prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.

Report 1: The national pipeline system consists of more than 2 7 million miles of networked pipelines transporting oil, natural gas, and other hazardous liquids  Hazardous liquid and natural gas pipelines—primarily buried underground in the continental United States—run under remote and open terrain, as well as densely populated areas  These pipelines are of three main types: Hazardous liquid: About 216,000 miles of hazardous liquid pipeline transport crude oil, diesel fuel, gasoline, jet fuel, anhydrous ammonia, and carbon dioxide  Natural gas transmission and storage: About 319,000 miles of pipeline—mostly interstate—transport natural gas from sources to communities  Natural gas distribution: About 2 2 million miles of pipeline—mostly intrastate—transport natural gas from transmission sites to consumers  Figure 1 depicts the network of hazardous liquid and natural gas transmission pipelines in the United States  More than 3,000 pipeline companies operate the nation’s pipeline systems, which can traverse multiple states and the U S  borders with Canada and Mexico  Many pipeline systems are comprised of the pipelines themselves, as well as a variety of facilities, such as storage tanks, compressor stations, and control centers  Most pipeline systems are monitored and moderated through automated ICS or Supervisory Control and Data Acquisition (SCADA) systems using remote sensors, signals, and preprogramed parameters to activate and deactivate valves and pumps to maintain flows within tolerances  Federal agencies and pipeline operators determine the criticality of pipeline systems and their facilities based on their importance to the nation’s energy infrastructure; service to installations critical to national defense; or, if attacked, have the potential to cause mass casualties and significant impact on public drinking water affecting major population centers  Accordingly, those determined to be critical merit increased attention to security  However, as we previously reported, the inherent design and operation of U S  pipeline systems may reduce some potential impacts of lost service  The pipeline sector is generally considered to be resilient and versatile  Historically, pipeline operators have been able to quickly respond to the adverse consequences of an incident—whether it is damage from a major hurricane or a backhoe—and quickly restore pipeline service  Pipeline infrastructure also includes redundancies such as parallel pipelines or interconnections that enable operators to reroute material through the network  Figure 2 depicts the U S  pipeline system, its basic components, examples of vulnerabilities, and the entities to which it supplies energy and raw materials  These entities include utility companies, airports, military sites, and industrial and manufacturing facilities  According to TSA, pipelines are vulnerable to physical attacks—including the use of firearms or explosives—largely due to their stationary nature, the volatility of transported products, and the dispersed nature of pipeline networks spanning urban and outlying areas  The nature of the transported commodity and the potential effect of an attack on national security, commerce, and public health make some pipelines and their assets more attractive targets for attack  Oil and gas pipelines have been and continue to be targeted by terrorists and other malicious groups globally  Terrorists have also targeted U S  pipelines, but have not succeeded in attacking them  Further, environmental activists and lone actors seeking to halt the construction of new pipelines through sabotage have recently emerged as a new threat to pipelines  For example, in March 2017, activists used blowtorches to cut holes in empty portions of the Dakota Access Pipeline in two states  In February 2017, local law enforcement officers fatally shot a man who used an assault rifle to damage the Sabal Trail Pipeline, a natural gas pipeline under construction in Florida  The sophisticated computer systems that pipeline operations rely on are also vulnerable to various cyber threats  According to DOE, the frequency, scale, and sophistication of cyber threats have increased, and attacks have become easier to launch  NCCIC reported that the energy sector, which includes pipelines, experienced more cyber incidents than any sector from 2013 to 2015, accounting for 35 percent of the 796 incidents reported by all critical infrastructure sectors  In 2016, NCCIC reported that the energy sector was the third most frequently attacked sector  Further, according to DOE, the cost of preventing and responding to cyber incidents in the energy sector is straining the ability of companies to adequately protect their critical cyber systems  For example, a 2015 study by the Ponemon Institute estimated the annualized cost of cyber crime for an average energy company to be about $28 million  Ineffective protection of cyber assets from these threats can increase the likelihood of security incidents and cyber attacks that disrupt critical operations; lead to inappropriate access to and disclosure, modification, or destruction of sensitive information; and threaten national security, economic well-being, and public health and safety  Unintentional or nonadversarial threat sources may include failures in equipment or software due to aging, resource depletion, and errors made by end users  They also include natural disasters and failures of critical infrastructure on which the organization depends, but that are outside of the control of the organization  Intentional or adversarial threats may include corrupt employees, criminal groups, terrorists, and nations that seek to leverage the organization’s dependence on cyber resources (i e , information in electronic form, information and communications technologies, and the communications and information-handling capabilities provided by those technologies)  These threat adversaries vary in terms of their capabilities, their willingness to act, and their motives, which can include seeking monetary gain or seeking an economic, political, or military advantage  Cyber threat adversaries make use of various techniques, tactics, practices, and exploits to adversely affect an organization’s computers, software, or networks, or to intercept or steal valuable or sensitive information  For example, an attacker could infiltrate a pipeline’s operational systems via the internet or other communication pathways to potentially disrupt its service and cause spills, releases, explosions, or fires  Moreover, ICS, which were once largely isolated from the Internet and the company’s information technology systems, are increasingly connected in modern energy systems, allowing cyber attacks to originate in business systems and migrate to operational systems  For example, malicious nation-state actors used spear-phishing and other similar approaches in 2018 against energy sector organizations to gain access to their business systems, conduct reconnaissance, and collect information about their ICS  Similarly, in April 2012, the Industrial Control Systems Cyber Emergency Response Team reported that an unidentified cyber attacker had conducted a series of cyber intrusions into U S  natural gas pipeline systems beginning in December 2011  Federal policy and public-private plans establish roles and responsibilities for the protection of critical infrastructure, including pipelines  These include Presidential Policy Directive 21 (PPD-21), the NIPP, and Executive Order 13636  PPD-21, issued in February 2013, reflects an all- hazards approach to protecting critical infrastructure, including natural disasters, terrorism, and cyber incidents  The directive also identifies the 16 critical infrastructure sectors and assigns roles and responsibilities for each critical infrastructure sector among nine designated federal sector-specific agencies  While PPD-21 identified the critical infrastructure sectors and assigned responsibility for each sector’s sector-specific agency, the NIPP outlines critical infrastructure stakeholder roles and responsibilities regarding critical security and resilience  It describes a voluntary partnership model as the primary means of coordinating government and private sector efforts to protect critical infrastructure  As part of the partnership structure, the designated sector-specific agencies serve as the lead coordinators for security programs of their respective sector  As sector-specific agencies, federal departments or agencies lead, facilitate, or support the security and resilience programs and associated activities of their designated critical infrastructure sector  For example, DHS and DOT are both designated as sector-specific agencies for the transportation systems sector, which includes pipelines  Each sector also has a government coordinating council, consisting of representatives from various levels of government, and many have a sector coordinating council (SCC) consisting of owner-operators of these critical assets or members of their respective trade associations  For example, the Transportation Government Coordinating Council has been established, and the Pipeline Modal SCC has been established to represent pipeline operators  The NIPP also outlines a risk management framework for critical infrastructure protection  As shown in Figure 3, the NIPP uses a risk management framework as a planning methodology intended to inform how decision makers take actions to manage risk  The risk management framework calls for public and private critical infrastructure partners to conduct risk assessments to understand the most likely and severe incidents that could affect their operations and communities, and use this information to support planning and resource allocation  According to DHS, the risk management framework is influenced by the nature and magnitude of a threat, the vulnerabilities to that threat, and the consequences that could result, as shown in Figure 4  Federal policy has encouraged voluntary information-sharing mechanisms between the federal government and critical infrastructure owners and operators  For example, Information Sharing and Analysis Centers (ISAC) are formed by critical infrastructure owners and operators to gather, analyze, appropriately sanitize, and disseminate intelligence and information related to critical infrastructure  They typically collect, analyze and disseminate actionable threat information to their members and provide members with tools to mitigate risks and enhance resiliency  ISACs in which pipeline operators may participate have been formed including the Oil and Natural Gas ISAC, Downstream Natural Gas ISAC, and Electricity ISAC  Finally, in February 2013, the president issued Executive Order 13636, Improving Critical Infrastructure Cybersecurity, which cited repeated cyber intrusions into critical infrastructure as demonstrating the need for improved cybersecurity  Executive Order 13636 outlined actions for improving critical infrastructure cybersecurity, including direction for the National Institute of Standards and Technology (NIST) to lead the development of a voluntary risk-based cybersecurity framework that would comprise a set of industry standards and best practices to help organizations manage cybersecurity risks  NIST issued the framework in 2014 and updated it in April 2018  The order also addressed the need to improve cybersecurity information sharing and collaboratively develop risk-based standards and stated that U S  policy was to increase the volume, timeliness, and quality of cyber threat information shared with private sector entities so that these entities may better protect and defend themselves against cyber threats  Protecting the nation’s pipeline systems is a responsibility shared by both the federal government and private industry  As a result, several federal departments, agencies, and the private sector have significant roles in pipeline physical and cyber-related security  These entities include the following: Transportation Security Administration (TSA)  TSA, within DHS, has primary oversight responsibility for the physical security and cybersecurity of transmission and distribution pipeline systems  Within TSA, the Security Policy and Industry Engagement’s Pipeline Security Branch is charged with overseeing its pipeline security program  Pursuant to its authority, TSA’s Pipeline Security Branch first issued its voluntary Pipeline Security Guidelines in 2011, and released revised guidelines in March 2018  In accordance with the 9/11 Commission Act, TSA’s Pipeline Security Branch identifies the top 100 critical pipeline systems in the nation  To do so, it uses system annual throughput, which is based on the amount of hazardous liquid or natural gas product transported through a pipeline in 1 year (i e , annual throughput)  TSA also ranks the relative risk among the top 100 critical pipeline systems, discussed later in the report  Additionally, TSA’s Pipeline Security Branch is responsible for conducting voluntary Corporate Security Reviews (CSR) and Critical Facility Security Reviews (CFSR), which assess the extent to which the 100 most critical pipeline systems are following the intent of TSA’s Pipeline Security Guidelines  See figure 5 below for an overview of the CSR and CFSR processes  In addition, TSA Intelligence and Analysis is responsible for collecting and analyzing threat information related to the transportation network, and sharing relevant threat information to pipeline stakeholders  National Cybersecurity and Communications Integration Center (NCCIC)  Within DHS, NCCIC assists critical infrastructure owners in addressing cyber incidents and attacks, including those targeting industrial control systems  The NCCIC’s mission is to reduce the likelihood and severity of incidents that may significantly compromise the security and resilience of the nation’s critical information technology and communications networks  NCCIC’s role is to serve as the federal civilian interface for sharing information related to cybersecurity risks, incidents, analysis, and warnings with federal and nonfederal entities, and to provide shared situational awareness to enable real-time actions to address cybersecurity risks and incidents to federal and nonfederal entities  Pipeline and Hazardous Materials Safety Administration (PHMSA)  PHMSA, within DOT, is responsible for regulating the safety of hazardous materials transportation and the safety of pipeline systems, some aspects of which can be related to pipeline security  In 2004, PHMSA and TSA entered into a memorandum of understanding regarding their respective roles in all modes of transportation  In 2006, they signed an annex to the memorandum of understanding that further delineates lines of authority and responsibility between TSA and PHMSA on pipeline and hazardous materials transportation security  The annex identifies TSA as the lead federal entity for transportation security, including hazardous materials and pipeline security, and PHMSA as responsible for administering a national program of safety in natural gas and hazardous liquid pipeline transportation, including identifying pipeline safety concerns and developing uniform safety standards  Department of Energy (DOE)  DOE is responsible for protecting electric power, oil, and natural gas delivery infrastructure and, in December 2015, was identified in statute as the sector-specific agency for cybersecurity for the energy sector  The Office of Cybersecurity, Energy Security, and Emergency Response is the lead for DOE’s cybersecurity efforts  In addition, DOE operates the National SCADA Test Bed Program, a partnership with Idaho National Laboratory, Sandia National Laboratories, and other national laboratories which addresses control system security challenges in the energy sector  Among its key functions, the program performs control systems testing, research, and development; control systems requirements development; and industry outreach  Federal Energy Regulatory Commission (FERC)  FERC regulates the U S  bulk electric power system, which is increasingly powered by natural gas pipeline systems  FERC has regulatory authority over interstate natural gas pipelines under the Natural Gas Act  However, its role is limited to natural gas pipeline siting and rate regulation  The North American Electric Reliability Corporation is the federally designated U S  Electric Reliability Organization, and is overseen by FERC  The North American Electric Reliability Corporation, with approval from FERC, has developed mandatory critical infrastructure protection standards for protecting electric utility–critical and cyber-critical assets  Private sector  Although TSA has primary federal responsibility for overseeing interstate pipeline security, private sector pipeline operators are responsible for implementing asset-specific protective security measures  As we previously reported, operators have increased their attention on security by incorporating security practices and programs into their overall business operations  Pipeline operators’ interests and concerns are primarily represented by five major trade associations with ties to the pipeline industry—the Interstate Natural Gas Association of America (INGAA), American Gas Association (AGA), American Public Gas Association, American Petroleum Institute (API), and Association of Oil Pipe Lines  According to TSA officials, pipeline operators, and association representatives, these associations have worked closely with the federal government on a variety of pipeline security-related issues, including collaborating on TSA’s voluntary standards and information sharing  All of the pipeline operators and pipeline association representatives we interviewed reported receiving security information from federal and nonfederal entities  Pipeline operators also reported providing security- related information to federal agencies, including TSA, as incidents occur  Multiple federal entities exchange alerts of physical and cybersecurity incidents and other risk-related information with critical infrastructure partners, including pipeline operators  For example, DHS components including TSA’s Intelligence and Analysis and NCCIC share security- related information on physical and cyber threats and incidents with sector stakeholders  Specifically, Intelligence and Analysis provides quarterly intelligence briefings to pipeline operators  NCCIC also issues indicator bulletins, which can contain information related to cyber threat indicators, defensive measures, and cybersecurity risks and incidents  In addition, TSA and other federal entities have coordinated to address specific pipeline-related security incidents  For example, TSA officials coordinated with DOT, DOE, the Department of Justice, and FERC through the Oil and Natural Gas subsector SCC to address ongoing incidents of vandalism and sabotage of critical pipeline assets by environmental activists in 2016  In July 2017, according to DOT officials, PHMSA and TSA collaborated on a web-based portal to facilitate sharing sensitive but unclassified incident information among federal agencies with pipeline-related responsibilities  See table 1 for the key federal information sharing entities and programs that exchange security-related or incident information with critical infrastructure stakeholders, including the pipeline sector  Pipeline operators also share security-related information with TSA and the NCCIC  In its Pipeline Security Guidelines, TSA requests that pipeline operators report by telephone or email to its Transportation Security Operations Center (TSOC) any physical security incidents that are indicative of a deliberate attempt to disrupt pipeline operations or activities that could be considered precursors to such an attempt  TSA’s Pipeline Security Guidelines also request that operators report any actual or suspected cyber attacks that could impact pipeline industrial control systems or other information technology-based systems to the NCCIC  According to the TSOC’s operating procedures, if a reported incident meets certain criteria, such as the incident was intended to or resulted in damage or requires a general evacuation of a facility, the TSOC watch officer is then to contact Office of Security and Industry Engagement officials  According to TSA officials, the TSOC does not conduct investigations of the specific security incidents that pipeline operators report  However, TSOC staff do analyze the incident information they receive for national trends and common threats  TSA officials stated that they share their observations with pipeline operators and other critical infrastructure asset owners during monthly and quarterly conference calls that TSA holds with pipeline operators  All the pipeline operators and association representatives we interviewed identified other nonfederal information sharing entities, including ISACs, fusion centers, industry associations, and SCCs, which provide forums for exchanging information about physical and cyber incidents throughout the pipeline sector  See table 2 for nonfederal information sharing entities identified as available to pipeline operators  Operators and TSA officials reported that the current backlog in granting security clearances for some key pipeline operator employees was a significant factor affecting information sharing between TSA and pipeline operators  TSA officials acknowledged that some pipeline operators have had difficulty obtaining security clearances for key employees due to ongoing backlogs in processing requests by the Office of Personnel Management National Background Investigation Bureau, and that TSA’s ability to share timely information with operators whose staff do not have a clearance may be hindered  Three of the 10 pipeline operators we interviewed identified receiving timely classified security information as a specific challenge due, in part, to difficulties staff have had obtaining security clearances  Further, 7 of the 10 pipeline operators that we interviewed reported experiencing delays in obtaining a security clearance or were aware of others who had experienced this issue  However, according to three operators we interviewed, TSA was helpful in facilitating approval of security clearances for the operators’ personnel to access classified information when necessary  This security clearance challenge is not faced by pipeline operators alone  In January 2018, we designated the backlog of investigations for the clearance process and the government-wide personnel security clearance process as a high-risk area  We will continue to monitor agencies’ progress in reducing the backlog and improving the security clearance process  Pipeline operators that we interviewed reported using a range of guidelines and standards to address their physical and cybersecurity risks, and all of them reported implementing TSA’s voluntary Pipeline Security Guidelines that were applicable to their operations  TSA revised and issued its Pipeline Security Guidelines in March 2018, but the revised guidelines lack a defined process to consider updates to supporting guidance such as to the NIST Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework)  Furthermore, TSA has not clearly defined the terms within the criteria that pipeline operators are to use to determine the criticality of their facilities  Pipeline operators that we interviewed reported using a range of guidelines and standards to address their physical and cybersecurity risks  For example, all 10 of the pipeline operators we interviewed stated they had implemented the voluntary 2011 TSA Pipeline Security Guidelines the operators determined to be applicable to their operations  The guidelines provide TSA’s recommendations for pipeline industry security practices such as establishing a corporate security program and identifying critical facilities among others (see sidebar)  Five of the 10 pipeline operators we interviewed characterized the guidelines as generally or somewhat effective in helping to secure their operations, 1 was neutral on their effectiveness, and 4 did not provide an assessment of the guidelines’ effectiveness  However, one operator pointed out that they had not adopted the guidelines’ recommended interval of 36 months or less for conducting security vulnerability assessments due to staffing limitations  Also, another pipeline operator noted that they were working to implement the guidelines in the operations of a newly acquired asset that they determined was not using the guidelines in the same manner as their company  All of the pipeline operators we interviewed reported using other guidelines or standards to address pipeline systems’ security risks  For example, pipeline operators reported using and industry association representatives reported that their members use INGAA’s Control Systems Cyber Security Guidelines for the Natural Gas Pipeline Industry, API’s Pipeline SCADA Security standard, and the NIST Cybersecurity Framework as sources of cybersecurity standards, guidelines, and practices that may be scaled and applied to address a pipeline operator’s cybersecurity risks  Further, pipeline operators are required to adhere to regulations related to pipeline safety and, depending upon their assets, operations, and location, may be required to adhere to regulations for electrical utilities, chemical storage facilities, and locations near waterways  For example, all pipeline operators must adhere to DOT’s PHMSA safety regulations  In addition, pipeline operators whose systems include chemical facilities may be required to comply with DHS’s Chemical Facility Anti-Terrorism Standards (CFATS)  Pipeline operators whose systems include a terminal located on a U S  port may be required to comply with Maritime Transportation Security Act regulations  For a listing of federal and industry guidelines identified as applicable to security by the pipeline operators, see appendix I  TSA’s Pipeline Security Branch issued its revised Pipeline Security Guidelines in March 2018, but TSA has not established a documented process to ensure that revisions occur and fully capture updates to supporting standards and guidance  The guidelines were revised to, among other things, reflect the dynamic threat environment and to incorporate cybersecurity principles and practices from the NIST Cybersecurity Framework, which were initially issued in February 2014  To revise the guidelines and incorporate feedback, according to Pipeline Security Branch officials, they incorporated outcomes from pipeline modal threat assessments and best practices from security reviews, and collaborated with pipeline sector stakeholders—including industry associations and other federal agencies with a role in pipeline security  Officials from the industry associations we interviewed confirmed that they provided input to the revised pipeline guidelines, including meeting with and consolidating comments from member pipeline operators  See figure 6 for a timeline of events pertinent to federal pipeline security guidelines  TSA’s