Statement of Michael Gallagher Deputy Commissioner for
Budget, Finance, and Management
Joint Oversight Hearing
on the Recovery Act Project to Replace the
Social Security Administration's National Computer Center
before
the House Ways and Means
Subcommittee on Social Security
and
the House Transportation and Infrastructure
Subcommittee on Economic Development, Public Buildings, and Emergency Management

December 15, 2009

Chairman Tanner, Chairwoman Norton, Ranking Members Johnson and Diaz-Balart, and Members of the Subcommittees:

Good morning. I am Michael Gallagher, Deputy Commissioner for Social Security's Office of Budget, Finance, and Management and the Senior Accountable Official for Recovery Act funds. I am joined here today by Bill Gray, Deputy Commissioner for Systems. On behalf of Commissioner Michael J. Astrue, I thank you for the opportunity to update you on the progress we have made working with the General Services Administration (GSA) in replacing our outdated National Computer Center (NCC), using the $500 million appropriated to us in the Recovery Act. Our new data center, the National Support Center (NSC), will replace our 30-year-old NCC. This new facility will be state-of-the-art and incorporate green building technology.

Before I explain our process for replacing the NCC and the safeguards we have established to deal with unexpected cost, delay, and the risk of catastrophic failure of the NCC, I will briefly describe the role and importance of information technology (IT) to the services we provide to the American public. An understanding of the ever-increasing role IT plays in our processes will put our needs for robust and reliable data repositories in perspective.

Over the past three years, we have made a concerted effort to improve our service delivery by taking advantage of modern technology and the Internet, and have made fundamental changes in our use of IT. We have taken to heart the recommendations of the 2007 report by the National Academy of Sciences to modernize our IT infrastructure. We have established an advisory committee of world-class IT experts to guide our future use of IT, and we also have strengthened the role and functions of our Chief Information Officer (CIO).

Technology Is Crucial to the Services We Provide

We maintain benefit, earnings, and demographic information on virtually every American. Over the last decade, we have moved from a paper-based system to electronic processing of our core workloads. Currently, over 95 percent of our work is electronic. As new benefit applications continue to flood our agency due to the economic downturn and the aging of the baby boomers, we are handling an all-time high of over 75 million electronic transactions per day. Without technology, we would be unable to manage this onslaught of work. Technology has allowed us to provide faster and more accurate service to the American public.

For instance, technology will allow us to fast-track about 140,000 disability applications this year, and we will award benefits, when appropriate, in those cases in a matter of days. Our new electronic disability case analysis tool, eCat, is improving the consistency and quality of our disability decisions.

In addition, we maintain claims information in electronic folders, which allows us to move work to available resources and respond to catastrophic events like Hurricane Katrina. We maintain one of the world's largest repositories of imaged medical evidence, storing over 400 million medical records, to which we add nearly 3 million new records each week. We exchange over 2 billion data files annually with public and private entities for benefit management and homeland security purposes.

We have embraced the need for more and better on-line services. With the launch of our new on-line retirement estimator, benefit application, and Medicare low-income subsidy application, we have emerged as the Federal Government's leader in on-line services. The public rated these three services the highest in the University of Michigan 's satisfaction surveys. These new on-line service options have allowed us to weather the increased workloads due to baby boomers and the economic downturn without substantially increasing waiting times.

We are not resting on our laurels. In 2010, we will introduce a Medicare-only on-line application, an improved disability application, and the first Federal Government Spanish-language on-line application.

To help us achieve our IT vision for the future, we have established an advisory committee of world-class IT experts to reach outside of the agency for the best technical advice, which we use to guide our future use of technology. And internally, we have strengthened the role and functions of our Chief Information Officer (CIO) to ensure that we have a long-term vision, and the processes in place to make use of leading edge technologies. Our Office of the Chief Information Officer now has functional responsibility for: (1) Open Government to ensure transparency in our decisions, improving communication with the public, and providing authentication solutions that will create additional opportunities over the Internet; (2) Investment Management to oversee the agency's IT investment process; (3) Innovation to serve as our "think tank" for emerging technologies; (4) Vision and Strategy, so as to define our technology vision and establishing a long-term, architectural plan, and (5) Information Security, to develop a policy framework that effectively manages risk, and safeguards the personally identifiable information with which we are entrusted .

