text: Background Mobile devices use wireless networks to enable voice and data communications. Mobile wireless networks comprise several components and provide coverage based on dividing a large geographic area into smaller areas of coverage known as “cells.” Each cell contains a cell site—a base station equipped with an antenna—to receive and transmit radio signals to mobile devices within its coverage area. (See fig. 1.) The cell sites are often located on a tower, rooftop, or other structure to provide coverage to a wide area. For a mobile device to transmit and receive signals, it must be within range of a cell site antenna. In many areas, a mobile device is able to transmit and receive signals from multiple cell sites. Each cell site is linked to a base station controller that manages communications between the cell site and the mobile switching center (e.g., routes and hands over calls). The mobile switching center then directs voice and data traffic to landline phones, other cell phones via a carrier’s network, or the Internet. Backhaul facilities provide transport for this voice and data traffic, and backhaul can be provided over fiber optic or copper cables or wirelessly via microwave facilities. According to FCC, there are four “nationwide” mobile wireless carriers— AT&T, Verizon, T-Mobile, and Sprint—with networks that cover most of the United States. The industry also includes dozens of other carriers, many of which provide service in a specific, sometimes rural, geographic area. According to an FCC report on the wireless industry, most consumers in the United States have the ability to choose among multiple carriers with wireless network coverage in their area, and wireless carriers typically compete on price, network quality, and the availability of mobile devices with innovative features. Federal law states that FCC must take into account whether its actions will encourage competition in mobile wireless networks. Some wireless carriers own a portion or all of the structures that host cell sites, but wireless carriers mostly lease space from independent companies that own or operate a majority of the towers and other structures that host cell sites. Mobile wireless networks face several kinds of risks that could affect the network’s physical components, resulting in disrupted service or an outage. Government reports generally identify three types of physical risks facing wireless networks: Natural disasters, such as hurricanes, tornados, wildfires, and earthquakes. Manmade events, such as terrorist attacks and damage associated with theft or another malicious act. Accidents, such as cable damage due to digging or locating errors and damage associated with a vehicle accident. The potential effects related to these physical risks include damage to wireless network components that requires wireless carriers and other providers to make repairs or replace equipment to restore service. For example, flooding, which can occur with a hurricane or heavy rain, could damage the cable or other equipment submerged in water. Wildfires can damage network components like antennas and backhaul facilities (including fiber optic and copper lines and microwave towers) as well as equipment in buildings if the buildings are damaged or destroyed. In addition to physical risks, wireless networks face risks stemming from their dependence on other sectors and providers. One key dependency identified by several government and industry reports is the reliance on commercially provided electricity, referred to in this report as commercial power. Several components—including the mobile switching center, antennas at cell sites, and consumer devices—may rely on commercial power. Therefore, loss of electric power may result in a loss of wireless communications. Another key dependency for wireless networks is backhaul used to get data from an end user to a major network. Wireless carriers can provide backhaul but typically obtain it from another communications provider, such as a local telephone company or cable company. An outage in the backhaul network can cause an outage that affects one or more cell sites or a portion of the wireless network. FCC has reported that the loss of backhaul service is a major cause of a cell site’s unavailability, which can lead to wireless outages. Also important is having clear roads and highways, as wireless carriers’ personnel or contractors need to be able to access cell sites to repair or replace equipment, or deliver fuel for generators that are sometimes located at cell sites. Resilience is the ability to prepare for and adapt to changing conditions and withstand and recover rapidly from disruptions, according to Presidential Policy Directive 21. Owners and operators of wireless networks can take a variety of actions to manage different risks, including various physical risks, according to the Communications Sector-Specific Plan. These actions can be designed to achieve different aims, including to prepare for incidents, like creating and exercising disaster recovery reduce a specific vulnerability, like elevating or moving a mobile switching center in a flood-prone area to a higher location; mitigate the consequences of an incident, like installing backup power—using batteries with a limited supply of power or generators that run on diesel or other fuel sources—to support continued wireless service during a commercial power outage; or enable efficient response and restoration following an incident, such as deploying portable cell sites on trucks and other equipment after an incident to provide wireless communications when the network experiences an outage or a significant disruption. FCC, pursuant to the Communications Act of 1934, as amended, is charged with regulating interstate and international communications throughout the United States, which means that FCC regulates wireless networks and carriers, among other responsibilities. It develops and administers policies and rules to advance the security and reliability of the nation’s communications infrastructure; this responsibility includes, among other topics, network resiliency, public safety communications, and communications infrastructure protection. FCC administers two web-based outage-reporting systems to help it oversee network reliability and resiliency: NORS: Carriers are required to report details about service disruptions or outages (e.g., cause, location, and duration) to their communications systems that meet specified thresholds set forth in regulation. FCC uses NORS data to monitor trends in communications outages and to try to identify and address any shortcomings or issues going forward. Disaster Information Reporting System (DIRS): Carriers can voluntarily report on the status of communications infrastructure during an emergency event in DIRS. For example, wireless carriers report daily on the number of cell sites, by county, that are out of service by reason (e.g., power outage, physical damage). FCC activates DIRS in response to an event and then uses these data to track network restoration during and after an emergency event. DHS also plays a role in wireless network resiliency as the lead agency for coordinating and prioritizing security and resilience activities for the communications sector. Presidential Policy Directive 21 establishes national policy to strengthen the security and resilience of critical infrastructure and states that the federal government shall work with critical infrastructure owners and operators to do so. DHS’s Office of Cybersecurity and Communications, within the National Protection and Programs Directorate, leads this coordination for the communications sector as the sector-specific agency, and this office works with the Communications Sector Coordinating Council and the Communications Government Coordinating Council to set goals, objectives, and activities for the sector. During a national emergency or disaster, DHS also coordinates response efforts for communications systems in its role as the coordinator for Emergency Support Function #2 – Communications (ESF-2). Specifically, two DHS components—the Federal Emergency Management Agency (FEMA) and Office of Cybersecurity and Communications—lead the federal government’s work to support the restoration of communications infrastructure, coordinate response efforts, and