Background

The speed, functionality, and accessibility that create the enormous  benefits of the computer age can, if not properly controlled, allow  individuals and organizations to inexpensively eavesdrop on or interfere  with computer operations from remote locations for mischievous or  malicious purposes, including fraud or sabotage. As public and private  organizations use computer systems to transfer more and greater amounts  of money, sensitive economic and commercial information, and critical  defense and intelligence information, the likelihood increases that  malicious individuals will attempt to penetrate current security  technologies, disrupt or disable our nation’s critical infrastructures, and  use sensitive and critical information for malicious purposes.
In a May 2004 report, we discussed how cyber security technologies can  provide a near-term solution for improving critical infrastructure security  vulnerabilities. However, these technologies offer only single-point  solutions by addressing individual vulnerabilities; they do not provide a  complete solution. For example, firewalls can control the flow of traffic  between networks but cannot protect against threats from within the  network; antivirus software can provide some protection against viruses  and worms but cannot protect the confidentiality of the data residing on  the system. As a result, many researchers have described the use of these  types of near-term solutions as being short-sighted. They argue that it is  necessary to design systems with built-in security because it is difficult to  deploy secure systems based on insecure components. In addition,  researchers have indicated that long-term efforts are needed, such as  researching cyber security vulnerabilities, developing technological  solutions, and transitioning research results into commercially available  products. Research in cyber security technology can help create a broader  range of choices and more robust tools for building secure, networked  computer systems.
Recent cyber attacks and threats have underscored the need to strengthen  and coordinate the federal government’s cyber security R&D efforts.  Examples of recent attacks include the following:  In November 2005, the U.S. government issued a warning about a virus  disguised in an e-mail purportedly sent from the Federal Bureau of  Investigation. The e-mail tells users that they have been visiting illegal Web  sites and directs them to open an attachment with a questionnaire that  contains a variant of the w32/sober virus. If the attachment is opened, the  virus is executed.
In October 2005, information security specialists reported that the Zotob  worm, which had adversely affected computer networks in mid-August,  had cost infected organizations an average of $97,000. Variants of the  worm were capable of attacks that included logging keystrokes, stealing  authentication credentials, and performing mass mailings. It was estimated  that it took 61 percent of the impacted organizations more than 80 hours  of work to clean up the infected systems.
In March 2005, security consultants within the electric industry reported  that hackers were targeting the U.S. electric power grid and had gained  access to electronic control systems. Computer security specialists  reported that, in a few cases, these intrusions had “caused an impact.”  While officials stated that hackers had not caused serious damage to the  systems that feed the nation’s power grid, the constant threat of intrusion  has heightened concerns that electric companies may not have adequately  fortified defenses against a potential catastrophic strike.
In January 2005, a major university reported that a hacker had broken into  a database containing 32,000 student and employee social security  numbers, potentially compromising the identities and finances of the  individuals. In similar incidents during 2003 and 2004, it was reported that  hackers had attacked the systems of other universities, exposing the  personal information of more than 1.8 million people.
The number of malicious attacks has increased with the growing number  of vulnerabilities. In 2000, the Software Engineering Institute’s CERT®  Coordination Center (CERT/CC) received 1,090 reports of security  vulnerabilities. By 2005, this number had more than quadrupled to 5,990.  Figure 1 illustrates the number of security vulnerabilities reported from  1995 through 2005.
Over the years, the federal government has taken these and other actions  to improve cyber security efforts:    publishing best practices and guidelines that assist in the planning,  selection, and implementation of cyber security technologies;    partnering with private sector counterparts to assess vulnerabilities and  develop plans to eliminate those vulnerabilities; and   awarding grants to support cyber security R&D.

		Federal Cyber Security Research and Development Policies

Research associated with enhancing the cyber security of critical  infrastructures has been reinforced through federal requirements aimed at  improving the nation’s cyber security posture. Additional requirements for  research can be found in legislation that establishes agency  responsibilities. For example, the act that establishes the Office of Science  and Technology Policy gives the office the responsibility of assisting the  President in providing general leadership and coordination of the research  programs of the federal government. To provide a historical perspective,  table 1 summarizes the key federal cyber security R&D actions that have  shaped the development of the federal government’s cyber security R&D  policies.

