the Commerce Department’s inspector general — which found last June that bureau failed to secure the most privileged user accounts for its 2020 cloud infrastructure — said the “Iowa primary debacle comes to mind when I think of the census going digital.”
Al Fontenot, the associate director for decennial programs, said the bureau stores decennial census data in multiple areas in the cloud to guarantee security. He said the bureau also regularly backs up that data.
“We can recover data if we had a breach or a situation like that,” Fontenot said.
Census Bureau Director Steven Dillingham said the bureau had addressed all the issues raised in the Commerce IG report.
Meanwhile, the bureau has fallen short of its recruiting goals.
In order to hire 320,000 to 500,000 enumerators to conduct nonresponse follow-up work that will take place mostly in May, the bureau is looking to bring in 2.6 million job applications. So far, it has about 2.2 million.
But what’s more troubling, said Chris Mihm, GAO’s managing director for strategic issues, is that 202 of 248 area census office fell short of their individual recruiting targets as of February.
“This is concerning because if the bureau does not recruit sufficient applicants, it may have difficulty hiring enough staff to complete upcoming operations, leading to delays, increased costs and eroded data quality,” Mihm said.
Dillingham told members of the committee that the bureau is receiving 20,000 applications a day, and is on track to meet the high end of its hiring goals by the first week of March.
The number of enumerators the bureau needs to hire, Dillingham explained, depends on the number of households that self-respond to the census questionnaire.
Under a “worst-case scenario,” if the self-response rate drops below 55%, “which no one expects,” Dillingham said the bureau would then need about 500,000 enumerators to complete non-response follow-up.
The bureau, he added, currently has four applicants for every temporary enumerator hire, but he said he would like to see five or even six applicants for every position to select higher-quality candidates with in-demand language skills.
“We have absolute confidence, there is no one at the Census Bureau worried about us not having recruits overall in the country,” Dillingham said.
The bureau is also taking steps to keep applicants in the loop with where they stand in the hiring process.
Rep. Ayanna Pressley (D-Mass.) said constituents have “have been given the runaround, or have been left waiting to hear for weeks on end from the Census Bureau on the status of their applications.”
Fontenot said the issue is that people signed up for census jobs online months ago, but the bureau won’t begin selection for enumerator jobs until March.
“People missed that,” Fontenot said, adding applicants will now receive a notification at least two weeks from submitting their application that the bureau has received it, and will begin hiring in March.
Meanwhile, the Office of Personnel Management has reminded agencies that current federal employees can accept temporary census work during decennial operations, “receive pay for more than one federal position, specifically short-term, temporary jobs affiliated with the 2020 Census.”