The Office of the Inspector General (OIG) at NASA has reported findings of multiple major issues with quality control and compliance with their contract to build the Block 1B version of the Space Launch System (SLS). In total, there were 71 corrective action requests (CARs), including 24 that rose to level 2 and even a recommendation for a level 3 one due to repeated issues with “stamp warranties” (Foust, 2024). For context, there are four total levels, with any level 2 or higher requests treated as official customer complaints due to the severity, recurrence, lead time to correct, or safety risk associated with the issue (AcqNotes, 2024). The issues were largely attributed to the lack of an effective quality management system at the Michoud Assembly Facility in New Orleans, along with the relatively low level of experience and training amongst project staff (Foust, 2024). While cybersecurity was not named as a primary concern in Foust’s article, the wide range of quality control problems with the SLS program suggests that there are likely even more than the report identifies, and some of those are likely related to cybersecurity.
The lack of appropriate background and training of workers means that they may not even know enough to recognize serious issues. Additionally, planning and supervision of work orders is not being done properly, so while technicians need to be producing high quality work in the first place, in the event that they do not do so, the mistakes are not being caught. The location in Louisiana and relatively low pay compared to other aerospace positions mean that the facility generally struggles to hire and keep experienced employees (Foust, 2024). From a cybersecurity perspective, this suggests that they would similarly struggle to identify and remedy cyber vulnerabilities aboard the SLS, largely due to a lack of knowledge on what to look for. If the workers are not producing high-quality products, and supervisors are letting errors slide or improperly planning the work in the first place, the person who ends up noticing the issue could easily be an attacker.
Even when a team can identify issues and possible remedies, planning and tracking that work is crucial. The Earned Value Management System (EVMS) in place at the Michoud facility has not been allowed by the DoD since 2020 due to “several deficiencies,” suggesting that it is not an appropriate system for managing a project on the scale of the SLS (Foust, 2024). Without a better system or strategy for tracking progress, it would be very easy for an issue to slip through the cracks, preventing its resolution. In general, the quality control issues seem to be exacerbated by mismanagement and disorganization.
On the bright side, the existence of an effective internal watchdog at NASA is a key step to resolving the quality control situation at Boeing. Independent audits, reviews, and other controls ensure that where Boeing drops the ball on quality management, NASA is there to catch it before a more hostile actor. Even in situations where a contractor has a solid internal process, having a third-party that is able and willing to review work is worthwhile, as even the best teams can make mistakes or overlook problems. However, when the contractor does not implement effective quality control, it becomes crucial to fill that gap elsewhere. Learning from Boeing’s mistakes is important, but so is learning from the OIG’s success.
Further examining possible remedies, increasing communication is a major one, as Foust notes Boeing’s lack of response to several issues that have been noted as far back as 2021. Additionally, overhauling the quality management system to include an approved EVMS is key. One recommendation that was rejected was the imposition of financial penalties, which aligns with limiting the CARs in question to level 2 (Foust, 2024). In general, levels 3 and 4 are more likely to involve withholding payments to the contractor. This indicates that trying to resolve the current issues with Boeing cooperatively is still the preferred approach, although given the severity and recurrence of noncompliance, the possibility remains that a more punitive approach will be needed to resolve these issues.
Works Cited:
Corrective action request (CAR). AcqNotes. (2024, February 23). https://acqnotes.com/acqnote/careerfields/corrective-action-request
Foust, J. (2024, August 12). NASA watchdog finds quality control problems with Boeing SLS work. SpaceNews. https://spacenews.com/nasa-watchdog-finds-quality-control-problems-with-boeing-sls-work/