To protect our sensitive data and continue to enhance our electronic services, we have worked with you and the Administration to address our need for data centers that support the rapidly expanding demand for electronic services. We first apprised you of this need in July 2008, and you quickly took action to allow us to replace our aging facility that is running out of capacity. We are grateful for your prompt response.

Second Support Center (SSC) Necessary for Our Electronic Environment

For years, we have contracted with a commercial hot site to provide us with the ability to recover our data in the event of a disaster. As our use of technology has grown, this commercial site has become a less viable disaster recovery option. With nearly all of our business processes fully electronic, if the NCC were to go down, we would come to a near standstill while we recover our systems. If our NCC went down tomorrow, we would need to take backup our tapes to the commercial hot site in order to recover these data. This process would take 7 days and would provide only about 25-30 percent of our capacity to run the critical applications that we use to issue Social Security numbers and administer benefits. To remedy this issue, we sought a second support center, geographically separate from the NCC, now located in North Carolina.

The initial vision of the second support center (SSC) was to serve as a co-processing center on a daily basis and back up the NCC in the event of a disaster or catastrophic systems failure. In the last year, we have accelerated and expanded the role of the SSC to address the vulnerabilities of our 30-year old NCC.

In January 2009, we took possession of the SSC and began equipping it to function as a co-processing center that will provide the day-to-day operations for about half of our systems. It began production operations in May 2009 and now maintains medical images for the electronic disability folders and fully-redundant communications connections to our offices, to the Internet, and the NCC. Moving these workloads to the SSC reduced our disaster exposure from systems failure in the NCC. In addition, maintaining medical records at the SSC minimizes the down time of our disability systems.

By 2012, we will synchronize data between both centers every hour. In the event of a disaster, we will be able to use these data to restore services within 24 hours. These data will be current to within one hour prior to the disaster.

Recognizing that the timeframes for fully synchronizing the two centers would still leave us dependent on the commercial hot site in the event of a disaster through 2012, the Commissioner decided to accelerate the purchase and installation of the additional hardware and software necessary to support our critical claims and data processing systems housed in the NCC. This equipment will be fully operational by January, 2010, and a major protection for the American public, because we will be capable of recovering all our critical systems from the backup tapes at the SSC, instead of using the commercial hot site. While it would still take us 7 days to restore services, once services are up and running, we would be able to handle all critical claims and data processing workloads. In the near future, we will perform a disaster recovery exercise in the SSC to fully test our ability to recover completely.

We are currently adding the facility infrastructure to the SSC to support important NCC workloads that are not critical to the payment of benefits. These workloads include management information, forecasting, cyclical, regional, and end-user developed applications. By October 2010, we will have the infrastructure needed to recover these services in the SSC. With these changes, we will be able to recover the entire NCC production operations in the SSC. (Please see the attached chart for additional details about our NCC disaster recovery capability timeline.)

Our rapidly growing electronic business processes and service channels, as well as the tragic events of September 11, 2001, underscored the critical need for the SSC. At the same time we decided to pursue the SSC, we continued to make improvements to the NCC to deal with our growing workloads.

The NCC was designed over 30 years ago. Technology has changed radically since then, and the NCC's infrastructure, including the building's cooling, electrical, and fire suppression systems, is not sufficient to fully accommodate current technologies. As a result, the NCC's infrastructure systems will not be capable of accommodating the information technology necessary to handle our increasing volumes of work, our new and expanded responsibilities, and our new ways of doing business. Our transition to full electronic processing of our core workloads and the growth of electronic service delivery over the last decade resulted in a dramatic increase in our needs for data storage and network capacity. While we have modernized our hardware, we are facing finite limitations on our ability to distribute electrical power to our servers and mainframes.

Updated servers and mainframes have significant electrical requirements. Until recently, each server required only one power supply to operate; now, a server requires two to four power supplies to function, which the NCC can accommodate at this time. The current facility's electrical panels will not accommodate the more than four power supplies that we will need to run servers in the future.

We have undertaken important steps to continue the services of the current facility until the new data center is operating. As the NCC has aged, we have continuously upgraded and repaired structural, electrical, and data processing capabilities. Incrementally upgrading a facility of this kind is a best industry practice for maintaining facilities beyond their life cycle. We must incrementally repair these infrastructure systems because we cannot totally replace them in the existing NCC. To replace them, we would have to shut down the building completely for an extended period of weeks or months. Such a shutdown would result in an unacceptably long interruption of service to the public.