Pipeline Security Smart Practice Observations for pipeline operators states that security plans should have a documented process to include security plan reviews and updates on a periodic and an as- needed basis  Standards for Internal Control in the Federal Government states that periodic review of policies, procedures, and related control activities should occur to determine their continued relevance and effectiveness in achieving identified objectives or addressing related risks  The NIPP and NIST also emphasize the need to provide updates on incident response guidance and security procedures, respectively  Moreover, other pipeline industry guidance cited by TSA’s guidelines also has a prescribed interval for review and revision  For example, API reviews its standards at least every 5 years  However, TSA has not instituted a documented process to consider the need to update the Pipeline Security Guidelines on a regular basis  Pipeline Security Branch officials acknowledged the value of having a defined process for reviewing and, if necessary, revising TSA’s Pipeline Security Guidelines at regular defined intervals to ensure it includes, among other things, newly identified best practices and updated industry guidance that are relevant to pipeline operators, such as the elements of the latest version of NIST’s Cybersecurity Framework  For example, TSA’s revisions to its guidelines incorporated some, but not all of the elements of the NIST Cybersecurity Framework version 1  Specifically, to improve incident response, the NIST framework recommends implementing an incident response analysis and feedback function to a security program  However, TSA’s Pipeline Security Guidelines do not include similar steps for pipelines operators to include in their pipeline security programs  Further, because NIST released version 1 1 of the Cybersecurity Framework in April 2018, the guidelines that TSA released in March 2018 do not incorporate cybersecurity elements that NIST added to the latest Cybersecurity Framework such as the Supply Chain Risk Management category  Pipeline Security Branch officials said that they have not instituted a review process on a regular basis because they intended to review and revise TSA’s guidelines on an as-needed basis in response to updated supporting guidance, but could provide no timeline for doing so  Without a documented process defining how frequently Pipeline Security Branch staff are to review and revise its guidelines, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical and cybersecurity, or address the persistent and dynamic security threat environment currently facing the nation’s pipeline system  Under TSA’s Pipeline Security Guidelines, pipeline operators are to self- identify the critical facilities within their system and report their critical facilities to TSA  TSA’s Pipeline Security Branch conducts CFSRs at the critical facilities that pipeline operators have identified  However, our analysis of TSA’s data found that at least 34 of the top 100 critical pipeline systems deemed highest risk indicated that they had no critical facilities  Accordingly, TSA would not conduct a CFSR at any of these systems’ facilities because their operators identified none of them as critical  The fact that pipeline operators of about one third of the highest risk systems identified no critical facilities may be due, in part, to the Pipeline Security Branch not clearly defining the criteria outlined in the Pipeline Security Guidelines that pipeline operators are to use to determine the criticality of their facilities  Three of the 10 operators we interviewed stated that some companies reported to TSA that they had no critical facilities, and may possibly be taking advantage of the guidelines’ lack of clarity  Accordingly, operators that report no critical facilities would avoid TSA’s reviews of their facilities  service or deliverability resulting in a state or local government's inability to provide essential public services and emergency response for an extended period of time; Significantly damage or destroy national intended use of major rivers, lakes, or waterways (e g , public drinking water for large populations or disruption of major commerce or public transportation routes); service or deliverability to a significant number of customers or individuals for an extended period of time; operations for an extended period of time (i e , business critical facilities)  Our review of the eight criteria included in TSA’s Pipeline Security Guidelines (see sidebar) found that no additional examples or clarification are provided to help operators determine criticality  Although we previously noted that 5 of the 10 operators we interviewed generally found TSA’s Guidelines as a whole helpful in addressing pipeline security, more than half of the operators we interviewed identified TSA’s criticality criteria as a specific area for improvement  Specifically, 3 of the 10 pipeline operators that we interviewed stated that TSA had not clearly defined certain terms within the criteria, and 3 additional operators of the 10 reported that additional consultation with TSA was necessary to appropriately apply the criteria and determine their facilities’ criticality  For example, 2 operators told us that individual operators may interpret TSA’s criterion, “cause mass casualties or significant health effect,” differently  One of these operators that we interviewed stated that this criterion could be interpreted either as a specific number of people affected or a sufficient volume to overwhelm a local health department, which could vary depending on the locality  Another operator reported that because TSA’s criteria were not clear, they created their own criteria which helped the operator identify two additional critical facilities  Pipeline Security Branch officials acknowledged there are companies that report having no critical facilities in their pipeline systems  According to Pipeline Security Branch officials, pipeline operators are in the best position to determine which of their facilities are critical, and the companies that have determined that their pipeline systems have no critical facilities also have reported sufficient redundancies to make none of their facilities critical to the continuity of their operations  According to these officials, they have had extensive discussions with pipeline company officials to assess the validity of their criticality determinations, and have closely questioned companies to ensure they have properly applied TSA’s criteria  However, according to TSA’s Pipeline Security Guidelines, operators should use a consistent set of criteria for determining the criticality of their facilities  In addition, Standards for Internal Control in the Federal Government states that management should define objectives clearly to enable the identification of risks  To achieve this, management generally defines objectives in specific and measurable terms and ensures the terms are fully and clearly set forth so they can be easily understood  Pipeline Security Branch officials acknowledged that the criticality definitions in the Pipeline Security Guidelines could be clarified to be more specific  Additionally, an industry association representative reported that the association, in consultation with TSA, has been developing supplementary guidance for its members to clarify certain terms in TSA’s critical facility criteria  As of October 2018 this guidance is still under review at the association and has not been made available to the association’s members  Pipeline Security Branch officials confirmed they worked with the industry association on its supplementary guidance, but also acknowledged that the supplementary guidance may only be distributed to the association’s membership  Without clearly defined criteria for determining pipeline facilities’ criticality, TSA cannot ensure that pipeline operators are applying its guidance uniformly  Further, because TSA selects the pipeline facilities on which to conduct CFSRs based on operators’ determinations, TSA cannot fully ensure that all of the critical facilities across the pipeline sector have been identified using the same criteria, or that their vulnerabilities have been identified and addressed  TSA’s Intelligence and Analysis identifies security risks to pipeline systems through various assessments  Additionally, TSA’s Pipeline Security Branch conducts security reviews to assess pipeline operators’ implementation of TSA’s Pipeline Security Guidelines, but gaps in staffing and lack of a workforce plan may affect its ability to carry out effective reviews  The Pipeline Security Branch also developed a pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems and to prioritize its security reviews of pipeline companies, but shortfalls in its calculations of threat, vulnerability, and consequence may limit its ability to accurately identify pipeline systems with the highest risk  Finally, the pipeline risk assessment has not been peer reviewed to validate the assessment’s data and methodology, which we previously reported as a best practice in risk management  TSA’s Intelligence and Analysis produces assessments related to pipeline security risks, including Pipeline Modal and Cyber Modal Threat Assessments and the Transportation Sector Security Risk Assessment  The Pipeline and Cyber Modal Threat Assessments are issued on a semiannual basis; TSA Intelligence and Analysis may also issue additional situation-based products on emerging threats  The Pipeline Modal and Cyber Modal Threat Assessments evaluate, respectively, physical and cyber threats to pipelines  The pipeline modal threat assessment evaluates terrorist threats to hazardous liquid and natural gas pipelines, and the cyber modal threat assessment evaluates cyber threats to transportation, including pipelines  Both assessments specifically analyze the primary threat actors, their capabilities, and activities—including attacks occurring internationally—as well as other characteristics of threat  The Transportation Sector Security Risk Assessment assesses threat, vulnerability, and consequence for various attack scenarios across the five transportation modes for which TSA is responsible  The scenarios define a type of threat actor—including homegrown violent extremists and transnational extremists, such as al Qaeda and its affiliates—a target, and an attack mode  For example, a scenario might assess the risk of attacks using varying sizes of improvised explosive devices on pipeline system assets  As part of the assessment process, TSA engages with subject matter experts from TSA and industry stakeholder representatives to compile vulnerabilities for each mode, and TSA analyzes both direct and indirect consequences of the various attack scenarios  According to Pipeline Security Branch officials, the assessments produced by TSA’s Intelligence and Analysis provide key information to inform the pipeline security program’s efforts  According to TSA officials, TSA conducts pipeline security reviews— Corporate Security Reviews (CSRs) and Critical Facility Security Reviews (CFSRs)—to assess pipeline vulnerabilities and industry implementation of TSA’s Pipeline Security Guidelines  However, as shown by Figure 7 below, the number of CSRs and CFSRs completed by TSA has varied during the last five fiscal years, ranging from zero CSRs conducted in fiscal year 2014 to 23 CSRs conducted in fiscal year 2018, as of July 31, 2018  TSA officials reported that staffing limitations have prevented TSA from conducting more reviews  As shown in table 3, TSA Pipeline Security Branch staffing levels (excluding contractor support) have varied significantly over the past 9 years ranging from 14 full-time equivalents (FTEs) in fiscal years 2012 and 2013 to one FTE in fiscal year 2014  They stated that, while contractor support has assisted with conducting CFSRs, there were no contractor personnel providing CSR support from fiscal years 2010 through 2017, but that has now increased to two personnel in fiscal year 2018  TSA prioritizes reviewing and collecting information on the nation’s top 100 critical pipeline systems  According to TSA officials, they would need to conduct 46 CSRs in order to review the top 100 critical pipeline systems  In July 2018, TSA officials stated that TSA’s current target was to assess each pipeline company every 2 to 3 years; this would equate to about 15 to 23 CSRs per year  TSA officials stated that they expect to complete 20 CSRs and 60 CFSRs per fiscal year with Pipeline Security Branch employees and contract support, and have completed 23 CSRs through July 2018 for fiscal year 2018  Given the ever-increasing cybersecurity risks to pipeline systems, ensuring that the Pipeline Security Branch has the required cybersecurity skills to effectively evaluate pipeline systems’ cybersecurity is essential  Pipeline operators we interviewed emphasized the importance of cybersecurity skills among TSA staff  Specifically, 6 of the 10 pipeline operators and 3 of the 5 industry representatives we interviewed reported that the level of cybersecurity expertise among TSA staff and contractors may challenge the Pipeline Security Branch’s ability to fully assess the cybersecurity portions of its security reviews  TSA officials stated that Security Policy and Industry Engagement staff are working with DHS’s National Protection and Programs Directorate to help address cyber- related needs, including identifying specific cybersecurity skills and competencies required for the pipeline security program  The officials were uncertain, however, whether TSA would use contractor support or support from the National Protection and Programs Directorate to provide identified skills and competencies  TSA officials also stated that Security Policy and Industry Engagement staff work with TSA’s human resource professionals to identify critical skills and competencies needed for Pipeline Security Branch personnel, and helps its workforce maintain professional expertise by providing training and education for any identified skill or competency gaps  Our previous work has identified principles that a strategic workforce planning process should follow including developing strategies tailored to address gaps in number, deployment, and alignment of human capital approaches for enabling and sustaining the contributions of all critical skills and competencies  Workforce planning efforts, linked to an agency’s strategic goals and objectives, can enable it to remain aware of and be prepared for its needs, including the size of its workforce, its deployment across the organization, and the knowledge, skills, and abilities needed for it to pursue its mission  Agencies should consider how hiring, training, staff development, performance management, and other human capital strategies can be aligned to eliminate gaps and improve the long-term contribution of skills and competencies identified as important for mission success  TSA has not established a workforce plan for its Security Policy and Industry Engagement or its Pipeline Security Branch that identifies staffing needs and skill sets such as the required level of cybersecurity expertise among TSA staff and contractors  When asked for TSA strategic workforce planning documents used to inform staffing allocations related to the pipeline security program, TSA officials acknowledged they do not have a strategic workforce plan  Rather, according to these officials, TSA determines agency-level staffing allocations through the Planning, Programming, Budgeting and Execution process, which is used to decide policy, strategy, and the development of personnel and capabilities to accomplish anticipated missions  According to TSA officials, when they use this process they look at existing resources and then set priorities based on the TSA Administrator’s needs  However, a strategic workforce plan allows an agency to identify and prepare for its needs, such as the size of its workforce, its deployment across the organization, and the knowledge, skills, and abilities needed to pursue its mission  TSA officials stated that the agency has a detailed allocation plan for strategically aligning resources to screen passengers at TSA-regulated airports, but not for the entire agency  By establishing a strategic workforce plan, TSA can help ensure it has identified the knowledge, skills, and abilities that the future workforce of TSA’s Pipeline Security Branch may need in order to meet its mission of reducing pipeline systems’ vulnerabilities to physical and cybersecurity risks, especially in a dynamic and evolving threat environment  Further, as greater emphasis is placed on cybersecurity, determining the long- term staffing needs of the Pipeline Security Branch will be essential  Furthermore, a workforce plan could enable TSA to determine the number of personnel it needs to meet its stated goals for conducting CSRs and CFSRs  After TSA identifies the top 100 critical pipeline systems based on throughput, the Pipeline Security Branch uses the Pipeline Relative Risk Ranking Tool (risk assessment), which it developed in 2007, to assess various security risks of those systems  We previously reported, in 2010, that the Pipeline Security Branch was the first of TSA’s surface transportation modes to develop a risk assessment model that combined all three components of risk—threat, vulnerability, and consequence—to generate a risk score  The risk assessment generates a risk score for each of the 100 most critical pipeline systems and ranks them according to risk  The risk assessment calculates threat, vulnerability, and consequence for each pipeline system on variables such as the amount of throughput in the pipeline system and the number critical facilities  The risk assessment combines data collected from pipeline operators, as well as other federal agencies, such as the Departments of Transportation and Defense, to generate the risk score  However, the last time the Pipeline Security Branch calculated relative risk among the top 100 critical pipeline systems using the risk assessment was in 2014  Pipeline Security Branch officials told us that they use the pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems, and the standard operating procedures for conducting CSRs state the results of the risk ranking are the primary factor considered when prioritizing corporate security reviews of pipeline companies  According to Pipeline Security Branch officials, the risk assessment has not changed since 2014 because the Pipeline Security Branch is still conducting CSRs based on the 2014 ranking of pipeline systems  As outlined in table 4 below, we identified several factors that likely limit the usefulness of the current risk assessment in calculating threat, vulnerability, and consequence to allow the Pipeline Security Branch to effectively prioritize reviews of pipeline systems  For example, because the risk assessment has not changed since 2014, information on threat may be outdated  Additionally, sources of data and underlying assumption and judgments regarding certain threat and vulnerability inputs to the assessment are not fully documented  For example, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology, making it unclear if cybersecurity is part of the assessment’s threat factor  Further, the risk assessment does not include information that is consistent with the NIPP and other DHS priorities for critical infrastructure risk mitigation, such as information on natural hazards and the ability to measure risk reduction (feedback data)  According to Pipeline Security Branch officials, the risk ranking assessment is not intended to be a fully developed risk model detailing all pipeline factors influencing risk  Rather, officials said they are primarily interested in assessing risk data that impacts security  However, because TSA’s Pipeline Security Program is designed to enhance the security preparedness of the pipeline systems, incorporating additional factors that enhance security into their risk calculation would better align their efforts with PPD-21  For example, PPD-21 calls for agencies to integrate and analyze information to prioritize assets and manage risks to critical infrastructure, as well as anticipate interdependencies and cascading impacts  For a more detailed discussion of the shortfalls we identified, refer to appendix II  In addition to the shortfalls identified above, the risk assessment has not been peer reviewed since its conception in 2007  In our past work, we reported that independent, external peer reviews are a best practice in risk management and that independent expert review panels can provide objective reviews of complex issues  According to the National Research Council of the National Academies, external peer reviews should, among other things, address the structure of the assessment, the types and certainty of the data, and how the assessment is intended to be used  The National Research Council has also recommended that DHS improve its risk analyses for infrastructure protection by validating the assessments and submitting them to independent, external peer review  Other DHS components have implemented our prior recommendations to conduct peer reviews of their risk assessments  For example, in April 2013, we reported on DHS’s management of its Chemical Facility Anti- Terrorism Standards (CFATS) program and found that the approach used to assess risk did not consider all of the elements of consequence, threat, and vulnerability associated with a terrorist attack involving certain chemicals  The Infrastructure Security Compliance Division, which manages the CFATS program conducted a multiyear effort to improve their risk assessment methodology and included commissioning a peer review by the Homeland Security Studies and Analysis Institute, which resulted in multiple recommendations  As part of the implementation of some of the peer review’s recommendations, DHS conducted peer reviews and technical reviews with government organizations and facility owners and operators, and worked with Sandia National Laboratories to verify and validate the CFATS program’s revised risk assessment methodology, which was completed in January 2017  According to Pipeline Security Branch officials, they are considering updates to the risk assessment methodology including changes to the vulnerability and consequence factors  These officials said the risk assessment was previously reviewed within the past 18 months by industry experts and they consider input from several federal partners including DHS, DOT, and the Department of Defense  Officials also said they will consider input from industry experts and federal partners while working on updating the risk assessment  However, most of the proposed changes to the risk assessment methodology officials described are ones that have been deliberated since our last review in 2010  Therefore, an independent, external peer review would provide the opportunity for integration and analysis of additional outside expertise across the critical infrastructure community  While independent, external peer reviews cannot ensure the success of a risk assessment approach, they can increase the probability of success by improving the technical quality of projects and the credibility of the decision-making process  According to the National Research Council of the National Academies, independent, external peer reviews should include validation and verification to ensure that the structure of the risk assessment is both accurate and reliable  Thus, an independent, external peer review would provide better assurance that the Pipeline Security Branch can rank relative risk among pipeline systems using the most comprehensive and accurate threat, vulnerability, and consequence information  TSA has established performance measures, as well as databases to monitor pipeline security reviews and analyze their results  However, weaknesses in its performance measures and its efforts to record pipeline security review recommendations limit its ability to determine the extent that its pipeline security program has reduced pipeline sector risks  Furthermore, we identified data reliability issues in the information that TSA collects to track the status of pipeline security review recommendations, such as missing data, inconsistent data entry formats, and data entry errors  TSA has three sets of performance measures for its pipeline efforts: the Pipeline Security Plan in the 2018 Biennial National Strategy for Transportation Security (NSTS), a management measure in the DHS fiscal year 2019 congressional budget justification, and summary figures in their CSR and CFSR databases  As a result of our 2010 work, TSA established performance measures and linked them to Pipeline Security Plan goals within the Surface Security Plan of the 2018 NSTS  See table 5 below for the 2018 NSTS Pipeline Security Plan performance measures  As shown in table 6 below, DHS also included a management measure in its fiscal year 2019 congressional budget justification to track the annual number of completed pipeline security reviews  Finally, TSA Pipeline Security Branch officials said they use summary figures in the CFSR status database and the CSR goals and priorities database as performance measures  For example, these include the percentage of CFSR recommendations implemented and the average percentage compliance with the guidelines by fiscal year  We previously found that results-oriented organizations set performance goals to clearly define desired program outcomes and develop performance measures that are clearly linked to the performance goals  Performance measures should focus on whether a program has achieved measurable standards toward achieving program goals, and allow agencies to monitor and report program accomplishments on an ongoing basis  Our previous work on performance metrics identified 10 attributes of effective performance  Table 7 identifies each key attribute of effective performance measures along with its definition  We evaluated the current performance measures included in the 2018 NSTS, the DHS fiscal year 2019 congressional budget justification, the CSR goals and priorities database, and the CFSR status database related to TSA’s Pipeline Security Branch  We primarily focused on key attributes which could be applied to individual measures  These include clarity, linkage, measurable targets, objectivity, reliability, and baseline and trend data  Our prior work on performance measurement found that all performance measure attributes are not equal and failure to have a particular attribute does not necessarily indicate that there is a weakness in that area or that the measure is not useful; rather, it may indicate an opportunity for further refinement  Based on our evaluation, the TSA-identified measures do not possess attributes that we have identified as being key to successful performance measures  As a result, TSA cannot fully determine the extent to which the Pipeline Security Branch has achieved desired outcomes, including the effectiveness of its efforts