iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Federal agencies do still depend on some aging, critical systems, including selected Treasury systems that run COBOL. But COBOL alone does not make a system insecure, and the available government findings do not show that every agency system—or every DOGE team—had unrestricted access. The central issue is how technical risk, maintenance capacity and institutional access controls interact.
Why do federal agencies still rely on legacy systems?
Replacing a system that supports a critical public service is not simply a matter of installing newer software. Agencies must keep the service working while they change underlying technology, move data and maintain connections to other systems. A rushed replacement can create disruption of its own; keeping an old system can also leave an agency dependent on scarce expertise or components that are difficult to support.
The financial context is substantial but should not be mistaken for a savings forecast. In its 2025 reporting, the U.S. Government Accountability Office (GAO) said the federal government spends over $100 billion annually on IT and that agencies have typically reported about 80 percent of that spending on operating and maintaining existing IT. That is an operating-cost context, not an estimate of how much modernization would save.
Recommended Free Tools
“Legacy” describes age or obsolescence in GAO’s reporting; it does not, by itself, mean broken, insecure or written in COBOL. Security depends on the system’s actual condition: for example, whether its hardware and software remain supported, vulnerabilities are known and addressed, and the agency can maintain and protect it.
#1 Best Overall
- Murach's Mainframe COBOL
- Mike Murach & Associates
- ABIS BOOK
What did GAO find about federal legacy systems?
The figures from different GAO reviews refer to different groups of systems. They should not be combined into a single count or treated as a census of federal IT.
| Review and population | What GAO reported | How to read it |
|---|---|---|
| 2019 review, as described in GAO testimony published May 10, 2023 | GAO identified 10 critical legacy systems at 10 agencies. Agencies reported ages of about 8 to 51 years, and combined annual operating and maintenance costs of about $337 million for that 2019 group. Several systems used COBOL. | These are historical figures for the 2019 cohort, repeated in 2023 testimony—not figures for the later group reviewed in 2025. |
| GAO review published July 17, 2025 | GAO selected 11 systems from 69 legacy systems submitted by 24 agencies subject to the CFO Act. The 11 systems were maintained by 10 agencies. Eight used outdated languages, four had unsupported hardware or software, and seven had known cybersecurity vulnerabilities. | These findings concern GAO’s selected systems, not every legacy system or every federal agency. |
| GAO DOGE access-and-controls review published September 29, 2026 | The review covered six agencies. Four provided information about system access, and three provided information about controls. GAO said the information was insufficient to determine the extent of access. | This was a bounded review of access and controls at six agencies; it was not a review establishing that all DOGE teams had unrestricted access, nor was it a review of COBOL systems specifically. |
What the 2025 review says about modernization plans
For the 11 selected systems in its July 2025 review, GAO said three agencies had documented modernization plans that included all key practices. Plans for the other eight systems did not fully document those practices. GAO’s key planning elements were milestones, a description of the work and details about what would happen to the legacy system.
That finding concerns the completeness of documented plans. It does not establish that every system without a fully documented plan was unprotected or that every system with a complete plan had already been modernized.
What does COBOL have to do with the risk?
GAO reported that the two selected Treasury systems in its July 2025 review ran COBOL and Assembly Language Code. It also described dwindling availability of staff with the skills to maintain such languages as a support risk. That is a workforce and maintainability concern—not proof that either language is inherently insecure.
Rank #3
A system written in an old language may still have controls that work; a newer system may still be poorly secured. More relevant questions include whether components receive support and security fixes, whether the agency can make changes safely, and whether it has enough people who understand the system to maintain it. The reported vulnerabilities and unsupported components in GAO’s selected systems are concrete risk indicators; the language label alone is not.
What is the Evil Housekeeper Problem?
The “evil housekeeper” is a security analogy about what can happen when someone gains physical access to a device. Dan Hon, writing in MIT Technology Review on February 7, 2025, described the principle this way: “It’s a principle of computer security roughly stating that once someone is in your hotel room with your laptop, all bets are off.” The idea is that defenses designed around remote threats may not be enough once an adversary can handle the device directly.