facilitate the delivery of information to emergency-management decision makers. DHS has direct access to FCC’s NORS and DIRS data to support its work. Other DHS components also have responsibilities related to wireless network resiliency. For example, the Science & Technology Directorate conducts research in the area of wireless and other communications network resiliency, although its focus is on communications for the public-safety community. Within the Department of Commerce, NIST also plays a role in promoting network resiliency by sponsoring the Community Resilience Panel. According to NIST, the Community Resilience Panel is sponsored by NIST and co-sponsored by other federal agencies to promote collaboration among stakeholders to strengthen the resiliency of infrastructure that communities rely on, including communications infrastructure. As part of this mission, the panel seeks to identify policy and standards-related impediments to community resiliency, raise awareness of sector dependencies and of the cascading effects of disasters, and identify potential resiliency metrics. Wireless Outages Caused by Physical Incidents Have Increased since 2009, and Outages due to Natural Disasters Lasted Longest Trends in Number and Reported Causes of Wireless Outages The number of wireless outages attributed to a physical incident increased from 2009 to 2016 (see fig. 2). Specifically, the number of outages with a physical incident reported as a root cause increased from 189 outages in 2009 to 1,079 in 2016. The number of outages increased substantially during the first few years of this period and then was relatively stable, which mirrored the trend for all wireless outages. According to FCC officials, the increase in reported outages was due to increases in both the number of wireless customers and wireless infrastructure over this period, as well as due to FCC’s outreach to wireless companies to clarify the thresholds for which carriers are required to report wireless outages to help ensure that carriers were consistently and fully reporting outages. From 2009 to 2016, about one- third of all wireless outages reported to FCC (6,002 of 18,325) were attributed to physical incidents. Of wireless outages reported to FCC that were attributed to physical incidents, most were due to accidents, described below: Accidents—which include cable damage due to a backhoe cut, among other causes—were the root cause for 74 percent of wireless outages attributed to a physical event. Natural disasters—including tornados and wildfires—were the root cause for 25 percent of wireless outages attributed to a physical incident. Manmade events—which include damage associated with theft or other intentional damage to facilities—were the root cause for the remaining 1 percent of these outages. FCC typically suspends NORS reporting requirements in areas where FCC activates DIRS reporting for an emergency event, generally a natural disaster. For example, when FCC activated DIRS reporting for all counties in Puerto Rico and the U.S. Virgin Islands in response to Hurricane Maria in September 2017, FCC suspended NORS reporting requirements for those counties. As a result, FCC officials said that NORS data can undercount the number of wireless outages due to natural disasters. For a large natural disaster, however, FCC still can receive NORS reports for wireless outages outside the DIRS reporting area that are due to the natural disaster. Hurricane Irma In September 2017, Hurricane Irma made landfall as a Category 3 hurricane in Florida, having previously tracked near Puerto Rico and the U.S. Virgin Islands. The hurricane produced sustained winds of nearly 115 miles per hour as it made landfall in Florida. In the days that followed, the hurricane’s impact was felt over the southeastern United States, with nearly 16 inches of rain falling over portions of Florida and high winds observed in five states. The President issued disaster declarations covering portions of Puerto Rico, the U.S. Virgin Islands, Florida, and Georgia. The damage from Hurricane Irma—both damage to wireless network infrastructure and damage resulting in power outages—created wireless service disruptions and outages in certain impacted areas. In particular, over half of cell sites were out of service for 3 or more consecutive days in five counties in Puerto Rico and in two counties in the U.S. Virgin Islands, according to data from wireless carriers reported to FCC. Within a week, only 6 percent of cell sites were out of service in reporting counties in Puerto Rico, but a majority of cell sites remained non-operational in the U.S. Virgin Islands; in one county, St. John, 90 percent of cell sites remained out of service a week and a half after landfall. In southern Florida, three counties had more than half of cell sites out of service for 4 straight days. The number of out-of-service cell sites decreased over time, so that less than 20 percent of cell sites were out of service in these counties within a week. Looking more broadly across all counties for which FCC collected data in Florida, Georgia, and Alabama, about 13 percent, 2 percent, and 1 percent of cell sites in the reporting area were out of service 4 days after Hurricane Irma’s landfall, respectively. cause and contributing factor fields. Looking across cause fields, wireless outages citing an accident were most common, particularly from 2010 to 2016, as shown in figure 3. Wireless outages citing a natural disaster were less common, although there were several spikes in the number of outages citing a natural disaster. Some of these spikes correspond with major natural disasters like the derecho affecting Midwest and Mid-Atlantic states in 2012 or Hurricane Matthew in 2016. Manmade events were rarely reported as the cause or contributing factor. Duration of Wireless Outages Attributed to Physical Incidents While less common than accidents, wireless outages attributed to natural disasters lasted much longer than outages attributed to other physical incidents. Specifically, figure 4 shows that outages where a natural disaster was cited as the root cause were often twice as long as outages attributed to an accident or manmade event. From 2009 to 2016, the annual median duration of wireless outages attributed to accidents ranged from 8 hours to 16 hours, compared to natural disasters, which ranged from 19 to 36 hours. Due to this longer duration, wireless outages attributed to natural disasters have a greater impact on the public as it is left without key means of communication for longer periods of time. In addition, an industry association told us that even though public safety officials primarily use dedicated communication networks, like land mobile radio networks, to carry out their work, they also rely on their mobile devices that use commercial wireless networks for maps and other applications. Ten of 24 stakeholders we interviewed said that natural disasters pose the greatest risk to wireless networks as they have the most intense consequences. Natural disasters can result in physical damage to or flooding of critical network components, and fallen trees and debris can temporarily block transportation routes, keeping repair crews from inoperable cell sites and other network components, as described in the Community Resilience Planning Guide for Buildings and Infrastructure Systems. Further, the failure of other systems like commercial power upon which wireless networks depend can lead to cascading failures in communications networks. One industry association we spoke with said that natural disasters are the primary risk to wireless network resiliency as these events usually create the largest outages with the longest durations. Location of Wireless Outages Attributed to Physical Incidents By location, the number of wireless outages attributed to physical incidents increased from 2009 to 2016 in some states, including several of the most populous states such as California and Texas (see fig. 5). Most of the recent expansion of wireless networks has tended to be in the most populous states, as those states contain the most customers and the highest densities of customers, according to FCC officials. In addition, the thresholds for which carriers are required to report wireless outages in NORS are such that many outages that affect