Telecommunications and Call Centers: Observations on Federal Contracting Practices

The federal government relies on an extensive global telecommunications network to carry out operations and provide information to the public. These networks and call centers, which handle public inquiries, are often maintained or supported by contractors. Concerns have been raised about the extent to which federal contractors are subcontracting or offshoring work, and have in place worker protections and mechanisms to secure the technologies and the data they handle.

GAO was asked to review aspects of contracting for federal telecommunications and call centers, including the extent of subcontracting and offshoring. This report provides information on, among other things (1) federal obligations on telecommunications and call center contracts, (2) worker protections identified in selected contracts, and (3) data security and privacy protections identified in selected contracts.

GAO analyzed federal procurement data for fiscal years 2014 through 2018 (the most recent available), reviewed a nongeneralizable sample of five contracts from three agencies with significant telecommunications and call center procurements to identify worker protections and data security and privacy protections; and interviewed relevant officials and federal contractors about contracting and industry trends.

The federal government obligated over $30 billion for telecommunications contracts and almost $4 billion for call center contracts from fiscal years 2014 through 2018. On average for the 5-year period, telecommunications and call center obligations were a nominal portion of total federal spending—accounting for 1.2 percent and less than 0.2 percent, respectively. Defense agency obligations accounted for the majority of federal telecommunications spending to support a range of information capabilities across the full spectrum of military operations. The Department of Health and Human Services accounted for the majority of call center obligations to support customer inquiries about Medicare and the health insurance marketplace, among other services.

Federal procurement data systems do not collect information that can provide insight into the extent of subcontracting or offshoring—including for telecommunications and call center contracts—because they were not designed to do so. GAO's review of selected contracts found that four of the five contracts expressly stated that some or all work must be performed within the continental United States or by U.S. citizens.

GAO identified several examples of worker protection requirements in the five selected contracts, generally falling into the areas of wages and hours, workplace safety and health, and protections against certain employer actions. With regard to data security and privacy protections, the five selected contracts GAO reviewed included requirements to limit access to data systems and data maintained, establish security management procedures for and monitoring of data systems, or establish contingency plans for how to provide continued or restored services when system interruptions or problems occur.

The federal government relies on an extensive and globalized  telecommunications network that includes systems and equipment to  communicate by wireline, wireless, satellite, and cable to carry out the  operations of the government and provide information to the public. In  addition, call centers are an essential component of federal agencies’  operations, enabling them to directly connect with the public to handle  inquiries. The telecommunications networks and call centers rely on a  vast array of workers to operate and maintain the underlying systems and  equipment and respond to inquiries. Ensuring the workplace safety and  health of these workers and securing the technology and data maintained  are essential to protecting national security, ensuring continuity of  government operations, and maintaining accurate information. Recent  efforts by the Congress and the executive branch to prohibit the use of  certain telecommunications equipment and services produced or provided  by specific foreign vendors highlight concerns about federal contracting  for telecommunications. In addition, many federal systems, such as those  used by federal call centers that interact with the public, maintain  personally identifiable information that must be protected to ensure the  confidentiality, integrity, and availability of this information and effectively  respond to data breaches and security incidents, when they occur.

You asked us to review certain aspects of federal telecommunications  and call center contracting, including observations on the extent and  effect of offshoring—which generally refers to obtaining goods or services  through non-U.S.-based subcontractors. This report discusses: (1) total  federal obligations on telecommunications and call center contracts for  fiscal years 2014 through 2018; (2) worker protections identified in  selected telecommunications and call center contracts; and (3) data security and privacy protection requirements identified in these contracts.  In addition, we are including information on employment trends for the  telecommunications and call center industries for calendar years 2014  through 2018 in appendix I.

To determine the level of federal obligations on telecommunications and  call center contracts, we extracted the most recent data available from the  Federal Procurement Data System-Next Generation (FPDS-NG) for fiscal  years 2014 through 2018, using the North American Industry  Classification System (NAICS) codes for these industry sectors.

To identify examples of worker protections and data security and privacy  protections in federal contracts, we selected a nongeneralizable sample  of five contracts from three agencies with some of the highest obligations  for telecommunications and call center contracts during fiscal years 2014  through 2018. Specifically, we selected (1) the Department of Defense  (DOD) because it obligated the highest amount for telecommunications  contracts; (2) the Department of Health and Human Services (HHS)  because it obligated the highest amount for call center contracts; and (3)  the General Services Administration (GSA) because it provides a  government-wide contract available for agencies to place orders for  telecommunications and call centers. We then identified the component  within each agency that obligated the most for these services or that  provides a large government-wide contract vehicle. The components  were DOD’s Defense Information Systems Agency (DISA), HHS’s Center  for Medicare and Medicaid Services (CMS), and GSA’s Federal  Acquisition Service. We selected five contracts, which included a variety  of telecommunications and a call center:

DISA’s DOD Information Network services contract to provide day-to- day support for information capabilities across the spectrum of military  operations;

DISA’s Emergency Preparedness Telecommunications Services  contract to provide priority wireless communications for U.S.  government leaders in the event of massive wireless network  congestion;

CMS’s call center contract to provide management and staffing of call  centers to respond to beneficiary inquires about Medicare and  consumer inquiries about the Health Insurance Marketplace;

GSA’s Networx services contract to provide voice and data, wireless,  and management and application services, including video and audio  conferencing, as well as mobile and fixed satellite services for federal  agencies; and

GSA’s Alaska telecommunications services contract to provide video  and data transmission and analog and digital phone services in  various locations across Alaska.