	Numerous Federal Entities Involved in Cyber Security Research and Development

Numerous federal agencies and organizations are involved in federally  funded cyber security R&D. Several entities oversee and coordinate  federal cyber security research; other groups support coordination on an  informal basis; and multiple federal agencies fund or conduct this  research.

		Federal Structure for Oversight and Coordination of Cyber Security Research and Development

The Office of Science and Technology Policy and OMB, both in the  Executive Office of the President, provide high-level oversight of federal  R&D, including cyber security. The Office of Science and Technology  Policy oversees the National Science and Technology Council, which  prepares R&D strategies that are coordinated across federal agencies. The  council operates through its committees, subcommittees, and interagency  working groups, which coordinate activities related to specific science and  technology disciplines. The Subcommittee on NITRD and the Interagency  Working Group on Cyber Security and Information Assurance are the key  entities responsible for coordinating cyber security R&D activities among  federal agencies. The organization chart in figure 2 depicts the federal  organizations involved.
While this chart illustrates that several organizations are involved, much of  the coordination for cyber security research is actually accomplished at  lower level working groups and subcommittees by content matter experts  from different agencies. Table 2 contains a brief description of the roles  and responsibilities of the federal organizations and groups involved in the  oversight and coordination of cyber security research.

		Other Groups Support Coordination on Informal Basis

Participation by federal entities in other interagency groups provides  opportunities for enhanced coordination of cyber security R&D efforts on  an informal basis.

			InfoSec Research Council

The InfoSec Research Council (the Council) is a voluntary organization  that is to facilitate coordination and communication of federal information  security research among its members. The Council meets regularly to  discuss current research projects, proposed future research initiatives, and  critical information security issues. It is also responsible for producing a  “hard problems list” that describes what it considers to be the most critical  information security problems that, from a government perspective,  should be addressed within the next 5 to 10 years. The latest version of the  hard problems list was released in November 2005 and includes problems  such as addressing insider threats, building secure systems, and improving  information security without sacrificing privacy. The development of the  list was intended to create consensus on particularly challenging  information security issues that can be addressed through federal  government coordination, but the Council recognizes that its members  also have their own research priorities.

			Technical Support Working Group

The Technical Support Working Group also provides a means for  coordination of cyber security R&D. Under the supervision of the  Departments of Defense and State, the group operates with the  collaboration and voluntary participation of more than 80 federal  organizations in its 10 subgroups. In fulfilling its mission to conduct the  national interagency R&D program for combating terrorism, the group  facilitates interagency communication by serving as a forum for  developing user-based counterterrorism technology requirements across  the federal government. Its Infrastructure Protection subgroup meets  once a year and is responsible for identifying, prioritizing, and executing  R&D projects that satisfy interagency infrastructure protection  requirements, including cyber security.

			Ad Hoc Cooperation

Research and development officials at several agencies noted that, through  other informal activities, they maintained additional contact with  personnel at other agencies conducting cyber security R&D. Many  mentioned that they participated in other agencies’ project selection and  technical review panels. For example, experts from the Department of  Homeland Security served on the review panel for the National Science  Foundation’s 2005 Cyber Trust program. In addition, officials noted the  relatively small size of the federal cyber security research community— many of the same officials attend the coordination meetings and a few  officials within the community have worked at other agencies. This  familiarity among cyber security experts has allowed for informal  knowledge sharing and communication among agencies.

