United States Government Accountability Office

GAO Testimony before the Subcommittee on 

Federal Financial Management, Government 

Information, and International Security, Senate 

Committee on Homeland Security and 

Governmental Affairs 

INTERNET 

INFRASTRUCTURE 

Challenges in Developing a 

Public/Private Recovery 

Plan 

Statement of David A. Powner 

Director, Information Technology Management Issues 

Keith A. Rhodes, Chief Technologist 

Director, Center for Technology and Engineering 

For Release on Delivery

Expected at 9:30 a.m. EDT

Friday, July 28, 2006

 

GAO-06-863T 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

July 2006

INTERNET INFRASTRUCTURE 

Challenges in Developing a Public/Private 

Highlights of GAO-06-863T, a testimony Recovery Plan 

before the Subcommittee on Federal 

Financial Management, Government 

Information, and International Security, 

Committee on Homeland Security and 

Governmental Affairs, U.S. Senate 

Since the early 1990s, growth in the 

use of the Internet has 

revolutionized the way that our 

nation communicates and conducts

business. While the Internet

originated as a U.S. governmentsponsored research project, the 

vast majority of its infrastructure is 

currently owned and operated by 

the private sector. Federal policy 

recognizes the need to prepare for

debilitating Internet disruptions 

and tasks the Department of

Homeland Security (DHS) with 

developing an integrated 

public/private plan for Internet 

recovery. 

GAO was asked to summarize its 

report being released today—

Internet Infrastructure: DHS 

Faces Challenges in Developing a 

Joint Public/Private Recovery 

Plan, GAO-06-672 (Washington,

D.C.: June 16, 2006). This report (1) 

identifies examples of major 

disruptions to the Internet, (2) 

identifies the primary laws and

regulations governing recovery of

the Internet in the event of a major 

disruption, (3) evaluates DHS plans

for facilitating recovery from 

Internet disruptions, and (4) 

assesses challenges to such efforts. 

 What GAO Recommends

In its report, GAO suggests that

Congress consider clarifying the 

legal framework guiding Internet 

recovery and makes 

recommendations to DHS to 

strengthen its ability to help

recover from Internet disruptions. 

In written comments, DHS agreed 

with GAO’s recommendations. 

A major disruption to the Internet could be caused by a physical incident 

(such as a natural disaster or an attack that affects key facilities), a cyber 

incident (such as a software malfunction or a malicious virus), or a 

combination of both physical and cyber incidents. Recent physical and cyber 

incidents, such as Hurricane Katrina, have caused localized or regional 

disruptions but have not caused a catastrophic Internet failure. 

Federal laws and regulations that address critical infrastructure protection, 

disaster recovery, and the telecommunications infrastructure provide broad 

guidance that applies to the Internet, but it is not clear how useful these 

authorities would be in helping to recover from a major Internet disruption. 

Specifically, key legislation on critical infrastructure protection does not 

address roles and responsibilities in the event of an Internet disruption. 

Other laws and regulations governing disaster response and emergency 

communications have never been used for Internet recovery. 

DHS has begun a variety of initiatives to fulfill its responsibility for 

developing an integrated public/private plan for Internet recovery, but these 

efforts are not complete or comprehensive. Specifically, DHS has developed 

high-level plans for infrastructure protection and incident response, but the 

components of these plans that address the Internet infrastructure are not 

complete. In addition, the department has started a variety of initiatives to 

improve the nation’s ability to recover from Internet disruptions, including 

working groups to facilitate coordination and exercises in which government 

and private industry practice responding to cyber events. However, progress 

to date on these initiatives has been limited, and other initiatives lack time

frames for completion. Also, the relationships among these initiatives are not 

evident. As a result, the government is not yet adequately prepared to 

effectively coordinate public/private plans for recovering from a major 

Internet disruption. 

Key challenges to establishing a plan for recovering from Internet 

disruptions include (1) innate characteristics of the Internet that make 

planning for and responding to disruptions difficult, (2) lack of consensus on 

DHS’s role and when the department should get involved in responding to a 

disruption, (3) legal issues affecting DHS’s ability to provide assistance to 

restore Internet service, (4) reluctance of many in the private sector to share 

information on Internet disruptions with DHS, and (5) leadership and 

organizational uncertainties within DHS. Until these challenges are 

addressed, DHS will have difficulty achieving results in its role as a focal 

point for helping the Internet to recover from a major disruption. 

www.gao.gov/cgi-bin/getrpt?GAO-06-863T.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact David Powner 

at (202) 512-9286 or pownerd@gao.gov. 
Mr. Chairman and Members of the Subcommittee: 

Thank you for the opportunity to join today’s hearing on reconstitution of 

critical networks such as the Internet. Since the early 1990s, increasing 

computer interconnectivity—most notably growth in the use of the 

Internet—has revolutionized the way that our government, our nation, and

much of the world communicate and conduct business. Our country has 

come to rely on the Internet as a critical infrastructure supporting 

commerce, education, and communication. While the benefits of this 

technology have been enormous, this widespread interconnectivity poses

significant risks to the government’s and our nation’s computer systems 

and, more importantly, to the critical operations and infrastructures they 

support. 

