Neither of the Merchant Marine Academy's misconduct trackers works

The U.S. Merchant Marine Academy, at Kings Point, New York, operates under two separate congressional mandates requiring it to properly track student misconduct: one covering sexual assault and harassment claims, the other covering honor and conduct violations.▸ In December 2024⧉, DOT's Inspector General audited the first system. About a year later⧉, GAO audited the second, as part of a review covering all five U.S. service academies.

The fiscal year 2023 National Defense Authorization Act required MARAD to build a proper information management system for USMMA's Sexual Assault Prevention and Response (SAPR) Program by January 1, 2023, so that assault and harassment claims involving cadets could be tracked in a way that let patterns be identified.▸ DOT's Inspector General found that, nearly two years past that deadline, MARAD had done no such thing: the SAPR Program was instead using a spreadsheet, which USMMA's own Superintendent acknowledged didn't meet the Academy's operational needs.

The spreadsheet's problems went beyond missing data fields.▸ DOT's Inspector General assessed the system against six cybersecurity control categories required by federal standards -- access control, encryption, data integrity, audit logging, data exfiltration protection, and backup -- and found every one deficient. Staff who didn't need it, including IT personnel who might not even work at the Academy, had read/write access to sexual assault victims' claims, and the monthly account reviews required to catch and remove that kind of access hadn't been conducted. The network drive holding the spreadsheet wasn't encrypted. There was no audit logging, no data-loss-prevention software, and no special backup protections for the sensitive files. MARAD's own Privacy Officer had never even analyzed the system to determine what privacy protections it needed.

The Inspector General made four recommendations -- securing the data, completing the required fields, implementing interim cybersecurity controls, and finishing a privacy impact analysis.▸ MARAD concurred with all four and provided completion dates; the recommendations remain open pending that work.

GAO's December 2025 review of honor and conduct systems across all five service academies found USMMA's separate misconduct-tracking system -- for honor-code violations and conduct offenses, not sexual assault -- had parallel problems.▸ USMMA doesn't collect data on three specific stages of its conduct process: investigations, the method used to adjudicate a case, and the use of remediation as a disciplinary outcome. On evidentiary rules, USMMA's guidance -- like several other academies' -- doesn't clearly specify what kinds of evidence, including hearsay, are admissible in honor hearings, even though officials say hearsay is in practice allowed.

USMMA officials also told GAO they can't directly access their own historical conduct data.▸ Instead, they have to go through an outside contractor who manages the database -- a database GAO says is 25 years old, which officials said makes it hard to query directly. USMMA has identified a replacement system but, as of the report, had not set a timeline for putting it in place.

GAO made 13 recommendations across all five academies; three were directed specifically at the Secretary of Transportation for the Merchant Marine Academy -- clarify the honor and conduct system's due-process guidance, identify and document a complete set of data-collection requirements for every stage of the process, and set a timeline for fixing the data-access problems.▸ The Department of Transportation concurred with all three. Combined with the four SAPR-system recommendations DOT's own Inspector General made a year earlier, that's seven recommendations across two entirely separate, congressionally mandated tracking systems at the same Academy -- and all seven have been accepted, not disputed.