primarily rural areas will not accumulate enough user minutes to be reportable. However, the number of wireless outages with a physical incident as the root cause was relatively steady in many states or had spikes that generally corresponded with major natural disasters like the 2012 derecho. For more detailed information on the location of all reported wireless outages that occurred from 2009 through 2016, including the cause and number of users associated with these outages, see an interactive graphic which can be viewed at http://www.gao.gov/products/gao-18-198. Wireless Network Dependencies Power failures and failures in other providers’ networks (e.g., backhaul) played a role in the majority of wireless outages attributed to physical incidents. When an accident, natural disaster, or manmade event was the root cause for an outage, we found that wireless carriers often also reported a failure in one of these two key dependencies for wireless networks: Regarding power, 8 percent of wireless outages with a physical incident as the root cause (465 of 6,002 outages) cited power failure as the direct cause of the outage. Nearly all these outages were attributed to a natural disaster. Regarding failures in other providers’ networks, 87 percent of outages attributed to a physical incident (5,206 of 6,002 outages) were due to a failure in another provider’s network, which includes backhaul connecting cell sites to mobile switching centers and onto the broader network. Most of these outages—4,111—cited an accident (i.e., a digging error resulting in cable damage) as the root cause. In 2014, a working group from an FCC-chartered federal advisory committee concluded that there is little to no shared, last-mile transport infrastructure for backhaul that wireless carriers (or other providers) could share dynamically to mitigate the effect of a backhaul failure. Thus, a backhaul outage will often result in a wireless outage. However, the working group identified existing best practices that providers can employ to help reduce or lessen the impact of failure in last-mile backhaul. Federal Agencies and Industry Have Taken Some Actions to Improve Wireless Network Resiliency, but FCC’s Oversight of Industry Actions Is Limited Federal Agencies Largely Continue to Use Existing Mechanisms to Improve Resiliency Since 2013, FCC and DHS have both continued to take action using a range of existing mechanisms to improve wireless network resiliency. These mechanisms include leading communications-specific planning activities and topic-specific research to develop and to share best practices. While these mechanisms are not new, FCC and DHS report updating and adapting these activities based on emerging needs and lessons learned from exercises and emergency events. FCC and DHS actions include the following: Chartering advisory committees that examine resilience: DHS and FCC charter federal advisory committees that have studied how agencies and industry could improve resiliency. For example, one such committee is FCC’s Communications Security, Reliability, and Interoperability Council (CSRIC), whose members include representatives from wireless carriers and other communications companies, industry associations, and federal, state, and local agencies. CSRIC working groups often develop best practices for industry and make recommendations to wireless carriers, FCC, and others to improve network resiliency. One example is a working group that studied how industry could share backup power resources in 2014. FCC maintains a database of best practices and publicizes these through presentations at conferences and in public reports, as it did in a report on communications outages caused by the 2012 derecho. Six stakeholders we interviewed said best practices represent a valuable means to improve resiliency, as for example, best practices are flexible and enable providers to adapt practices as communications networks evolve. One stakeholder attributed CSRIC’s effectiveness in issuing and promoting best practices and information in part to its affiliation with the industry’s regulator, FCC. Other advisory committees that examined resiliency include DHS’s National Security Telecommunications Advisory Committee and FCC’s Technological Advisory Council. Developing and implementing procedures to respond to physical incidents: DHS leads emergency communications response and recovery efforts, as coordinator for ESF-2. For example, within DHS, the National Coordinating Center for Communications (NCC) holds weekly calls with government and industry partners to exchange information as part of NCC’s work to continuously monitor events that may affect communications. These weekly calls sustain relationships and promote readiness that can be leveraged to coordinate a response to an emergency incident, according to DHS and FCC officials and members of the Communications Sector Coordinating Council. During an incident, NCC reports that it holds these calls on a daily basis to understand the status of wireless and other networks—along with FCC outage data and other information collected from carriers—and to support industry response efforts. For instance, NCC officials said that during an incident they can help carriers find available generators or work with local governments to enable carriers to enter disaster areas to make repairs if carriers are denied access. Two carriers we interviewed said the NCC works well to support industry response to and recovery from incidents, as NCC has established response processes to help the communications sector to coordinate with the power industry. According to DHS, NCC participates in the Energy Priority Restoration Group that is dedicated to determining power restoration priority following an incident. While this group includes many sectors, it enables communications providers to help prioritize power restoration for critical communications components, like mobile switching centers. Analyzing wireless outage data to identify trends and areas for further study: As noted above, FCC collects and regularly analyzes data on wireless outages during the regular course of business and during emergency events. FCC meets with each nationwide wireless carrier annually to discuss trends in the carrier’s outages and any issues related to how the carrier completes NORS reports, according to FCC officials and an industry association we interviewed. FCC also analyzes and shares its analysis of NORS data with industry at quarterly meetings of the Alliance for Telecommunications Industry Solutions’ Network Reliability Steering Committee. Specifically, FCC presents trends in NORS outage data for the last 3 years for different types of outages. Such data include trends in the total number and duration of wireless outages. The Network Reliability Steering Committee, at FCC’s request or its own initiative, establishes teams to examine NORS trends and to make recommendations that may increase network reliability and reduce network outages. Based on this work, the team may identify relevant best practices that carriers could use to reduce or eliminate outages or suggest refining or creating a new best practice. Representatives from two industry associations said that FCC meets with industry to discuss outage data and is receptive to feedback on how to improve data-reporting processes and data quality. In addition to these existing mechanisms, federal agencies have initiated some new activities to enhance wireless network resiliency since 2013. Community Resilience Panel: NIST issued the Community Resilience Planning Guide for Buildings and Infrastructure Systems in October 2015 and sponsors the Community Resilience Panel, which aims to reduce barriers to achieving community resilience by promoting collaboration among stakeholders to strengthen the resilience of buildings, infrastructure, and social systems upon which communities rely. The panel held its first meeting in November 2015. The planning guide provides a process that communities can use to improve their resilience by setting priorities and allocating resources to manage risks based on their prevailing hazards. The guide also devotes sections to key infrastructures; the communications section describes components of communications networks, the regulatory environment, and industry standards that can help inform