		Key Agencies Fund and Conduct Cyber Security Research

While there are multiple agencies involved, three agencies fund and  conduct much of cyber security R&D: the National Science Foundation  and the Departments of Homeland Security and Defense.
In 2004, the National Science Foundation established the Cyber Trust  program to complement ongoing cyber security investments in each of its  core research areas: computer and networked systems, computing and  communication foundations, information and intelligence systems, shared  cyber infrastructure, and information technology research. In accordance  with the Cyber Security Research and Development Act, the National  Science Foundation awards Cyber Trust grants for projects that (1)  advance the relevant knowledge base; (2) creatively integrate research and  education for the benefit of technical specialists and the general populace;  and (3) effectively integrate the study of technology with the policy,  economic, institutional, and usability factors that often determine its  deployment and use. Recent Cyber Trust grants include research in areas  such as approaches to Internet security, system behavior monitoring, and  information security risk management architecture. The President’s  budget for fiscal year 2006 provides about $94 million to the National  Science Foundation for cyber security research, education, and training.
The Department of Homeland Security’s R&D efforts are aimed at  countering threats to the homeland by making evolutionary improvements  to current capabilities and by developing revolutionary new capabilities.  The Department of Homeland Security’s cyber security R&D program  resides in the agency’s Science and Technology Directorate. According to  Department of Homeland Security officials, the cyber security R&D  program was funded—out of the department’s $1 billion science and  technology budget—with approximately $10 million in fiscal year 2004,  $18 million in fiscal year 2005, and $17 million in fiscal year 2006. The  Department of Homeland Security’s cyber security R&D activities are  largely unclassified and near-term. In addition, some work is funded in  partnership with the National Science Foundation.
Several agencies within the Department of Defense have cyber security  R&D programs. The Department of Defense’s Office of the Director,  Defense Research and Engineering, provides coordination and oversight in  addition to supporting some cyber security research activities directly. The  office is responsible for the Department of Defense’s science and  technology as well as for oversight of research and engineering. According  to Department of Defense officials, its cyber security research programs  totaled about $150 million in fiscal year 2005. Although the Department of  Defense’s research organizations (the Office of Naval Research, Army  Research Laboratory, and Air Force Research Laboratory) have cyber  security programs, the largest investments within its cyber security  program are with the Defense Advanced Research Projects Agency and the  National Security Agency.
The Defense Advanced Research Projects Agency is the central R&D  organization of the Department of Defense. Its mission is to identify  revolutionary, high-risk, high-payoff technologies of interest to the  military—and then to support their development through transition. Its  portfolio has shifted toward classified and short-term R&D, and it has the  authority to award cash prizes to encourage and accelerate technical  accomplishments. There are two types of offices at the agency: technology  offices and systems offices. The technology offices focus on new  knowledge and component technologies that might have significant  national security applications. Systems offices focus on technology  development programs leading to products that more closely resemble a  specific military end-product; that is, an item that might be in the military’s  inventory. One of the technology offices (the Information Processing  Technology Office) and one of the systems offices (the Advanced  Technology Office) focus on cyber security research and development.
The National Security Agency also performs extensive cyber security  research. The research is conducted and supported by its National  Information Assurance Research Group. Two of the agency’s programs— the Information Systems Security Program and Consolidated Cryptologic  Program—fund the majority of its cyber security research. The research  focuses on high-speed encryption and certain defense capabilities, among  other things.

			Other Agencies Fund or Conduct Cyber Security Research and Development

In addition to the three primary agencies that fund or conduct cyber  security R&D, other agencies, including the Department of Energy, the  National Institute of Standards and Technology, and the Disruptive  Technology Office, also fund or conduct this research.
The Department of Energy also conducts and funds cyber security R&D.  Nearly all of the Department of Energy’s cyber security R&D investments  are directed toward short-term or military and intelligence applications.  This work is conducted principally at the national laboratories.
The National Institute of Standards and Technology’s cyber security  research program is multi-disciplinary and focuses on a range of long-term  to applied R&D in the creation of security standards, guidelines, and new  technologies. The National Institute of Standards and Technology’s fiscal  year 2006 budget estimate for cyber security was $9.1 million. The  National Institute of Standards and Technology also receives funding from  other agencies such as the Departments of Homeland Security and  Transportation and the General Services Administration, to work on  projects that are consistent with its cyber security mission. For example, it  is producing, for the Department of Homeland Security, the National  Vulnerability Database. According to the National Institute of Standards  and Technology, it is mandated under the Federal Information Security  Management Act, the Cyber Security Research and Development Act, the  Uniting and Strengthening America by Providing Appropriate Tools  Required to Intercept and Obstruct Terrorism (USA PATRIOT ACT) Act  (for biometrics), and OMB’s Circular A-130, to develop standards,  guidelines, and tests for use by federal agencies. Under the Federal  Information Security Management Act, the National Institute of Standards  and Technology also conducts security research in support of future  standards and guidelines.
The Disruptive Technology Office supports the development of  technologies to improve the information systems and networks that are  used primarily by the intelligence community. Its budget for cyber security  research amounts to about $17 million; one third of this amount supports  mostly unclassified academic research. However, the office typically  classifies the results of this research once it is mature enough to be  incorporated into tools for the intelligence community.