We reviewed documentation from the five selected contracts, along with  the relevant federal acquisition regulations for worker protections, data  security and privacy protections, subcontracting, and offshoring. We  interviewed cognizant contracting officials to clarify our understanding of  the contract requirements we identified. We also met with contractor  representatives for the selected contracts to obtain their insights into  contracting with the government, relevant contract requirements, and  industry trends. Findings from our review of the selected contracts are not  generalizable, but provide illustrative examples of the types of worker  protections and data security and privacy protections that are included in  federal telecommunications and call center contracts.

To provide information on employment trends in telecommunications and  call centers and how these trends were affected by offshoring, we  reviewed employment data from the Bureau of Labor Statistics (BLS)  within the Department of Labor (DOL), performed a literature review of  selected economic research and other relevant articles, and discussed  the results with DOL officials. The research provided some insights on the  potential types of effects of offshoring on the telecommunications and call  center industries, but provided no information regarding the extent of the  impact. Because of this and other data limitations, we were unable to  determine the extent to which offshoring may be occurring and the effects  of offshoring on the telecommunications and call center industries.

We conducted this performance audit from March 2019 to April 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives. See appendix II for further details on our  scope and methodology.

Background Federal Procurement for Telecommunications and Call Centers

The federal government relies on commercial communications networks  to obtain various services, including video conferencing, local and long- distance telephone calls, email, text messages, file transfers, and more.  Much of the communications infrastructure is owned or operated by  commercial entities. Similarly, federal agencies rely on call centers (also  known as contact centers) to handle public inquiries on government  programs and services, such as Medicare. These centers utilize  automated and live telephone response systems, websites, and trained  customer service representatives to provide information to the public.

Agencies that contract with industry to meet their telecommunications and  call center needs report information about these contracts and their  obligations in FPDS-NG—the federal government’s primary database for  contract information at the prime contract level. When reporting contract  data, agencies report information on the type of product or service being  purchased as well as the NAICS code that best describes the principal  purpose of the product or service being acquired. See table 1 for a  description of the industry categories for businesses that provide  telecommunications and call center goods or services.

In addition to FPDS-NG, the federal government has developed other  contract reporting systems to collect contracting information related to  subcontracting.

The Electronic Subcontract Reporting System (eSRS) was created in  2005 to streamline contractors’ reporting of progress toward meeting  the small business subcontracting goals in their subcontracting plans  and to facilitate agency oversight. The Federal Acquisition Regulation  (FAR) generally requires that contractors be required to submit an  acceptable subcontracting plan when they are awarded a contract that  exceeds $700,000 and is expected to have subcontracting  possibilities. Depending on the individual contract, the system may  contain subcontracting information reported by both the prime  contractor as well as multiple subcontractors.

The Federal Funding Accountability and Transparency Act Subaward  Reporting System (FSRS) was created in 2010 to provide  transparency about federal spending. Prime contractors must register  and report subcontract information for first-tier subcontractors, as  applicable. Information on subcontracts awarded by first-tier  subcontractors to other entities, or lower-tier subcontractors, is not  required.

USASpending.gov was created in 2007 to promote transparency by  providing the public with information about where and how federal  dollars are spent. USASpending.gov contains prime contract award  data from FPDS-NG and subcontract information from FSRS.

Laws and Technology Standards to Protect Federal Communications Data

Telecommunications and information technology (IT) fields have been  merging in recent years due to integration of the technologies and  combined operational management of their functions. Federal  telecommunications systems can include a multitude of IT equipment and  products, as well as services, such as managed network services and IT  security services. In addition, telecommunications include such  broadband internet services.

The Federal Information Security Modernization Act (FISMA) of 2014  provides a comprehensive framework for ensuring that effective  information security controls are put in place for information resources  and assets that support federal operations and for ensuring the effective  oversight of the security of the information. Under FISMA, the Office of  Management and Budget (OMB) is responsible for overseeing agency  information security policies and practices. To implement FISMA, the  National Institute of Standards and Technology (NIST)—a component  within the Department of Commerce—developed standards and  guidelines for agencies to use to help manage information security risks.  Both FISMA and OMB require agencies to comply with applicable NIST  standards and guidelines.

The NIST framework has many components, but generally provides  guidance to agencies to manage information security risks for  communication and information technology networks. The framework  emphasizes that an organization needs to develop and implement  appropriate safeguards to ensure delivery of critical services. To  accomplish this goal an agency generally must be able to develop an organizational understanding to manage cybersecurity develop and implement appropriate safeguards to ensure delivery of mitigate those events, and  restore system capabilities or services that were impaired due to a  cybersecurity event.

NIST publications can help agencies mitigate potential risks by providing  approaches on how to manage or resolve information technology risks.  For example, NIST states that agencies should conduct continuous threat  monitoring and suggests control activities to implement to help manage  supply chain risks, among other things. Some of the controls that NIST  recommends are access controls—authentication requirements and physical access  controls to limit or detect inappropriate access to data, equipment,  and facilities; security management controls—establish a framework and  continuous cycle for assessing data systems for security weaknesses,  implementing security procedures, and monitoring the procedures to  ensure adequate protection of sensitive or critical resources; and contingency planning and restoration of services—planning for  how to provide continued or restored services when system  interruptions or problems occur.