community planning. The Community Resilience Panel also has a Communication Standing Committee comprised of industry and government members. This committee is currently creating additional resources to support communities, including a methodology that communities could use to involve wireless carriers and other communications providers in resilience planning activities. While communities have started to use the guide, NIST officials said it is too soon to measure or point to specific outcomes attributable to the Community Resilience Panel’s work. Post Hurricane Sandy hearings and proposed rule: In 2013, FCC held field hearings on network reliability and continuity. The goals of the hearings were to improve network resiliency, improve restoration, empower the public, and unleash technological solutions. The two hearings included a wide range of panelists including representatives from FCC and FEMA, state and local agencies, consumer groups, wireless carriers, and other communications providers. Following the hearings, FCC issued a notice of proposed rulemaking to promote transparency to the public on how wireless carriers compare in keeping their networks operational during emergency events. Specifically, FCC’s proposed rule would publicly report the number and percentage of each carrier’s cell sites that remained operational during an emergency event to enable consumers to compare wireless carriers when purchasing service. Based on our review of comments, public safety and consumer groups tended to support the proposed rule while industry expressed concerns, in particular, that the public reporting in the proposed rule would not accurately portray the service available during an emergency or be a useful measure to help consumers choose among wireless carriers. FCC decided not to issue a final rule, stating in December 2016 that a voluntary industry approach, described below, provided a more appropriate path to improve network resiliency. We asked stakeholders about the results of the actions taken by FCC and DHS, and across the 24 stakeholders we interviewed, there was no consensus regarding needed improvements in DHS and FCC guidance, coordination, or research on wireless resiliency. Seven stakeholders said they did not think there were any gaps or needed improvements from FCC, and six stakeholders said they did not think there were any gaps or needed improvements from DHS. Although most stakeholders identified a need for further federal agency action, they tended to identify dissimilar actions. However, the three state and two local agencies we interviewed noted that more real-time data on wireless outages would help aid their efforts to respond to an incident, which we discuss further below. Voluntary Industry Framework Aims to Improve Wireless Network Resiliency, but FCC Has Limited Plans to Monitor This Framework In April 2016, an industry coalition consisting of CTIA, a wireless industry association, and five wireless carriers announced the Wireless Network Resiliency Cooperative Framework (framework) in response to FCC’s 2013 notice of proposed rulemaking on wireless network resiliency. The framework is a voluntary initiative designed to advance wireless service continuity and information sharing during and after emergencies by enhancing coordination and communication, both among carriers and between carriers and government. The framework has five elements; some elements are specific to disaster response while other elements focus on preparedness and education. Industry has taken steps related to all five elements of the framework, as described in table 1. Furthermore, CTIA representatives told us they have ongoing meetings with representatives from the public-safety community, the outcome of which they expected to be a series of best practices concerning planning before disasters, addressing coordination during and after emergencies, and developing education and awareness strategies in fall 2017. The threshold to trigger the response elements is when DHS activates ESF-2 and FCC activates DIRS. At the time of our review, four events—Hurricane Matthew in October 2016 and hurricanes Harvey, Irma, and Maria in late 2017—had met the threshold to trigger the response elements. Prior to the three events in 2017, FCC officials and three stakeholders we interviewed told us it was too soon to know the effectiveness or results of the framework. FCC is responsible for administering policies to improve resiliency, which include monitoring actions taken by industry, and federal standards for internal control state that management should establish and operate monitoring activities, evaluate and document the results of ongoing monitoring, and then identify changes that either have occurred or are needed. Federal standards for internal control also state that agencies should define objectives clearly and that objectives should be in specific and measurable terms that allow for the assessment of performance. In December 2016, FCC said it would continue to engage with industry on the implementation and use of the framework, and FCC has taken some steps to monitor the framework’s implementation. Specifically, FCC developed a plan to track certain tasks related to the framework in August 2017. This plan tracks the completion of initial tasks related to the framework, such as tracking industry’s publication of best practices to enhance municipal preparedness and resiliency, and confirming the five signatory wireless carriers’ commitment to the framework, and notes that FCC will update its emergency response documents to ensure that the documents reflect the framework and include checklists to validate that carriers take these actions during emergency events (e.g. instituting roaming, providing mutual assistance). In August 2017, FCC also issued a public notice inviting carriers beyond the five signatory wireless carriers to sign on to the framework. However, we found FCC’s plan does not include any steps to document and assess the effect of the framework on the resiliency of wireless networks. In particular, FCC’s plan does not track any outputs or outcomes over time that speak to the results of the framework, such as the number of roaming requests made and fulfilled during an emergency event. FCC’s plan to monitor the framework is still new. According to FCC officials, FCC did not decide what division would lead its monitoring of the framework until August 2017 because it needed to determine which division should have responsibility for the framework. Since the plan was created, FCC has met with industry groups and individual carriers to gather additional information and has updated its plan with this information to track implementation tasks. Overall, by monitoring the outputs and outcomes of the framework, FCC could determine where further changes are needed to help ensure that wireless networks are resilient. In 2016, FCC reported that the framework could produce benefits such as bolstering FCC’s situational awareness and providing consumers with a means to hold carriers accountable for service continuity during emergency events. Yet, seven stakeholders we interviewed, including wireless carriers, said the framework largely codified actions that carriers already generally take to prepare for and respond to an emergency event. In addition, comments submitted to FCC in 2016 were split on whether the framework represented a sufficient path forward, and some stakeholders noted specific issues that they believed could limit the effectiveness of the framework, for example: Four stakeholders we interviewed—an industry association, local agency, state agency, and consumer group—cited the lack of federal agency enforcement or monitoring. Two industry associations stated in joint comments that there was no assurance that all carriers would conduct adequate testing to enable roaming under disasters. A local agency said in comments that the threshold to trigger the response elements was too high; as such, carriers would not be- obligated to implement the elements for more local events. Therefore, monitoring the outputs and outcomes of the framework would help FCC understand the effect of industry formalizing these actions in the framework. Furthermore, although FCC and industry documents that describe and endorse the voluntary framework include broad goal