A recent nonpartisan report from the U.S. Government Accountability Office (GAO) highlights the wasteful spending of taxpayer dollars and increasing cybersecurity risks associated with restrictive software licensing.
Last month, the U.S. Government Accountability Office (GAO) confirmed it was notified of a data breach by an IT contractor that impacted more than 6,000 people in January. This hack came on the heels of a January GAO report detailing how, across federal agencies, the government is inefficiently tracking its spending on software licenses and other cyber-related investments, resulting in duplicative purchases and missed opportunities for cost savings. At first glance, these developments may seem unrelated. Unfortunately, though, they are not.
In addition to missed cost-savings, restrictive IT licenses can increase a federal agency’s cybersecurity risks and leave them vulnerable to attack.
As GAO reported, the U.S. government spends over $100 billion annually on IT and cyber-related investments, including software licenses, across 24 federal agencies. GAO found that multiple software products may be bundled into a single license with a vendor, and agencies may not have usage data for each product individually.
The cost-saving implications are clear. GAO issued 18 recommendations to nine agencies to track software license usage and compare inventories with already purchased software more consistently. Eight agencies agreed to these guidelines, with one remaining neutral.
GAO’s report mirrors the non-partisan watchdog’s September 2023 report that issued similar recommendations specific to the Department of Defense. Across the three selected components of the Defense Department, the GAO found that restrictive software licensing:
- Increased the cost of cloud computing through additional fees
- Limited choice of commercial cloud service providers and imposed arduous requirements
According to Garland Management Consulting, reforming the IT monoculture in federal government software licensing procurement could save taxpayers around $750 million per year – conservatively – through increased competition.
But that’s not all. According to our report conducted by Prescient Comply LLC, legacy software vendors who engage in anticompetitive licensing practices often lock customers into their ecosystem with duplicative licenses and the inability to use best-of-breed offerings from other vendors. When that ecosystem is insecure, a cyber tax consisting of direct breach remediation, security upgrades, legal fees, loss of time, and reputational and IP damages is placed on customers.
- On a smaller scale, the report details how restrictive licensing can create a 498% “Cyber Tax” on small to medium-sized businesses.
- On a larger scale, the U.S. government is the largest IT customer in the world. Experts can only estimate a“Cyber Tax” for federal agencies, but taxpayers are the ones who carry that burden.
What This Means
GAO’s own hack highlights what its report missed – agencies need to do a better job at tracking their software licenses and IT procurement, not just to address wasteful spending but to identify cyber vulnerabilities and build stronger, more protected IT systems.
Bigger Picture
There must be universal adoption of the Principles for Fair Software Licensing. Stringent policies and unclear terms from legacy providers are causing the U.S. government to forgo cost savings to the tune of hundreds of millions of dollars and potentially lose even more through potential cyber hacks.
In fact, many government workers have already faced the dread of data theft from a widespread cyber-attack. Due to a data breach in early 2023, the Department of Defense is alerting more than 26,000 former and current employees whose personal information was likely compromised.
The GAO’s findings and recent cyber security hacks renew the importance of adopting federal legislation to require federal agencies to complete comprehensive assessments of their software entitlements and IT inventories, namely through implementing the Strengthening Asset Management and Oversight Act (SAMOSA).
Read the full GAO reports here:
- January 2024: https://www.gao.gov/products/gao-24-105717
- September 2023: https://www.gao.gov/products/gao-23-106290