Federal Laws and Regulations to Protect Workers

Various federal laws exist to protect workers, establishing requirements  related to wages, hours worked, and worker safety and health, among  other things. Some of these laws apply specifically to federal contractors,  although the requirements may vary depending on factors such as the  type and size of the contract. For example, the Service Contract Act  establishes minimum wage, fringe benefit, and safety and health  requirements for covered federal service contractors.  Telecommunications service contracts are exempt from the Service  Contract Act, but call center contracts may be subject to it. Similarly, the  Walsh-Healey Act establishes minimum wage, overtime, and workplace  safety and health requirements for covered federal supply contractors.

Contractors are also generally subject to a number of non-discrimination  and equal employment opportunity requirements under an executive  order and federal laws. For example, covered contractors and  subcontractors are prohibited from discriminating in employment based  on race, color, religion, sex, sexual orientation, gender identity, national  origin, disability, or status as a protected veteran. In addition, covered  contractors and subcontractors generally are prohibited from  discriminating against applicants or employees because they inquire  about, discuss, or disclose their compensation or that of others, subject to  certain limitations. Along with laws that apply specifically to federal  contractors, worker protection requirements of other federal laws may  also apply, such as the Fair Labor Standards Act or the Occupational  Health and Safety Act.

Federal contractors are also generally subject to the requirements set  forth in the FAR, which provides uniform policies and procedures for  acquisition by executive agencies. Specifically, Part 22 of the FAR,  Application of Labor Laws to Government Acquisitions, establishes  various labor-related requirements for federal contractors and implements  applicable requirements, as described above. Federal contractors may  also be subject to specific department or agency regulations. For  example, when contracting with DOD, contractors must comply with  applicable contract provisions and clauses from the Department of  Defense Federal Acquisition Regulation Supplement (DFARS), such as  clauses incorporated pursuant to DFARS Part 222, Application of Labor  Laws to Government Acquisitions. FAR clauses in the prime contract can  indicate whether the contractor’s requirements will flow down to its  subcontractors. FAR flow-down clauses may be mandatory or  discretionary, and are subject to other considerations such as whether a  subcontract is performed extraterritorially.

Total Obligations Were Consistent across Recent Years for Both Telecommunications and Call Center Contracts; Data on Subcontracting and Offshoring Are Limited

Federal Obligations for Telecommunications Averaged $6 Billion Annually

Federal agencies reported obligating a total of over $30 billion to acquire  telecommunications products and services during fiscal years 2014  through 2018. Telecommunications spending accounted for 1.2 percent of  total federal obligations for the 5-year period. Over these five years, the  majority of the government-wide telecommunications obligations—84  percent—were awarded for services, such as internet and satellite  services with the remainder going to products.

In fiscal year 2018, federal agencies reported obligating $6.2 billion to  acquire telecommunications products and services—an amount that is  consistent with the preceding 4 fiscal years. DOD accounted for about  two-thirds of this amount and civilian agencies for roughly one-third.  These obligation levels are consistent with the previous 4 fiscal years.  Within DOD, DISA—which has responsibility for providing, operating, and  assuring command and control and information-sharing capabilities  across the full spectrum of military operations—had the highest  obligations for telecommunications services and products. Among civilian  agencies, the National Aeronautics and Space Administration, the  Department of Transportation, and the Department of Veterans Affairs  had the highest obligations. These three agencies consistently had the  highest obligations in each of the previous 4 fiscal years. Defense and  civilian agencies’ obligations for telecommunications for the 5-year period  are shown in figure 1.

Agencies procured telecommunications products and services from an  average of 1,500 vendors each year across the five telecommunications  industry categories. A little more than half of these contractors were  classified as small businesses. Ten contractors accounted for 52 percent  of total federal telecommunications obligations for fiscal year 2018, which  is generally consistent with obligation levels in the preceding 4 fiscal  years. Appendix III provides additional information on the top federal  telecommunications contractors based on dollars obligated. For the 5- year period we reviewed, our analysis shows that agencies reported the  majority of dollars obligated were for purchases for wired  telecommunications, as illustrated in figure 2.

Federal Obligations for Call Centers Averaged $800 Million Annually

Agencies reported an average of $800 million annually for call center  obligations for fiscal years 2014 through 2018, with HHS accounting for at  least 80 percent of total spending. Call center spending accounted for 0.2  percent of all federal spending during the 5-year period we reviewed.  Almost all—an average of 99.7 percent—of call center contract  obligations were awarded for services each year, such as professional  and administrative support, help desk, and technical assistance services.  For example, the CMS contract in our sample was awarded to acquire  management and staffing services for a call center that handles Medicare  beneficiary inquiries for 1-800 MEDICARE and consumer inquiries for the  Health Insurance Marketplace. Total government-wide call center  obligations for fiscal years 2014 through 2018 are shown in figure 3.

An average of 133 different contractors had contracts with obligations for  call centers during the 5 years we reviewed and about half were classified  as small businesses. One contractor accounted for the majority of all  obligations with obligation levels ranging from 80 to 84 percent for fiscal  years 2014 through 2018. Appendix IV provides additional information on  the top call center contractors based on dollars obligated.

Contract Reporting Systems Have Limited Data to Determine Extent of Subcontracting or Offshoring

Three federal reporting systems provide limited information about  subcontracting and no information about offshoring because the systems  were not designed to capture the extent of these activities.