statements, there are no specific measures for what the framework hopes to achieve. As a result, FCC lacks specific and measurable terms to monitor the effect of the framework. The CTIA- and carrier-released public summary of the framework said it aims to advance wireless service continuity and information sharing during and after emergencies and disasters, as well as help consumers be better prepared for future disasters. FCC, when endorsing the framework, said it was a reasonable approach to achieve FCC’s stated goals for the 2013 proposed rule, including promoting availability of wireless mobile services in the event of natural disasters and increasing provider transparency around wireless resiliency. FCC officials told us they have not discussed possible measures to monitor the effect of the framework with industry participants. As the creators of the framework, industry participants could provide insight into such measures. However, FCC officials acknowledged that it will be important to determine what the results of the framework have been in light of the 2017 hurricanes, and that developing measures to assess industry’s efforts under the framework would be beneficial. In addition, FCC has not communicated the framework to all state and local public-safety officials and wireless carriers, potentially limiting its effectiveness. At the time of our review, CTIA and the signatory wireless carriers had released a high-level summary of the framework but no additional documentation on the scope of wireless carriers’ obligations under the framework. Based on our interviews, we found that knowledge of the framework was not widespread. Six stakeholders we interviewed, including representatives of state agencies we interviewed and a non-signatory wireless carrier, were either unaware of the framework or unaware of whether industry had taken actions on any elements of the framework since its announcement. For example, a state emergency manager in one state affected by Hurricane Matthew was unaware of the framework and that FCC, based on one element of the framework, had posted daily status updates on wireless service following the hurricane. This manager noted that those updates would be useful for response efforts. Federal standards for internal control state that federal agencies should externally communicate necessary, quality information to achieve the agency’s objectives and that open communication can also help enable a federal agency to obtain information from external parties. Among the stated objectives of FCC is to advise and assist public safety entities on wireless communications issues and to develop and administer policy goals and plans to promote reliable communications for public safety and disaster management. Moreover, one of FCC’s current strategic objectives is to promote access to effective public-safety communications services used by government as well as all consumers in need. To address this and other objectives, FCC stated that it will facilitate discussions and share information among key constituencies. FCC uses several mechanisms and standing forums to share information and educate constituencies. For example, FCC gives presentations about FCC activities at conferences on public safety communications that include state and local officials. In addition, FCC participates in the regular conference calls hosted by DHS’s NCC through which government and industry exchange information and the Network Reliability Steering Committee’s public quarterly meetings, as noted above. Without greater awareness of the framework, state and local public safety officials may continue to be unaware of tools or other improvements available through the framework that could help them prepare for or respond to an emergency, such as the posting of daily updates on the number of out-of-service cell sites or best practices that could aid resilience. Also, smaller and rural (non-signatory) wireless carriers might be unaware of commitments made by the signatory carriers, such as committing to roaming under disasters that could benefit them and the citizens they serve during an emergency event but may require entering into and testing a roaming arrangement. By actively communicating information about the framework, FCC could also increase the likelihood of receiving information from industry or state and local public-safety officials about any implementation issues or positive results from the framework. In August 2017, FCC created a website that summarized the framework and, as noted above, issued a public notice inviting additional carriers to sign on to the framework. Only two carriers, as of October 2017, beyond the carriers involved in creating the framework publicly informed FCC of their intent to participate in the framework. As of October 2017, FCC officials told us they did not have additional plans to promote awareness of the framework, but noted that it would be important to inform relevant stakeholder groups about the framework, especially those who might remain unaware of it. Stakeholders Cited Advantages and Disadvantages for Options Aimed at Improving Wireless Network Resiliency We identified options that federal agencies could take to further improve wireless network resiliency based on agency reports, federal advisory committee recommendations, peer-reviewed literature, and other reports. The options we identified could be implemented either alone or in combination and are not meant to be exhaustive. We categorized them by their aim—preparedness, response, and awareness. FCC, as the regulator for wireless communications, would be the likely agency to implement many of the options, although DHS or other federal agencies could play a role in implementing some of the options. We asked stakeholders to comment on the advantages and disadvantages, including the feasibility—technical, legal, or other—of each option. The tables below describe identified options by category, along with the most frequently cited advantages and disadvantages. FCC has previously suggested and discussed some of these options, most recently during its notice of proposed rulemaking in 2013. FCC noted that its proposed rule sought to comply with guidance from the Office of Management and Budget to use disclosure requirements or transparency measures where possible in place of prescriptive regulations. However, as noted above, FCC declined to issue a final rule, stating that the proposed rule was problematic in light of substantial concerns raised about proposed metrics and disclosure requirements. Preparedness Two options identified in agency reports and literature intend to improve resiliency by focusing on actions to be taken ahead of an emergency or disaster, as described in table 2. Twelve stakeholders we interviewed raised concerns about the feasibility of the option to require a minimum level of backup power at cell sites due to technical or legal issues. In 2007, FCC adopted a requirement for wireless carriers to provide 8 hours of backup power at cell sites. That requirement was vacated after the Office of Management and Budget disapproved the rule’s information collection requirements. In contrast, nine stakeholders we interviewed were more positive about the feasibility of guidance. Further, FCC created the Broadband Deployment Advisory Committee in January 2017 to provide recommendations on how to accelerate broadband deployment. Two of the committee’s five working groups focus on state and local regulatory barriers and model language for state and municipal code, both of which could provide a model for wireless network infrastructure. Response As shown in table 3, agency reports and literature also included options related to response activities during and after an emergency event. For the first option, FCC officials and six stakeholders we interviewed noted that wireless carriers have on occasion opened up their networks in prior emergency situations, which indicates that the option is technically feasible. For the second option, every state and local agency we spoke with noted the value of having real-time information on wireless outages during an emergency event. FCC collects DIRS data, and these data are confidential when provided to FCC. According to FCC, if outage data were shared with a state or local agency, it may be subject to open