Federal regulation establishes the Department of Homeland Security 

(DHS) as the focal point for the security of cyberspace—including 

recovery efforts for public and private critical infrastructure systems.1

Additionally, federal policy recognizes the need to be prepared for the 

possibility of debilitating Internet disruptions and tasks DHS with 

developing an integrated public/private plan for Internet recovery.2

 Last 

July, we testified before you on DHS’s responsibilities for cybersecurityrelated critical infrastructure protection.3

 In that testimony, we discussed 

the status of DHS’s efforts and challenges faced by DHS in fulfilling its 

responsibilities. We reported that DHS had much work ahead of it. In a 

related report, we recommended that DHS prioritize cybersecurity-related

responsibilities—including establishing recovery plans for key Internet 

functions.4

As requested, our testimony summarizes a report we released that (1) 

identifies examples of major disruptions to the Internet, (2) identifies the 

primary laws and regulations governing recovery of the Internet in the 

 1

Homeland Security Presidential Directive 7: Critical Infrastructure Identification, 

Prioritization, and Protection (Dec. 17, 2003). 

2

The White House, National Strategy to Secure Cyberspace (Washington D.C.: February 

2003). 

3

GAO, Critical Infrastructure Protection: Challenges in Addressing Cybersecurity, 

GAO-05-827T (Washington, D.C.: July 19, 2005). 

4

GAO, Critical Infrastructure Protection: Department of Homeland Security Faces 

Challenges in Fulfilling Cybersecurity Responsibilities, GAO-05-434 (Washington, D.C.: 

May 26, 2005). 

Page 1 GAO-06-863T 
event of a major disruption, (3) evaluates DHS’s plans for facilitating 

recovery from Internet disruptions, and (4) assesses challenges to such 

efforts.5

 The report includes matters for congressional consideration and 

recommendations to DHS for improving Internet recovery efforts. In 

preparing for this testimony, we relied on our work supporting the 

accompanying report. That report contains a detailed overview of our 

scope and methodology. All the work on which this testimony is based 

was performed in accordance with generally accepted government 

auditing standards. 

A major disruption to the Internet could be caused by a physical incident 

(such as a natural disaster or an attack that affects facilities and other 

assets), by a cyber incident (such as a software malfunction or a malicious 

virus), or by a combination of both physical and cyber incidents. Recent 

physical and cyber incidents have caused localized or regional disruptions, 

highlighting the importance of recovery planning. For example, a 2002 root

server attack highlighted the need to plan for increased server capacity at

Internet exchange points in order to manage the high volumes of data 

traffic during an attack. However, recent incidents have also shown the 

Internet as a whole to be flexible and resilient. Even in severe 

circumstances, the Internet did not suffer a catastrophic failure. 

Nevertheless, it is possible that a complex attack or set of attacks could 

cause the Internet to fail. It is also possible that a series of attacks against 

the Internet could undermine users’ trust and thereby reduce the Internet’s

utility. 

Results in Brief 

Several federal laws and regulations provide broad guidance that applies 

to the Internet, but it is not clear how useful these authorities would be in 

helping to recover from a major Internet disruption. Specifically, the 

Homeland Security Act of 2002 and Homeland Security Presidential 

Directive 7 provide guidance on protecting our nation’s critical

infrastructures. However, they do not specifically address roles and 

responsibilities in the event of an Internet disruption. The Defense 

Production Act and the Stafford Act provide authority to federal agencies 

to plan for and respond to incidents of national significance like disasters 

and terrorist attacks. However, the Defense Production Act has never been

used for Internet recovery. In addition, the Stafford Act does not authorize 

 5

GAO, Internet Infrastructure: DHS Faces Challenges in Developing a Joint

Public/Private Recovery Plan, GAO-06-672 (Washington, D.C.: June 16, 2006).

Page 2 GAO-06-863T 
the provision of resources to for-profit companies such as those that own 

and operate core Internet components. The Communications Act of 1934 

and National Communication System authorities govern the 

telecommunications infrastructure and help ensure communications 

during national emergencies, but they have never been used for Internet 

recovery either. Thus, it is not clear how effective these laws and 

regulations would be in assisting Internet recovery. 

DHS has begun a variety of initiatives to fulfill its responsibility to develop 

an integrated public/private plan for Internet recovery, but these efforts 

are not yet comprehensive or complete. Specifically, DHS has developed

high-level plans for infrastructure protection and incident response, but 

the components of these plans that address the Internet infrastructure are 

not complete. In addition, DHS has started a variety of initiatives to 

improve the nation’s ability to recover from Internet disruptions, including 

working groups to facilitate coordination and exercises in which 

government and private industry practice responding to cyber events. 

However, progress to date on these initiatives has been limited, and other 

initiatives lack timeframes for completion. Also, the relationships between 

these initiatives are not evident. As a result, the risk remains that the 

government is not yet adequately prepared to effectively coordinate 

public/private plans for recovering from a major Internet disruption. 

Key challenges to establishing a plan for recovering from Internet 

disruption include (1) innate characteristics of the Internet (such as the 

diffuse control of the many networks that make up the Internet and the 

private-sector ownership of core components) that make planning for and 

responding to disruptions difficult, (2) lack of consensus on DHS’s role 

and when the department should get involved in responding to a 

disruption, (3) legal issues affecting DHS’s ability to provide assistance to 

entities working to restore Internet service, (4) reluctance of many in the

private sector to share information on Internet disruptions with DHS, and 

(5) leadership and organizational uncertainties within DHS. Until these 

challenges are addressed, DHS will have difficulty achieving results in its 

role as a focal point for helping to recover the Internet from a major 

disruption. 