While FPDS-NG captures data on contracts entered into by federal  agencies, it was not designed to include subcontracting data. The  system has a field to indicate whether the prime contractor has  developed a subcontracting plan, but does not have a field for  contracting officials to specify details about what or how much of the  products or services will be obtained through subcontracting. In  addition, FPDS-NG was not designed to collect data on the extent to  which prime contractors may offshore work performed on a federal  contract. No field exists for contracting officials to indicate whether the  contract involves business activities that include offshoring, regardless  of what type of products or services are being acquired. eSRS collects information from prime contractors on their planned use  of subcontractors. The FAR generally requires that contractors be  required to submit an acceptable subcontracting plan when they are  awarded a contract that exceeds $700,000 if subcontracting  opportunities exist, and impose subcontracting plan requirements on  subcontractors that receive subcontracts above certain thresholds.  However, as we previously reported in December 2014, eSRS was  not designed to provide a list of subcontractors associated with a  particular contract. As a result, the utility of eSRS in linking reported  subcontractors to prime contracts is limited. Additionally, in general,  prime contractors are not required to report in eSRS if a  subcontractor’s services are being performed outside of the United  States or its territories. Contracting officials told us that they have  limited insight into whether prime contractors subcontract with foreign  entities.

FSRS is used to collect award and entity information, such as  subcontractor names and award amounts, from prime contractors on  their subcontract awards. Prime contractors obtain and report  information provided by their subcontractors into FSRS. However, in  June 2014, we reported that we could not verify the subcontract data  in FSRS as agencies frequently do not maintain the records  necessary to verify the information reported by the awardees. In  light of this, we recommended that the Director of OMB, in  collaboration with Treasury’s Fiscal Service, clarify guidance on  agency maintenance of records to verify the accuracy of required data  reported. OMB generally agreed with our recommendation. As of our  latest report in April 2017, OMB had not yet taken action to implement  our recommendation.

Selected Telecommunications and Call Center Contracts Included Worker Protections

We identified several examples of worker protection requirements in our  review of the five selected contracts. We categorized those requirements  into three areas: wages and hours, workplace safety and health, and  protections against certain employer actions.

Wages and Hours. These protections ensure the payment of minimum  wage rates and authorize overtime pay, as appropriate, among other  things. For example:

The GSA Networx services contract and the DISA contract for DOD  Information Network operations include requirements to ensure that  covered contractor employees are to be paid wages at least at the  federal minimum wage rate.

The CMS call center operations contract and the DISA emergency  telecommunications services contract authorize the contractor to  provide overtime pay to certain employees if they work more than  their standard hours.

The CMS call center operations contract and the DISA contract for  DOD Information Network operations identify classes of workers and  state the minimum wage rate and fringe benefits that may be or are  payable to them. For example, the CMS call center operations  contract reflects Department of Labor rates for federal hires.

The CMS call center operations contract also includes an HHS- specific requirement related to salary rate limitations that specifies  that the contractor shall not use contract funds to pay the direct salary  of an individual at a rate that exceeds the Federal Executive Schedule  Level II in effect on the date the funding was obligated.

Workplace Safety and Health. These protections address dangers in the  workplace that might affect the workplace safety or health of contractor  employees. All five contracts reviewed contain requirements aimed at  promoting or ensuring safe behaviors in the work environment, among  other things. For example:

All five contracts require the contractor to promote a drug-free  workplace environment.

DISA’s DOD Information Network operations contract requires the  contractor to establish specific safeguards to protect the health of its  workers who might work in a federal building complex that is known to  be a toxic location, since asbestos and toxic metals have been  located in the soil.

DISA’s DOD Information Network operations contract also includes  requirements for the contractor to ensure its employees have health  screenings and vaccinations as applicable to ensure they are  physically and psychologically fit to perform the work at specific  locations, such as those in military operation zones.

All five contracts encourage the contractor to establish policies to ban  text messaging while driving.

Protections against Certain Employer Actions. These protections are  intended to protect workers from potentially harmful actions undertaken  by employers—such as discrimination in hiring practices, retaliation for  reporting company violations, and participation in human trafficking. For  example:

All five selected contracts included equal employment opportunity  provisions that prohibit discrimination in employment based on  specific characteristics, such as being a veteran or a person with a  disability.

The CMS call center operations contract also included an agency  requirement for the contractor to cooperate in any investigations into  allegations of employment discrimination.

The CMS call center operations contract, the two DISA contracts, and  the GSA Networx services contract incorporate clauses requiring their  contractors to provide whistleblower protections that protect an  employee from reprisal when they inform authorities of fraud, waste,  abuse, or violations of contract law by the contractor.

All five selected contracts include the clause that prohibits the  contractor and its employees from any involvement in trafficking in  persons.

In addition, DISA’s DOD Information Network operations contract requires  the contractor to offer employment to specific groups of people under  certain circumstances. Specifically, the contractor is to employ local  residents when work is to be performed in Hawaii. In addition, the  contractor is to offer employment to former federal employees first when  work is to be performed at a military base that is closing.

Observations on Offshoring. We did not identify offshoring of the  products or services being acquired in the five contracts we reviewed.  Generally, if a prime contractor awards a subcontract, the contractor will  flow down applicable requirements to the first-tier subcontractor and other  subcontractors at lower tiers, unless otherwise specified. We identified  only one worker protection clause that would flow down to the  subcontractor in the event of offshoring—the requirement to prohibit  involvement in trafficking in persons.