records laws that provide a means for the public to gain access to government documents. Awareness Other options are intended to improve wireless network resiliency by fostering transparency, as described in table 4. For some options below, transparency would involve making information publicly available so consumers could use this information when choosing a wireless carrier. Such transparency could give industry an incentive to improve the resiliency of their networks. For example, by setting performance standards or requiring wireless carriers to disclose their efforts to improve resiliency, consumers could compare the performance or practices of wireless carriers. However, some of these options would require defining specific parameters, whether a metric or the specific information to disclose, and seven stakeholders we interviewed noted this could be difficult given factors such as the variation in carriers’ wireless networks and the pace of technological change. For other options below, transparency would involve more selectively sharing information with other public safety agencies to improve coordination and aid planning for possible disruptions to wireless networks during emergencies. Conclusions During natural disasters and other emergencies, wireless network outages can make emergency communications, such as making 911 calls, nearly impossible for the vast number of people who rely solely on wireless communications. The wireless industry sought to enhance resiliency by improving the continuity of wireless service and information sharing during and after emergency events by introducing a voluntary framework. Although FCC stated that this voluntary framework would have many benefits, neither industry nor FCC has identified any specific, measurable objectives that could be used to determine whether the framework meets its broad goals, and FCC has limited plans to monitor the framework’s implementation and use. Absent sufficient monitoring, including identifying specific, objective measures for the framework, FCC lacks information on the framework’s outcomes and overall effectiveness; such information could help FCC identify whether it needs to take steps to address challenges or take other action to further promote wireless network resiliency. Furthermore, FCC does not have any plans to actively communicate information about the framework to public safety officials and industry representatives. A concerted effort by FCC to promote awareness of the framework could help more public safety officials and other industry participants use the framework to prepare for or help mitigate the risks to wireless networks posed by natural disasters and other emergencies. Recommendations for Executive Action We are making the following three recommendations to FCC: The Chairman of FCC should work with industry, to the extent practical, to develop specific and measurable objectives for the Wireless Network Resiliency Cooperative Framework, such as outputs to measure the extent of the framework’s use. (Recommendation 1) The Chairman of FCC should develop a plan to monitor the outputs and outcomes of the Wireless Network Resiliency Cooperative Framework and document the results of its monitoring to evaluate its effectiveness and identify whether changes are needed. (Recommendation 2) The Chairman of FCC should promote awareness about the elements of and any outcomes from the Wireless Network Resiliency Cooperative Framework among state and local public safety officials and other industry stakeholders, such as through existing outreach mechanisms and government-industry forums. (Recommendation 3) Agency Comments We provided a draft of this report to FCC, DHS, and the Department of Commerce for comment. In its comments, reproduced in appendix III, FCC agreed with the recommendations. FCC also provided technical comments, which we incorporated as appropriate. DHS and the Department of Commerce had no comments. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees, the Chairman of FCC, the Secretary of Homeland Security, and the Secretary of Commerce. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-2834 or goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. Appendix I: Objectives, Scope, and Methodology This report examines federal agency and industry efforts to improve the resiliency of mobile wireless networks in response to natural disasters and other physical incidents since Hurricane Sandy, a natural disaster that caused significant communications outages across several states in late 2012. Specifically, this report examines: (1) trends in mobile wireless outages attributed to physical incidents since 2009 as reported to the Federal Communications Commission (FCC), (2) the actions federal agencies and industry have taken since 2013 to improve wireless network resiliency, and (3) options that federal agencies could take to improve network resiliency and their advantages and disadvantages. This report focuses on the physical risks facing wireless networks; that is, the potential for an unwanted effect from an incident on a network’s infrastructure like towers, antennas, and switches. Therefore, we did not examine cyber risks facing wireless networks. To determine the trends in wireless outages, we analyzed data from FCC’s Network Outage Reporting System (NORS) on wireless outages that occurred from 2009 through 2016. We chose this timeframe to cover 4 years of data before and after Hurricane Sandy. Communications providers, including wireless carriers, are required in regulation to submit outage reports in NORS for network service disruptions that reach certain thresholds. Given our focus on wireless outages, we examined reports in NORS for outages (1) that were reported by wireless companies that identified themselves as either a wireless carrier or Voice over Internet Protocol (VoIP) provider and (2) that were cited, as the reason the outage was reportable, a reporting requirement applicable to a wireless carrier or VoIP provider in 47 C.F.R. Part 4. We analyzed NORS data for wireless outages to determine the total number and the causes of wireless outages that occurred from 2009 through 2016. FCC provides carriers a list of 19 main categories from which a carrier selects a root cause, direct cause, and contributing factor(s) for an outage. We examined the root cause and direct cause for each wireless outage reported to FCC. We collapsed several of the FCC categories to create 9 categories for ease of presentation. Table 5 shows the crosswalk between the 19 FCC categories and our 9 collapsed categories. We also analyzed the data to identify the share of all wireless outages attributed to a physical incident—that is, a natural disaster (e.g., flooding, earthquake, wildfire); accident (e.g., backhoe cut); or manmade event (e.g., theft, malicious act). FCC provides carriers a list of categories from which they select a root cause, direct cause, and contributing factor(s) for an outage. Using these FCC categories, we created three new categories for natural disasters, accidents, and manmade events (see table 6). We based these three new categories on the description and categorization of physical risks in FCC and DHS reports, including the Communications Sector-Specific Plan. To understand the distribution of causes across all wireless outages in our time frame, we focused primarily on the root cause for each wireless outage. However, we also examined the root and direct cause reported for each outage to better understand the multiple factors that may have led to an outage and to understand wireless network dependencies (e.g., power, backhaul). Finally, we examined the number of outages, by month and by year, for which a wireless carrier reported a physical event as the root cause, direct cause, or contributing factor to better understand the total number of outages related to a physical incident during our time period. We also analyzed other characteristics of wireless outages such as location, duration, and whether the failure occurred in another company’s network. To examine location, we focused on three NORS fields—city, state, and description of location—to identify a city(ies) and state for each outage, and then we determined the latitude and longitude for each outage. We also examined NORS data in conjunction with two other data