Given the importance of the Internet infrastructure to our nation’s 

communications and commerce, we suggested in our accompanying 

report, that Congress consider clarifying the legal framework guiding 

Page 3 GAO-06-863T 
Internet recovery.6

 We also made recommendations to the Secretary of 

Homeland Security to strengthen the department’s ability to serve 

effectively as a focal point for helping to recover from Internet disruptions 

by establishing clear milestones for completing key plans, coordinating 

various Internet recovery-related activities, and addressing key challenges

to Internet recovery planning. In written comments, DHS agreed with our 

recommendations and provided information on initial activities it was 

taking to implement them. 

The Internet is a vast network of interconnected networks that is used by 

governments, businesses, research institutions, and individuals around the 

world to communicate, engage in commerce, do research, educate, and 

entertain. From its origins in the 1960s as a research project sponsored by 

the U.S. government, the Internet has grown increasingly important to 

both American and foreign businesses and consumers, serving as the 

medium for hundreds of billions of dollars of commerce each year. The 

Internet has also become an extended information and communications 

infrastructure, supporting vital services such as power distribution, health

care, law enforcement, and national defense. Today, private industry—

including telecommunications companies, cable companies, and Internet

service providers—owns and operates the vast majority of the Internet’s 

infrastructure. In recent years, cyber attacks involving malicious software 

or hacking have been increasing in frequency and complexity. These 

attacks can come from a variety of actors, including criminal groups, 

hackers, and terrorists. 

Background 

Federal regulation recognizes the need to protect critical infrastructures 

such as the Internet. It directs federal departments and agencies to identify

and prioritize critical infrastructure sectors and key resources and to 

protect them from terrorist attack. Furthermore, it recognizes that since a 

large portion of these critical infrastructures is owned and operated by the 

private sector, a public/private partnership is crucial for the successful 

protection of these critical infrastructures. Federal policy also recognizes

the need to be prepared for the possibility of debilitating disruptions in 

cyberspace and, because the vast majority of the Internet infrastructure is 

owned and operated by the private sector, tasks DHS with developing an 

integrated public/private plan for Internet recovery. In its plan for 

protecting critical infrastructures, DHS recognizes that the Internet is a 

 6

GAO-06-672. 

Page 4 GAO-06-863T 
key resource composed of assets within both the information technology 

and the telecommunications sectors.7

 It notes that the Internet is used by 

all critical infrastructure sectors to varying degrees and provides 

information and communications to meet the needs of businesses and 

government.

In the event of a major Internet disruption, multiple organizations could

help recover Internet service. These organizations include private 

industry, collaborative groups, and government organizations. Private 

industry is central to Internet recovery because private companies own the 

vast majority of the Internet’s infrastructure and often have response 

plans. Collaborative groups—including working groups and industry 

councils—provide information-sharing mechanisms to allow private 

organizations to restore services. In addition, government initiatives could 

facilitate response to major Internet disruptions.

Federal policies and plans8

 assign DHS lead responsibility for facilitating a 

public/private response to and recovery from major Internet disruptions. 

Within DHS, responsibilities reside in two divisions within the 

Preparedness Directorate: the National Cyber Security Division (NCSD) 

and the National Communications System (NCS). NCSD operates the U.S.

Computer Emergency Readiness Team (US-CERT), which coordinates 

defense against and response to cyber attacks. The other division, NCS, 

provides programs and services that assure the resilience of the 

telecommunications infrastructure in times of crisis. Additionally, the 

Federal Communications Commission can support Internet recovery by

coordinating resources for restoring the basic communications 

infrastructures over which Internet services run. For example, after 

Hurricane Katrina, the commission granted temporary authority for 

private companies to set up wireless Internet communications supporting

various relief groups; federal, state, and local government agencies; 

businesses; and victims in the disaster areas. 

Prior evaluations of DHS’s cybersecurity responsibilities have highlighted

issues and challenges facing the department. In May 2005, we issued a 

 7

DHS, The National Infrastructure Protection Plan. 

8

These include the National Strategy to Secure Cyberspace, the interim National 

Infrastructure Protection Plan, the Cyber Incident Annex to the National Response Plan, 

and Homeland Security Presidential Directive 7. 

Page 5 GAO-06-863T 
report on DHS’s efforts to fulfill its cybersecurity responsibilities.9

 We 

noted that while DHS had initiated multiple efforts to fulfill its 

responsibilities, it had not fully addressed any of the 13 key cybersecurity 

responsibilities noted in federal law and policy. We also reported that DHS 

faced a number of challenges that have impeded its ability to fulfill its 

cyber responsibilities. These challenges included achieving organizational 

stability, gaining organizational authority, overcoming hiring and 

contracting issues, increasing awareness of cybersecurity roles and 

capabilities, establishing effective partnerships with stakeholders, 

achieving two-way information sharing with stakeholders, and 

demonstrating the value that DHS can provide. In this report, we also 

made recommendations to improve DHS’s ability to fulfill its mission as an 

effective focal point for cybersecurity, including recovery plans for key 

Internet functions. DHS agreed that strengthening cybersecurity is central

to protecting the nation’s critical infrastructures and that much remained

to be done, but it has not yet addressed our recommendations. 