Selected Telecommunications and Call Center Contracts Included Data Protection and System Security Requirements

The five selected contracts we reviewed include examples of various  safeguards—such as limiting access to data systems and data, system  management controls, contingency planning and restoration of services,  and restrictions on the use of equipment—to protect data systems and  personally identifiable information from unauthorized access and use.  These safeguards are all part of NIST standards.

Access Controls. Physical access controls and authentication  requirements limit, block, or detect inappropriate access to data,  equipment, and facilities. These controls help to reduce the chances of  data systems being used for malicious purposes and protect the systems  from unauthorized modification, loss, or disclosure. For example:

The GSA Alaska telecommunications services contract states that the  physical access point to the telecommunications closet must be  limited to personnel with appropriate identification. In addition, this  contract requires the contractor to follow agency security procedures,  such as having personnel sign into and out of physical locations and  abide by escort procedures. Further, the contractor is required to  ensure that all employees have identification that meets specific  federal guidelines. The contract also states that subcontractors are  subject to personal identity verification, and are to comply with  applicable standards.

The CMS call center operations contract requires a multifactor  authentication—which requires two pieces of identifying information to  log in—for call center employees to remotely access sensitive  government-owned data on computer systems. In addition, the  contract requires all employees who have access to data systems and  personally identifying information to pass a background check.  Further, the contract reduces the ability of employees to copy or  transmit a customer’s personal information by requiring the contractor  to ensure a secure floor that prohibits cell phone usage or note taking  on paper. According to the CMS officials, the call center employees  are required to leave all personal items, such as cell phones, in  lockers, and the scripts they reference during calls are laminated. In  addition, the supervisor on duty checks desks to ensure personal  items are not present. According to CMS officials these steps help  protect callers’ sensitive data, such as their medical information.

The DISA contract for the day-to-day operations for the DOD  Information Network states that the contractor must have a plan in  place that includes physical security and protection of the system  infrastructure.

Security Management Controls. These controls establish a framework  and continuous cycle for assessing data systems for security  weaknesses, implementing security procedures, and monitoring the  procedures to ensure adequate protection of sensitive or critical  resources. A variety of security management control requirements were  included in the selected contracts. For example:

The GSA Networx contract, which provides a variety of network  services to the federal government, states that a contractor must  comply with FISMA and NIST standards. According to a GSA  contracting official, contractors have to show that their information  systems are adequately protected against cybersecurity threats  before performing any services on a task order. Government officials  will certify the system once they agree the system is adequately  protected. This certification occurs after a contract has been awarded,  but before work begins. According to a government official, these  systems are periodically reviewed and monitored to ensure the  systems stay protected.

The DISA contract for the day-to-day operations for the DOD  Information Network requires the contractor to assist the government  to ensure that all networks and information systems are accredited in  accordance with DOD’s Certification and Accreditation Program,  which requires certain cybersecurity protections are in place. This  contract also requires that the contractor or any subcontractor  implement safeguarding requirements to protect covered contractor  information systems, such as limiting access to authorized users,  verifying and controlling connections to and use of external  information systems, authenticating the identities of users before  allowing access to information systems, and limiting physical access  to systems and equipment. The contract also requires that the  government have access to the contractor’s databases in order to  carry out vulnerability testing and audits to safeguard against threats  to the integrity, availability, and confidentiality of data or to the  functions of information technology systems operated on behalf DISA  or DOD.

The DISA contract that provides priority telecommunications for  executive branch staff in case of an emergency requires that the  contractor must identify and analyze threats to the system on a 24- hours-a-day, 7-days-a-week basis, and offer solutions to fix identified  weaknesses. DISA contracting officials stated that threats to the data  systems are mitigated before contract award because the government  is trying to prevent attacks and not just react to threats. Additionally,  the contractor has to provide periodic maintenance of the installed  networking infrastructure to certify proper functioning of the  equipment.

The CMS call center operations contract requires that the contractor  perform annual vulnerability assessments, which includes tests that  attempt to break into the contractor’s systems, the contractor’s system  programs, and the contractor’s facility in accordance with agency  specific standards.

Contingency Planning and Restoration of Services. Planning for how  to provide continued or restored services when system interruptions or  problems occur is necessary because even a minor interruption can result  in lost or incorrectly processed data. NIST has published guidance on the  contingency planning process. Several of the contracts we reviewed  required the contractor to have contingency plans in place in case of any  disruption of services and specified how quickly services are to be  restored if disrupted. For example:

The GSA Alaska telecommunication services contract requires that  the contractor restore service within 4 hours of any system disruption.  According to the contracting officer, not restoring the system within 4  hours, unless a longer time is agreed to by the contracting officer,  would be considered a performance issue and would count against  the contractor during its performance review. This includes restoring  any equipment, transmission station, circuit, or area that the  government deems critical.

The DISA DOD Information Network services contract requires the  contractor to ensure that there is no disruption of services on the  government networks during routine maintenance of systems, during  system upgrades, or while the system has vulnerability testing, among  others.

The CMS call center contract requires that the contractor develop a  business continuity plan that identifies and prioritizes critical systems  and recovery strategies, as well as a consolidated business continuity  plan. The consolidated plan needs to account for the interdependence  between applications and operations and address procedures for  sustaining essential business operations while recovering from  significant disruptions, including contingencies for a catastrophic loss  of equipment required to deliver its services.