We considered the possibility of renovating the existing building; however, renovations of this magnitude would require us to vacate the building and design and lease a facility to temporarily house the data and employees. The expense of doing this would be almost as costly as simply building a new, up-to-date data center and would create a risk of a major interruption in service and require relocation twice, incurring significant costs.

Even if we could overcome the obstacles to repair and upgrade the NCC and its infrastructure, we would still have a building designed around a 1970s' mainframe environment. In the seventies, redundant electrical, heating, and cooling systems were not state-of-the-art requirements for data centers. In addition, fire suppression systems were not designed to cover an entire floor. In short, the current facility will not be able to meet the industry standards for data centers in the future.

In 2008, it was determined that a replacement facility was the most viable option and began the planning efforts with GSA. SSA cannot lease or purchase real estate, so we rely on GSA; and our relationship is one of partnership. GSA offers its expertise in real estate and building construction, and we offer our expertise in data center design and operations. Specifically, we work closely and constructively with GSA and its expert contractors throughout every stage of this process.  Our most seasoned real estate professionals work side by side with their GSA counterparts. I assure you that both we and GSA are taking all appropriate steps to ensure that this partnership is successful.

Our GSA/SSA project team includes architects, electrical engineers, mechanical engineers, fire protection engineers, project managers, occupational safety and industrial hygiene experts, physical security experts, and network and IT engineers with knowledge and experience in our IT program requirements. We have great confidence in the site criteria and Program of Requirements that the team developed. The team is adhering to all applicable procurement rules and is following the best practices for data center construction.

We and GSA are closely monitoring the planning and construction of the NSC to ensure mitigation of any unexpected challenges, and we are holding our executives and staff accountable for achieving the goals of this initiative. For example, as the Senior Accountable Official, I oversee and monitor overall progress. I also function as a liaison for the SSA executives who have lead responsibility for the planning and the execution of the project.

We hold periodic meetings at both the executive and staff levels to discuss implementation status and any other issues that may arise. We also hold regular meetings internally and with GSA executives to review the status of the project. We have established performance measure targets that we will monitor in these status meetings.

The joint project team is thoroughly analyzing our detailed list of technical specifications for all aspects of the NSC project to efficiently use taxpayers' dollars and minimize cost and schedule overruns. We have consulted with industry experts, such as Uptime Institute, to ensure we are implementing the most current data center standards. We have toured several existing data centers to learn about best practices.

Our requirements for the new facility site are based on our business process and technology needs, and the security standards that are necessary given the sensitive data we maintain. In August 2009, GSA requested expressions of interest using the Federal Business Opportunities website. The notice contained mandatory requirements, such as a minimum of 35 acres suitable for development within 40 miles of our headquarters. It also included requirements to avoid increased project costs or a delayed schedule that could be caused by landfills, hazardous waste, or soil or water contamination on or near the site. The site cannot be located within 100 or 500 year flood plain and must have reasonable access to utilities, including fiber optic, power and water.

After conducting research and consulting industry experts, we determined that the best practice to ensure continuous service to the public when we eventually migrate from the NCC to the new center would be to bring the systems in the NSC online incrementally. That would allow us to test their stability while continuing to operate the systems in the NCC in case something did not work properly. For example, the computer processes involved in adjudicating a benefit application actually “talk” to each other to verify and update the applicant's personal information on multiple systems. In order to properly maintain this interactivity, we need to use software that enables the synchronization of data bases with responsive systems performance. Available technology limits the separation of the transitioning systems to less than 100 kilometers. A site located within 40 miles of our headquarters assures us a lower risk transition that will not disrupt service to the public.

The project team is currently evaluating the sites.

GSA is also leading the development of the detailed Program of Requirements for building the NSC. GSA's contractor, Jacobs, is developing these requirements through interviews with technical experts. While this process is lengthy, a comprehensive and systematic approach to long-term planning will provide us with a facility that will meet our needs.

Conclusion

The SSC will allow us to recover all essential functions and systems associated with our primary mission while we make steady progress toward having our NSC fully operational in 2015. This state-of the-art facility will help us maintain the service the American public expects.

National Computer CenterCenter Disaster Recovery Capability Timeline