to reduce risks to pipelines  Specifically, many of TSA’s measures cover agency goals and mission, but they generally lack clarity and measurable targets, provide significantly overlapping information, and do not include baseline and trend data  Clarity  The pipeline-related measures in the 2018 NSTS are not clear because they do not describe the methodology used to calculate them, and the names and definitions are not clearly described  For example, NSTS goal 1 includes an objective to conduct training of employees responding to terrorist attacks  The desired outcome is to improve the capability of industry employees to respond and recover from terrorist attacks  However, the performance measure is the percentage of critical pipeline systems implementing the TSA Pipeline Security Guidelines  It is not clear if this measure is specific to the sections of the guidelines related to employee training or overall implementation of the guidelines  The CFSR status database measures include the percentage of recommendations implemented by topic, such as “Site Specific Security Measures,” “Signage,” or “Miscellaneous ” However, the database does not specifically define these topics or explain the methodology for calculating the measures  Unclear measures could be confusing and misleading to users  Core program activities  The pipeline-related measures in the 2018 NSTS cover some of the agency’s core program activities, such as conducting security exercises with the pipeline industry and providing intelligence and information products to the industry  However, the NSTS Pipeline Security Plan measures do not specifically include some core program activities, such as updating the TSA Pipeline Security Guidelines or the results of conducting CSRs and CFSRs in order to collect the information necessary for the existing performance measures  The CSR goals and priorities database and the CFSR status database include measures intended to track some of the results of pipeline security reviews, such as the average percentage compliance with the guidelines by fiscal year and the percentage of CFSR recommendations implemented  If core program activities are not covered, there may not be enough information available in those areas to managers and stakeholders  Limited overlap  The pipeline-related measures in the 2018 NSTS do not have limited overlap  As discussed previously, four of the five NSTS measures are based on the percentage of critical pipeline systems implementing TSA’s Pipeline Security Guidelines  The management measure is based on the number of complete pipeline security reviews  The CFSR status database measures are based on the percentage of recommendations implemented overall and by groups  Finally, the CSR goals and priorities database measures are based on the average compliance percentage of companies that had CSRs conducted in fiscal years 2016 and 2017  This is similar to four of the five NSTS measures  Significantly overlapping measures may lead to redundant, costly information that does not add value for TSA management  Linkage  The pipeline-related measures in the 2018 NSTS generally exhibited this key attribute  For example, all of the NSTS measures were arranged by agency strategic goals and risk-based priorities  However, the management measure in DHS’s fiscal year 2019 congressional budget justification and the CFSR status database measures did not specify the TSA goals and priorities to which they were aligned  If measures are not aligned with division and agency- wide goals and mission, the behaviors and incentives created by these measures do not support achieving those goals or mission  Measurable target  TSA’s measures generally did not include measurable targets in the form of a numerical goal and none of the NSTS measures had measurable targets  For example, the NSTS measure under the Security Planning priority, which tracks the percentage of critical pipeline systems implementing TSA’s Pipeline Security Guidelines, does not state what specific percentages would be considered an improvement in industry security plans  However, the management measure did include target numbers of pipeline security reviews by fiscal year  Both the CFSR status database measures and CSR goals and priorities database measures did not include measurable targets  Without measurable targets, TSA cannot tell if performance is meeting expectations  Objectivity  Because the pipeline-related measures in the 2018 NSTS, the CFSR status database, and the CSR goals and priorities database generally lack clarity and measurable targets, TSA cannot ensure its measures are free from bias or manipulation, and therefore, are not objective  If measures are not objective, the results of performance assessments may be systematically overstated or understated  Reliability  Because the pipeline-related measures in the 2018 NSTS, the CFSR status database, and the CSR goals and priorities database generally lack clarity, measurable targets, and baseline and trend data, it is not clear if TSA’s measures produce the same result under similar conditions; therefore, the pipeline-related measures are unreliable  If measures are not reliable, reported performance data may be inconsistent and add uncertainty  Baseline and trend data  TSA’s measures generally did not include baseline and trend data  For example, none of the NSTS measures included past results and compared them to measurable targets  TSA officials were unable to identify measures or goals to assess the extent to which pipeline operators have fully implemented the guidelines or increased pipeline security, but did say developing a feedback mechanism to measure progress in closing vulnerability gaps was important  However, the management measure did include the number of completed pipeline security reviews for each fiscal year from 2014 through 2017, as well as numerical goals  The CFSR status database includes information on CFSRs conducted from May 22, 2012, through June 29, 2017, but the measures are calculated for the entire time period rather than year-by-year  The CSR goals and priorities database measures include percentage compliance with the guidelines for CSRs conducted in fiscal years 2016 and 2017, as well as a combined measure  However, baseline and trend data are not tracked or reported in either database  Collecting, tracking, developing, and reporting baseline and trend data allows agencies to better evaluate progress being made and whether or not goals are being achieved  Pipeline Security Branch officials explained that in addition to the measures reported in the 2018 NSTS Pipeline Security Plan, they primarily rely on measures assessing CSR and CFSR implementation for assessing the value of its pipeline security program  TSA officials reported that they collect and analyze data and information collected from CSRs and CFSRs to, among other things, determine strengths and weaknesses at critical pipeline facilities, areas to target for risk reduction strategies, and pipeline industry implementation of the voluntary Pipeline Security Guidelines  For example, TSA officials reported that they analyzed information from approximately 734 CFSR recommendations that were made during fiscal years 2012 through 2016  They found that pipeline operators had made the strongest improvements in security training, public awareness outreach and law enforcement coordination, and site specific security measures  The most common areas in need of improvement were 24x7 monitoring, frequency of security vulnerability assessments, and proper signage  However, as described above, we found those measures also did not comport with key attributes for successful measures and we report below on reliability concerns for underlying data supporting those measures  In addition, while the Pipeline Security Branch may not rely on the measures included in the 2018 NSTS Pipeline Security Plan and the fiscal year 2019 congressional budget justification, they are important for reporting the status of pipeline security efforts to TSA as a whole and to external stakeholders such as Congress  Taking steps to ensure that the pipeline security program performance measures exhibit key attributes of successful performance measures could allow TSA to better assess the program’s effectiveness at reducing pipeline physical and cybersecurity risks  This could include steps such as modifying its suite of measures so they are clear, have measurable targets, and add baseline and trend data  Further examples include the following: Adding measurable targets consisting of numerical goals could allow TSA to better determine if the pipeline security program is meeting expectations  For example, measurable targets could be added to TSA’s existing measures by developing annual goals for the percentage of recommendations implemented to the CFSR status database and then reporting annual results  To make measures clearer, TSA could verify that each measure has a clearly stated name, definition, and methodology for how the measure is calculated  For example, the NSTS objective for security training mentioned above could have more specific language explaining how the measure is calculated and whether it applies to pipeline operators’ implementation of the training-related portions of the TSA Pipeline Security Guidelines or overall implementation  Finally, adding baseline and trend data could allow TSA to identify, monitor, and report changes in performance and help ensure that performance is viewed in context  For example, the NSTS measures, CFSR status database measures, and CSR goals and priorities database measures could have annual results from prior years  This could help TSA and external stakeholders evaluate the effectiveness of the pipeline security program and whether it is making progress toward its goals  According to TSA officials, the primary means for assessing the effectiveness of the agency’s efforts to reduce pipeline security risks is through conducting pipeline security reviews— Corporate Security Reviews (CSRs) and Critical Facility Security Reviews (CFSRs)  However, TSA has not tracked the status of CSR recommendations for over 5 years and related security review data are not sufficiently reliable  When conducting CSRs and CFSRs, TSA staff makes recommendations to operators, if appropriate  For example, a CSR recommendation might include a suggestion to conduct annual security-related drills and exercises, and a CFSR recommendation might include a suggestion to install barbed wire on the main gate of a pipeline facility  In response to recommendations that we made in our 2010 report, TSA developed three databases to track CSR and CFSR recommendations and their implementation status by pipeline facility, system, operator, and product type  In addition, the agency recently developed a fourth database to collect and analyze information gathered from pipeline operators’ responses to CSR questions  TSA officials reported that they use this database to assess the extent that TSA’s pipeline security program has met NSTS goals and Pipeline Security Branch priorities  TSA officials stated that they use the CSR goals and priorities database for follow-up on recommendations, indications of improvement in pipeline security, and as an input into TSA performance goals and measures, including the performance measures for the 2018 NSTS Pipeline Security Plan  We found several problems with the databases that indicate that the pipeline security program data are not sufficiently reliable and do not provide quality information that is current, complete, and accurate  First, the CSR recommendations database only included information for reviews conducted from November 2010 through February 2013  TSA officials stated that the agency stopped capturing CSR recommendations and status information in 2014  A TSA official stated that one factor was that the pipeline staffing level was one FTE in fiscal year 2014  However, the Pipeline Security Branch did not resume entering CSR recommendation-related information when staffing levels rose to 6 FTEs in the following year and beyond  As a result, TSA is missing over 5 years of data for the recommendations it made to pipeline operators when conducting CSRs  The agency collected some information from CSRs conducted in fiscal years 2016 and 2017 in the separate CSR goals and priorities database  However, this database does not include all of the information that TSA collects when conducting CSRs  Specifically, the CSR goals and priorities database does not state which companies were reviewed, what specific recommendations were made, or the current status of those recommendations, and only records operators’ responses to 79 of the 222 CSR questions  Second, our review identified instances of missing data, inconsistent data entry formats, and data entry errors in the four databases  For example: The CSR recommendations database had missing data in all 13 of the included fields and a data entry error shifted 50 observations into the wrong fields, impacting both the Status Date and Completion Code fields  The CSR goals and priorities database had seven entries with inconsistent data formatting and five of those entries were not taken into account when calculating summary figures  The CFSR recommendations database had missing data in 3 of 9 fields  There was also inconsistent data entry formats in 3 fields  The CFSR status database had missing data in 7 of 29 fields and inconsistent data entry formats in 4 fields  Finally, TSA has not documented its data entry and verification procedures, such as in a data dictionary or user manual, and does not have electronic safeguards for out-of-range or inconsistent entries for any of the databases it uses to track the status of CSR or CFSR recommendations and analyze operator responses to the CSR  TSA Pipeline Security Branch officials told us that they had not documented data entry and verification procedures and did not have electronic safeguards  This was for two reasons  First, the officials stated that the databases are small and maintained in a commercial spreadsheet program that does not allow for electronic safeguards  However, based on our review of the databases, the spreadsheet program does allow for a variety of electronic safeguards  For example, entries can be restricted to only allow selections from a drop-down list or only allow dates to be entered  Second, only a small number of TSA employees enter information into these databases  TSA officials explained that typically one TSA employee is responsible for entering information from pipeline security reviews, and another individual, usually whoever conducted the review, is tasked to verify the accuracy of the data entered  As a result, according to the officials, any errors would be self-evident and caught during these TSA employees’ reviews  Our work has emphasized the importance of quality information for management to make informed decisions and evaluate agencies’ performance in achieving key objectives and addressing risks  The Standards for Internal Control in the Federal Government states that management should use quality information to achieve agency objectives, where “quality” means, among other characteristics, current, complete, and accurate  In addition, DHS’s Information Quality Guidelines state that all DHS component agencies should treat information quality as integral to every step of the development of information, including creation, collection, maintenance, and dissemination  The guidelines also state that agencies should substantiate the quality of the information disseminated through documentation or other appropriate means  Without current, complete, and accurate information, it is difficult for TSA to evaluate the performance of the pipeline security program  Until TSA monitors and records the status of these reviews’ recommendations, it will be hindered in its efforts to determine whether its recommendations are leading to significant reduction in risk  By entering information on CSR recommendations and monitoring and recording their status, developing written documentation of its data entry and verification procedures and electronic safeguards, and improving the quality of its pipeline security program data, TSA could better ensure it has the information necessary to effectively monitor pipeline operators’ progress in improving their security posture, and evaluate its pipeline security program’s effectiveness in reducing security risks to pipelines  A successful pipeline attack could have dire consequences on public health and safety, as well as the U S  economy  Recent coordinated campaigns by environmental activists to disrupt pipeline operations, and the successful attempts by nation-state actors to infiltrate and obtain sensitive information from pipeline operators’ business and operating systems, demonstrate the dynamic and continuous threat to the security of our nation’s pipeline network  To help ensure the safety of our pipelines throughout the nation, it is important for TSA to address weaknesses in the management of its pipeline security program  TSA’s Pipeline Security Branch revised its security guidelines in March 2018 to, among other things, reflect the dynamic threat environment and incorporate NIST’s Cybersecurity Framework cybersecurity principles and practices  However, without a documented process defining how frequently TSA is to review and, if deemed necessary, revise its guidelines, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical and cybersecurity, or address the persistent and dynamic security threat environment currently facing the nation’s pipeline system  Further, without clearly defined criteria for determining pipeline facilities’ criticality, TSA cannot ensure that pipeline operators are applying guidance uniformly and that all of the critical facilities across the pipeline sector have been identified; or that their vulnerabilities have been identified and addressed  TSA could improve its ability to conduct pipeline security reviews and the means that it uses to prioritize which pipeline systems to review based on their relative risk ranking  Establishing a strategic workforce plan could help TSA ensure that it has identified the necessary skills, competencies, and staffing allocations that the Pipeline Security Branch needs to carry out its responsibilities, including conducting security reviews of critical pipeline companies and facilities, as well as their cybersecurity posture  Better considering threat, vulnerability, and consequence elements in its risk assessment and incorporating an independent, external peer review in its process would provide more assurance that the Pipeline Security Branch ranks relative risk among pipeline systems using comprehensive and accurate data and methods  We are making 10 recommendations to TSA: The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to implement a documented process for reviewing, and if deemed necessary, for revising TSA’s Pipeline Security Guidelines at regular defined intervals  (Recommendation 1) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to clarify TSA’s Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities  (Recommendation 2) The TSA Administrator should develop a strategic workforce plan for its Security Policy and Industry Engagement’s Surface Division, which could include determining the number of personnel necessary to meet the goals set for its Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct CSRs and CFSRs  (Recommendation 3) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to update the Pipeline Relative Risk Ranking Tool to include up-to-date data to ensure it reflects industry conditions, including throughput and threat data  (Recommendation 4) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to fully document the data sources, underlying assumptions and judgments that form the basis of the Pipeline Relative Risk Ranking Tool, including sources of uncertainty and any implications for interpreting the results from the assessment  (Recommendation 5) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to identify or develop other data sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities and incorporate that data into the Pipeline Relative Risk Ranking Tool to assess relative risk of critical pipeline systems, which could include data on prior attacks, natural hazards, feedback data on pipeline system performance, physical pipeline condition, and cross-sector interdependencies  (Recommendation 6) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool, after the Pipeline Security Branch completes enhancements to its risk assessment approach  (Recommendation 7) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to ensure that it has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, and baseline and trend data  (Recommendation 8) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to take steps to enter information on CSR recommendations and monitor and record their status  (Recommendation 9) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to improve the quality of its pipeline security program data by developing written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors  (Recommendation 10) We provided a draft of this report to DHS, DOE, DOT, and FERC  DHS provided written comments which are reproduced in appendix III  In its comments, DHS concurred with our recommendations and described actions planned to address them  DHS, DOE, DOT, FERC, also provided technical comments, which we incorporated as appropriate  We also provided draft excerpts of this product to the American Petroleum Institute (API), the Association of Oil Pipe Lines, the American Gas Association (AGA), the Interstate Natural Gas Association of America (INGAA), the American Public Gas Association, and the selected pipeline operators that we interviewed  For those who provided technical comments, we incorporated them as appropriate  With regard to our first recommendation, that TSA implement a documented process for reviewing, and if deemed necessary, for revising its Pipeline Security Guidelines at regular defined intervals, DHS stated that TSA will implement a documented process for reviewing and revising its Pipeline Security Guidelines at regular defined intervals, as appropriate  DHS estimated that this effort would be completed by March 31, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our second recommendation, that TSA clarify its Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities, DHS stated that TSA will clarify its Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities  DHS estimated that this effort would be completed by May 31, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our third recommendation, that TSA develop a strategic workforce plan for its Security Policy and Industry Engagement's Surface Division, DHS stated that TSA will develop a strategic workforce plan for the division, which includes determining the number of personnel necessary to meet the goals set for the Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct CSRs and CFSRs  DHS estimated that this effort would be completed by June 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our fourth recommendation, that TSA update the Pipeline Relative Risk Ranking Tool to include up-to-date data in order to ensure it reflects industry conditions, including throughput and threat data, DHS stated that TSA will update the Pipeline Relative Risk Ranking Tool to include up-to-date data in order to ensure it reflects industry conditions, including throughput and threat data  DHS estimated that this effort would be completed by February 28, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our fifth recommendation, that TSA fully document the data sources, underlying assumptions, and judgements that form the basis of the Pipeline Relative Risk Ranking Tool, including sources of uncertainty and any implications for interpreting the results from the assessment, DHS stated that TSA will fully document the data sources, underlying assumptions, and judgements that form the basis of the Pipeline Relative Risk Ranking Tool  According to DHS, this will include sources of uncertainty and any implications for interpreting the results from the assessment  DHS estimated that this effort would be completed by February 28, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our sixth recommendation, that TSA identify or develop other data sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities and incorporate that data into the Pipeline Relative Risk Ranking Tool to assess relative risk of critical pipeline systems, DHS stated that TSA will identify and/or develop other sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities  DHS also stated that TSA will incorporate that data into the Pipeline Risk Ranking Tool to assess relative risk of critical pipeline systems, which could include data on prior attacks, natural hazards, feedback data on pipeline system performance, physical pipeline condition, and cross-sector interdependencies  DHS estimated that this effort would be completed by June 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our seventh recommendation, that TSA take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool, after the Pipeline Security Branch completes enhancements to its risk assessment approach, DHS stated that, after completing enhancements to its risk assessment approach, TSA will take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool  DHS estimated that this effort would be completed by November 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our eighth recommendation, that TSA ensure that the Security Policy and Industry Engagement's Surface Division has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, baseline, and trend data, DHS stated that TSA’s Surface Division’s Pipeline Section will develop both physical and cyber security performance measures, in consultation with pipeline stakeholders, to ensure that it has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, baseline, and trend data  DHS estimated that this effort would be completed by November 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our ninth recommendation, that TSA take steps to enter information on CSR recommendations and monitor and record their status, DHS stated that TSA will enter information on CSR recommendations and monitor and record their status  DHS estimated that this effort would be completed by October 31, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our tenth recommendation, that TSA take steps to improve the quality of its pipeline security program data by developing written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors, DHS stated that TSA will develop written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors  DHS estimated that this effort would be completed by July 31, 2019  This action, if fully implemented, should address the intent of the recommendation  As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until one day from the report date  At that time, we will send copies to the