In February 1997 and again in January 1999 , our reports to the Congress designated information security as a governmentwide highrisk area .
Our reports identified information security as our main concern .