	Federal Entities Have Improved Oversight and Coordination, but Limitations Remain

Federal entities have taken several important steps to improve the  oversight and coordination of federal cyber security R&D. These include  (1) chartering an interagency working group to focus on this type of  research, (2) publishing a federal plan for cyber security and information  assurance research that is to provide baseline information and a  framework for planning and conducting this research, (3) separating the  reporting of budget information for cyber security research from other  types of research, and (4) maintaining governmentwide repositories of  information on R&D projects. However, limitations exist with the  development of a federal cyber security research agenda, the federal plan,  and populating the governmentwide repositories that, if not remedied,  could diminish the effectiveness of oversight and coordination of cyber  security R&D.

		Interagency Working Group on Cyber Security Research Provides Coordination Opportunities

In August 2005, the National Science and Technology Council chartered  the Interagency Working Group for Cyber Security and Information  Assurance. This working group succeeds the Interagency Working Group  on Critical Information Infrastructure Protection, which reported to the  Subcommittee on Infrastructure. The working group reports jointly to the  Subcommittee on NITRD and the Subcommittee on Infrastructure. This  change is to facilitate better integration of cyber security R&D with the  NITRD program and reflect the broader impact of cyber security and  information assurance beyond critical information infrastructure  protection. According to a NITRD official, the charter of the Interagency  Working Group for Cyber Security and Information Assurance was made  in response to the February 2005 recommendation of the President’s  Information Technology Advisory Committee to strengthen and integrate  the working group under the NITRD program.

		Federal Plan for Cyber Security Research and Development Has Been Developed but Cyber Security Agenda Still Needed

In February 2003, the National Strategy to Secure Cyberspace was issued  to provide a framework for organizing and prioritizing efforts to protect  our nation’s cyberspace. The strategy recommended that the Director of  the Office of Science and Technology Policy coordinate the development  of an annual federal government cyber security research agenda that  includes near-term (1–3 years), mid-term (3–5 years), and long-term (5  years and longer) research for fiscal years 2004 and beyond.
In April 2006, the Cyber Security and Information Assurance Interagency  Working Group released an interagency plan for cyber security research  and development. The plan provides baseline information and a technical  framework for coordinated multi-agency research in cyber security and  information assurance. The Federal Plan for Cyber Security and  Information Assurance Research and Development addresses:  types of vulnerabilities, threats, and risks;   analysis of recent calls for federal research and development;  technical topics in cyber security and information assurance research;   current technical and investment priorities of federal agencies in cyber  security and information assurance research;  results of technical and funding gaps analysis; research of technical topic perspectives, including assessments of the  state of the art and key technical challenges; and   a summary of roles and responsibilities, by agency.
According to the Interagency Working Group for Cyber Security and  Information Assurance, which operates under the auspices of the Office of  Science of Technology Policy and the National Science and Technology  Council, the Federal Plan for Cyber Security and Information Assurance  Research and Development is the first step towards developing a federal  agenda for cyber security research. The plan specifies the need to develop  a road map for addressing identified gaps in cyber security research, but  has not committed to a date when the road map would be developed or  completed.
Key activities for the development of an agenda have not been completed.  For instance, mid-term and long-term cyber security research goals have  not been defined. Further, the following activities necessary for the  agenda have also not been completed: (1) specifying timelines and  milestones for conducting research and development activities; (2)  specifying goals and measures for evaluating research and development  activities; (3) assigning responsibility for implementation, including the  accomplishment of the focus areas and suggested research priorities; and  (4) aligning the funding priorities with technical priorities.
Until a federal agenda as called for in the National Strategy to Secure  Cyberspace is developed, increased risk exists that agencies will focus on  their individual priorities for cyber security research and development,  which may not be the most important national research priorities. Better  coordination of research and development efforts will enable the most  important topics to receive priority funding and resources and avoid  duplication of effort.

		Reporting of Budget Information Increases Visibility of Cyber Security Research

For the first time, the NITRD program, in response to the President’s  Information Technology Advisory Committee recommendation to  strengthen coordination, reported budget information for cyber security  research separately from other types of research in its supplement to the  President’s fiscal year 2007 budget. This important change was made  possible with the addition of a new NITRD program component area for  cyber security and information assurance. Before this addition, budget  amounts for cyber security research projects were difficult to identify  because they were often grouped with the non-cyber security research  projects in other program component areas. Now, program member  agencies are to report budget amounts for cyber security research  separately. For example, the National Science Foundation, Department of  Defense agencies, and National Institute of Standards and Technology,  among others, reported budget amounts for cyber security and  information assurance research in the NITRD Supplement to the  President’s Fiscal Year 2007 Budget.
Although the NITRD supplement included budget amounts for cyber  security research, this information was limited. Budget amounts for  certain cyber security research activities were reported in another NITRD  program component area, and budget information on cyber security  research for non-NITRD members—such as the Department of Homeland  Security and elements within the Department of Energy—was not  included in the supplement. However, in his February 2006 testimony  before the House Committee on Science, the former Department of  Homeland Security Under Secretary for Science and Technology testified  that the science and technology division of the Department of Homeland  Security is now participating in NITRD. Further, in June 2006, the OMB  issued its annual Circular A-11 budget submission guidance, which  requires that agencies submit separate budget amounts for cyber security  R&D as part of their 2008 budget submissions. These new requirements  should increase the visibility of federal cyber security research and could  provide a mechanism for determining the total federal budget in cyber  security research and development.

		Federal Agencies and Public Could Benefit from Fully Populated Governmentwide Repository

In order to improve the methods by which government information is  organized, preserved, and made accessible to the public, the E- Government Act of 2002 mandated that the Director of OMB (or the  Director’s delegate) ensure the development and maintenance of a  governmentwide repository and Web site that integrates information about  federally funded R&D. The Director delegated this responsibility to the  National Science Foundation. According to the E-Government Act, the  repository is to integrate information about each separate R&D task or  award, including: the dates on which the task or award is expected to start  and end, a brief summary describing the objective and the scientific and  technical focus of the task or award, the entity performing the task or  award, the amount of federal funds to be provided, and any restrictions  that would prevent the sharing of information related to the task with the  public. In addition, the Web site on which all or part of the repository  resides is to be made available to, and be searchable by, federal agencies  and non-federal entities, including the general public, and is to facilitate:  the coordination of federal R&D activities;   collaboration among those entities conducting federal R&D;  the transfer of technology among federal agencies, and between federal  agencies and non-federal entities; and    access by policy makers and the public to information concerning federal  R&D activities.
The E-Government Act also requires agencies that fund federal R&D to  provide the information needed to populate the repository in the manner  prescribed by the Director of OMB.
The federal government has established, and currently funds, two  governmentwide repositories and Web sites for R&D information that are  available to, and searchable by, federal agencies and the public: Research  and Development in the United States (RaDiUS) and Science.gov.  RaDiUS is a database that contains information on federally funded R&D  projects. Science.gov provides information on federal research through  links to science Web sites and scientific databases. The repositories  generally contain the type of information about R&D tasks or awards  required by the E-Government Act. Both are intended to provide the public  and agencies with information about federally funded R&D activities and  results.
However, the RaDiUS and Science.gov repositories were incomplete and  not fully populated with information about all federally funded tasks and  awards. Query searches for cyber security research projects on the  RaDiUS repository produced limited results. For example, we found that  (1) as of March 2006, all searches on RaDiUS were limited to awards that  were made during or prior to fiscal year 2004, (2) searches on RaDiUS for  the Department of Homeland Security did not return any cyber-related  results and returned only one project when searching for all projects, (3)  searches on RaDiUS for the National Science Foundation’s Cyber Trust  program produced only 8 of the 35 Cyber Trust awards listed for 2004.  In  addition, the Federal R&D Project Summaries database at Science.gov  does not include R&D project summaries for the Departments of  Homeland Security and Defense and the National Institute for Standards  and Technology. As a result, the usefulness of the repositories and Web  sites to facilitate the coordination of cyber security R&D activities,  collaboration among researchers, and access to research information in a  timely and efficient manner was limited.
The governmentwide repositories were incomplete and not fully  populated, in part, because OMB had not issued guidance to ensure that  agencies had provided all information required for the repositories.  Although OMB has issued guidance related to improving the public’s  access to, and dissemination of, government information and policies for  federal agency public Web sites, this guidance does not specifically  address reporting information on all federally funded research and  development projects to the governmentwide repositories. The E- Government Act specifies that OMB shall issue any guidance determined  necessary to ensure that agencies provide all the information required by  the act. Our search query results (previously described), and the fact that  research and development officials at several federal agencies were not  aware of the RaDiUS repository or Web site when asked about the  existence of a governmentwide repository for research and development  projects indicates that such guidance is necessary.

	Federal Agencies Use Various Methods for Technology Transfer

Each of the three primary agencies that fund or conduct cyber security  R&D has established technology transfer methods for sharing the results  of the research. The following are examples of how each agency conducts  technology transfer.
The National Science Foundation essentially relies on the researcher or  grantee to disseminate information about National Science Foundation- funded research. In accordance with the Bayh-Dole Act, the National  Science Foundation allows grantees to retain principal legal rights to  intellectual property developed under its grants. According to an agency  official, the Grant Policy Manual provides the incentive to develop and  disseminate inventions, software, and publications that can enhance their  usefulness, accessibility, and upkeep. The official stated that the National  Science Foundation’s policy does not, however, reduce the responsibilities  of researchers and organizations to make results, data, and collections  available to the research community. It was the National Science  Foundation’s expectation that grantees would share data, collections,  software, and inventions, making their products widely available and  useful. The National Science Foundation grantees are required to submit  annual and final project reports to the agency; these reports include  information on dissemination activities such as publications and  conferences.
The Department of Homeland Security has several methods for technology  transfer, such as attending conferences and workshops and working with  industry in several areas to share information about emerging threats and  R&D needs. In addition, agency officials stated that their Web site is  another way that they share information about R&D activities.
The Department of Defense has several programs to encourage the  transfer of technology information. For example, within the academic  world, the Department of Defense uses published peer review journals to  help facilitate information sharing. Within the classified community,  research is shared among the Departments of Defense and Homeland  Security and the intelligence community. The Department of Defense’s  small business innovation research and small business technology transfer  programs are used to encourage the transfer of information to the private  sector. In addition, every Armed Service research laboratory has a  technology transfer office. While technology transfer exists within the  Department of Defense, there are instances in which the Department of  Defense does not want research information to be available to the public  because the information could expose organizational and technological  vulnerabilities.

	Conclusions

Several federal entities led by the Office of Science and Technology Policy  and OMB are involved in overseeing, coordinating, funding, or conducting  cyber security R&D. These entities have acted to enhance the oversight  and coordination of federal cyber security R&D, including the formation of  an interagency working group that developed a federal plan to provide a  baseline of information and a technical framework for coordinated multi- agency R&D in cyber security and information assurance. However, key  elements of the federal research agenda called for in the National Strategy  to Secure Cyberspace have not been developed, thereby increasing the  risk that mid- and longer-term research priorities may not be achieved.  Without sufficient guidance on reporting R&D information for  governmentwide repositories, the repositories cannot be fully populated  with data on all cyber security research projects, diminishing their  usefulness for coordinating research activities and facilitating technology  transfer of research results. Until these issues are addressed, federal  research for cyber security and information assurance may not keep pace  with the increasing number of threats and vulnerabilities.

	Recommendations for Executive Action

To strengthen cyber security research and development programs, we  recommend that the Director of the Office of Science and Technology  Policy take the following action:    Establish firm timelines for the completion of the federal cyber security  R&D agenda that includes near-term, mid-term, and long-term research.  Such an agenda should include the following elements: timelines and milestones for conducting research and development  activities;    goals and measures for evaluating research and development activities;    assignment of responsibility for implementation, including the  accomplishment of the focus areas and suggested research priorities; and  the alignment of funding priorities with technical priorities.
We also recommend that the Director of the Office of Management and  Budget implement the following action:  Issue guidance to agencies on reporting information about federally  funded cyber security R&D projects to the governmentwide repositories.

	Agency Comments and Our Evaluation

A Senior Policy Analyst in the Office of Science and Technology Policy  provided technical comments on a draft of this report, but did not  comment on our recommendation that the office establish timelines for  the completion of the federal cyber security R&D agenda. We have  considered and incorporated the technical comments into the report as  appropriate.
In providing oral comments on a draft of this report, OMB officials stated  that OMB’s August 2006 Fiscal Year 2006 E-Government Act Reporting  Instructions require agencies that fund federal R&D activities to describe  how they fulfill their responsibilities under section 207(g) of the E- Government Act, including how their R&D information is available  through RaDiUS, science.gov, or other means. The officials stated that  after reviewing the agencies’ reports and other information, they will  consider whether specific guidance is necessary to further ensure agencies  provide all R&D information as required under section 207(g) of the E- Government Act.
In addition, they were concerned with the report’s limited scope—cyber  security R&D—and stated that the requirement to specify and report cyber  security as a separate category of R&D is a recent change and therefore  might bias the report’s findings. We acknowledge that the scope of our  review was limited to cyber security R&D which is why we limited the  scope of our findings and recommendations to cyber security R&D. The  recent change in reporting requirements relates to the reporting of  budgetary information and does not affect our finding on reporting project  information to the central repositories.
The National Science Foundation and the National Institute of Standards  and Technology provided technical comments, which we have  incorporated into the report as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  date of this letter. At that time, we will then send copies of this report to  the Directors of the Office of Science and Technology Policy, OMB, and  National Science Foundation; to the Secretaries of the Departments of  Homeland Security and Defense; and to other interested parties. In  addition, the report will be available at no charge on the GAO Web site at  http://www.gao.gov.
If you or members of your staff have questions about this report, please  contact Gregory C. Wilshusen at (202) 512-6244 or Keith A. Rhodes at (202)  512-6412. We can also be reached by e-mail at wilshuseng@gao.gov and  rhodesk@gao.gov, respectively. Contact points for our Offices of   Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix II.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to identify the (1) federal agencies that are involved  with cyber security research and development (R&D); (2) actions taken to  improve oversight and coordination of cyber security research and  development, including the development of a federal research agenda; and  (3) methods used for technology transfer at the agencies with significant  activities in cyber security research and development.
To identify which agencies are involved in federal cyber security R&D, we  researched a key report on cyber security R&D from the President’s  Information Technology Advisory Committee. We also analyzed relevant  federal law and policy, including the Cyber Security Research and  Development Act, the National Strategy to Secure Cyberspace, and  Homeland Security Presidential Directive 7; we also reviewed our prior  reports. We then reviewed budget documents from the Subcommittee on  Networking and Information Technology Research and Development  (NITRD) to determine the key agencies that fund and conduct cyber  security R&D.
To identify actions taken to improve oversight and coordination of federal  cyber security R&D, including the development of a governmentwide  research agenda, we interviewed officials at the National Science  Foundation, the National Institute of Standards and Technology, the  National Security Agency, the Departments of Defense and Homeland  Security, the Subcommittee on NITRD, the Technical Support Working  Group, the Office of Science and Technology Policy, and the Infosec  Research Council. We also reviewed NITRD budgetary documents,  examined federal policy, reviewed the Office of Management and Budget  reports and guidance, observed meetings and reviewed meeting agendas  and minutes to determine the extent of coordination for federal cyber  security R&D. To evaluate the development of a governmentwide research  agenda, we reviewed the National Strategy to Secure Cyberspace to  determine the requirements for the annual federal cyber security R&D  agenda and compared them to the Federal Plan for Cyber Security and  Information Assurance Research and Development issued by the  Interagency Working Group on Cyber Security and Information Assurance.  To evaluate the completeness of the RaDiUS repository, in March 2006, we  executed search queries on “cybersecurity”, “cyber security”, “cyber”,  “cyber trust” and “information assurance” to determine whether the  database contained cyber-related program data for the federal agencies.  To evaluate the completeness of the Science.gov repositories, in August  and September 2006, we executed search queries on “cybersecurity”,  “cyber security”, and “information assurance” to determine whether the  database contained cyber-related program data for the federal agencies.
We compared the results to the list of cyber projects provided by the  individual agencies. We did not validate the data returned with the  agencies conducting cyber security research. In addition, we analyzed  relevant laws, including the E-Government Act of 2002 and interviewed  officials at the National Science Foundation, the National Institute of  Standards and Technology, the National Security Agency, and the  Departments of Defense and Homeland Security to evaluate the  completeness of the two mandated governmentwide repositories.
To identify methods used for technology transfer at the agencies with  significant cyber security research activities, we identified the agencies  and other groups that have responsibility for management and oversight of  federal cyber security R&D, interviewed officials at these agencies to  determine their methods for technology transfer, and reviewed agency  policies on technology transfer. We also analyzed relevant laws, including  the Bayh-Dole Act.
We conducted our work from August 2005 through August 2006 in  accordance with generally accepted government auditing standards.