sets. First, data on events for which FCC activated its Disaster Information Reporting System (DIRS) or “DIRS-lite” to understand any correlation between wireless outages and major physical incidents. Second, data from CTIA’s annual wireless survey on the number of wireless subscribers and other measures of wireless networks’ size to understand any correlation between wireless outages and the size of the wireless industry. To assess the reliability of NORS data, we reviewed FCC’s data glossary and other FCC documentation on the NORS data system and data elements. We interviewed agency officials responsible for collecting and analyzing NORS data to understand the manual and automated controls used to review carrier-reported outage information and any potential limitations in the data. We also reviewed relevant data elements for missing data, outliers, and errors. We found the data were sufficiently reliable for the purpose of describing the number and type of wireless outages reported to FCC that were attributed to a physical incident. To determine the actions federal agencies have taken since 2013 to improve the resiliency of mobile wireless networks, we reviewed reports and documents from FCC, the Department of Homeland Security (DHS), and the National Institute of Standards and Technology (NIST) within the Department of Commerce. Specifically, we reviewed transcripts and papers from hearings and a workshop FCC held in 2013 on communications reliability and continuity. We also analyzed agency orders and comments submitted in FCC’s 2013 proceeding on wireless resiliency. In addition, we reviewed communications sector planning reports, such as the 2015 Communications Sector-Specific Plan and 2013 National Infrastructure Protection Plan, and other DHS communications sector-specific documents, as well as the NIST Community Resilience Planning Guide for Buildings and Infrastructure Systems and related documents. We also examined reports from federal advisory committees and partnership councils that cover wireless network resiliency, including reports from the Technological Advisory Council; Communications, Security, Reliability, and Interoperability Council; National Security Telecommunications Advisory Committee; and the Communications Sector Coordinating Council. To ensure we covered relevant agency actions and to seek any information on the results of these actions, we interviewed officials from DHS’s Office of Cybersecurity and Communications within the National Protection and Programs Directorate, including officials from the Stakeholder Engagement and Cyber Infrastructure Resilience division— the sector-specific agency that leads federal efforts to protect and secure the communications critical infrastructure—and National Cybersecurity and Communications Integration Center—the center that continuously monitors incidents that may impact communications. We also interviewed officials from DHS’s Federal Emergency Management Agency and Science and Technology Directorate, FCC, and NIST. Beyond federal agency officials, we interviewed 24 stakeholders to further understand federal agency and related industry actions to improve wireless network resiliency since 2013 and any results from these actions. Stakeholders included wireless carriers and other owners of wireless network infrastructure, industry associations, consumer groups, and state and local government officials. We selected stakeholders to ensure we covered different perspectives (e.g., industry and consumer groups, associations that represent state and local public safety officials). In particular, we selected industry associations and individual companies to cover both wireless carriers—which operate networks and own some network infrastructure—and communications tower companies—which own and operate towers and sites and then lease space to wireless carriers. We selected wireless carriers to include both nationwide and regional carriers. We selected state agencies to include states directly affected by two events—flooding in Louisiana and Hurricane Matthew— for which industry had implemented elements of the framework at the time we began our review. The views presented in our report are not generalizable to those of all stakeholders. See table 7 for a list of interviewed stakeholders. We reviewed documents describing the Wireless Network Resiliency Cooperative Framework (framework)—a voluntary, industry initiative announced in April 2016. We interviewed CTIA and three of the five wireless carriers that collectively proposed the framework to learn about the impetus for, status of, and any outcomes or lessons learned from use of the framework to date. We also interviewed FCC and DHS about each agency’s awareness of and role monitoring industry use of the framework, and we reviewed FCC plans to monitor and share information about the framework. Finally, we asked stakeholders we interviewed, as described above, about their knowledge of and experience with the framework, including any observed outcomes from its use to date. We assessed FCC’s efforts to monitor implementation of the framework against Standards for Internal Control and FCC’s current strategic plan. To determine what options exist for federal agencies to improve wireless network resiliency, we examined federal agency reports, literature, and other sources. First, we reviewed filings in FCC’s 2013 proceeding examining wireless resiliency, including FCC’s orders and comments filed by various parties, for proposed options that federal agencies could take. Second, we conducted a literature review of peer-reviewed articles, government reports, industry publications, and think tank publications from the last 5 years to identify additional options. Third, we examined reports from the aforementioned federal advisory committees on wireless network resiliency, the NIST Community Resilience Planning Guide for Buildings and Infrastructure Systems, and the Hurricane Sandy Rebuilding Task Force for recommendations made to federal agencies to enhance wireless network resiliency. From these sources, we identified 11 proposed options that federal agencies could take to improve wireless network resiliency. We eliminated one option—requiring wireless carriers to disclose outage information to the public—as this was the only option that FCC specifically proposed as a new rule in its 2013 proceeding, but ultimately FCC decided not to move forward on this proposal when it decided to not issue a final rule. The identified options were primarily those that FCC could implement, as FCC is the regulatory agency for wireless communications, although DHS or NIST could implement several of the options. We interviewed a variety of stakeholders, described above, to obtain their views on the advantages, disadvantages, and feasibility of each of the identified options. We used open-ended questions to solicit input on each option rather than provide a list of advantages and disadvantages to stakeholders. We also asked stakeholders if there were additional options for federal agencies to ensure we had a thorough list of options for federal agencies. Based on interviews with stakeholders and federal agencies, we decided not to present two options in our report—establish more formal, ongoing collaboration between wireless carriers and power companies and create a program to facilitate collaborative restoration between wireless carriers and power companies—as federal agencies told us they were already taking actions on these fronts. Therefore, we included federal agencies’ actions related to these two options while describing actions taken by federal agencies since 2013. We analyzed information collected through the interviews with stakeholders to identify the most commonly cited advantages and disadvantages, and to determine the number of stakeholders that supported or did not support each option. The information collected from stakeholder interviews is not generalizable to all industry stakeholders. Appendix II: Analysis of FCC Data on Wireless Outages The figures below provide results from our analysis of Federal Communications Commission (FCC) data on wireless outages from 2009 through 2016. The data is from the Network Outage Reporting System (NORS), the system that wireless carriers and other communications providers use to report information on outages