Rank #4
In the government context, the analogy also prompts a question about institutional authority: what happens when someone with authority is present and asks staff to enable access? That is a way to examine assumptions about access processes and oversight. It is not evidence that a named person entered a system, bypassed a control or caused a breach.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Hon also argued, in a sentence reproduced by Ben Werdmuller on February 7, 2025: “We’re seeing in real time that there are no practical technical measures preventing someone from taking a spanner to the technology that keeps our government stable, that keeps society running every day—despite the very real consequences.” That is Hon’s characterization, not a GAO finding. His accompanying advice was: “So we should plan for the worst, even if the likelihood of the worst is low.” The useful distinction is between preparing for a threat and claiming it has occurred.
Best Value
How do Elon Musk, DOGE and the GAO findings fit together?
Elon Musk’s post, as quoted in a 2025 academic article’s references, said: “The government runs on ancient computers & software. Needs an upgrade!” The post expresses Musk’s view; it is not an independent technical assessment of federal systems. GAO’s selected-system reviews provide a narrower basis for discussion: they identify specific outdated languages, unsupported components, vulnerabilities and planning gaps in the systems it examined.
The DOGE access question is separate from the COBOL question. GAO’s September 2026 review asked about system access and controls at six agencies. Because agencies did not provide enough information for GAO to determine the extent of access, GAO said Congress and the public lacked assurance that systems and data were protected. That is a finding about the limits of available information and assurance. It does not establish that every DOGE team had unrestricted access, that a particular system was breached, or that the review concerned COBOL systems.
The connection to the “evil housekeeper” analogy is therefore about governance as well as technology. Technical controls matter, but so do clear authorization, oversight and evidence that access is being managed. The analogy helps frame a threat model; it cannot substitute for evidence about what permissions people actually had or what they did.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →How can agencies modernize COBOL systems safely?
There is no one-size-fits-all answer, and GAO’s findings do not identify a universally best migration method. A sound decision weighs continuity and failure risk, security and patchability, data-conversion risk, workforce and vendor support, interoperability and operating costs, as well as a credible schedule for retiring or otherwise disposing of the old system. GAO’s planning practices—milestones, a description of the work and disposition of the legacy system—provide a useful minimum structure for making that work visible.
| Approach to assess | Potential value | Questions and risks to test |
|---|---|---|
| Keep the existing system while improving support and controls | Can preserve current service behavior while addressing specific maintenance or security weaknesses. | Can needed fixes be made and tested? Are supportable components, skilled maintainers and a funded plan available? Is continued operation a deliberate choice with milestones, rather than an indefinite default? |
| Retain core functions while adding an interface or replacing surrounding components | Can allow changes around a stable core without replacing every component at once. | Does the added layer create new dependencies or security boundaries? How will data integrity, interoperability and ownership of the old component be managed? |
| Move the system to different infrastructure | May change the operating environment without immediately replacing all application logic. | Will the application and its dependencies be supported in the new environment? How will access controls, performance, recovery and migration be validated? |
| Replace or rewrite the system, all at once or in stages | Can provide a path away from obsolete components and enable a redesigned service. | How will the agency preserve required behavior, validate converted data, maintain service during cutover and avoid simply recreating the same dependencies? What is the tested rollback or recovery plan? |
These are decision questions, not claims that GAO recommended any particular approach for a named system. The safest plan is the one that makes the transition and its risks explicit: what work will happen, when it will happen, how continued service will be checked, and what will happen to the old system when it is no longer needed.
Quick Recap
What the evidence does—and does not—establish
- GAO has documented modernization and support concerns in selected federal systems, including selected Treasury systems using COBOL and Assembly Language Code.
- The 2025 figures apply to GAO’s selected group, while the age and cost figures repeated in 2023 apply to the earlier 2019 group.
- The 2026 DOGE review found that the information available from the agencies it examined was not sufficient for GAO to determine the extent of access. It did not establish unrestricted access across government or a breach.
- The Evil Housekeeper Problem is a useful analogy for thinking about access and limits of technical safeguards; it is not evidence of a specific incident.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