appropriate congressional committees; the Secretaries of Energy, Homeland Security, and Transportation; the Executive Director of the Federal Energy Regulatory Committee; and other interested parties  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact Chris Currie at (404) 679-1875 or curriec@gao gov, and Nick Marinos at (202) 512-9342 or marinosn@gao gov  Key contributors to this report are listed in appendix IV  This appendix lists security guidance and guidance-related tools that the pipeline operators and industry association officials we interviewed identified as adopted or available in order to secure their physical and cyber operations  This list should not be considered to include all physical and cybersecurity guidance that may be available or used by all pipeline operators nor do all operators use all guidance listed  The Transportation Security Administration’s (TSA) Pipeline Security Branch developed the Pipeline Relative Risk Ranking Tool (risk assessment) in 2007  The risk assessment calculates threat, vulnerability, and consequence on variables such as the amount of throughput in the pipeline system (consequence input)  Pipeline Security Branch officials told us that they use the pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems, and the standard operating procedures for conducting Corporate Security Reviews (CSR) state the results of the risk ranking are the primary factor considered when prioritizing CSRs of pipeline companies  However, we identified several factors that likely limit the usefulness of the current assessment in calculating threat, vulnerability, and consequence to allow the Pipeline Security Branch to effectively prioritize reviews of pipeline systems  For example, because the risk assessment has not changed since 2014, information on threat may be outdated  Additionally, sources of data and underlying assumption and judgments regarding certain threat and vulnerability inputs to the assessment are not fully documented  For example, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology, making it unclear if cybersecurity is part of the assessment’s threat factor  Further, the risk assessment does not include information that is consistent with the National Infrastructure Protection Plan (NIPP) and other Department of Homeland Security (DHS) priorities for critical infrastructure risk mitigation, such as information on natural hazards and the ability to measure risk reduction (feedback data)  According to Pipeline Security Branch officials, the risk ranking assessment is not intended to be a fully developed risk model detailing all pipeline factors influencing risk  Rather, officials said they are primarily interested in assessing risk data that impacts security  However, because TSA’s Pipeline Security Program is designed to enhance the security preparedness of the pipeline systems, incorporating additional factors that enhance security into their risk calculation of the most critical pipeline systems would better align their efforts with Presidential Policy Directive 21 (PPD-21)  For example, PPD-21 calls for agencies to integrate and analyze information to prioritize assets and manage risks to critical infrastructure, as well as anticipate interdependencies and cascading impacts  Below we present the various shortfalls in the risk assessment—outdated data, limited description of sources and methodology, and opportunities to better align with the NIPP and other DHS priorities for critical infrastructure risk mitigation—in the context of the components that comprise a risk assessment: threat, vulnerability, and consequence  Whereas in 2010 we made recommendations to improve the consequence component in the pipeline relative risk ranking tool, we have currently identified shortfalls that cut across all risk components: threat, vulnerability, and consequence  We identified several shortfalls in the pipeline risk assessment’s calculation of threat  First, while the risk assessment assesses consequence and vulnerability by pipeline system through use of multiple variables, it currently ranks threat for pipeline systems equally  Second, the evolving nature of threats to pipelines may not be reflected, since the risk assessment was last updated in 2014  Third, the threat calculation does not take into account natural hazards  Pipeline Security Branch officials said they currently rank threat equally across pipeline systems because they do not have granular enough threat information to distinguish threat by pipeline  However, ranking threat equally effectively has no effect on the risk calculation for pipeline systems  Further, this judgment is not documented in the risk assessment’s methodology  According to the NIPP, a risk assessment’s methodology must clearly document what information is used and how it is synthesized to generate a risk estimate, including any assumptions and judgments  Additionally, our analysis of the pipeline risk assessment found that it includes at least one field that TSA could use to differentiate threat by pipeline  Specifically, the risk assessment includes a field that accounts for whether a pipeline experienced a previous security threat (including failed attacks), and information provided by Pipeline Security Branch suggests some pipeline systems have experienced such threats  However, the Pipeline Security Branch did not capture these events in the risk assessment’s calculation, which Pipeline Security Branch officials said should be part of the threat calculation, but could not account for why they were not calculated for the systems in the risk assessment  These officials also clarified that incidents such as suspicious photography or vandalism do not constitute an attack to be accounted for in the threat calculation  Documenting such assumptions, judgments, or decisions to exclude information could provide increased transparency to those expected to interpret or use the results  Pipeline Security Branch officials also said that they ranked threat equally because TSA Intelligence and Analysis data show that threats to the oil and natural gas sector have been historically low, and Intelligence and Analysis does not conduct specific threat analysis against individual pipeline systems  However, the Pipeline Security Branch has not updated the risk assessment since June 2014; therefore, the threat information it used to determine threat calculations—and decide to rank threat equally—may be outdated and not reflect the threats to the industry that have emerged in recent years  In fact, pipeline operators we interviewed indicated that the types of threats that concern pipeline operators have evolved  For example, 5 of the 10 operators we interviewed indicated that environmental activists were an increased threat to the pipeline industry because they use sabotage techniques, such as valve turning and cutting in service pipelines with blow torches, against pipelines  Additionally, 6 of 10 pipeline operators we interviewed said cyber attacks from nation-state actors were a primary threat to their industry  Further, when TSA issued its revised Pipeline Security Guidelines in March 2018, it stated that its revisions to the guidelines were made to reflect the ever-changing threat environment in both the physical and cybersecurity realms  However, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology  Recent Pipeline Modal and Cyber Modal Threat Assessments include cyber threats to the pipeline industry, but the description of the pipeline risk assessment’s methodology does not specify what types of threat assessments (sources) are used to calculate its threat score  To better align with the guidance in the NIPP for documenting sources of information when conducting risk assessments, the Pipeline Security Branch should document the information used  Keeping the risk assessment updated with current information, as well as documenting those data sources, could help the Pipeline Security Branch ensure it is using its limited resources to review the pipeline systems with greater risk  Natural Hazard Threats to Pipelines The Transportation Systems Sector, of which pipelines are a part, is critical to the Pacific Northwest, but also at risk from natural hazards, like earthquakes  For example, according to the Department of Homeland Security, an earthquake in the Puget Sound region—which relies on the transportation of crude oil from Alaska—could cripple the ports of Seattle and Tacoma, as well as the Olympic and Williams Pipelines greatly impacting the Pacific Northwest Economic Region  Hurricanes are the most frequent disruptive natural hazard for the oil and natural gas subsector and can cause the shutdown of facilities in an area, even when the facilities themselves are not directly affected by the storms  For example, according to the U S  Energy Information Administration, the flow of petroleum into the New York area via pipeline from the Gulf Coast relies on the ability to move it through major terminals  In August 2017, Hurricane Harvey caused major disruptions to crude oil and petroleum product supply chains, including those to New York Harbor from Houston, Texas via the Colonial Pipeline  Due to the hurricane, decreased supplies of petroleum products available for the pipeline in Houston forced Colonial Pipeline to limit operations temporarily  Finally, another shortfall in the current pipeline risk assessment methodology is that it does not account for natural hazards in its threat calculation, even though DHS’s definition of threat includes natural hazards, and security and resilience of critical infrastructure are often presented in the context of natural hazards  According to the NIPP, threat is a natural or manmade occurrence, individual, entity, or action that has or indicates the potential to harm life, information, operations, the environment, and/or property  As such, along with terrorism, criminal activity and cybersecurity, natural disasters are a key element of DHS’s critical infrastructure security and resilience mission  According to Pipeline Security Branch officials, there is not sufficient historical data available that would indicate a significant impact from natural disasters on specific pipeline systems  However, we identified possible sources of data for the Pipeline Security Branch to consider  For example, a 2016 RAND Corporation study examined national infrastructure systems’ exposure to natural hazards, including pipelines  Additionally, the Federal Emergency Management Agency (FEMA) has collaborated with stakeholders to develop the National Risk Index to, among other things, establish a baseline of natural hazards risk for the United States While there may not be historical data of natural hazard impact for every pipeline system, consulting other sources or experts could provide regional data or analysis to build a more comprehensive threat picture to help distinguish threats by pipeline system  According to the NIPP, hazard assessments should rely not only on historical information, but also future predictions about natural hazards to assess the likelihood or frequency of various hazards  We also identified multiple shortfalls in the vulnerability factors used in the risk assessment methodology, such as the potential uncertainty of the number of critical facilities and incorporating a feedback mechanism to calculate overall risk reduction  Other considerations for vulnerability calculations include physical condition of the pipeline system, cybersecurity activities, and interdependencies among sectors  The number of critical facilities a pipeline system has identified is used as an input for its vulnerability calculation in the Pipeline Security Branch’s risk assessment methodology  As discussed earlier, we identified deficiencies in TSA’s criteria for identifying critical facilities, and found that well-defined criteria and consistent application of the criteria for identifying critical facilities could improve the results of the Pipeline Security Branch’s risk assessment  Nevertheless, communicating in the risk assessment the uncertainty that may be inherent in this self-reported information would better align the risk assessment with the NIPP  Measuring Effectiveness in a Voluntary Environment According to the National Infrastructure Protection Plan, the use of performance metrics is an important step in the critical infrastructure risk management process to enable assessment of improvements in critical infrastructure security and resilience  The metrics provide a basis for the critical infrastructure community to establish accountability, document actual performance, promote effective management, and provide a feedback mechanism to inform decision making  By using metrics to evaluate the effectiveness of voluntary partnership efforts to achieve national and sector priorities, critical infrastructure partners can adjust and adapt their security and resilience approaches to account for progress achieved, as well as changes in the threat and other relevant environments  Metrics are used to focus attention on areas of security and resilience that warrant additional resources or other changes through an analysis of challenges and priorities at the national, sector, and owner/operator levels  Metrics also serve as a feedback mechanism for other aspects of the critical infrastructure risk management approach  Another shortfall in the risk assessment is its inability to reliably measure the progress a pipeline system made in addressing vulnerability gaps between security reviews  The current risk assessment includes a CSR score as part of its vulnerability calculation, which was developed in part in response to our 2010 recommendation to use more reliable data to measure a pipeline system’s vulnerability gap  However, during our review, Pipeline Security Branch officials said they plan to remove pipeline companies’ CSR scores from the risk assessment calculations, because they and industry partners do not have confidence that the score appropriately measures a pipeline system’s vulnerability  For example, Pipeline Security Branch officials explained that pipeline companies consider security factors differently, which can lead to variation in implementing risk reduction activities and by extension lead to different CSR scores  However, removing the CSR score eliminates the only feedback mechanism in the risk assessment from a pipeline company’s actual security review conducted by the Pipeline Security Branch  The NIPP and DHS’s Risk Management fundamentals emphasize the important role that such feedback mechanisms play in risk management  Officials from the Pipeline Security Branch agree on the importance of a feedback mechanism tying results of reviews to a revised vulnerability metric, but said they need a better measure than the current CSR score which is unreliable for comparative and analytic purposes  Developing a feedback mechanism based on implementation of TSA’s Pipeline Security Guidelines could be an important input to the risk assessment’s vulnerability calculation  This information would also inform the amount of risk pipeline companies are reducing by implementing the guidelines and could be used to inform overall risk reduction  The physical and cyber environments in which the pipeline sector operates also present vulnerabilities not accounted for in the pipeline risk assessment  In recent years, DHS has listed the potential for catastrophic losses to dramatically increase the overall risk associated with failing infrastructure and highlighted risks due to climate change and natural hazards to pipelines  For example, DHS reported extreme temperatures—such as higher and lower temperatures over prolonged periods of time—increase vulnerability to the critical infrastructure by causing elements to break and cease to function  Pipelines that freeze and then rupture can affect the energy and transportation systems sectors  As noted above, according to the NIPP, a natural or man-made occurrence or action with the potential to harm life is considered a threat, whereas vulnerability is defined as a physical feature or operational attribute that renders an entity open to exploitation or susceptible to a given threat or hazard  While pipeline physical condition is typically thought of in context of safety, pipeline condition or location (such as above or below ground) could touch upon pipeline security as it relates to system vulnerability  For example, a pipeline system or segment of a system with a compromised physical condition due to corrosion or age could affect the system’s vulnerability to threats and affect its ability to recover from such threats by potentially increasing the time a system is offline  According to the Transportation Systems Sector-Specific Plan, vulnerabilities to damage in aging transportation infrastructure—of which pipelines are a part—are projected to increase with the continued effects of climate change  Further, according to TSA’s Pipeline Security and Incident Recovery Protocol Plan, pipeline integrity efforts—including the design, construction, operation, and maintenance of pipelines—are important to pipeline security because well-maintained, safe pipelines are more likely to tolerate a physical attack  The Pipeline Security Branch already collects information from the Pipeline and Hazardous Materials Safety Administration (PHMSA) for its risk assessment, specifically information on High Consequence Area and High Threat Urban Area mileage  By considering additional information PHMSA collects on pipeline integrity, the Pipeline Security Branch could also use the information to help pipeline operators identify security measures to help reduce the consequences related to the comparatively higher vulnerability of an aging or compromised system  This would align with the Pipeline Security Branch’s efforts to improve security preparedness of pipeline systems and could better inform its vulnerability calculations for relative risk ranking of pipeline systems  Capturing cybersecurity in the risk assessment is also an area for improvement  Pipeline Security Branch officials told us they consulted with the National Cybersecurity and Communications Integration Center to revise TSA’s Pipeline Security Guidelines to align with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and that absent data specific to pipelines on their cybersecurity vulnerabilities, they are unable to include a pipelines’ vulnerability to cyber attack in the risk assessment  However, the Pipeline Security Branch recently updated the security review questions asked of pipeline operators during corporate and critical facility reviews based on the recently updated Pipeline Security Guidelines  Using these updated questions related to companies’ cybersecurity posture, the Pipeline Security Branch could collect additional information on cybersecurity vulnerabilities which could inform the risk assessment  This could be an element of the feedback mechanism described above and emphasized in the NIPP  Additionally, NIST identified several supply chain vulnerabilities associated with cybersecurity, which are not currently accounted for in TSA’s Pipeline Security Guidelines  As pipeline operators implement increasing levels of network technologies to control their systems, the Pipeline Security Branch may not be fully accounting for pipeline systems’ cybersecurity posture by not including the cybersecurity-related vulnerabilities in its risk assessment inputs  Finally, we identified shortfalls in cross-sector interdependencies, which could affect vulnerability calculations  According to the NIPP, understanding and addressing risks from cross-sector dependencies and interdependencies is essential to enhancing critical infrastructure security and resilience  The Pipeline Security Branch’s pipeline risk assessment currently considers the effects of a pipeline system’s ability to service assets such as major airports, the electric grid, and military bases  However, consequence is calculated on the loss or disruption of the pipeline system to these other assets and does not capture the dependency of the pipeline system on other energy sources, such as electricity  Weather events such as Gulf of Mexico hurricanes and Superstorm Sandy highlighted the interdependencies between the pipeline and electrical sectors  Specifically, according to a 2015 DHS annual report on critical infrastructure, power failures during Superstorm Sandy in 2012 closed major pipelines for 4 days, reducing regional oil supplies by 35 to 40 percent  The report goes on to say that the interconnected nature of infrastructure systems can lead to cascading impacts and are increasing in frequency  Pipeline Security Branch officials are considering cross-sector interdependencies and said they discuss these factors with operators as they relate to system resiliency  Considering interdependencies of sectors in both directions—such as calculating the likelihood that an input like electricity could fail and cause disruptions to critical pipelines—could improve the calculations in the pipeline risk assessment  As previously discussed, the Pipeline Security Branch last calculated relative risk among the top 100 pipeline systems in 2014  When doing so, it used pipeline systems’ throughput data from 2010 to assess relative risk  According to Pipeline Security Branch officials, the amount of throughput in pipeline systems does not change substantially year to year  However, Standards for Internal Control in the Federal Government calls for management to use quality information to achieve the entity’s objectives, including using relevant data from reliable sources obtained in a timely manner  The Pipeline Security Branch uses throughput data as a consequence factor in the risk assessment to determine a pipeline system’s relative risk score  Throughput changes could affect relative risk ranking and the Pipeline Security Branch’s ability to accurately prioritize reviews based on relative risk  Chris P  Currie at (404) 679-1875 or curriec@gao gov Nick Marinos at (202) 512-9342 or marinosn@gao gov  In addition to the contacts named above, Ben Atwater, Assistant Director; Michael W  Gilmore, Assistant Director; and Michael C  Lenington, Analyst-in-Charge, managed this assignment  Chuck Bausell, David Blanding, Dominick Dale, Eric Hauswirth, Kenneth A  Johnson, Steve Komadina, Susanna Kuebler, Thomas Lombardi, David Plocher, and Janay Sam made significant contributions to this report 


Report 2: CAPTA, originally enacted in 1974, provides formula grants to states to improve child protective service systems  ACF administers the CAPTA state grant program and provides guidance and oversight to states  In fiscal year 2017, Congress provided about $25 million for the program  As part of the CAPTA state grant program, states are required to submit to the Secretary of HHS plans outlining how they intend to use CAPTA funds to improve their child protective service systems, among other things  State plans remain in effect for the duration of states’ participation in the grant program; if modifications are needed, these must be submitted  In addition to state plans, states are required to submit to HHS an annual data report providing information on agency decisions made in response to referrals of child abuse and neglect, as well as preventive services provided to families, among other things  CAPTA requires state governors to provide a series of assurances in their state plans  Since 2003, governors have had to provide an assurance that states have in effect and are enforcing a state law or program that includes policies and procedures to address the needs of infants affected by prenatal substance abuse or displaying withdrawal symptoms at birth  Under states’ policies and procedures, health care providers are required to notify CPS of such infants  Governors must also assure that a plan of safe care is developed for these infants  Although CAPTA does not define “plans of safe care,” for the purposes of this report we define them as plans to ensure the safety and well-being of infants who are born substance-affected  The Comprehensive Addiction and Recovery Act of 2016 (CARA) amended certain provisions of CAPTA that relate to substance-affected infants (see table 1)  In addition to provisions related to substance-affected infants, CAPTA also requires governors to provide an assurance to the Secretary of HHS that they have provisions or procedures for certain individuals to report known and suspected instances of child abuse and neglect, which are generally referred to as mandated reporter laws  All states have statutes identifying persons who are required to report suspected child maltreatment to an appropriate agency, such as child protective services, a law enforcement agency, or a state’s toll-free child abuse reporting hotline, according to a 2016 HHS report  Mandatory reporters often include social workers; teachers, principals, and other school personnel; physicians, nurses, and other health care workers; and counselors, therapists, and other mental health professionals  The circumstances under which a mandatory reporter must make a report vary from state to state, according to HHS  Typically, a report must be made when the reporter, in his or her official capacity, suspects or has reason to believe that a child has been abused or neglected  State laws require mandatory reporters to report the facts and circumstances that led them to suspect that a child has been abused or neglected; they do not have the burden of providing proof that abuse or neglect has occurred  CPS, a division within state and local social services, is generally the agency that conducts an initial assessment or investigation of reports of child abuse and neglect  It also offers services to families and children where maltreatment has occurred or is likely to occur  Typically, when CPS agencies receive a notification about suspected child abuse, including a substance-affected infant, social workers review the referral to determine if it should be accepted for investigation  During an investigation, social workers determine, among other things, the nature, extent, and cause of abuse or neglect, and identify the person responsible for the maltreatment  An investigation may include the following: a visit to the hospital and/or infant’s home; observation of the infant; risk and safety assessments; evaluation of the home environment; background checks, including criminal record checks of adults that reside with the family; as well as mental health evaluations  If social workers determine that there is enough evidence to suggest that an infant is at risk for harm or neglect, or that abuse or neglect occurred, the case is substantiated  Once a case is substantiated, CPS develops a case plan with the family outlining objectives and tasks for the family  Among other things, CPS may refer the family to services in the community, such as early intervention services, parenting classes, and substance abuse treatment  Generally, CPS attempts to strengthen the family and alleviate the problems which led to maltreatment  