The Internet’s infrastructure is vulnerable to disruptions in service due to 

terrorist and other malicious attacks, natural disasters, accidents, 

technological problems, or a combination of the above. Disruptions to 

Internet service can be caused by cyber and physical incidents—both 

intentional and unintentional. Recent physical and cyber incidents have 

caused localized or regional disruptions, highlighting the importance of 

recovery planning. However, these incidents have also shown the Internet 

as a whole to be flexible and resilient. Even in severe circumstances, the 

Internet has not yet suffered a catastrophic failure. 

To date, cyber attacks have caused various degrees of damage. For 

example, in 2001, the Code Red worm used a denial-of-service attack to 

affect millions of computer users by shutting down Web sites, slowing 

Internet service, and disrupting business and government operations. In 

2003, the Slammer worm caused network outages, canceled airline flights, 

and automated teller machine failures. Slammer resulted in temporary loss 

of Internet access to some users, and cost estimates on the impact of the

worm range from $1.05 billion to $1.25 billion. The federal government 

coordinated with security companies and Internet service providers and 

released an advisory recommending that federal departments and agencies 

patch and block access to the affected channel. However, because the 

Although Cyber and 

Physical Incidents 

Have Caused 

Disruptions, the 

Internet Has Not Yet 

Suffered a 

Catastrophic Failure 

 9

GAO-05-434. 

Page 6 GAO-06-863T 
worm had propagated so quickly, most of these activities occurred after it 

had stopped spreading. 

In 2002, a coordinated denial-of-service attack was launched against all of 

the root servers in the Domain Name System. At least nine of the thirteen 

root servers experienced degradation of service. However, average end 

users hardly noticed the attack. The attack became visible only as a result 

of various Internet health-monitoring projects. The response to the attacks 

was handled by the server operators and their service providers. The 

attack pointed to a need for increased capacity for servers at Internet 

exchange points to enable them to manage the high volumes of data traffic 

during an attack. If a massive disruptive attack on the domain name server 

system were successful, it could take several days to recover from. 

According to experts familiar with the attack, the government did not have 

a role in recovering from it. 

Like cyber incidents, physical incidents could affect various aspects of the

Internet infrastructure, including underground or undersea cables and 

facilities that house telecommunications equipment, Internet exchange 

points, or Internet service providers. For example, on July 18, 2001, a 60-

car freight train derailed in a Baltimore tunnel, causing a fire that 

interrupted Internet and data services between Washington and New York. 

The tunnel housed fiber-optic cables serving seven of the biggest U.S. 

Internet service providers. The fire burned and severed fiber optic cables,

causing backbone slowdowns for at least three major Internet service 

providers. Efforts to recover Internet service were handled by the affected

Internet service providers; however, local and federal officials responded 

to the immediate physical issues of extinguishing the fire and maintaining 

safety in the surrounding area, and they worked with telecommunications 

companies to reroute affected cables.

In addition, Hurricane Katrina caused substantial destruction of the 

communications infrastructure in Louisiana, Mississippi, and Alabama, but 

it had minimal affect on the overall functioning of the Internet outside of 

the immediate area. According to an Internet monitoring service provider,

while there was a loss of routing around the affected area, there was no 

significant impact on global Internet routing. According to the Federal

Communications Commission, the storm caused outages for over 3 million 

telephone customers, 38 emergency 9-1-1 call centers, hundreds of 

thousands of cable customers, and over 1,000 cellular sites. However, a 

substantial number of the networks that experienced service disruptions 

recovered relatively quickly. 

Page 7 GAO-06-863T 
Federal officials stated that the government took steps to respond to the 

hurricane, such as increasing analysis and watch services in the affected 

area, coordinating with communications companies to move personnel to

safety, working with fuel and equipment providers, and rerouting 

communications traffic away from affected areas. However, private-sector 

representatives stated that requests for assistance, such as food, water, 

fuel, and secure access to facilities were denied for legal reasons; the 

government made time-consuming and duplicative requests for 

information; and certain government actions impeded recovery efforts. 

Since its inception, the Internet has experienced disruptions of varying 

scale—including fast-spreading worms, denial-of-service attacks, and 

physical destruction of key infrastructure components—but the Internet 

has yet to experience a catastrophic failure. However, it is possible that a 

complex attack or set of attacks could cause the Internet to fail. It is also 

possible that a series of attacks against the Internet could undermine 

users’ trust and thereby reduce the Internet’s utility. 

Several federal laws and regulations provide broad guidance that applies 

to the Internet infrastructure, but it is not clear how useful these 

authorities would be in helping to recover from a major Internet disruption 

because some do not specifically address Internet recovery and others 

have seldom been used. Pertinent laws and regulations address critical 

infrastructure protection, federal disaster response, and the 

telecommunications infrastructure. 

Specifically, the Homeland Security Act of 200210 and Homeland Security 

Presidential Directive 711 establish critical infrastructure protection as a 

national goal and describe a strategy for cooperative efforts by the 

government and the private sector to protect the physical and cyber-based

systems that are essential to the operations of the economy and the 

government. These authorities apply to the Internet because it is a core 

communications infrastructure supporting the information technology and 

telecommunications sectors. However, this law and regulation do not 

specifically address roles and responsibilities in the event of an Internet 

disruption. 

Existing Laws and 

Regulations Apply to 

the Internet, but 

Numerous 

Uncertainties Exist in 

Using Them for 

Internet Recovery 

 10The Homeland Security Act of 2002, Pub. L. No.107-296 (Nov. 25, 2002). 

