11. The audit found it possible that commercial companies might secretly have collected and sold personal information about visitors to Defense Web sites.