If the case is not substantiated, but there is genuine concern about the child’s situation and the family may benefit from services in the community, the case may be closed and/or the family may be referred for voluntary services (see figure 1)  Prenatal maternal opioid use has increased considerably in recent years  This increase has contributed to a significant rise in the rate of NAS  According to a recent study, the rate of NAS has increased from 1 2 per 1,000 hospital births in 2000 to 5 8 per 1,000 hospital births in 2012, reaching a total of 21,732 infants diagnosed with NAS  NAS occurs with considerable variability  According to a recent HHS report, various studies indicate that anywhere from 55 to 94 percent of infants exposed to opioids in-utero exhibit some degree of symptoms  Typically, infants with NAS develop symptoms within 72 hours of birth, but may develop symptoms within the first 2 weeks of life, including after hospital discharge  For the purpose of this report, infants exposed to opioids ingested by mothers in utero are considered substance-exposed, and those born negatively affected by exposure or experiencing withdrawal symptoms are considered substance-affected  According to experts, NAS is considered an expected and treatable result of women’s prenatal opioid use  Opioid exposure during pregnancy may occur for the following reasons: Women receiving pain medication with a prescription under the care of a physician  Medications can include fentanyl and oxycodone  Women under the care of a physician and undergoing treatment for an opioid use disorder with medications, such as methadone or buprenorphine  This type of treatment is generally referred to as medication-assisted treatment (MAT)  Women misusing opioid pain medications with or without a prescription (such as using without a prescription, using a different dosage than prescribed, or continuing to use a drug when no longer needed for pain)  Women using or abusing illicit opioid, such as heroin  In response to our survey, 42 states reported that state policies and procedures require health care providers to notify CPS about substance- affected infants  Some states reported that they explicitly require health care providers to notify CPS of substance-affected infants  For example, Wisconsin reported that under its state law if tests indicate that infants have controlled substances or controlled substance analogs in their bodily fluids, the health care provider shall report the occurrence of that condition to CPS  Others reported that the requirement is met by their states’ mandated reporter law—whereby people in certain positions, including health care providers, are required to notify CPS about substance-affected infants, similar to the manner in which other mandatory reporters, like school teachers, day care personnel, and social workers are required to report other instances of child abuse and neglect  For example, Kentucky statute requires that “any person who knows or has reasonable cause to believe that a child is dependent, neglected, or abused shall immediately” make a report to the police or CPS  The statutory definition for an abused or neglected child in Kentucky includes situations where a child’s health or welfare is harmed or threatened with harm because of parental incapacity due to alcohol and other drug abuse  Of the 42 states that require health care providers to notify CPS of substance-affected infants, 21 reported that notification is required for infants affected by both illegal and legal use of opioids  For example, in Massachusetts health care providers are required to notify CPS orally and, in writing within 48 hours, about substance-affected infants physically dependent on drugs, even if the drugs were legally obtained and the mother is under the care of a prescribing medical professional  Sixteen of the 42 states reported that health care providers are required to notify CPS of infants affected only by the illegal use of opioids, and five of the 42 states reported that they did not know if health care providers were required to notify CPS of infants affected by the illegal and legal use of opioids  The other eight states reported that although they did not have policies and procedures that require health care providers to notify CPS about substance-affected infants, they have laws or policies that encourage notification  Specifically, in written responses to our survey: Two states reported that under their state mandated reporter laws health care providers are encouraged, but not required, to notify CPS about substance-affected infants  Four states reported that they are working to amend their states’ policies and procedures to require that health care providers refer substance-affected infants to CPS  Another state reported that it encourages the notification from health care providers, but has not sought legislation to require health care providers to report substance-affected infants to CPS because of concerns that any laws that criminalize prenatal substance use would further deter substance-using pregnant women from seeking prenatal care  The state’s law requires all hospital personnel who suspect abuse and neglect or observe conditions that are likely to result in abuse or neglect to notify CPS  One state reported that all persons, including health care providers, are required to report child abuse and neglect, but reporting depends on whether a hospital’s policy indicates substance abuse is child abuse or neglect  Further, the state CPS director reported collaboration with the health care community on reporting substance exposed infants to its child abuse hotline  Although one state reported in our survey that it does not require or encourage health care providers to notify CPS about substance-affected infants, in an interview, state officials explained that its policy requires that health care providers notify CPS if, through an assessment, they conclude that infants are at risk for abuse and neglect  Under the state’s law, health care providers in each county are required to assess the needs of mothers and substance-affected infants using a protocol established by county health departments, CPS agencies, and hospitals  State officials told us that under the state’s law, the birth of a substance- affected infant is not in and of itself a sufficient basis for reporting child abuse or neglect  In addition to having policies and procedures regarding the reporting of substance-affected infants, in written responses to our survey some states reported providing training and guidance to support the efforts of health care providers to notify CPS about these infants  Three states reported that they offer mandatory reporter training to inform health care providers that they are obligated to notify CPS about substance-affected infants  Another state reported that its Department of Human Services developed a guide for mandated reporters that discusses what needs to be reported and where to make reports  Also, one state reported that it sent a formal letter to its state hospital association about how to report substance-affected infants to CPS  This state also sent a memo to its CPS county directors instructing them to contact their local health care providers on the importance of reporting substance-affected infants to CPS and the process for doing so  In addition, during our Massachusetts site visit, officials shared with us a memo that was sent to mandated reporters, community partners, and other stakeholders that offered guidance on when to file a report about substance-exposed infants  Further, local CPS staff at one Massachusetts field office told us that upon request they provide mandated reporter training to health care providers  Despite these policies, procedures, and guidance, in written responses to our survey, a few states reported concerns about requiring health care providers to notify CPS about substance-affected infants and the definition of substance-affected  All of the hospitals that we visited have policies consistent with their state’s law that require that health care providers, primarily hospital social workers, to notify CPS about substance-affected infants  However, one state reported that some medical personnel have been reluctant to report some infants that are positive for illegal and legal substances due to fears of mothers being arrested  Another state reported that stakeholders are concerned that having to notify CPS about substance-affected infants will have a chilling effect on the willingness of pregnant women who use substances to be honest with providers and seek the help and support they need and deserve  According to one state, there is often an inherent resistance to contacting CPS in these cases as health care providers tend to view child welfare involvement as punitive rather than a potential resource for the family  In addition, three states reported in written responses to our survey challenges understanding how to define terms, such as substance- affected, under CAPTA  For example, the Pennsylvania CPS director expressed concerns during our site visit, suggesting that CAPTA raises many unanswered questions, such as (1) if “affected by substances” means at-risk of being or physically affected by substances, (2) what policies relating to substance-affected infants should look like and include, and (3) whether “affected by substances” should include women who are under the care of health care or treatment providers and taking their medications as prescribed  A Kentucky public health official told us that a drug test, or whether the infant is affected by legal or illegal substances, should not be the sole factor in determining CPS’ involvement with a family  Rather, a holistic view of the family, whether the substance prohibits the mother’s ability to care for her child, and any risk factors present that places the infant at risk should also be considered  According to officials, an infant that is exposed to substances, but has not been affected by the substance, can still be at risk for child abuse and neglect  In response to our survey, 46 states reported that they have policies and procedures for deciding which notifications about substance-affected infants are accepted for investigation  Seventeen of those states reported that all notifications of substance-affected infants are accepted for investigation, regardless of the circumstances  The remaining 29 states reported that they apply specific criteria to determine if children who present as substance-affected are accepted for investigation by CPS  Several states reported in written responses to our survey that they base their criteria for accepting notifications on the infant’s safety  For these states, drug exposure does not by itself indicate that an infant’s safety is at risk  For example, one state explained that in determining a child’s safety risk, staff evaluate a number of factors including the history of the family; the family’s presentation at the birthing hospital (appearance of chaotic behavior, suspected intoxication of adults, lack of appropriate concern or bonding with the infant); the presentation of the infant’s physical condition; the results of any testing of parent or child (blood, urine, etc ); discrepancies identified in the parent’s representation of their substance use or substance use treatment; and any other concerns noted by the reporting source  Other states reported that their criteria for accepting notifications for investigation are based on the degree or type of drug exposure in question  For example, one state reported that its policy directs CPS agencies to accept notifications for investigation when a parent has used illegal substances or non-medical use of prescribed medication during the last trimester of pregnancy  Another state reported that it will accept notifications for investigation if the infant is born with a positive toxicology or is experiencing drug withdrawal, or if the mother tests positive for substances  A few states reported using both risk to the safety of infants as well as degree or type of drug as their criteria for accepting notifications  For example, one state reported that it considers factors, such as the type of drug, the parent’s ability to care for the child, addiction history, and the parent’s readiness and preparation to care for the infant  In follow-up correspondences with states that reported that they do not have policies and procedures to decide whether to accept for investigation notices about substance-affected infants, one state reported that decisions are made on a case-by-case basis  A few states reported that after receiving notifications about substance- affected infants, CPS agencies may decide to opt out of investigating some families, referred to as “screening out” families  For example, in Massachusetts, CPS can “screen out” referrals of mothers if the only substance affecting the infants was used by the mothers as prescribed by their physician  In these instances, when CPS in Massachusetts is notified by the hospital about an infant, the screener gathers information from the caller and consults with a supervisor to determine whether the referral should be accepted for investigation or screened out  If the mother is on methadone, for example, but is involved with services and is in a treatment plan, CPS verifies with medical or other qualified providers that the mother used the drug as part of substance abuse or medical treatment as authorized  Additionally, CPS confirms that there are no other concerns of child abuse and/or neglect  If CPS officials in Massachusetts are unable to collect all the information that they need to screen out families, for example when a mother does not sign a release allowing CPS officials to speak with her health care providers, notifications about substance-affected infants are accepted for investigation  In response to our survey, 49 states reported that their CPS agency has policies to develop a plan to ensure the safety and well-being of substance-affected infants who meet the state’s criteria for investigation  Two states reported that CPS staff are not required to develop such a plan, even if a notification is accepted for an investigation or an assessment  For purposes of this report, we are defining a plan of safe care as a plan to ensure the safety and well-being of the infant  States’ approaches to identifying children and families who will receive a plan of safe care generally fall into two categories: 38 states reported that CPS is required to develop a plan of safe care for all notifications of substance-affected infants that are accepted for investigation, including those that are not substantiated  11 states reported that CPS staff are required to develop a plan of safe care only in those instances where an investigation substantiates the notification or uncovers an unmet need or present or emerging danger  For example, local Pennsylvania CPS officials told us that they only develop plans when there is a safety threat or other concern about the infant  Most states reported that after a notification of a substance-affected infant is accepted for investigation, CPS always conducts a needs assessment for the infant and caregivers  For example, one local CPS office that we visited told us that social workers assess risk to and safety of infants, their function (development, age appropriate behavior, etc ), and environment  In addition, workers assess the caregiver’s ability to parent and employment status, as well as housing  The assessments conducted as part of the investigation inform the development of plans of safe care, as well as decisions about the removal of infants from the home  Among the 49 states that reported that plans of safe care are developed for all or some substance-affected infants, 47 reported that these plans either always or sometimes address infants’ safety needs  Plans also address other needs, such as infants’ immediate medical and longer-term developmental needs, as well as caregiver’s substance use treatment needs  See figure 2 for the number of states whose plans of safe care address various issues facing the infant and parent  In written responses to our survey and during our site visits, officials reported that plans of safe care and referrals for services included in the plans are individualized based on the infant and family’s needs  For example, Massachusetts state CPS officials told us that plans of safe care are developed for each family based on the information that staff collect from the safety, risk, and family assessments, as well as information collected from individuals who may have knowledge that would inform the family assessments, such as medical and treatment providers, and family members  Kentucky state CPS officials told us that the local organizations and service providers that they collaborate with to develop the plan of safe care also vary based on the family’s needs  For example, Kentucky will only collaborate with substance use treatment providers to develop the plan of safe care when families have substance use disorders  Similarly, during our site visits, officials from two states told us that the decision to place an infant in foster care is based on the individualized needs of the infant and caregiver  For example, Massachusetts state officials told us that their decision to remove a baby from the home depends on a myriad of factors and is determined on a case-by-case basis  Officials explained that if a mother is discharged from the hospital and begins using drugs again and does not have adequate supports in place to care for her baby, CPS may decide to place the infant in foster care  However, if a mother has existing support systems in place to mitigate safety risks, CPS may decide to keep the baby in the home  In our survey, all 51 states reported that their agencies either always or sometimes refer parents or caregivers to substance use treatment programs, and most states reported that they always or sometimes refer parents or caregivers to parenting classes or programs (49), and other supportive services (49)  CPS officials in each of the three states that we visited told us that their plans of safe care include referrals to address not only the immediate needs of the infants, but also the needs of the parent or caregiver  For example, officials from a local Kentucky CPS agency told us that staff refer mothers of substance-exposed infants to a program called Sobriety Treatment and Recovery Team (START)  START is comprised of a social worker and a peer support mentor who has at least 3 years of sobriety, previous involvement with CPS, and was successfully able to regain or keep custody of her own children  According to officials, the START program has been able to provide participants with quick access to substance use disorder treatment  Officials from a Massachusetts local CPS agency told us that one of the services that they provide to parents of substance-affected infants is a parent aide who can help monitor how the parent is caring for the infant, such as administering the infant’s medications appropriately and ensuring the parent is not abusing the infant’s drugs  In addition, a parent aide can provide emotional support and help parents adjust after the infant is discharged from the hospital  Kentucky officials noted the effect that a healthy caregiver has on the outcome of the infant and emphasized that a baby cannot be healthy if the mother is not  Kentucky CPS officials said that they have found that the earlier caregivers enter treatment, the better the outcomes are for mothers and babies  According to Kentucky officials, parents who participate in the START program are less likely to have their child placed in foster care  Officials from the states that we visited told us that developing and monitoring plans of safe care under CAPTA’s new requirements for infants affected by their mother’s legal use of prescribed medications, as well as plans for these infants’ caregivers, present challenges  Specifically, officials reported concerns about increased caseloads, particularly if they are required to provide plans and services for infants at low risk of abuse or neglect, the content of plans, and confidentiality restrictions  Thirty-one of 50 states reported on our survey that staffing or resource limitations was very or extremely challenging, and CPS officials across the 3 states we visited said that the opioid epidemic has directly contributed to increased caseloads  According to a local Kentucky CPS office, the number of babies that met criteria for being accepted for investigation has increased about 55 percent from 2011 to 2016, while the number of staff has remained the same  Similarly, hospitals reported being impacted by this challenge  For example, staff at four hospitals we visited told us that they have delayed discharging infants from the hospital because CPS social workers did not identify caregivers to whom infants may be released or make plans for infants in a timely manner  In addition, staff from three hospitals told us that some CPS workers are difficult to contact and not especially responsive to their questions  One hospital social worker told us that she is concerned that the changes to CAPTA that require notifying CPS of all substance-affected newborns will inundate the agencies with cases  Officials from two of the three states we visited anticipated that providing services to infants affected by the legal use of prescribed medications, but not likely to be at risk for child abuse and neglect, will result in an increase in the number of families referred to CPS  This, in turn, will require a plan of safe care and further strain limited resources  Twenty- five states reported in our survey that the plan they develop for substance-affected infants is the same as for other children in CPS care, suggesting that states devote the same level of resources to these infants as other cases  The states we visited interpret CAPTA to require that plans of safe care be developed for all substance-affected infants who are referred to CPS, including those who may not meet usual criteria to be accepted for an investigation  Some state officials we interviewed questioned whether the new CAPTA requirements would allow for the best use of limited resources  For example, one senior state CPS official questioned whether it would be a good use of resources to develop plans of safe care for mothers in substance use disorder treatment or mothers using opioid medications due to chronic pain  A local CPS official we interviewed stated that drug exposure, in and of itself, is not necessarily a safety risk, and CPS should not intervene with families who are not at risk for child abuse or neglect  Instead, hospitals or treatment providers should intervene and refer families who do not meet criteria for CPS involvement, but could benefit from additional supports, to voluntary services  Kentucky public health officials told us that the period after a woman gives birth is a critical time for families as mothers may be stressed, sleep-deprived, exhausted, and may have other children in the home  This period may be especially challenging for mothers with substance use disorders, if adequate supports are not in place  According to officials women are typically covered for substance use treatment during pregnancy; however, this coverage ends roughly 60 days after the baby is born  In written responses to our survey, some states reported that they would rely on other agencies to develop plans of safe care  Similarly, in order to manage limited CPS resources, officials from two of the three states that we visited said they are considering having hospitals or other agencies assume responsibility for developing plans of safe care when there is no evidence of abuse or neglect and there appears to be minimal risk to the safety and well-being of the infant  Kentucky officials told us that they envision that CPS will be responsible for developing a plan of safe care for notifications that are accepted for investigation, while hospitals, or another agency, will be responsible for developing plans of safe care for referrals that are screened out by CPS  According to CPS state officials, the plan of safe care for the infant and the family can be part of the discharge plan prior to the family leaving the hospital  However, officials reported that obtaining cooperation from other agencies may be difficult  Some state officials reported being concerned that other agencies may not feel obligated to develop these plans, in part, because CAPTA provides funding to child welfare, and other agencies may therefore believe that child welfare should be responsible for developing the plan of safe care  CPS officials we interviewed in two of our site visit states, as well as one state we followed up with, told us that they were unsure of whether their current plans will meet new CAPTA requirements because CAPTA does not define a plan of safe care  For example, Massachusetts officials said that their plans include everything that a family might need to ensure the safety of the child, including resources to ensure stabilization and reunification of a family, but they are not sure whether the plans meet new CAPTA requirements, in part because they are not familiar with the term “plan of safe care ” An official in another state was also unsure about whether his state’s “safety plans” would meet CAPTA requirements  According to the official, safety plans may include a treatment plan for mothers, and referral services, such as early intervention for the child  In practice, plans of safe care generally address gaps that place an infant at risk for harm or neglect  However, state officials we interviewed reported being unsure about what a plan of safe care should look like for families where these gaps do not exist  Also, in a written response to our survey, one state expressed uncertainty about CPS’ role if required to work with infants who do not typically receive CPS services  For example, a Pennsylvania official said that it is unclear what types of interventions child welfare should conduct with families of infants exposed to legal substances, such as medications prescribed by doctors, when the caregivers are taking their medications correctly  Similarly, officials also questioned whether a plan would be necessary, and what the plan would entail, for caregivers who are already addressing their substance use disorder and taking steps to ensure their infant’s safety  Officials from a local Kentucky CPS office described a case in which a mother was participating in medication-assisted treatment, had attended counseling three times per week throughout her pregnancy, and was continuing treatment in the postpartum period  Through CPS’ investigation, the agency found that the case was not substantiated, in part, because there were no additional services that CPS could connect her with that she was not already receiving  Officials across the three states we visited also said that state and federal drug and alcohol confidentiality restrictions may challenge