Restricting the Purchase and Use of Equipment from Identified  Countries or Manufacturers. As we reported in July 2018, reliance on a  global supply chain introduces multiple risks to federal information  systems, including the installation of intentionally harmful hardware or  software, reliance on malicious service providers, or installation of  hardware or software containing unintentional vulnerabilities such as  defective code. NIST published several guidelines to help federal  agencies select controls and activities relevant to managing supply chain  risk. Our selected contracts included several requirements related to  mitigating supply chain risks. For example:

Under the CMS call center contract, certain government-provided  systems are supplied to the contractor to meet the requirements of the  contract. By providing the systems, the government controls what type  of equipment is being used and reduces the risk that any  compromised equipment is introduced in its network.

The DISA contract for the day-to-day operations for the DOD  Information Network requires the contractor to use the DISA-approved  products list for purchasing equipment for use in repair and similar  functional activities. According to a DISA contracting official, this list is  continuously updated to make sure that vulnerable products are not  being purchased. In addition, this contract specifically prohibits  contractors from using certain Chinese-manufactured equipment or  services utilizing that equipment. This requirement extends to any  equipment or services provided by subcontractors. According to the  contracting officer, the contractor requests confirmation from its  subcontractors that they are not using prohibited equipment. The  contractor then notifies the contracting officer that prohibited  equipment is not used on the contract.

All five contracts include a restriction on purchases of most goods and  services from specific countries, such as Cuba and Iran. The contract  requires this restriction to flow down to any subcontractor.

Privacy for Personally Identifiable Information. The CMS call center  contract involves handling personally identifiable information, such as  private medical information. As part of the contract terms, contractor  personnel are required to follow specific health care privacy requirements  to protect customers’ personal health information. In addition, the contract  includes agency-specific requirements to protect personally identifiable  information and personal health information.

Observations on Offshoring. The five contracts we reviewed included  requirements that limited the contractors’ opportunity to use offshoring for  labor.

The DISA contract for the day-to-day operations for the DOD  Information Network stipulates that only U.S. citizens can be hired to  perform services. According to the contracting officer, the DISA  contract that provides priority telecommunications for executive  branch staff in case of an emergency also requires that the contractor  hire only U.S. citizens. In addition, the GSA Networx services contract  states that work on some orders may require U.S. citizenship.

The GSA Alaska telecommunications services contract states that  contractor personnel may be required to successfully pass a  background check to work in controlled areas under the contract.

The CMS call center contract requires that the call center be located  in a facility within the continental United States. According to officials,  this requirement helps protect data and privacy information. CMS  officials stated that generally for call center contracts the contractor  must obtain prior approval from the agency’s contracting officer in  writing if it wants to subcontract or move operations to a location  outside of the United States or its territories. According to CMS  contracting officials, they have never received a request to offshore  call center operations.

We provided a draft of this product to DOD, DOL, GSA, and HHS for  review and comment. DOL, GSA, and HHS provided technical comments,  which we incorporated as appropriate. DOD informed us that it had no  comments on the draft report.

We are sending copies of this report to the appropriate congressional  committees and the Secretaries of Defense, Labor, and Health and  Human Services and the Administrator of General Services. In addition,  the report is available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  William T. Woods at (202) 512-4841 or woodsw@gao.gov or Cindy S.

Brown Barnes art (202) 512-7215 or brownbarnesc@gao.gov. Contact  points for our Office of Congressional Relations and Public Affairs may be  found on the last page of this report. GAO staff who made key  contributions to this report are listed in appendix V.

Appendix I: U.S. Employment Trends in the Telecommunications and Call Center Industries and Observations on Offshoring

Employment Decline in Telecommunications Industry Potentially Influenced by Technological Advances

Our review of data from the Bureau of Labor Statistics (BLS) Quarterly  Census of Employment and Wages shows that employment in the  telecommunications sector overall declined 12 percent from calendar  years 2014 through 2018, as illustrated in figure 4. In contrast, during the  same 5-year period, total employment across all industries in the United  States grew by 7 percent. According to BLS data, the decline in  telecommunications employment has been underway since at least 2009.  BLS projects this decline will continue through at least 2028.

Department of Labor (DOL) data series on trends in employment are not  designed to identify causes of employment changes. However, BLS  officials and other researchers cited the role of technology as a possible  cause of the decline in telecommunications employment. For example,  BLS officials said the move toward newer technologies, such as satellite  transmissions, has had an adverse impact on employment. Additionally,  representatives of a major telecommunications contractor told us that  technological advances either resulted in fewer employees being needed  to perform specific functions or replaced previous manual operations with  automated processes. In addition, the representatives stated that uses of  artificial intelligence, such as smart networks and machine learning,  facilitate tasks that in the past relied extensively on human labor. Finally,  the effect of technology on employment in telecommunications has also  been noted by an industry analyst.

Employment in the telecommunications industry has been marked by job  gains as well as losses in the last 5 years, although generally, losses  have exceeded gains. BLS’s Business Employment Dynamics data  capture the gross number of job gains from establishment openings and  expansions and job losses from establishment closings and contractions  across the U.S. economy. In the last 5 years, new jobs in  telecommunications have been generated; however, job losses have  exceeded job gains in almost every quarter since 2014, as shown in  figure 5.