Appendix II: GAO Contacts and Staff Acknowledgments

	Staff Acknowledgments

In addition to the individuals named above, Kristi Dorsey, Nalani Fraser,  Nancy Glover, Richard Hung, Anjalique Lawrence, and Suzanne Lightman  were key contributors to this report.

Summary:
Why GAO Did This Study

Research and development (R&D) of cyber security technology is essential to creating a broader range of choices and more robust tools for building secure, networked computer systems in the federal government and in the private sector. The National Strategy to Secure Cyberspace identifies national priorities to secure cyberspace, including a federal R&D agenda. GAO was asked to identify the (1) federal entities involved in cyber security R&D; (2) actions taken to improve oversight and coordination of federal cyber security R&D, including developing a federal research agenda; and (3) methods used for technology transfer at agencies with significant activities in this area. To do this, GAO examined relevant laws, policies, budget documents, plans, and reports.

What GAO Found

Several federal entities are involved in federal cyber security research and development. The Office of Science and Technology Policy and OMB establish high-level research priorities. The Office of Science and Technology Policy is to coordinate the development of a federal research agenda for cyber security and oversee the National Science and Technology Council, which prepares R&D strategies that are to be coordinated across federal agencies. The Council operates through its committees, subcommittees, and interagency working groups, which oversee and coordinate activities related to specific science and technology disciplines. The Subcommittee on Networking and Information Technology Research and Development and the Cyber Security and Information Assurance Interagency Working Group are prominently involved in the coordination of cyber security research. In addition, other groups provide mechanisms for coordination of R&D efforts on an informal basis. The National Science Foundation and the Departments of Defense and Homeland Security fund much of this research. Federal entities have taken several important steps to improve the oversight and coordination of federal cyber security R&D, although limitations remain. Actions taken include chartering an interagency working group to focus on cyber security research, publishing a federal plan for guiding this research, reporting budget information for this research separately, and maintaining repositories of information on R&D projects. However, a federal cyber security research agenda has not been developed as recommended in the National Strategy to Secure Cyberspace and the federal plan did not fully address certain key elements. Further, the repositories do not contain information about all of the federally funded cyber security research projects in part because OMB had not issued guidance to ensure that agencies provided all information required for the repositories. As a result, information needed for oversight and coordination of cyber security research activities was not readily available. Federal agencies use a variety of methods for sharing the results of cyber security research with federal and private organizations (technology transfer), including sharing information through agency Web sites. Other methods include relying on the researcher to disseminate information about his or her research, attending conferences and workshops, working with industry to share information about emerging threats and research, and publishing journals to help facilitate information sharing.