their ability to monitor plans of safe care  To monitor plans of safe care, CPS staff may need access to confidential information in order to know how caregivers are progressing in treatment, particularly now that these plans must address the substance use disorder needs of the caregiver  However, federal law restricts the disclosure and use of alcohol and drug patient records maintained in connection with the performance of any federal- assisted alcohol and drug abuse program  Generally, confidential information may be disclosed in accordance with the prior written consent of the patient  State and local CPS staff we interviewed said that strict confidentiality requirements make it challenging for drug and alcohol treatment providers to share information about mothers and infants  A CPS state director from Pennsylvania said that treatment providers are often reluctant to provide CPS case workers with information or updates on a mother’s treatment, which prevents child welfare workers from fully understanding how mothers are progressing with their treatment and the extent to which those in treatment are adhering to prescribed directions as outlined by treatment providers  In addition, one official from a state we visited said state statutes regarding sharing of drug and alcohol treatment information may be more restrictive than the federal statute  Some states have developed ways to obtain confidential information about mothers in substance use disorder treatment  For example, officials from one local CPS office told us that in instances when they have to develop a long-term plan of safe care for families, they have mothers sign a release of information form in order to obtain updates about her treatment adherence from the medication- assisted treatment provider  Similarly, a local Massachusetts CPS office told us that typically staff obtain releases from mothers so that they can verify whether mothers are actively participating in their treatment and that there are no records of relapse  In HHS’ role to assist states in the delivery of child welfare services, two agencies—ACF and the Substance Abuse and Mental Health Services Administration (SAMHSA)—provided technical assistance to states through the National Center on Substance Abuse and Child Welfare (NCSACW)  In addition, in ACF’s role to administer and monitor states’ implementation of CAPTA, the agency has provided some guidance to states on the provisions pertaining to substance-affected infants and has begun its monitoring responsibilities  ACF and SAMHSA, which leads public health efforts to reduce the impact of substance abuse and mental illness, established the NCSACW in 2002  The NCSACW provides technical assistance to states, and has issued publications and hosted forums to help states develop policies and procedures around issues affecting substance-affected infants  The technical assistance has focused on a broad range of issues, including collaboration among service providers, and plans of safe care  With respect to collaboration, NCSACW has issued several studies that identify opportunities for strengthening interagency efforts to prevent, intervene, identify, and treat prenatal substance exposure  The NCSACW collaboration guides encourage states to involve CPS agencies with medical providers in an interagency collaborative setting, thereby facilitating the process for CPS agencies to be notified of substance- affected infants  Regarding plans of safe care, NCSACW has provided technical assistance and best practices to states around development of these plans  For example, in one state it has facilitated discussion groups to help the state develop a model plan  From calendar year 2011 to 2016, NCSACW processed approximately 600 requests from state CPS agencies for short-term technical assistance related to improving care for substance-affected infants and their families  This short-term technical assistance included activities such as responding to telephone inquiries, mailing information, identifying needed resources, and making referrals  The NCSACW has also provided in- depth assistance to 16 states to strengthen collaboration and linkages across child welfare, addiction treatment, medical communities, early care and education systems, and family courts to improve outcomes for substance-affected infants and their families  Through this in-depth assistance, NCSACW identified areas for improvement in states, including a lack of clarity regarding compliance with CAPTA requirements (such as identification, notification, and developing plans of safe care) and the need for state models to comply with CAPTA requirements to develop plans of safe care  In one state, the project overview report indicated that a next step for the in-depth technical assistance is to continue development of the plan of safe care model and ensure practices and protocols are in place across systems to meet CAPTA requirements  The report indicated that this will include ongoing work with hospitals to ensure consistent identification of infants with prenatal exposure and notifications to CPS  Although18 states reported in our survey that technical assistance from the NCSACW was very or extremely helpful, 11 reported that it was moderately helpful, 7 reported that it was slightly helpful, and 1 reported that it was not at all helpful  Eleven states reported that they were not familiar with this assistance  Since July 2016, when the most recent amendments to CAPTA were enacted, ACF has issued one information memorandum and two program instructions to states about provisions relating to substance-affected infants  According to an ACF official, information memoranda share information with states, while program instructions provide interpretations of the law and inform states of actions they must take  ACF issued an August 2016 information memorandum informing states of the 2016 amendments to CAPTA  The August 2016 information memorandum also provided states with best practices, drawing on an NCSACW guide on collaboration for developing multi-systemic approaches to assist child welfare, medical, substance use disorder treatment, and other systems to support families affected by opioid use disorders  In January 2017, ACF issued a program instruction which provided guidance to states on implementing the 2016 amendments to CAPTA made by CARA and informed states of the flexibilities that they have under the law  Particularly, the guidance noted that: “CAPTA does not define ‘substance abuse’ or ‘withdrawal symptoms resulting from prenatal drug exposure ’ We recognize that by deleting the term ‘illegal’ as applied to substance abuse affecting infants, the amendment potentially expands the population of infants and families subject to the provision [that states have policies and procedures in place to address their needs]  States have flexibility to define the phrase, ‘infants born and identified as being affected by substance abuse or withdrawal symptoms resulting from prenatal drug exposure,’ so long as the state’s policies and procedures address the needs of infants born affected by both legal (e g , prescribed drugs) and illegal substance abuse ” “While CAPTA does not specifically define a ‘plan of safe care,’ CARA amended the CAPTA state plan requirement       to require that a plan of safe care address the health and substance use disorder treatment needs of the infant and affected family or caregiver ” “CAPTA does not specify which agency or entity must develop the plan of safe care; therefore the state may determine which agency will develop the plans  We understand that in most instances the state already has identified the responsible agency in its procedures  When the state reviews and modifies its policies and procedures to incorporate the new safe care plan requirements in CARA, the state may wish to revisit its procedures regarding which agency develops the plan of safe care, including any role for agencies collaborating with CPS in caring for the infant and family ” In addition, in April 2017, ACF issued a program instruction on reporting requirements, including changes in those requirements brought about by the 2016 amendments to CAPTA  ACF conducted limited monitoring of states prior to the amendments passed in 2016  According to ACF officials, if presented with evidence of potential deficiencies, the agency would attempt to learn more about the state’s activities  In one instance, ACF reviewed South Carolina’s policies and found them to not be in compliance with the notification and safe care plan requirements of CAPTA  It directed the state to develop a program improvement plan to bring it into full compliance, which South Carolina submitted in April 2016  In a recent progress report (February–April 2017), South Carolina reported that it was focused on updating statutes, developing policies and procedures, training child protective service workers, and building relations with health care providers  In response to the 2016 amendments to CAPTA that added the requirement for HHS to monitor state policies and procedures to address the needs of substance-affected infants, ACF officials told us that staff in regional offices will review states’ annual reports, submitted in June 2017  In its program instruction describing the reporting requirements, ACF asked each state to submit a new Governor’s Assurance, as well as a narrative explaining what they have done in response to the amendments  Specifically, ACF asked states to provide information on any changes that were made in state laws, policies, or procedures related to identifying and referring infants affected by substance abuse to CPS as a result of prenatal drug exposure  It also requested updates on states’ policies and procedures regarding the development of plans of safe care; a description of how states have developed systems to monitor plans of safe care; and a description of any outreach or coordination efforts the states have taken to implement the amendments, among other things  According to ACF officials, as of October 1, 2017, some states have provided information and a Governor’s Assurance demonstrating compliance with the amended provisions and some states have been placed on Program Improvement Plans, but the agency does not yet have information on the status of all states  An ACF official explained that, in their annual reports, some states either acknowledged that they are trying to get legislation enacted to bring them into compliance with the law and it has failed, or that they are not in compliance, for example, because they were limiting their policies to those infants affected only by illegal substances  In addition, in May 2017, ACF issued a technical bulletin informing states of the new data collection requirements that resulted from the 2016 amendments to CAPTA  ACF stated that it intends to collect data required by the amendments to CAPTA through the National Child Abuse and Neglect Data System, beginning with states’ submission of fiscal year 2018 data  This system is maintained by ACF and contains data from states about children who have been abused or neglected  ACF issued a Federal Register notice about the proposed data elements and requested comments on the accuracy and quality of the proposed data collection, among other things; the comment period closed in July 2017  In the Federal Register notice, ACF notes that the 2016 amendments to CAPTA require it to collect information from state CPS agencies on the number of notifications from health care providers that are accepted for investigation or screened out  Further, of those infants screened in, ACF is required to collect data on the number of safe care plans developed for substance- affected infants as well as the number of infants for whom a referral was made for appropriate services, including services for the affected family or caregiver  In the Federal Register notice, ACF proposed to collect this information using a combination of existing and new data from states  Thirty-two states reported in our survey that they already collect data on the incidence of substance-affected and/or substance-exposed infants; 15 of those 32 states also collect data on the incidence of NAS  Further, 18 states reported that they collect data on the number of notifications health care providers make to CPS  Of those states, 8 reported that they collect specific data on notifications related to infants diagnosed with NAS  Most states reported in our survey that additional guidance and assistance would be extremely or very helpful (see figure 3)  For example, 38 states reported that additional guidance on requirements for health care providers to notify CPS of substance-affected infants would be extremely or very helpful  Similarly, 37 states reported that additional guidance on developing, implementing, and monitoring plans to ensure the safety and well-being of substance-affected infants would be extremely or very helpful  In written responses to our survey, states suggested ideas for additional guidance, training, and technical assistance to help them address the needs of substance-affected infants  States’ suggestions ranged from assisting in the development of substance abuse training curriculum for staff to video conferences with other states to share information about implementing CAPTA  A few states suggested that the guidance ACF has provided to date is not clear and reported grappling with the meaning of terms such as “affected” and “legal vs  illegal” substances, and two states requested “concrete guidance” and “specificity ” A few other states suggested that it would be helpful to obtain additional information about meeting the requirements of plans of safe care within the constraints of state and federal confidentiality laws, technical assistance on what plans of safe care look like, and a format for a plan of safe care  ACF officials told us that states have flexibility with implementing the law and the agency does not anticipate issuing additional written guidance on the amendments to CAPTA made by CARA  ACF officials explained, in October 2017, that they were finalizing their review of the plans that states were required to submit  These plans are expected to include details on how the states are addressing the CAPTA requirements  While ACF could not provide the number, officials reported that some of the state plans submitted to date did not meet the requirements and those states have been asked to develop program improvement plans  They expect states to work with the ACF regional offices, which will provide or facilitate technical assistance to states on their implementation of the provisions, as needed  In addition to the review of state plans, ACF officials explained that regional officials may learn about states’ needs for technical assistance through meetings or informational exchanges  Finally, the NCSACW is expected to review and prepare a summary of CAPTA state plans, current state statutes and policies and procedures relating to amended CAPTA requirements  In addition, according to ACF, NCSACW will continue to offer technical assistance on the development and implementation of plans of safe care to states  Technical assistance may include responding to requests for information, disseminating written materials and resources, and conducting webinars/conference calls  Further, ACF reported that some states will receive more in-depth technical assistance, albeit in some instances on a time-limited basis  Undertaking these actions can enhance states’ understanding of CAPTA requirements and better address known challenges such as the ones described in this report  However, more specific guidance from HHS on the issues which states have expressed confusion can assist them in better understanding CAPTA requirements and providing more effective protections and services for the children and families most in need  The opioid epidemic has generated a significant increase in the number of substance-affected infants born and diagnosed with NAS  These vulnerable infants may be at risk for child abuse and neglect if adequate supports and services are not available to ensure their safety  CAPTA requires states to have policies and procedures to address the needs of these infants and their families, including mothers with a substance use disorder  However, states have experienced challenges implementing new CAPTA requirements  Many states reported in our survey that they are not completely adhering to the law  This is reflected in ACF’s review of state plans, some of which are resulting in program improvement plans  States cite challenges that stem, in part, from ACF’s lack of specificity in providing guidance on implementing CAPTA requirements  Specifically, states report that ACF has not provided clear guidance about which substance-affected infants health care providers are required to notify CPS about, as well what a plan of safe care is and for whom it should be developed  Given the challenges that states reported facing in implementing the provisions, a majority reported wanting more help from ACF, such as trainings and teleconferences with other states, to help overcome their challenges  Additional guidance and assistance from HHS would help states better understand what they need to do to develop policies and procedures that meet the needs of children and families affected by substance use  The Secretary of HHS should direct ACF to provide additional guidance and technical assistance to states to address known challenges and enhance their understanding of CAPTA requirements, including the requirements for health care providers to notify CPS of substance- affected infants and the development of a plan of safe care for these infants  We provided a draft of this report to HHS for review and comment  HHS’s comments are reproduced in appendix I  HHS also provided technical comments, which we incorporated into our report where appropriate  HHS did not concur with our recommendation  HHS stated that: in January 2017, ACF clarified in guidance several of the issues raised in the report, including the population of infants and families covered by the provision and the state flexibility inherent in determining which infants are “affected by” substance abuse, and the terminology used in the federal law of what a “plan of safe care” is; ACF believes it is necessary to allow states the flexibility to meet the requirements in the context of their state CPS program; several of the challenges that the GAO notes are not specific to CAPTA compliance with the safe care plan and notification requirements; and it does see the value in continuing to provide technical assistance to states to address known challenges and to enhance their understanding of CAPTA requirements  With respect to HHS’ January 2017 guidance, state officials reported in our survey and during site visits that they found some terms unclear and were uncertain about what is required of them  In written responses to our survey, states reported challenges understanding how to define substance-affected under CAPTA  In addition, as we note in our report, the guidance about plans of safe care described the following: “While CAPTA does not specifically define a ‘plan of safe care,’ CARA amended the CAPTA state plan requirement       to require that a plan of safe care address the health and substance use disorder treatment needs of the infant and affected family or caregiver ” States reported in our survey and in follow-up discussions that this lack of specificity remained an ongoing challenge for them  For example, as we discuss in our report, one state that we followed up with in August 2017 was still unsure about whether its safety plans would meet CAPTA requirements for plans of safe care  In addition, as of October 2017, HHS confirmed that some state plans did not meet CAPTA requirements and that the states were asked to develop program improvement plans  Accordingly, a key ongoing challenge was not addressed by the January guidance  Regarding allowing states flexibility to meet CAPTA requirements, we acknowledge in our report that HHS said that states have flexibility  However, in our survey and site visits, states indicated that they would find it helpful for HHS to provide them with greater specificity around terms, including the degree of flexibility they are allowed  States added that this would include parameters within which they can develop policies and procedures that meet CAPTA requirements  We continue to believe that additional guidance addressing these concerns would benefit states and could be provided without imposing additional mandates  Concerning HHS’ third point that some of the issues raised in the report are not specific to CAPTA, the states we visited interpret CAPTA to require that plans of safe care be developed for all substance-affected infants who are referred to CPS  During our discussions with states and in responses to our survey, state officials did not delineate which federal requirement impacted their approach to serving children and families  As stated in our conclusion, vulnerable infants may be at risk for child abuse and neglect if adequate supports and services are not available to ensure their safety  Lastly, HHS indicated that it will continue to provide technical assistance to states and fund demonstration sites to establish or enhance collaboration across community agencies and courts  Although continuing to provide technical assistance to states should be beneficial, our findings demonstrate that additional guidance is also needed  For example, 38 states reported that additional guidance on requirements for health care providers to notify CPS of substance-affected infants would be extremely or very helpful  Similarly, 37 states reported that additional guidance on developing, implementing, and monitoring plans to ensure the safety and well-being of substance-affected infants would be extremely or very helpful  Overall, given the results of our review, we continue to believe our recommendation is warranted  Effective implementation of our recommendation should help states better implement protections for children  As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date  At that time, we will send copies of this report to the appropriate congressional committees and the Secretary of Health and Human Services  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-7215 or larink@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix II  Kathryn A  Larin, (202) 512-7215 or larink@gao gov  In addition to the contact above, Sara Schibanoff Kelly (Assistant Director), Ramona L  Burton (Analyst-in-Charge), Kay E  Brown, Hannah Dodd, Ada Nwadugbo, and Srinidhi Vijaykumar made key contributions to this report  Also contributing to this report were Sandra L  Baxter, James Bennett, Gina Hoover, Jessica Orr, Rhiannon Patterson, Jean McSween, and James Rebbe 

ground_truth: More than 2.7 million miles of pipeline transport and distribute oil, natural gas, and other hazardous products throughout the United States. Interstate pipelines run through remote areas and highly populated urban areas, and are vulnerable to accidents, operating errors, and malicious physical and cyber-based attack or intrusion. The energy sector accounted for 35 percent of the 796 critical infrastructure cyber incidents reported to DHS from 2013 to 2015. Several federal and private entities have roles in pipeline security. TSA is primarily responsible for the oversight of pipeline physical security and cybersecurity. GAO was asked to review TSA's efforts to assess and enhance pipeline security and cybersecurity. This report examines, among other objectives: (1) the guidance pipeline operators reported using to address security risks and the extent that TSA ensures its guidelines reflect the current threat environment; (2) the extent that TSA has assessed pipeline systems' security risks; and (3) the extent TSA has assessed its effectiveness in reducing pipeline security risks. GAO analyzed TSA documents, such as its Pipeline Security Guidelines ; evaluated TSA pipeline risk assessment efforts; and interviewed TSA officials, 10 U.S. pipeline operators—selected based on volume, geography, and material transported—and representatives from five industry associations. Pipeline operators reported using a range of guidelines and standards to address physical and cybersecurity risks, including the Department of Homeland Security's (DHS) Transportation Security Administration's (TSA) Pipeline Security Guidelines , initially issued in 2011. TSA issued revised guidelines in March 2018 to reflect changes in the threat environment and incorporate most of the principles and practices from the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity . However, TSA's revisions do not include all elements of the current framework and TSA does not have a documented process for reviewing and revising its guidelines on a regular basis. Without such a documented process, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical security and cybersecurity, or address the dynamic security threat environment that pipelines face. Further, GAO found that the guidelines lack clear definitions to ensure that pipeline operators identify their critical facilities. GAO's analysis showed that operators of at least 34 of the nation's top 100 critical pipeline systems (determined by volume of product transported) deemed highest risk had identified no critical facilities. This may be due, in part, to the guidelines not clearly defining the criteria to determine facilities' criticality. To assess pipeline security risks, TSA conducts pipeline security reviews—Corporate Security Reviews and Critical Facility Security Reviews—to assess pipeline systems' vulnerabilities. However, GAO found that the number of TSA security reviews has varied considerably over the last several years, as shown in the table on the following page. TSA officials stated that staffing limitations have prevented TSA from conducting more reviews. Staffing levels for TSA's Pipeline Security Branch have varied significantly since fiscal year 2010 with the number of staff ranging from 14 full-time equivalents in fiscal years 2012 and 2013 to 1 in 2014. Further, TSA does not have a strategic workforce plan to help ensure it identifies the skills and competencies—such as the required level of cybersecurity expertise—necessary to carry out its pipeline security responsibilities. By establishing a strategic workforce plan, TSA can help ensure that it has identified the necessary skills, competencies, and staffing. GAO also identified factors that likely limit the usefulness of TSA's risk assessment methodology for prioritizing pipeline system reviews. Specifically, TSA has not updated its risk assessment methodology since 2014 to reflect current threats to the pipeline industry. Further, its sources of data and underlying assumptions and judgments regarding certain threat and vulnerability inputs are not fully documented. In addition, the risk assessment has not been peer reviewed since its inception in 2007. Taking steps to strengthen its risk assessment, and initiating an independent, external peer review would provide greater assurance that TSA ranks relative risk among pipeline systems using comprehensive and accurate data and methods. TSA has established performance measures to monitor pipeline security review recommendations, analyze their results, and assess effectiveness in reducing risks. However, these measures do not possess key attributes—such as clarity, and having measurable targets—that GAO has found are key to successful performance measures. By taking steps to ensure that its pipeline security program performance measures exhibit these key attributes, TSA could better assess its effectiveness at reducing pipeline systems' security risks. Pipeline Security Branch officials also reported conducting security reviews as the primary means for assessing the effectiveness of TSA's efforts to reduce pipeline security risks. However, TSA has not tracked the status of Corporate Security Review recommendations for the past 5 years. Until TSA monitors and records the status of these reviews' recommendations, it will be hindered in its efforts to determine whether its recommendations are leading to significant reduction in risk. GAO makes 10 recommendations to TSA to improve its pipeline security program management (many are listed on the next page), and DHS concurred. GAO recommends, among other things, that the TSA Administrator take the following actions: implement a documented process for reviewing, and if deemed necessary, for revising TSA's Pipeline Security Guidelines at defined intervals; clarify TSA's Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities; develop a strategic workforce plan for TSA's Security Policy and Industry Engagement‘s Surface Division; update TSA's pipeline risk assessment methodology to include current data to ensure it reflects industry conditions and threats; fully document the data sources, underlying assumptions and judgments that form the basis of TSA's pipeline risk assessment methodology; take steps to coordinate an independent, external peer review of TSA's pipeline risk assessment methodology; ensure the Security Policy and Industry Engagement‘s Surface Division has a suite of performance measures which exhibit key attributes of successful performance measures; and enter information on Corporate Security Review recommendations and monitor and record their status.