mr. wilshusen, are you familiar with the bill that the chairman and i have co-authored, called the federalnformation technology reform act, a month old? >> a little bit, sir. but not completely. >> well, that bill tries to get at how the federal government manages i.t. procurement, and acquisition, and it addresses interalia how the federal government is managed. and i think it's based on the conclusion that it's not well managed, and it's very inefficient, and there are too many people with the title cio, and what could go wrong with that. the estimate is the $82 billion we spend over the year is at least inefficiently used. sometimes downright unfortunately wasted. is it gao's position that we do need some i.t. updates and reforms to kind of update on clinger cohen, which was almost 20 years ago in technology, that's light years. >> that's outside my particular area. i focus on information security and privacy issues. i can get that answer to you. >> that would be fine. but isn't information security related to how well we're managing our i.t. assets? >> oh, certainly. and certainly ther

mr. wilshusen? in a nutshell, what you said in the beginning was, they didn't have strong passwords. so somebody could put in a short password and not change it, is that correct? >> that's correct. we identified several tactical security control weaknesses with healthcare.gov and supporting systems. >> so they didn't create a huge vulnerability -- >> if they used a weak password that could be easily guessed, that could be increased risk. >> so marilyn and her birthday, if that were used, would have been easy to guess, certainly would have been tried. did they have advance lockout systems in detection and reporting? >> one of the things -- i don't want to get too detailed into the security controls, so we don't give any -- >> we don't want to tell how weak it still is. so i will be a little careful on that. but there are techniques that if they were in place would have been much more secure. >> sure. and the weaknesses that we identify are all -- can be corrected and resolved almost immediately. >> so what you found a year into this site was they were not using best practices? >> we i