The effect of offshoring on employment in telecommunications, if any, is  unknown due to the absence of data. Although U.S. employment in  telecommunications has declined, the role of offshoring as a potential  contributor to the decline is unclear, due to a lack of data and because  offshoring is one of many factors that can affect employment levels.  According to BLS officials, no public or private data exist that estimate the  extent of offshoring in this or any industry sector. BLS officials told us  that little interest has been expressed in collecting data on offshoring.  They noted that if BLS were to develop a new survey aimed at measuring  the extent of offshoring, technical issues—including determining what  data should be collected that would give such insight—would need to be  resolved. Furthermore, the BLS officials stated that they did not identify  offshoring as a factor contributing to recent employment declines in  telecommunications based on their industry research, which included  interviews with industry specialists. According to BLS researchers,  offshoring is one of many factors that can affect job gains and losses for  occupations within an industry. In a 2008 article estimating the  susceptibility of different occupations to offshoring, BLS researchers  cautioned that “no attempt should be made to attribute growth rates in an  occupation, or differences between occupations, to offshoring.”

Call Center Employment Levels Appear Relatively Stable

Overall, employment in call centers has fluctuated recently, but appears  relatively stable over the period of calendar years 2014 through 2018,  though it remains higher than during the previous 5 years. As shown in  figure 6, after rising for a few years, in 2018 employment returned to a  level slightly below that reached in 2015. According to BLS officials,  employment in the business support services industry, which includes call  centers, is projected to increase modestly through 2028. BLS officials  said it is not clear why employment in call centers declined in 2018.

Although GAO and others have identified call centers as potentially  subject to offshoring, the full extent of offshoring occurring within the U.S.  call center industry is unknown.  Some anecdotal evidence exists about  the purported growth of offshore call centers that serve U.S. companies.  However, we found no analyses in our literature review regarding the  effects of offshoring on call center jobs overall. Just as with  telecommunications, many other factors potentially affect call center  employment, such as technological advances. For example, interactive  voice response technology has been used to provide responses to simple  inquiries, which to some extent may reduce or eliminate some call center  work.

Research Has Identified Various Factors That Potentially Affect Offshoring across Industries

Although we did not find studies that address the effects of offshoring on  telecommunications and call centers specifically, the literature we  reviewed discussed some characteristics of workers, services, and  companies that potentially influence offshoring decisions, in general,  across industries. As such, offshoring decisions may involve, but are not  limited to, considerations of the presumed interchangeability of U.S.- based and overseas workers, workers’ languages and cultures, technical  requirements for the services being offshored, and companies’ ability to  manage offshoring.

Appendix II: Objectives, Scope, and Methodology

This report addresses: (1) total federal obligations for telecommunications  and call center contracts; (2) worker protections identified in selected  telecommunications and call center contracts; and (3) data security and  privacy protection requirements identified in these contracts. This report  also includes observations on the extent and effect of offshoring. For the  purposes of this report we define “telecommunications” to encompass the  preparation, transmission, communication, or related processing of  information that can be in the form of voice, video, or data; “call centers”  to include centers handling inquiries via multiple channels such as  telephone, Web page, e-mail, and postal mail; and “offshoring” to mean  the obtaining of goods or services from non-U.S.-based employer  subcontractors located outside of the United States and its territories that  use non-U.S. citizen employees. In addition, we gathered information on  employment trends for the telecommunications and call center industries  for calendar years 2014 through 2018.

To determine the level of federal obligations for telecommunications and  call centers, we used data from the Federal Procurement Data System- Next Generation (FPDS-NG) for fiscal years 2014-2018. We identified  obligations for telecommunications and call center contracts by using the  associated North American Industry Classification System (NAICS) codes  for these industry sectors. As defined in the NAICS manual,  telecommunications contracts are identified as having a NAICS code  starting with the prefix 517, and call center contracts are identified as  having a NAICS code starting with the prefix 56142.

To identify examples of worker protections and data security and privacy  protections in federal contracts, we selected a nongeneralizable sample  of five contracts from three agencies with some of the highest obligations  for telecommunications and call center contracts during fiscal years 2014  through 2018. Specifically, we selected (1) the Department of Defense  (DOD) because it obligated the highest amount for telecommunications  contracts; (2) the Department of Health and Human Services (HHS)  because it obligated the highest amount for call center contracts; and (3)  the General Services Administration (GSA), which is among the top ten  agencies with the highest amounts for telecommunications contracts,  because it provides a government-wide contract available for agencies to  place orders for telecommunications and call centers. We then identified  the component within each agency that obligated the most for these  services or that provides a large government-wide contract vehicle. The  components were DOD’s Defense Information Systems Agency, GSA’s  Federal Acquisition Service, and HHS’s Center for Medicare and  Medicaid Services (CMS). We selected contracts that included a large  call center and a large government-wide telecommunications contract  vehicle. We also selected a variety of telecommunications contracts that  were among the highest obligations during fiscal years 2014 through  2018, and represented different types of telecommunications services  procured during the period, such as wired and wireless services. Table 2  provides a synopsis of the 5 contracts included in our review.

We reviewed documentation from the five selected contracts, along with  the relevant federal acquisition regulations for worker protections, data  security and privacy protections, subcontracting, and offshoring. We  interviewed cognizant contracting officials to clarify our understanding of  the contract requirements we identified related to worker protection and  data security and privacy protections. We also met with representatives  from three contractors to obtain their insights into contracting with the  government, relevant contract requirements, and industry trends. The  purpose of our contract review was to illustrate the different worker  protections and data security and privacy protections that may be  included in these types of contracts.