11Homeland Security Presidential Directive 7 (Dec. 17, 2003). 

Page 8 GAO-06-863T 
Regarding federal disaster response, the Defense Production Act12 and the 

Stafford Act13 provide authority to federal agencies to plan for and respond 

to incidents of national significance like disasters and terrorist attacks. 

Specifically, the Defense Production Act authorizes the President to 

ensure the timely availability of products, materials, and services needed 

to meet the requirements of a national emergency. It is applicable to 

critical infrastructure protection and restoration but has never been used 

for Internet recovery. The Stafford Act authorizes federal assistance to 

states, local governments, nonprofit entities, and individuals in the event 

of a major disaster or emergency. However, the act does not authorize 

assistance to for-profit companies—such as those that own and operate 

core Internet components. 

Other legislation and regulations, including the Communications Act of 

193414 and the NCS authorities,15 govern the telecommunications 

infrastructure and help to ensure communications during national 

emergencies. For example, the NCS authorities establish guidance for 

operationally coordinating with industry to protect and restore key 

national security and emergency preparedness communications services. 

These authorities grant the President certain emergency powers regarding 

telecommunications, including the authority to require any carrier subject 

to the Communications Act of 1934 to grant preference or priority to 

essential communications.16 The President may also, in the event of war or 

national emergency, suspend regulations governing wire and radio 

transmissions and authorize the use or control of any such facility or 

station and its apparatus and equipment by any department of the 

government. Although these authorities remain in force in the Code of 

Federal Regulations, they have been seldom used—and never for Internet 

recovery. Thus it is not clear how effective they would be if used for this 

purpose. 

 12Act of September 8, 1950, c. 932, 64 Stat. 798, as amended; codified at 50 U.S.C. App. 

Section 2061 et seq.

13Pub. L. No. 93-288, 88 Stat. 143 (1974).

14Communications Act of 1934 (June 19, 1934), ch. 652, 48 Stat. 1064. 

15Executive Order 12472 (Apr. 3, 1984), as amended by Executive Order 13286 (Feb. 28, 

2003). 

16Executive Order 12472 § 2; Communications Act of 1934, § 706, 47 U.S.C § 606.

Page 9 GAO-06-863T 
In commenting on the statutory authority for Internet reconstitution 

following a disruption, DHS agreed that this authority is lacking and noted 

that the government’s roles and authorities related to assisting in Internet

reconstitution following a disruption are not fully defined. 

DHS has begun a variety of initiatives to fulfill its responsibility to develop 

an integrated public/private plan for Internet recovery, but these efforts 

are not complete or comprehensive. Specifically, DHS has developed highlevel plans for infrastructure protection and national disaster response, 

but the components of these plans that address the Internet infrastructure 

are not complete. In addition, DHS has started a variety of initiatives to 

improve the nation’s ability to recover from Internet disruptions, including 

working groups to facilitate coordination and exercises in which 

government and private industry practice responding to cyber events. 

While these activities are promising, some initiatives are not complete, 

others lack time lines and priorities, and still others lack effective 

mechanisms for incorporating lessons learned. In addition, the 

relationship between these initiatives is not evident. As a result, the nation

is not prepared to effectively coordinate public/private plans for 

recovering from a major Internet disruption. 

DHS Initiatives 

Supporting Internet 

Recovery Planning 

Are under Way, but 

Much Remains to Be 

Done and the 

Relationship Between 

Initiatives Is Not 

Evident 

High-Level Response and 

Protection Plans 

DHS has two key documents that guide its infrastructure protection and

recovery efforts, but components of these plans dealing with Internet 

recovery are not complete. The National Response Plan is DHS’s 

overarching framework for responding to domestic incidents. It contains 

two components that address issues related to telecommunications and 

the Internet, Emergency Support Function 2 and the Cyber Incident 

Annex. These components, however, are not complete; Emergency 

Support Function 2 does not directly address Internet recovery, and the 

annex does not reflect the National Cyber Response Coordination Group’s 

current operating procedures. The other key document, the National 

Infrastructure Protection Plan, consists of both a base plan and sectorspecific plans. The base plan, which was recently released, describes the 

importance of cybersecurity and networks such as the Internet to critical

infrastructure protection and includes an appendix that provides 

information on cybersecurity responsibilities. The appendix restates DHS’s 

responsibility to develop plans to recover Internet functions. However, the 

base plan is at a high level and the sector-specific plans that would address 

the Internet in more detail are not scheduled for release until December 

2006. 

Page 10 GAO-06-863T 
Several representatives of private-sector firms supporting the Internet 

infrastructure expressed concerns about both plans, noting that they 

would be difficult to execute in times of crisis. Other representatives were 

uneasy about the government developing recovery plans, because they 

were not confident of the government’s ability to successfully execute the 

plans. DHS officials acknowledged that it will be important to obtain input 

from private-sector organizations as they refine these plans and initiate 

more detailed public/private planning. 

Both the National Response Plan and National Infrastructure Protection

Plan are designed to be supplemented by more specific plans and 

activities. DHS has numerous initiatives under way to better define its 

ability to assist in responding to major Internet disruptions. While these 

activities are promising, some initiatives are incomplete, others lack time 

lines and priorities, and still others lack an effective mechanism for 

incorporating lessons learned. 