meeting certain threshold as required by regulation. The figures below present information on the number, cause, and duration of all wireless outages reported to FCC for this period. To describe wireless outages by cause, we use nine categories that collapse several of the FCC categories from which wireless carriers select the root cause, direct cause, and contributing factor(s) when reporting an outage. The following provides a brief description of these nine categories. Appendix I contains information on the scope and methodology for this analysis, including these nine collapsed categories. Cable damage/failure includes outages caused by an error locating or digging that resulted in cable damage, by an aerial cable that was damaged or ceased to function, and by loss of transmission in a cable due to aging, among other causes. FCC categories: cable damage, cable damage/malfunction. Equipment failure contains outages caused by the failure of a hardware component (e.g., circuit pack or card in a processor) or by a problem with the design of firmware, hardware, or software (e.g., failure for firmware to reset or restore after initialization, logical errors in software). FCC categories: design-firmware, design-hardware, design-software, hardware failure. Network robustness includes outages caused by, for example, a failure to provide or maintain diversity, thus preventing single points of failure. FCC categories: diversity failure, simplex condition. Maintenance includes outages caused by a needed spare part not being on hand or available, a vendor or contractor lacking updated procedures for its work, a service provider not providing adequate or up-to-date training, and scheduled maintenance to upgrade a network component or fix a known problem, among other causes. FCC categories: spare, procedural-other vendor/contractor, procedural- service provider, procedural-system vendor, planned maintenance. External environmental contains outages caused by earthquakes, wildfires, flooding, and other natural disasters as well as vandalism, theft, vehicle accidents that impair or destroy a component, and animal damage. FCC category: environment (external). Internal environmental contains outages caused by contamination due to dirt or dust that leads to overheating, by water entering manholes or vaults that destroys or impairs a component, and by other damage related to the condition of buildings and structures housing network equipment. FCC category: environment (internal). Other/Insufficient data includes outages for which there is not enough information for a failure report or investigation to determine the cause of the failure, service was restored before the cause could be determined, and the cause cannot be determined or proven. FCC categories: insufficient data, other/unknown. Power failure includes outages due to a commercial power failure (including power failures that extend beyond any backup power capabilities), a generator running out of fuel, a power system that was insufficiently sized for its purpose, and batteries not functioning as designed. FCC category: power failure (commercial and/or backup). Traffic/System overload contains outages where a network is overloaded or congested because of an unplanned, external event, or because of under-engineering the network due to changing demand or technologies. FCC category: traffic/system overload. Appendix III: Comments from the Federal Communications Commission . Appendix IV: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contacts named above, Sally Moino (Assistant Director); Joanie Lofgren (Analyst in Charge); Enyinnaya David Aja; Stephen Brown; David Hooper; Richard Hung; Joshua Ormond; Amy Rosewarne; Andrew Stavisky; and Timothy Young made key contributions to this report. Jon Ludwigson, John Mortin, Mark Pross, Pam Snedden, James R Sweetman, Jr., and Joe Thompson also made contributions to this report.
target: Americans increasingly rely on mobile wireless communications for safety-related communications like calling 911 and receiving weather alerts. Mobile wireless networks face risks from physical incidents including extreme weather events and intentional and accidental damage. For example, in 2017 several major hurricanes damaged wireless network infrastructure, leaving many U.S. citizens without reliable access to wireless communications. GAO was asked to review federal efforts to improve the resiliency of wireless networks following natural disasters and other physical incidents. This report examines: (1) trends in mobile wireless outages reported to FCC since 2009 and (2) actions federal agencies and industry have taken since 2013 (after Hurricane Sandy) to improve wireless network resiliency, among other objectives. GAO analyzed wireless outage data from 2009 to 2016 (4 years before and after Hurricane Sandy); reviewed FCC, DHS, and industry documents; and interviewed stakeholders who represented a variety of perspectives, such as industry, public safety, and consumer groups. GAO assessed FCC's efforts to monitor an industry initiative to improve wireless network resiliency against federal internal control standards. The number of wireless outages attributed to a physical incident—a natural disaster, accident, or other manmade event, such as vandalism—increased from 2009 to 2016, as reported to the Federal Communications Commission (FCC). During this time, the number of outages substantially increased from 189 to 1,079 outages, with most of the increase occurring from 2009 to 2011. FCC officials said this increase was due in part to growth in wireless customers and wireless infrastructure. Almost all outages attributed to a physical incident were due to an accident, such as damage to a cable due to a digging error (74 percent) or a natural disaster (25 percent). However, outages due to a natural disaster had a longer median duration (ranging from 19 to 36 hours), which was more than twice as long as outages caused by an accident. Power failures and failures in other providers' networks also play a role in wireless outages attributed to physical incidents. For instance, carriers reported that 87 percent of wireless outages attributed to a physical incident were due to a failure in another provider's network on which they rely. Since 2013, federal agencies and industry have taken actions to improve the resiliency of wireless networks. For example, the Department of Homeland Security (DHS) and FCC charter federal advisory committees that have examined resiliency issues and potential solutions, such as sharing infrastructure during emergencies. FCC also proposed a rule that would disclose how individual wireless carriers' networks performed during emergency events. In response, an industry coalition announced an initiative—the Wireless Network Resiliency Cooperative Framework—whereby carriers agreed to allow roaming on each other's networks and aggregated statistics to be published on how networks performed during emergency events. This initiative prompted FCC to not adopt its proposed rule. FCC said it would engage with industry about the framework's implementation and use, but FCC has limited formal plans to oversee or spread knowledge of the framework: FCC developed a plan to track the completion of initial implementation tasks outlined in the framework, but this plan does not include steps to track or evaluate any outputs or outcomes from the framework. FCC and industry documents describe broad goals for the framework, such as advancing information sharing during and after emergency events, but neither FCC nor industry has set any specific measures to help determine whether the framework achieves these broad goals. Although some public safety officials and other stakeholders GAO contacted were not aware of the framework, FCC did not have plans to actively communicate information about the framework to these audiences. More robust measures and a better plan to monitor the framework would help FCC collect information on the framework and evaluate its effectiveness. Such steps could help FCC address any challenges or decide whether further action is needed. Also, by promoting awareness about the framework, FCC would help public safety officials and other industry participants to be well positioned to use the framework to help them prepare for or respond to emergency events.