To address the employment trends in telecommunications and call  centers and how they were affected by offshoring, we reviewed  employment data from the Quarterly Census of Employment and Wages  published by the Bureau of Labor Statistics (BLS) within the Department  of Labor. The Quarterly Census of Employment and Wages program  publishes a quarterly count of employment and wages reported by  employers that covers more than 95 percent of U.S. jobs and is supported  by quarterly reports from all private sector employers. We also reviewed  data from BLS’ employment projections program, which draws from  several BLS data collections as well as interviews with industry specialists  and reviews of relevant articles to develop information about the labor  market for the nation as a whole for 10 years in the future. In addition, we  reviewed BLS’ Business Employment Dynamics data, which consist of a  quarterly series of statistics on gross job gains and gross job losses for  the entire economy. Gross job gains and gross job losses reveal some  aspects of business dynamics, including establishment openings and  expansions, and establishment closings and contractions. The quarterly  data series include the number and percent of gross jobs gained by  opening and expanding establishments, and the number and percent of  gross jobs lost by closing and contracting establishments. Furthermore,  we reviewed DOL data on layoffs collected by the Trade Adjustment  Assistance program that are considered to be caused by trade through  shifts in production or services to a foreign country. While the data include  layoffs in telecommunications, DOL officials did not believe the data  would be useful for this report. Specifically, the data do not necessarily  reflect all layoffs in a given sector, but only those associated with  requests for investigations by DOL as to the role of trade in the layoff, and  initial estimates of affected workers—those facing layoffs and those  threatened by layoffs—are not representative.

To review the potential effect of offshoring on employment trends, we  performed a literature review of selected economic research and other  relevant articles, and discussed the results with DOL officials. To identify  relevant material—including reports, dissertations, working papers, and  journal articles—we searched databases including the National Bureau of  Economic Research, Bureau of Economic Analysis, Business Source  Corporate Plus, EBSCO, EconLit, ProQuest (including dissertations and  theses), Social SciSearch, Public Affairs Information Service via DIALOG,  Lexis Trade files, SSRN, WorldCat, National Academies Press, and  National Technical Information Service. We used search terms that  included variations on “telecommunications” and “call centers,” as well as  “offshoring,” “offshore outsourcing,” “labor market impact,” “worker  displacement,” “layoffs,” “employment trends,” and “hiring trends.” From  our initial literature search we selected 13 documents for more in-depth  review. We excluded references that addressed the effects of offshoring  on non-U.S. economies and labor forces, or were otherwise beyond our  scope, such as working conditions, work flow, collective bargaining,  customer service, service quality, or training in call centers. Based on this  research, we identified reasonable observations about employment  trends and offshoring in telecommunications and call centers. As noted in  this report, research on the questions addressed in this report reaches  different conclusions. The relevant research that we reviewed provided  some insights on how offshoring could potentially affect the  telecommunications and call center industries, but provided no  information regarding the extent of the impact. Because of this and other  data limitations, we were unable to determine the extent to which  offshoring may be occurring and what effect offshoring is having on the  telecommunications and call center industries.

Appendix III: Top Federal Telecommunications Contractors during Fiscal Years 2014 through 2018

Agencies reported obligations for approximately 1,500 different  contractors that provided telecommunications products and services each  year during fiscal years 2014 through 2018. Ten of these contractors  accounted for 52 percent of obligations for telecommunications contracts  in fiscal year 2018. The top contractor received 10 percent of the total  telecommunications obligations in fiscal year 2018, and was also one of  the top three contractors in the preceding fiscal years. Figure 7 shows the  top 10 telecommunications contractors’ based on total obligations during  fiscal years 2014 through 2018.

Appendix IV: Top Federal Call Center Contractors during Fiscal Years 2014 through 2018

Agencies reported obligations for approximately 133 different call center  contractors each year during fiscal years 2014 through 2018. Ten  contractors accounted for 94 percent of obligations for call centers in  fiscal year 2018; with one contractor accounting for 83 percent of total  obligations for the 5-year period we reviewed. Figure 8 shows the top 10  telecommunications contractors’ based on total obligations during fiscal  years 2014 through 2018. Although the amount of obligations each year  changed, these contractors were generally among the top 10 across all 5  fiscal years.

Appendix V: GAO Contacts and Staff Acknowledgments

In addition to the contacts named above, Candice Wright (Assistant  Director), Blake Ainsworth (Assistant Director), R. Eli DeVan (Analyst-in- Charge), Pedro Almoguerra, Sarah Cornetto, Lorraine Ettaro, Suellen  Foth, Stephanie Gustafson, Victoria Klepacz, Chris Morehouse, Patricia  Powell, Miranda Riemer, Roxanna Sun, Alyssa Weir, and April Yeaney  made key contributions to this report.

Agencies spend billions of dollars on contracts supporting telecommunication systems and call centers that handle public inquiries for programs like Medicare. Contractors often maintain or support these networks and call centers.

Contractors must follow various requirements to protect the systems and the privacy of personal data, which includes

implementing controls that limit or detect inappropriate access to data

not using equipment from certain foreign manufacturers that could include harmful hardware or software and pose national security risks

Most contracts also required that work be conducted in the United States or by U.S. citizens.