DHS plans to revise the role and mission of the National Communications 

System (NCS) to reflect the convergence of voice and data 

communications, but this effort is not yet complete. A presidential 

advisory committee on telecommunications17 established two task forces 

that recommended changes to NCS’s role, mission, and functions to reflect 

this convergence, but DHS has not yet developed plans to address these 

recommendations. 

National Communications 

System Reorganization 

National Cyber Response 

Coordination Group 

As a primary entity responsible for coordinating governmentwide 

responses to cyber incidents—such as major Internet disruptions—DHS’s

National Cyber Response Coordination Group is working to define its 

roles and responsibilities, but much remains to be done. DHS officials 

acknowledge that the trigger to activate this group is imprecise and will 

need to be clarified. Because key activities to define roles, responsibilities, 

capabilities, and the appropriate triggers for government involvement are 

still under way, the group is at risk of not being able to act quickly and 

definitively during a major Internet disruption. 

 17The National Security Telecommunications Advisory Committee advises the President on 

issues and problems related to implementing national security and emergency 

preparedness telecommunications policy. 

Page 11 GAO-06-863T 
Since most of the Internet is owned and operated by the private sector, 

NCSD and NCS established the Internet Disruption Working Group to 

work with the private sector to establish priorities and develop action 

plans to prevent major disruptions of the Internet and to identify recovery 

measures in the event of a major disruption. According to DHS officials 

who organized the group, it held its first forum, in November 2005, to

begin to identify real versus perceived threats to the Internet, refine the 

definition of an Internet disruption, determine the scope of a planned 

analysis of disruptions, and identify near-term protective measures. DHS 

officials stated that they had identified a number of potential future plans;

however, agency officials have not yet finalized plans, resources, or 

milestones for these efforts. 

US-CERT officials formed the North American Incident Response Group, 

which includes both public and private-sector network operators that 

would be the first to recognize and respond to cyber disruptions. In 

September 2005, US-CERT officials conducted regional workshops with 

group members to share information on structure, programs, and incident

response and to seek ways for the government and industry to work 

together operationally. While the outreach efforts of the North American 

Incident Response Group are promising, DHS has only just begun 

developing plans and activities to address the concerns of private-sector 

stakeholders. 

Internet Disruption 

Working Group 

North American Incident 

Response Group 

Exercises Over the last few years, DHS has conducted several broad intergovernmental exercises to test regional responses to significant incidents 

that could affect the critical infrastructure. More recently, in February 

2006, DHS conducted an exercise called Cyber Storm, which was focused 

primarily on testing responses to a cyber-related incident of national 

significance. Exercises that include Internet disruptions can help to 

identify issues and interdependencies that need to be addressed. However, 

DHS has not yet identified planned activities, milestones, or which group 

should be responsible for incorporating lessons learned from the regional

and Cyber Storm exercises into its plans and initiatives. 

While DHS has various initiatives under way, the relationships and 

interdependencies between these various efforts are not evident. For 

example, the National Cyber Response Coordination Group, the Internet 

Disruption Working Group, and the North American Incident Response 

Page 12 GAO-06-863T 
Group are all meeting to discuss ways to address Internet recovery, but 

the interdependencies between the groups have not been clearly 

established. Without a thorough understanding of the interrelationships 

between its various initiatives, DHS risks pursuing redundant efforts and 

missing opportunities to build on related efforts.

After our report was issued, a private-sector organization released a report 

that examined the nation’s preparedness for a major Internet disruption.18

The report stated that our nation is unprepared to reconstitute the Internet 

after a massive disruption. The report supported our findings that 

significant gaps exist in government response plans and that the 

responsibilities of the multiple organizations that would play a role in 

recovery are unclear. The report also made recommendations to complete 

and revise response plans such as the Cyber Incident Annex of the 

National Response Plan; better define recovery roles and responsibilities; 

and establish more effective oversight and strategic direction for Internet 

reconstitution. 

Although DHS has various initiatives under way to improve Internet 

recovery planning, it faces key challenges in developing a public/private 

plan for Internet recovery, including (1) innate characteristics of the 

Internet that make planning for and responding to a disruption difficult, 

(2) lack of consensus on DHS’s role and on when the department should 

get involved in responding to a disruption, (3) legal issues affecting DHS’s 

ability to provide assistance to restore Internet service, (4) reluctance of 

the private sector to share information on Internet disruptions with DHS, 

and (5) leadership and organizational uncertainties within DHS. Until it 

addresses these challenges, DHS will have difficulty achieving results in its 

role as focal point for recovering the Internet from a major disruption. 

Multiple Challenges 

Exist to Planning for 

Recovery from 

Internet Disruptions 

First, the Internet’s diffuse structure, vulnerabilities in its basic protocols, 

and the lack of agreed-upon performance measures make planning for and 

responding to a disruption more difficult. The components of the Internet

are not all governed by the same organization. In addition, the Internet is 

international. According to private-sector estimates, only about 20 percent 

of Internet users are in the United States. Also, there are no well-accepted 

standards for measuring and monitoring the Internet infrastructure’s 

 18Business Roundtable, Essential Steps to Strengthen America’s Cyber Terrorism 

Preparedness (Washington D.C.: June 2006).

Page 13 GAO-06-863T 
availability and performance. Instead, individuals and organizations rate 

the Internet’s performance according to their own priorities. 

Second, there is no consensus about the role DHS should play in 

responding to a major Internet disruption or about the appropriate trigger 

for its involvement. The lack of clear legislative authority for Internet 

recovery efforts complicates the definition of this role. DHS officials 

acknowledged that their role in recovering from an Internet disruption 

needs further clarification because private industry owns and operates the 

vast majority of the Internet. 

