GAO/AIMD00295, September 6, 2000) showed that in 24 agencies, physical and logical access controls were not effective in preventing or detecting system intrusions or misuse.
Logical access controls didn't do enough to stop people from abusing the system in at least 2 dozen agencies.