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: Cross-border data flows underlie today's globally connected world and are essential to conducting international trade and commerce  Data flows enable companies to transmit information for online communication, track global supply chains, share research, and provide cross-border services  One study estimates that digital commerce relying on data flows drives 22% of global economic output, and that global GDP will increase by another $2 trillion by 2020 due to advances in emerging technologies  However, while cross-border data flows increase productivity and enable innovation, they also raise concerns around the security and privacy of the information being transmitted  Cross-border data flows are central to trade and trade negotiations as organizations rely on the transmission of information to use cloud services, and to send nonpersonal corporate data as well as personal data to partners, subsidiaries, and customers  U S  policymakers are considering various policy options to address online privacy, some of which could affect cross-border data flows  For example, new consumer rights to control their personal data may impact how companies can use such data  To enable international data flows and trade, the United States has aimed to eliminate trade barriers and establish enforceable international rules and best practices that allow policymakers to achieve public policy objectives, including promoting online security and privacy  Building consensus for international rules and norms on data flows and privacy has become increasingly important as recent incidents have heightened the public's awareness of the risk of personal data stored online  For example, the 2018 Cambridge Analytica scandal drew attention because the firm reportedly acquired and used data on more than 87 million Facebook accounts in an effort to influence voters in the 2016 U S  presidential election and the UK referendum on continued European Union (EU) membership ("Brexit")  In addition, security concerns have been raised about data breaches, such as those that exposed the personal data of half a million Google users or 500 million Marriot hotel customers  Organizations value consumers' personal online data for a variety of reasons  For example, companies may seek to facilitate business transactions, analyze marketing information, detect disease patterns from medical histories, discover fraudulent payments, improve proprietary algorithms, or develop competitive innovations  Some analysts compare data to oil or gold, but unlike those valuable substances, data can be reused, analyzed, shared, and combined with other information; it is not a scarce resource  However, personal data is considered personal private property  Individuals often want to control who accesses their data and how it is used  Experts suggest that data may therefore be considered both a benefit and a liability that organizations hold  Data has value, but an organization takes on risk by collecting personal data; they become responsible for protecting users' privacy and not misusing the information  Data privacy concerns may become more urgent as the amount of online information organizations access and collect, and the level of global data flows, continue to expand  Countries vary in their policies and laws on these issues  The United States has traditionally supported open data flows and has regulated privacy at a sectoral level to cover data, such as health records, rather than create a comprehensive policy  U S  trade policy has sought to balance the goals of consumer privacy, security, and open commerce, including eliminating trade barriers and opening markets  Other countries are developing data privacy policies that affect international trade as some governments or groups seek to limit data flows outside of an organization or across national borders for a number of reasons  Blocking international data flows may impede the ability of a firm to do business or of an individual to conduct a transaction, creating a form of trade protectionism  Research demonstrates not only the economic gains from digital trade and international data flows, but also the real economic costs of restrictions on such flows  For many policymakers, the crux of the issue is: How can governments protect individual privacy in the least trade-restrictive way possible? The question is similar to concerns raised about ensuring cybersecurity while allowing the free flow of data  In recent years, Congress has examined multiple issues related to cross-border data flows and online privacy  In the 115 th Congress, congressional committees held hearings on these topics, introduced multiple bills, and conducted oversight over federal laws on related issues such as data breach notification  Members are introducing new bills and holding hearings in the 116 th Congress  Congress may consider the proposed U S -Mexico-Canada Agreement (USMCA) and examine the digital trade chapter as an example of how to address the issues through trade agreements  In most circumstances, a consumer expects both privacy and security when conducting an online transaction  However, users' expectations and values may vary and there is no globally accepted standard or definition of data privacy in the online world  In addressing online privacy, Congress may need to define personal data and differentiate between sensitive and nonsensitive personal data  In general, data privacy can be defined by an individual's ability to prevent access to personally identifiable information (PII)  According to the U S  Office of Management and Budget (OMB) guidance to federal agencies, PII refers to information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual  Since electronic data can be readily shared and combined, some data not traditionally considered PII may have become more sensitive  For example, the OMB definition does not specifically mention data on location tracking, purchase history, o r preferences, but these digital data points can be tracked by a device such as a mobile phone or laptop that an individual carries or logs into  The EU definition of PII attempts to capture the breadth of data available in the online world: "personal data" means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person  Policymakers may consider differentiating between sensitive and nonsensitive personal data  For example, sensitive personal data could include ethnic origin, political or religious affiliation, biometric data, health data, sexual orientation, precise geolocation data, etc  "Cross-border data flows" refers to the movement or transfer of information between computer servers across national borders  Cross-border data flows are part of, and integral to, digital trade and facilitate the movement of goods, services, people, and finance  A 2017 analysis estimated that global flows of goods, services, finance, and people increased world gross domestic product (GDP) by at least 10% in the past decade, adding $8 trillion between 2005 and 2015  Effective and sustainable digital trade relies on data flows that permit commerce and communication but that also ensure privacy and security, protect intellectual property, and build trust and confidence  Impeding cross-border data flows, including through some privacy regulations, may decrease efficiency and reduce other benefits of digital trade, resulting in the fracturing, or so-called balkanization, of the internet  In addressing online privacy, some policymakers focus on limiting access to online information by restricting the flow of data beyond a country's borders  Such limits may also act as protectionist measures  Online privacy policies may create barriers to digital trade, or damage trust in the underlying digital economy  For example, measures to limit cross-border data flows could block companies from using cloud computing to aggregate and analyze global data, or from gaining economies of scale, constrain e-commerce by limiting international online payments, hinder global supply chains seeking to use blockchain to track products or manage supply chains, customs documentation, or electronic payments, impede the trading of crypto-currency, or limit the use of advanced technology like artificial intelligence  According to the World Trade Organization (WTO), one of the most significant overall impacts of the growth of digital technologies is in transforming international trade  Technology can lower the costs of trade, change the types of goods and services that are traded, and may even change the factors defining a country's comparative advantage  The extent of the impact of digital technologies on trade, however, depends in large part on open cross-border data flows  One study of U S  companies found that data localization rules (i e , requiring organizations to store data on local servers) were the most-cited digital trade barrier  Some governments advocate privacy or security policies that require data localization and limit cross-border data flows  However, many industry stakeholders argue that blocking cross-border data flows and storing data domestically does not make such data more secure or private  Many experts argue that policymakers should limit cross-border data flows in the least trade-restrictive manner possible and also ensure security and privacy  These objectives are not easily reconciled  Moreover, although an overlap exists between data protection and privacy, the two are not equivalent  Cybersecurity measures are essential to protect data (e g , against intrusions or theft by hackers)  However, they may not be sufficient to protect privacy  For example, if an organization shares user data with a third party, it may be doing so securely, but not in a way that protects users' privacy or aligns with consumer expectations  Similarly, breach notification requirements are not the same as proactive privacy protection measures  At the same time, policies that protect a consumer's privacy can align with security policies  Laws can limit law enforcement's access to information except in certain circumstances  Keeping user information anonymous may enable firms to analyze data while protecting individuals' identities  Some see an inherent conflict between online security, privacy, and trade; others believe that policies protecting all three can be coherent and consistent  The U S  government has traditionally sought to balance these objectives  Some stakeholders note, however, that current U S  policy has been inadequate in protecting online privacy and that change is needed  In some cases in the past, Congress has acted to address privacy concerns in particular sectors; for example, the Health Insurance Portability and Accountability Act (HIPAA) of 1996 led to health privacy standards regulations  The Trump Administration has begun an effort to devise an overarching data privacy policy (see " Defining the U S  Approach ") and many Members of Congress are also considering possible approaches  There are no comprehensive multilateral rules specifically about privacy or cross-border data flows  However, the United States and other countries have begun to address these issues in negotiating new and updated trade agreements, and through international economic forums and organizations such as the Asia-Pacific Economic Cooperation (APEC) forum and the Organisation for Economic Co-operation and Development (OECD)  The World Trade Organization (WTO) General Agreement on Trade in Services (GATS) entered into force in January 1995, predating the current reach of the internet and the explosive growth of global data flows  Many digital products and services that did not exist when the agreements were negotiated are not covered  On the other hand, privacy is explicitly addressed within GATS as an exception to allow countries to take measures that do not conform with the agreement in order to protect "the privacy of individuals in relation to the processing and dissemination of personal data and the protection of confidentiality of individual records and accounts," as long as those measures are not arbitrary or a disguised trade restriction  Efforts to update the multilateral agreement and discussions for new digital trade rules under the WTO Electronic Commerce Work Program stalled in 2017  Given the lack of progress on multilateral rules, some have suggested that the WTO should identify best practices or guidelines for digital trade rules that could lay the foundation for a future multilateral WTO agreement  In December 2017, a group of more than 70 WTO members, including the United States, agreed to "initiate exploratory work together toward future WTO negotiations on trade-related aspects of electronic commerce " Overall U S  objectives include allowing the free flow of information for international trade and cross-border data flows, "subject to reasonable safeguards like the protection of consumer data when it is exported," but do not specifically address privacy  The group formally launched the e-commerce initiative in January 2019  The official joint statement lists the United States and EU as participants, and also several developing countries such as China and Brazil  India stated it will not join, preferring to maintain its flexibility to favor domestic firms, limit foreign market access, and raise revenue in the future  The statement did not define the scope of any potential agreement  After the meeting, the EU noted data localization measures among the potential new rules to be discussed when negotiations officially launch in March 2019  The U S  Trade Representative's (USTR's) statement emphasized the need for a high-standard agreement that includes enforceable obligations  Although some experts note that harmonization or mutual recognition is unlikely given divergent legal systems, privacy regimes, and norms of the parties, a common system of rules to allow for cross-border data flows while ensuring privacy protection is reportedly under discussion  Personal privacy has received increasing focus with the growth of digital trade encouraging global cooperation  The United States has contributed to developing international guidelines or principles related to privacy and cross-border data flows, although none are legally binding  The OECD 1980 Privacy Guidelines established the first international set of privacy principles emphasizing data protection as a condition for the free flow of personal data across borders  These OECD guidelines were intended to assist countries with drawing up national data privacy policies  The guidelines were updated in 2013, focusing on national level implementation based on a risk management approach and improving interoperability between national privacy strategies  The updated guidelines identify specific principles for countries to take into account in establishing national policies  The guidelines are to be reviewed and updated again in 2019  Building on the OECD principles and prior G-20 work, the 2018 G-20 Digital Economy Ministerial Declaration identified principles to "facilitate an inclusive and whole-of-government approach to the use of information and communication technology (ICT) and assist governments in reshaping their capacities and strategies, while respecting the applicable frameworks of different countries, including with regards to privacy and data protection " Japan is to host the 2019 G-20 and plans to focus on data governance, offering a forum to address potential global standards on privacy and cross-border data flows  APEC is a regional forum for economic cooperation whose initiatives on privacy and cross-border data flows have influenced members' domestic policies  APEC's 21 members, including the United States, agreed to the 2005 APEC Privacy Framework , based on the OECD guidelines  The framework identifies a set of principles and implementation guidelines to provide members with a flexible approach to regulate privacy at a national level  Once the OECD publishes updated guidelines in 2019, APEC members may revise the framework and principles to reflect the updated guidelines  The APEC Cross-Border Privacy Rules (CBPR), endorsed by APEC Leaders in 2011, is a privacy code of conduct, based on the framework  The CBPR system establishes a set of principles for governments and businesses to follow to protect personal data and allow for cross-border data flows between CBPR members  They aim to balance information privacy with business needs and commercial interests, and facilitate digital trade to spur economic growth in the region  Rather than creating a new set of international regulations, the APEC framework and CBPR system identify best practices that each APEC member can tailor to its domestic legal system and allow for interoperability between countries  The scope and implementation mechanisms under CBPR can vary according to each member country's laws and regulations, providing flexibility for governments to design national privacy approaches  To become a member of the CBPR, a government must 1  Be a member of APEC; 2  Establish a regulator with authority to sign the Cross-Border Privacy Enforcement Arrangement (CPEA); 3  Map national laws to the published APEC guidelines, which set baseline standards; and 4  Establish an accountability agent empowered to audit and review a company's practices, and enforce privacy rules and laws  If a government joins the CBPR system, every domestic organization is not required to also join; however, becoming a member of CBPR may benefit an organization engaged in international trade by indicating to customers and partners that the organization values and protects data privacy  With certified enrollment in CBPR, organizations can transfer personal information between participating economies (e g , Mexico to Singapore) and be assured of compliance with the legal regimes in both places  To become a CBPR member, an individual organization must develop and implement data privacy policies consistent with the APEC Privacy Framework and complete a questionnaire  The third party accountability agent is responsible for assessing an organization's application, ongoing monitoring of compliance, investigating any complaints, and taking enforcement actions as necessary  Domestic enforcement authorities in each member country serve as a backstop for dispute resolution if an accountability agent cannot resolve a particular issue  All CBPR member governments must join the CPEA to ensure cooperation and collaboration between the designated national enforcement authorities  In the United States, the Federal Trade Commission (FTC) is the regulator and enforcement authority  TrustArc is the only accountability agent, but many expect the U S  Department of Commerce to recognize additional agents soon  As of this writing, TrustArc lists about 20 U S  firms that are APEC CBPR certified  The CBPR grows in significance as the number of participating economies and organizations increases  The U S  ambassador to APEC aims to have "as many APEC economies as possible as soon as possible to join the system " Currently, the United States, Japan, Mexico, Canada, South Korea, Singapore, Taiwan, and Australia are CBPR members; the Philippines is in the process of joining  Russia, on the other hand, stated it has no plans to join  Although APEC initiatives are regionally focused, they can provide a basis to scale up to larger global efforts because they reflect economies at different stages of development and include industry participation  Due to its voluntary nature, APEC has served as a testbed for identifying best practices, standards, and principles and for creating frameworks that can lead to binding commitments in plurilateral or larger multilateral agreements (see " Data Flows and Privacy in U S  Trade Agreements ")  Expanding CBPR beyond APEC could represent the next step toward consistent international rules and disciplines on data flows and privacy  Countries vary in their privacy policies and laws, reflecting differing priorities, cultures, and legal structures  According to one index, China is the most restrictive digital trade country among 64 countries surveyed, followed by Russia, India, Indonesia, and Vietnam (see Figure 1 )  The United States ranks 22 in the index, less restrictive than Brazil or France but more restrictive than Canada or Australia  The relatively high U S  score largely reflects financial sector restrictions  The "restrictions on data" category covers data policies such as privacy and security measures; this category is included in the composite index  Looking specifically at the 64 countries' data policies, Russia is the most restrictive country, followed by Turkey and China  Russia's policies include data localization, retention, and transfer requirements, among others  Turkey's comprehensive Data Protection Law also establishes requirements in these areas  In contrast, the United States ranks 50 for data policy restrictions  Two of the top U S  trading partners (the EU and China) have established their data policies from different perspectives  The EU's policies are driven by privacy concerns; China's policies are based on security justifications  Both are setting examples that other countries, especially those with (or seeking) closer trading ties to China or the EU, are emulating; thus, these policies have affected U S  firms seeking to do business in those other countries as well  The EU considers the privacy of communications and the protection of personal data to be fundamental human rights, which are codified in EU law  Differences between the United States and EU in their approaches to data protection and data privacy laws have long been sticking points in U S -EU economic and security relations  The EU and United States negotiated the U S -EU Privacy Shield to allow for the transatlantic transfer of personal data by certified organizations  The bilateral agreement established a voluntary program with commitments and obligations for companies, limitations on law enforcement access, and transparency requirements  U S  companies that participate in the program must still comply with all of the obligations under EU law (see below) if they process personal data of EU persons  The Privacy Shield is overseen and enforced by EU federal and U S  agencies, including the Department of Commerce and the FTC, and is reviewed by both parties annually  The EU's General Data Protection Regulation (GDPR), effective May 2018, establishes rules for EU members, with extraterritorial implications  The GDPR is a comprehensive privacy regime that builds on previous EU data protection rules  It grants new rights to individuals to control personal data and creates specific new data protection requirements  The GDPR applies to (1) all businesses and organizations with an EU establishment that process (i e , perform operations on) personal data of individuals in the EU, regardless of where the actual processing of the data takes place; and (2) entities outside the EU that offer goods or services (for payment or for free) to individuals in the EU or monitor the behavior of individuals in the EU  While the GDPR is directly applicable at the EU member state level, individual countries are responsible for establishing some national-level rules and policies as well as enforcement authorities, and some are still in the process of doing so  As a result, some U S  stakeholders have voiced concerns about a lack of clarity and inadequate country compliance guidelines  Many U S  firms doing business in the EU have made and are making changes to comply with the GDPR, such as revising and clarifying user terms of agreement and asking for explicit consent  For some U S  companies, it may be easier and cheaper to apply GDPR protections to all users worldwide rather than to maintain different policies for different users


Report 2:  Large firms may have the resources to hire consultants and lawyers to guide implementation and compliance; it may be harder and costlier for small and mid-sized enterprises to comply, possibly deterring them from entering the EU market and creating a de facto trade barrier  Since the GDPR went into effect on May 25, 2018, some U S  businesses, including some newspaper websites and digital advertising firms, have opted to exit the EU market given the complexities of complying with the GDPR and the threat of potential enforcement actions  European Data Protection Authorities (DPAs) have received a range of GDPR complaints and initiated several GDPR enforcement actions in the fall of 2018  In January 2019, the French DPA issued the largest penalty to date for a data privacy breach  The agency imposed a €50 million (approximately $57 million) fine on Google for the "lack of transparency" regarding how the search engine processes user data  Analysts contend that the high fine may set a benchmark and signal for future enforcement, raising concerns among some firms doing business in the EU  Under the GDPR, a few options exist to transfer personal data in or out of the EU and ensure that privacy is maintained  1  An organization may use specific Binding Corporate Rules (BCRs) or Model Contracts approved by the EU; 2  An organization may comply with domestic privacy regimes of a country that has obtained a mutual adequacy decision from the EU, which means that the EU has deemed that a country's laws and regulations provide an adequate level of data protection; currently, fewer than 15 jurisdictions are deemed adequate by the EU; or 3  A U S -based organization may enroll in the bilateral U S -EU Privacy Shield program for transatlantic transfer of personal data  The GDPR legal text seems to envision a fourth way, such as a certification scheme to transfer data, that the EU has yet to elaborate  A certification option(s) could create a less burdensome means of compliance for U S  and other non-EU organizations to transfer personal data to or from the EU in the future  This could be an opportunity for the United States to work with the EU on creating a common system, perhaps even setting a global standard  Some experts contend that the GDPR may effectively set new global data privacy standards, since many companies and organizations are striving for GDPR compliance to avoid being shut out of the EU market, fined, or otherwise penalized, or in case other countries introduce rules that imitate the GDPR  The EU is actively promoting the GDPR and some countries, such as Argentina, are imitating all or parts of the GDPR in their own privacy regulatory and legislative efforts or as part of broader trade negotiations with the EU  In general, the EU does not include cross-border data flows or privacy in free trade agreements  However, alongside trade negotiations with Japan, the EU and Japan agreed to recognize each other's data protection systems as "equivalent," allowing for the free flow of data between the EU and Japan and serving as a first step in adopting an adequacy decision  Under the agreement, Japan committed to implementing additional measures to address the handling of the personal data of EU persons on top of Japan's own privacy regime  China's trade and internet policies reflect state direction and industrial policy, limiting the free flow of information and individual privacy  For example, the requirement for all internet traffic to pass through a national firewall can impede the cross-border transmission of data  China's 2015 counterterrorism law requires telecommunications operators and internet service providers to provide assistance to the government, which could include sharing individuals' data  Citing national security concerns, China's Internet Sovereignty policies, Cybersecurity Law, and Personal Information Security Specification impose strict requirements on companies, such as storing data domestically; limiting the ability to access, use, or transfer data internationally; and mandating security assessments that provide Chinese authorities access to proprietary information  In 2014, China announced a new social credit system, a centralized big-data-enabled system for monitoring and shaping businesses' and citizens' behavior that serves as a self-enforcing regulatory mechanism  According to the government, China aims to make individuals more "sincere" and "trustworthy," while obtaining reliable data on the creditworthiness of businesses and individuals  An individual's score would determine the level of government services and opportunities he or she could receive  China seeks to have all its citizens subject to the social credit system by 2020, forcing some U S  businesses who do business in China, such as airlines, to participate  As of 2018, multiple government agencies and financial institutions contribute data to the platform  Pilot projects are underway in some provinces to apply various rewards and punishments in response to data collected  The lack of control an individual may have and the exposure of what some consider private data is controversial among observers in and out of China  Some countries, such as Vietnam, are following China's approach in creating cybersecurity policies that limit data flows and require local data storage and possible access by government authorities  Some U S  firms and other multinational companies are considering exiting the Vietnamese market rather than complying, while some analysts suggest that Vietnam's law may not be in compliance with its recent commitments in trade agreements (see below)  India has also cited security as the rationale for its draft Personal Data Protection Bill, which would establish broad data localization requirements and limit cross-border transfer of some data  Unlike the EU, these countries do not specify mechanisms to allow for cross-border data flows  U S  officials have raised concerns with both Vietnam's and India's localization requirements  The EU's emphasis on privacy protection and China's focus on national security (and the countries that emulate their policies) have led these countries to create data-focused policies that restrict international trade and commerce  The United States has traditionally sought a balanced approach between trade, privacy, and security  U S  data flow policy priorities are articulated in USTR's Digital 2 Dozen report, first developed under the Obama Administration, and the White House's 2017 National Security Strategy  Both Administrations emphasize the need for protection of privacy, the free flow of data across borders, and an interoperable internet  These documents establish the U S  position that the free flow of data is not inconsistent with privacy protection  Recent free trade agreements translate the U S  position into binding international commitments  The United States has taken a data-specific approach to regulating data privacy, with laws protecting specific information, such as healthcare or financial data  The FTC enforces consumer protection laws and requires that consumers be notified of and consent to how their data will be used, but the FTC does not have the mandate or resources to enforce broad online privacy protections  There is growing interest among some Members of Congress and in the Administration for a more holistic U S  data privacy policy  The United States has played an important role in international discussions on privacy and data flows, such as in the OECD, G-20, and APEC, and has included provisions on these subjects in recent free trade agreements  Congress noted the importance of digital trade and the internet as a trading platform in setting the current U S  trade negotiating objectives in the June 2015 Trade Promotion Authority (TPA) legislation ( P L  114-26 )  TPA includes a specific principal U S  trade negotiating objective on "digital trade in goods and services and cross-border data flows " According to TPA, a trade agreement should ensure that governments "refrain from implementing trade-related measures that impede digital trade in goods and services, restrict cross-border data flows, or require local storage or processing of data " However, TPA also recognizes that sometimes measures are necessary to achieve legitimate policy objectives and aims for such regulations to be the least trade restrictive, nondiscriminatory, and transparent  Comprehensive and Progressive Agreement for Trans‐Pacific Partnership (CPTPP /TPP-11 )   The CPTPP is a recently concluded trade agreement among 11 Asia-Pacific countries  The CPTPP is based on the proposed Trans-Pacific Partnership (TPP) agreement negotiated by the Obama Administration and from which President Trump withdrew the United States in January 2017  The electronic commerce chapter in TPP, left unchanged in CPTPP, contains the strongest binding trade agreement commitments on digital trade in force globally  CPTPP includes provisions on cross-border data flows and personal information protection  The text specifically states that the parties "shall allow the cross-border transfer of information " The agreement allows restrictive measures for legitimate public policy purposes if they are not discriminatory or disguised trade barriers  The agreement also prohibits localization requirements for computing facilities, with similar exceptions  On privacy, the CPTPP requires parties to have a legal framework in place to protect personal information and to have consumer protection laws that cover online commerce  It encourages interoperability between data privacy regimes and encourages cooperation between consumer protection authorities  United States-Mexico-Canada Agreement (USMCA)  The released text for the proposed USMCA aims to revise and update the trilateral North American Free Trade Agreement (NAFTA), and illustrates the Trump Administration's approach  The USMCA chapter 19 on digital trade includes articles on consumer protection, personal information protection, cross-border transfer of information by electronic means, and cybersecurity, among other topics  Building on the TPP, the agreement seeks to balance the legitimate objectives by requiring parties to have a legal framework to protect personal information, have consumer protection laws for online commercial activities, and not prohibit or restrict cross-border transfer of information  While the agreement does not prescribe specific rules or measures that a party must take to protect privacy, it goes further than the TPP (or CPTPP) provisions and provides guidance to inform a country's privacy regime  In particular, the USMCA explicitly refers to the APEC Privacy Framework and OECD Guidelines as relevant and identifies key principles  In general, the proposed USMCA requires that parties not restrict cross-border data flows  Governments are allowed to do so to achieve a legitimate public policy objective (e g , privacy, national security), provided the measure is not arbitrary, discriminatory, a disguised trade barrier, or greater than necessary to achieve the particular objective  In this way, the parties seek to balance the free flow of data for commerce and communication with protecting privacy and security  The agreement specifically states that the parties may take different legal approaches to protect personal data and also recognizes APEC CBPR as a "valid mechanism to facilitate cross-border information transfer while protecting personal information " The agreement aims to increase cooperation between the United States, Mexico, and Canada on a number of digital trade issues, including exchanging information on personal information protection and enforcement experiences; strengthening collaboration on cybersecurity issues; and promoting the APEC CBPR and global interoperability of national privacy regimes  The governments also commit to encourage private-sector self-regulation models and promote cooperation to enforce privacy laws  While the agreement is only between three parties, the provisions are written broadly to encompass global efforts  Some stakeholders look at USMCA as the basis for potential future trade agreements (such as with the UK)  Cross-border data flows will likely be a key issue in future U S -EU trade negotiations  The United States has articulated a clear position on data privacy in trade agreements; however, there is no single U S  data privacy policy  Nevertheless, the Trump Administration is seeking to define an overarching U S  policy on data privacy  The Trump Administration's ongoing three-track process is being managed by the Department of Commerce (Commerce) in consultation with the White House  Different bureaus in Commerce are tasked with different aspects of the process, as follows  1  The National Institutes of Standards and Technology (NIST) is developing a privacy framework  Similar to its cybersecurity framework, NIST aims to create a voluntary framework as a tool for organizations to adopt to identify, assess, manage, and communicate about privacy risks  By classifying specific privacy outcomes and potential approaches, the framework is intended to enable organizations to create and adapt privacy strategies, innovate, and manage privacy risks within diverse environments  As part of its transparent approach, NIST is currently consulting with public- and private-sector stakeholders through various forms of outreach to collect feedback and aims to have a draft framework before the end of 2019  2  The National Telecommunications and Information Administration (NTIA) is developing a set of privacy principles to guide a domestic legal and policy approach  The NITA sought public comment on a proposed set of "user-centric privacy outcomes" and a set of high-level goals  3  The International Trade Administration (ITA) engages with foreign governments and international organizations such as APEC  ITA is focusing on the international interoperability aspects of potential U S  privacy policy  ITA's role is to ensure that the NIST and NTIA approaches are consistent with U S  international policy objectives, including TPA, and principles, such as the OECD framework and APEC CBPRs  Like the EU and China, Commerce is seeking input through a public- and private-sector consultation process  However, unlike the EU or China, Commerce is expecting to create a voluntary privacy framework  Some observers question whether the Commerce approach is sufficient to result in strong privacy protections if it is not backed up by congressional action and federal legislation  Some suggest that Congress could lead a whole-of-government approach through new federal legislation  In the 115 th Congress, then-House Committee on Energy and Commerce Ranking Member Frank Pallone, Jr  requested that the Government Accountability Office (GAO) examine issues related to federal oversight of internet privacy  The January 2019 GAO report concluded that now is "an appropriate time for Congress to consider comprehensive Internet privacy " GAO stated that "Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment  Issues that should be considered include what authorities agencies should have in order to oversee Internet privacy, including appropriate rulemaking authority " Recognizing the importance of protecting open data flows amid growing concerns about online privacy, some stakeholders seek to influence U S  policies on these issues  In addition to submitting comments in response to NTIA and NIST requests and participating in their forums, multiple organizations issued their own sets of principles or guidelines, some referencing the EU GDPR  The U S  Chamber of Commerce has also published model privacy legislation for Congress to consider  Though they vary in emphasis, these proposals share common themes: transparency on what data is being collected and how it is being used; user control, including the ability to opt out of sharing at least some information and to access and correct personal data collected; data security measures, like data breach notification requirements; and enforcement by the FTC; FTC commissioners also voiced support for the agency as the appropriate federal enforcer for consumer privacy  But these groups also differ in some areas, such as whether, or to what extent, to include certain aspects included in the GDPR, such as the right to deletion (so-called "right to be forgotten"), requirements for data minimization, or extraterritorial reach  There is not consensus on whether the FTC should be given rule-making authority or additional resources, the enforcement role of states, or if an independent data protection commission is needed similar to EU DPAs  Consistent with U S  trade policy, industry groups generally point out the need to be flexible, encourage private-sector innovation, establish sector- and technology-neutral rules, create international interoperability between privacy regimes, and facilitate cross-border data flows  Private-sector stakeholders generally want to avoid what they regard as overregulation or high compliance burdens  These groups emphasize risk management and a harm-based approach, which they state keeps an organization's costs proportional to the consumer harm prevented  On the other hand, some consumer advocates point to a need for baseline obligations to protect against discrimination, disinformation, or other harm  In general, consumer advocates believe that any comprehensive federal privacy policy should complement, and not supplant, sector-specific privacy legislation or state-level legislation  Finding a global consensus on how to balance open data flows and privacy protection may be key to maintaining trust in the digital environment and advancing international trade  One study found that over 120 countries have laws related to personal data protection  Divergent national privacy approaches raise the costs of doing business and make it harder for governments to collaborate and share data, whether for scientific research, defense, or law enforcement  A system for global interoperability in a least trade-restrictive and nondiscriminatory way between different national systems could help minimize costs and allow entities in different jurisdictions with varying online privacy regimes to share data via cross-border data flows  Such a system could help avoid fragmentation of the internet between European, Chinese, and American spheres, a danger that some analysts have warned against  For example, Figure 2 suggests the potential of an interoperability system that allows data to flow freely between GDPR- and CBPR-certified economies  The OECD guidelines, G-20 principles, APEC CBPR, CPTPP, and USMCA provisions demonstrate an evolving understanding on how to balance cross-border data flows, security, and privacy, to create interoperable policies that can be tailored by countries and avoid fragmentation or the potential exclusion of other countries or regulatory systems  The various trade agreements and initiatives with differing sets of parties may ultimately pave the way for a broader multilateral understanding and eventually lead to more enforceable binding commitments founded on the key WTO principles of nondiscrimination, least trade restrictiveness, and transparency  Congress may consider the trade-related aspects of data flows in trade agreements, including through close examination of these provisions during the congressional debate and consideration of legislation to implement the proposed USMCA  Issues include whether the agreements make progress in meeting TPA's related trade negotiating objectives and if the provisions strike the appropriate balance among public policy objectives  In addition, USTR's specific trade negotiating objectives for future agreements with the EU and Japan include establishing rules to protect cross-border data flows  These future trade negotiations present challenges and provide opportunities for Congress to further engage USTR on the issues and to conduct oversight  Congress may further consider how best to achieve broader consensus on data flows and privacy at the global level  Congress could, for example, conduct additional oversight of current best practice approaches (e g , OECD, APEC) or ongoing negotiations in the WTO on e-commerce to create rules through plurilateral or multilateral agreements  Congress may consider endorsing certain of these efforts to influence international discussions and the engagement of other countries  Congress may want to examine the potential challenges and implications of building a system of interoperability between APEC, CBPR, and the EU GDPR  Related issues are the extent to which the EU is establishing its system as a potential de facto global approach through its trade agreements and other mechanisms, and how U S  and other trade agreements may ultimately provide approaches that could be adopted more globally  Congress may seek to better understand the economic impact of data flows and privacy regimes in other countries related to U S  access to other markets and the extent to which barriers are being put in place that may discriminate against U S  exporters  Congress may examine the lack of reciprocal treatment and limits on U S  firms' access to some foreign markets  Congress may consider the implications of not having a comprehensive national data privacy policy  Will the EU GDPR and China cybersecurity policies become the global norms that other countries follow in the absence of a clear U S  alternative? Congress may enact comprehensive privacy legislation  In considering such action, Congress could investigate and conduct oversight of the Administration's ongoing privacy efforts, including requesting briefings and updates on the NTIA, NIST, and ITA initiatives to provide congressional feedback and direction and ensure they are aligned with U S  trade objectives  Congress may also seek input from other federal agencies  In deliberating a comprehensive U S  policy on personal data privacy, Congress may review the GAO report's findings and conclusions  Congress may also weigh several factors, including: How can U S  trade and domestic policy achieve the appropriate balance to encourage cross-border commerce, economic growth, and innovation, while safeguarding individual privacy and national security? How would a new privacy regime affect U S  consumers and businesses, including large multinationals who must comply with different national privacy regimes and small- and medium-sized enterprises with limited resources and technology expertise? Do U S  agencies have the needed tools to accurately assess the size and scope of cross-border data flows to help analyze the economic impact of different privacy policies, or measure the costs of trade barriers? How should an evolving U S  privacy regime align with U S  trade policy objectives and evolving international standards, such as the OECD Guidelines for privacy and cybersecurity, and should U S  policymakers prioritize interoperability with other international privacy frameworks to avoid further fragmentation of global markets and so-called balkanization of the internet? In addition, there are a host of other policy considerations not directly related to trade 

ground_truth: Under CAPTA, states perform a range of prevention activities, including addressing the needs of infants born with prenatal drug exposure. The number of children under the age of 1 entering foster care increased by about 15 percent from fiscal years 2012 through 2015. Child welfare professionals attribute the increase to the opioid epidemic. GAO was asked to examine the steps states are taking to implement CAPTA requirements on substance-affected infants and related amendments enacted in 2016. This report examines (1) the extent to which states have adopted policies and procedures to notify CPS of substance-affected infants; (2) state efforts to develop plans of safe care, and associated challenges; and (3) steps HHS has taken to help states implement the provisions. To obtain this information, GAO surveyed state CPS directors in all 50 states and the District of Columbia and reached a 100 percent response rate. GAO also visited 3 states (Kentucky, Massachusetts, and Pennsylvania); reviewed relevant documents such as federal laws and regulations, and HHS guidance; and interviewed HHS officials. GAO did not assess states' compliance with CAPTA requirements. All states reported adopting, to varying degrees, policies and procedures regarding health care providers notifying child protective services (CPS) about infants affected by opioids or other substances. Under the Child Abuse Prevention and Treatment Act (CAPTA), as amended, governors are required to provide assurances that the states have laws or programs that include policies and procedures to address the needs of infants affected by prenatal substance use. This is to include health care providers notifying CPS of substance-affected infants. In response to GAO's survey, 42 states reported having policies and procedures that require health care providers to notify CPS about substance-affected infants and 8 states reported having policies that encourage notification. The remaining 1 state has a policy requiring health care providers to assess the needs of mothers and infants and if they conclude that infants are at risk for abuse or neglect, CPS is notified. In response to GAO's survey, 49 states reported that their CPS agency has policies to develop a plan of safe care; 2 reported not having such a requirement. Under CAPTA, states are required to develop a plan of safe care for substance-affected infants. Although not defined in law, a plan of safe care generally entails an assessment of the family's situation and a plan for connecting families to appropriate services to stabilize the family and ensure the child's safety and well-being. States reported that plans typically address the infant's safety needs, immediate medical needs, and the caregiver's substance use treatment needs. However, officials in the 3 states GAO visited noted challenges, including uncertainty about what to include in plans and the level of intervention needed for infants at low risk of abuse or neglect. The Department of Health and Human Services (HHS) has provided technical assistance and guidance to states to implement these CAPTA requirements. Most states reported in GAO's survey that additional guidance and assistance would be very or extremely helpful for addressing their challenges. Nevertheless, HHS officials told GAO that the agency does not anticipate issuing additional written guidance, but that states can access technical assistance through their regional offices and the National Center on Substance Abuse and Child Welfare—a resource center funded by HHS. However, of the 37 states that reported on the helpfulness of the assistance they have received, 19 said it was only moderately helpful to not helpful. States offered suggestions for improving the assistance, such as developing substance abuse training materials for staff and holding video conferences with other states to share information. In October 2017, HHS officials explained that some states have submitted plans that include details on how they are addressing the CAPTA requirements. HHS officials reported that some of the plans submitted to date indicated that states are not meeting the requirements and those states have been asked to develop program improvement plans. Without more specific guidance and assistance to enhance states' understanding of CAPTA requirements and better address known challenges such as the ones described in this report, states may miss an opportunity to provide more effective protections and services for the children and families most in need. GAO recommends that HHS provide additional guidance and technical assistance to states to address known challenges and enhance their understanding of requirements. HHS did not concur with the recommendation. As discussed in the report, GAO continues to believe that added guidance would benefit states.