The trigger for the National Response Plan, which is DHS’s overall 

framework for incident response, is poorly defined and has been found by

both us and the White House to need revision.19 Since private-sector 

participation in DHS planning activities for Internet disruption is 

voluntary, agreement on the appropriate trigger for government 

involvement and the role of government in resolving an Internet disruption 

is essential to any plan’s success. 

Private-sector officials representing telecommunication backbone 

providers and Internet service providers were also unclear about the types 

of assistance DHS could provide in responding to an incident and about 

the value of such assistance. There was no consensus on this issue. Many 

private-sector officials stated that the government did not have a direct 

recovery role, while others identified a variety of potential roles, including 

• providing information on specific threats; 

• providing security and disaster relief support during a crisis; 

• funding backup communication infrastructures; 

• driving improved Internet security through requirements for the 

government’s own procurement; 

• serving as a focal point with state and local governments to establish 

standard credentials to allow Internet and telecommunications companies 

 19See GAO, Hurricane Katrina: GAO’s Preliminary Observations Regarding 

Preparedness, Response, and Recovery, GAO-06-442T (Washington, D.C.: Mar. 8, 2006), and 

the White House, The Federal Response to Hurricane Katrina: Lessons Learned

(Washington, D.C., February 2006). 

Page 14 GAO-06-863T 
access to areas that have been restricted or closed in a crisis; 

• providing logistical assistance, such as fuel, power, and security, to 

Internet infrastructure operators; 

• focusing on smaller-scale exercises targeted at specific Internet disruption 

issues; 

• limiting the initial focus for Internet recovery planning to key national 

security and emergency preparedness functions, such as public health and 

safety; and 

• establishing a system for prioritizing the recovery of Internet service, 

similar to the existing Telecommunications Service Priority Program. 

A third challenge to planning for recovery is that there are key legal issues 

affecting DHS’s ability to provide assistance to help restore Internet 

service. As noted earlier, key legislation and regulations guiding critical

infrastructure protection, disaster recovery, and the telecommunications 

infrastructure do not provide specific authorities for Internet recovery. As 

a result, there is no clear legislative guidance on which organization would 

be responsible in the case of a major Internet disruption. In addition, the 

Stafford Act, which authorizes the government to provide federal 

assistance to states, local governments, nonprofit entities, and individuals 

in the event of a major disaster or emergency, does not authorize 

assistance to for-profit corporations. Several representatives of 

telecommunications companies reported that they had requested federal 

assistance from DHS during Hurricane Katrina. Specifically, they 

requested food, water, and security for the teams they were sending in to

restore the communications infrastructure and fuel to power their 

generators. DHS responded that it could not fulfill these requests, noting 

that the Stafford Act did not extend to for-profit companies. 

A fourth challenge is that a large percentage of the nation’s critical 

infrastructure—including the Internet—is owned and operated by the 

private sector, meaning that public/private partnerships are crucial for 

successful critical infrastructure protection. Although certain policies 

direct DHS to work with the private sector to ensure infrastructure 

protection, DHS does not have the authority to direct Internet owners and 

operators in their recovery efforts. Instead, it must rely on the private 

sector to share information on incidents, disruptions, and recovery efforts. 

Many private-sector representatives questioned the value of providing 

information to DHS regarding planning for and recovery from Internet 

Page 15 GAO-06-863T 
disruption. In addition, DHS has identified provisions of the Federal 

Advisory Committee Act20 as having a “chilling effect” on cooperation with 

the private sector. The uncertainties regarding the value and risks of 

cooperation with the government limit incentives for the private sector to 

cooperate in Internet recovery-planning efforts. 

Finally, DHS has lacked permanent leadership while developing its 

preliminary plans for Internet recovery and reconstitution. In addition, the

organizations with roles in Internet recovery (NCS and NCSD) have 

overlapping responsibilities and may be reorganized once DHS selects 

permanent leadership. As a result, it is difficult for DHS to develop a clear 

set of organizational priorities and to coordinate between the various 

activities necessary for Internet recovery planning. In May 2005, we 

reported that multiple senior DHS cybersecurity officials had recently left

the department.21 These officials included the NCSD Director, the Deputy 

Director responsible for Outreach and Awareness, the Director of the USCERT Control Systems Security Center, the Under Secretary for the 

Information Analysis and Infrastructure Protection Directorate and the 

Assistant Secretary responsible for the Information Protection Office. 

Additionally, DHS officials acknowledge that the current organizational 

structure has overlapping responsibilities for planning for and recovering 

from a major Internet disruption. 

In a July 2005 departmental reorganization, NCS and NCSD were placed in 

the Preparedness Directorate. NCS’s and NCSD’s responsibilities were to 

be placed under a new Assistant Secretary of Cyber Security and 

Telecommunications—in part to raise the visibility of cybersecurity issues

in the department. However, almost a year later, this position remains 

vacant. While DHS stated that the lack of a permanent assistant secretary 

has not hampered its efforts in protecting critical infrastructure, several 

private-sector representatives stated that DHS’s lack of leadership in this 

area has limited progress. Specifically, these representatives stated that 

filling key leadership positions would enhance DHS’s visibility to the 

Internet industry and potentially improve its reputation. 

 20Pub. L. No. 92-463, 86 Stat. 770 (1972) codified at 5 U.S.C. app. 2. 

21GAO-05-434. 

Page 16 GAO-06-863T 
Given the importance of the Internet infrastructure to our nation’s 

communication and commerce, in our accompanying report we suggested 

matters for congressional consideration and made recommendations to 

DHS regarding improving efforts in planning for Internet recovery.22

Specifically, we suggested that Congress consider clarifying the legal 

framework that guides roles and responsibilities for Internet recovery in 

the event of a major disruption. This effort could include providing 

specific authorities for Internet recovery as well as examining potential

roles for the federal government, such as providing access to disaster 

areas, prioritizing selected entities for service recovery, and using federal 

contracting mechanisms to encourage more secure technologies. This 

effort also could include examining the Stafford Act to determine whether 

there would be benefits in establishing specific authority for the 

government to provide for-profit companies—such as those that own or 

operate critical communications infrastructures—with limited assistance 

during a crisis. 

Additionally, to improve DHS’s ability to facilitate public/private efforts to 

recover the Internet in case of a major disruption, we recommended that

the Secretary of the Department of Homeland Security implement the 

following nine actions: 

Implementation of 

GAO 

Recommendations 

Should Improve DHS 

Internet Recovery 

Planning Efforts 

• Establish dates for revising the National Response Plan—including efforts 

to update key components that are relevant to the Internet. 

• Use the planned revisions to the National Response Plan and the National

Infrastructure Protection Plan as a basis to draft public/private plans for 

Internet recovery and obtain input from key Internet infrastructure 

companies. 

• Review the NCS and NCSD organizational structures and roles in light of

the convergence of voice and data communications. 

• Identify the relationships and interdependencies among the various 

Internet recovery-related activities currently under way in NCS and NCSD, 

including initiatives by US-CERT, the National Cyber Response 

Coordination Group, the Internet Disruption Working Group, the North 

American Incident Response Group, and the groups responsible for 

developing and implementing cyber recovery exercises. 

 22GAO-06-672. 

Page 17 GAO-06-863T 
• Establish time lines and priorities for key efforts identified by the Internet

Disruption Working Group. 

• Identify ways to incorporate lessons learned from actual incidents and 

during cyber exercises into recovery plans and procedures. 

• Work with private-sector stakeholders representing the Internet 

infrastructure to address challenges to effective Internet recovery by 

• further defining needed government functions in responding to a major 

Internet disruption (this effort should include a careful consideration 

of the potential government functions identified by the private sector 

earlier in this testimony), 

• defining a trigger for government involvement in responding to such a 

disruption, and 

• documenting assumptions and developing approaches to deal with key 

challenges that are not within the government’s control. 

In written comments, DHS agreed with our recommendations and stated 

that it recognizes the importance of the Internet for information 

infrastructures. DHS also provided information about initial actions it is 

taking to implement our recommendations. 

In summary, as a critical information infrastructure supporting our 

nation’s commerce and communications, the Internet is subject to 

disruption—from both intentional and unintentional incidents. While 

major incidents to date have had regional or local impacts, the Internet has

not yet suffered a catastrophic failure. Should such a failure occur, 

however, existing legislation and regulations do not specifically address 

roles and responsibilities for Internet recovery. 

As the focal point for ensuring the security of cyberspace, DHS has 

initiated efforts to refine high-level disaster recovery plans; however, 

pertinent Internet components of these plans are not complete. While DHS 

has also undertaken several initiatives to improve Internet recovery 

planning, much remains to be done. Specifically, some initiatives lack 

clear timelines, lessons learned are not consistently being incorporated in

recovery plans, and the relationships between the various initiatives are 

not clear. 

Page 18 GAO-06-863T 
DHS faces numerous challenges in developing integrated public/private 

recovery plans—not the least of which is the fact that the government 

does not own or operate much of the Internet. In addition, there is no 

consensus among public and private stakeholders about the appropriate 

role of DHS and when it should get involved; legal issues limit the actions

the government can take; the private sector is reluctant to share 

information on Internet performance with the government; and DHS is 

undergoing important organizational and leadership changes. As a result, 

the exact role of the government in helping to recover the Internet 

infrastructure following a major disruption remains unclear.

To improve DHS’s ability to facilitate public/private efforts to recover the 

Internet in case of a major disruption, our accompanying report suggested 

that Congress consider clarifying the legal framework guiding Internet 

recovery. We also made recommendations to DHS to establish clear 

milestones for completing key plans, coordinate various Internet recoveryrelated activities, and address key challenges to Internet recovery 

planning. Effectively implementing these recommendations could greatly

enhance our nation’s ability to recover from a major Internet disruption. 

Mr. Chairman, this concludes my statement. I would be happy to answer 

any questions that you or members of the subcommittee may have at this 

time. 

If you have any questions on matters discussed in this testimony, please 

contact us at (202) 512-9286 and at (202) 512-6412 or by e-mail at 

pownerd@gao.gov and rhodesk@gao.gov. Other key contributors to this 

testimony include Don R. Adams, Naba Barkakati, Scott Borre, Neil 

Doherty, Vijay D’Souza, Joshua A. Hammerstein, Bert Japikse, Joanne 

Landesman, Frank Maguire, Teresa M. Neven, and Colleen M. Phillips. 

Page 19 GAO-06-863T 
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Mail or Phone 

To Report Fraud,

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER