Information Security: Better Implementation of Controls for Mobile Devices Should Be Encouraged
Published: 2012-09-18T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Millions of Americans currently use mobile devicese.g., cellphones, smartphones, and tablet computerson a daily basis to communicate, obtain Internet-based information, and share their own information, photographs, and videos. Given the extent of consumer reliance on mobile interactions, it is increasingly important that these devices be secured from expanding threats to the confidentiality, integrity, and availability of the information they maintain and share.
Accordingly, GAO was asked to determine (1) what common security threats and vulnerabilities affect mobile devices, (2) what security features and practices have been identified to mitigate the risks associated with these vulnerabilities, and (3) the extent to which government and private entities have been addressing the security vulnerabilities of mobile devices. To do so, GAO analyzed publically available mobile security reports, surveys related to consumer cybersecurity practices, as well as statutes, regulations, and agency policies; GAO also interviewed representatives from federal agencies and private companies with responsibilities in telecommunications and cybersecurity.
section_title: What GAO Found
paragraphs: Threats to the security of mobile devices and the information they store and process have been increasing significantly. For example, the number of variants of malicious software, known as malware, aimed at mobile devices has reportedly risen from about 14,000 to 40,000 or about 185 percent in less than a year (see figure). Cyber criminals may use a variety of attack methods, including intercepting data as they are transmitted to and from mobile devices and inserting malicious code into software applications to gain access to users sensitive information. These threats and attacks are facilitated by vulnerabilities in the design and configuration of mobile devices, as well as the ways consumers use them. Common vulnerabilities include a failure to enable password protection and operating systems that are not kept up to date with the latest security patches.
Mobile device manufacturers and wireless carriers can implement technical features, such as enabling passwords and encryption to limit or prevent attacks. In addition, consumers can adopt key practices, such as setting passwords and limiting the use of public wireless connections for sensitive transactions, which can significantly mitigate the risk that their devices will be compromised.
Federal agencies and private companies have promoted secure technologies and practices through standards and public private partnerships. Despite these efforts, safeguards have not been consistently implemented. Although the Federal Communications Commission (FCC) has facilitated public-private coordination to address specific challenges such as cellphone theft, it has not yet taken similar steps to encourage device manufacturers and wireless carriers to implement a more complete industry baseline of mobile security safeguards. In addition, many consumers still do not know how to protect themselves from mobile security vulnerabilities, raising questions about the effectiveness of public awareness efforts. The Department of Homeland Security (DHS) and National Institute of Standards and Technology (NIST) have not yet developed performance measures or a baseline understanding of the current state of national cybersecurity awareness that would help them determine whether public awareness efforts are achieving stated goals and objectives.
section_title: What GAO Recommends
paragraphs: GAO recommends that FCC encourage the private sector to implement a broad, industry-defined baseline of mobile security safeguards. GAO also recommends that DHS and NIST take steps to better measure progress in raising national cybersecurity awareness. The FCC, DHS, and NIST generally concurred with GAOs recommendations.

section_title: Letter
paragraphs: Millions of Americans currently use mobile devices—cellphones,  smartphones, and tablet computers—on a daily basis to communicate,  obtain Internet-based information, and share information, photographs,  and videos. Dramatic recent advances in the technical capabilities of  mobile devices have paved the way for increased connectivity. As a  result, consumers can now carry out a broad range of interactions,  including sensitive transactions, which previously required the use of a  desktop or laptop computer. Given the extent of consumer reliance on  mobile interactions, it is increasingly important that these devices be  secured from threats to the confidentiality, integrity, and availability of the  information they maintain and share.
Accordingly, our objectives were to determine: (1) what common security  threats and vulnerabilities affect mobile devices, (2) what security  features and practices have been identified to mitigate the risks  associated with these vulnerabilities, and (3) the extent to which  government and private entities have been addressing the security  vulnerabilities of mobile devices. To assess common security threats and  vulnerabilities as well as security controls and practices to address them,  we obtained and reviewed published analyses and guidance, including  databases of mobile security vulnerabilities. We also interviewed  representatives from federal agencies and private companies with  responsibilities in the telecommunications and cybersecurity fields to  obtain current information about threats and vulnerabilities. To determine  the extent to which the government and private entities are addressing  vulnerabilities, we analyzed statutes, regulations, agency policies, and  technical standards. We also interviewed officials from federal agencies  and private companies to identify actions taken to address mobile  security, such as developing guidance and sharing information.
We conducted this performance audit from November 2011 to September  2012 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that the  evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives. Appendix I contains additional  details on the objectives, scope, and methodology of our review.
subsections: section_title: Background
paragraphs: Consumer adoption of mobile devices is growing rapidly, enabled by  affordable prices, increasingly reliable connections, and faster  transmission speeds. According to a recent analysis, mobile devices are  the fastest growing consumer technology, with worldwide sales increasing  from 300 million in 2010 to an estimated 650 million in 2012. Advances  in computing technology have resulted in increased speed and storage  capacity for mobile devices. The advances have enhanced consumers’  abilities to perform a wide range of online tasks. While these devices  provide many productivity benefits to consumers and organizations, they  also pose security risks if not properly protected.
subsections: section_title: A Variety of Entities Provide Products and Services to Consumers
paragraphs: Several different types of private sector entities provide products and  services that are used by consumers as part of a seamless mobile  telecommunications system. These entities include mobile device  manufacturers, operating system developers, application developers, and  wireless carriers.
WiFi and Bluetooth are commonly used technologies that allow an electronic device to  exchange data wirelessly (using radio waves) with other devices and computer networks. recent report,January 2012.
Google Inc.  led the development of Android, an operating system for mobile  devices, based on the Linux operating system. Android, like Linux, is  an “open” operating system, meaning that its software code is publicly  available and can be tailored to the needs of individual devices and  telecommunications carriers. Thus, many different tailored versions of  the software are in use. To run on Android devices, software  applications need to be digitally signed by the developer, who is  responsible for the application’s behavior. Android applications are  made available on third-party application marketplaces, websites, and  on the online official Android application store called Google Play.
Research In Motion, Corp. Research In Motion developed a  proprietary operating system for its BlackBerry mobile devices.  Although a proprietary system, it can run any third-party applications  that are written in Java.
Applications are tested by Research In  Motion before users can download them. In addition, any application  given access to sensitive data or features when installed is required  by Research In Motion to be digitally signed by the developer.  BlackBerry applications are available for download on the online store  called BlackBerry App World.
Mobile application developers develop the software applications that  consumers interact with directly. In many cases, these applications  provide the same services that are available through traditional websites,  such as news and information services, online banking, shopping, and  electronic games. Other applications are designed to take into account a  user’s physical location to provide tailored information or services, such  as information about nearby shops, restaurants, or other elements of the  physical environment.
Wireless carriers manage telecommunications networks and provide  phone services, including mobile devices, directly to consumers. While  carriers do not design or manufacture their own mobile devices, in some  cases they can influence the design and the features of other  manufacturers’ products because they control sales and interactions with  large numbers of consumers. Major wireless carriers with the largest total  market shares in the United States include Verizon Wireless, AT&T Inc.,  Sprint, and T-Mobile USA Inc.
Carriers provide basic telephone service through wireless cellular  networks which cover large distances. However, other types of shorter- range wireless networks may also be used with mobile devices. These  shorter-range networks may be supported by the same carriers or by  different providers. Major types of wireless networks include cellular  networks, WiFi networks, and wireless personal area networks.
Cellular networks. Cellular networks are managed by carriers and  provide coverage based on dividing a large geographical service area  into smaller areas of coverage called “cells.” The cellular network is a  radio network distributed over the cells and each cell has a base  station equipped with an antenna to receive and transmit radio signals  to mobile phones within its coverage area. A mobile device’s  communications are generally associated with the base station of the  cell in which it is located. Each base station is linked to a mobile  telephone switching office, which is also connected to the local  wireline telephone network. The mobile phone switching office directs  calls to the desired locations, whether to another mobile phone or a  traditional wireline telephone. This office is responsible for switching  calls from one cell to another in a smooth and seamless manner as  consumers change locations during a call. Figure 1 depicts the key  components of this cellular network.
WiFi networks. WiFi networking nodes may be established by  businesses or consumers to provide networking service within a  limited geographic area, such as within a home, office, or place of  business. They are generally composed of two basic elements:  access points and wireless-enabled devices, such as smart phones  and tablet computers. These devices use radio transmitters and  receivers to communicate with each other. Access points are  physically wired to a conventional network and provide a means for  wireless devices to connect to them. WiFi networks conform to the  Institute of Electrical and Electronics Engineers 802.11 standards.
Other wireless personal area networks. Other wireless personal  area networks may be used that do not conform to the WiFi standard.  For example, the Bluetooth standard is often used to establish connectivity with nearby components, such as headsets or computer  keyboards.
section_title: Federal Agencies Have Roles in Addressing Mobile Security
paragraphs: While federal agencies are not responsible for ensuring the security of  individual mobile devices, several are involved in activities designed to  address and promote cybersecurity and mobile security in general.
The Department of Commerce (Commerce) is responsible under   in coordination with  Homeland Security Presidential Directive 7other federal and nonfederal entities, for improving technology for  cyber systems and promoting efforts to protect critical infrastructure.  Within Commerce, the National Institute of Standards and Technology  (NIST) is responsible for developing information security standards  and guidelines, including minimum requirements for unclassified  federal information systems, as part of its statutory responsibilities  under the Federal Information Security Management Act (FISMA).  For example, NIST has developed guidelines on cellphone and  Bluetooth security. These standards and guidelines are generally  made available to the public and can be used by both the public and  private sectors. NIST also serves as the lead federal agency for  coordinating the National Initiative for Cybersecurity Education (NICE)  with other agencies. According to NIST, NICE seeks to establish an  operational, sustainable, and continually improving cybersecurity  education program for the nation. NICE includes an awareness  initiative, which is led by the Department of Homeland Security (DHS),  which focuses on boosting national cybersecurity awareness through  public service campaigns to promote cybersecurity and responsible  use of the Internet, and making cybersecurity a popular educational  and career pursuit for older students. As we previously reported,  NIST developed a draft strategic plan for the NICE initiative. This plan  includes strategic goals, supporting objectives, and related activities  for the awareness component. Specifically, the draft strategic plan  calls for (1) improving citizens’ knowledge to allow them to make  smart choices as they manage online risk, (2) improving knowledge of  cybersecurity within organizations so that resources are well applied  to meet the most obvious and serious threats, and (3) enabling  access to cybersecurity resources. The plan also identifies supporting  activities and products designed to support the overarching goal, such  as the “Stop. Think. Connect.” awareness campaign.
According to Commerce’s National Telecommunications and  Information Administration (NTIA), it serves as the President’s  principal adviser on telecommunications policies pertaining to  economic and technological advancement and to the regulation of the  telecommunications industry, including mobile telecommunications.  NTIA is responsible for coordinating telecommunications activities of  the executive branch and assisting in the formulation of policies and  standards for those activities, including considerations of  interoperability, privacy, security, spectrum use, and emergency  readiness.
Federal law and policy tasks DHS with critical infrastructure protection  responsibilities that include creating a safe, secure, and resilient cyber  environment in conjunction with other federal agencies, other levels of  government, international organizations, and industry. The National  Strategy to Secure Cyberspace tasked DHS as the lead agency in  promoting a comprehensive national awareness program to empower  Americans to secure their own parts of cyberspace. Consistent with  that tasking, DHS is currently leading the awareness component of  NICE.
The Federal Communications Commission’s (FCC) role in mobile  security stems from its broad authority to regulate interstate and  international communications, including for the purpose of “promoting   In addition, FCC has established the  safety of life and property.” Communications, Security, Reliability, and Interoperability Council  (CSRIC). CSRIC is a federal advisory committee whose mission is to  provide recommendations to FCC to help ensure, among other things,  secure and reliable communications systems, including  telecommunications, media, and public safety. A previous CSRICincluded a working group that was focused on identifying  cybersecurity best practices (including mobile security practices), and  had representation from segments of the communications industry  and public safety communities. The current CSRIC has focused on  the development and implementation of best practices related to  several specific cybersecurity topics. FCC has also established a  Technological Advisory Council, which includes various working  groups, one of which has been working since March 2012 to identify,  prioritize, and analyze mobile security and privacy issues.
The Federal Trade Commission (FTC) promotes competition and  protects the public by, among other things, bringing enforcement  actions against entities that engage in unfair or deceptive acts or  practices. An unfair act is an act or practice that causes or is likely to  cause substantial injury to consumers that is not reasonably avoidable  by consumers and is not outweighed by countervailing benefits to  consumers or to competition. A deceptive act or practice occurs if  there is a representation, omission, or practice that is likely to mislead  the consumer acting reasonably in the circumstances, to the  consumer’s detriment. According to FTC, its authority to bring  enforcement actions covers many of the entities that provide mobile  products and services to consumers, including mobile device  manufacturers, operating system developers, and application  developers. FTC’s jurisdiction also extends to wireless carriers when  they are not engaged in common carrier activities. For example,  mobile phone operators engaging in mobile payments functions such  as direct-to-carrier billing are under FTC’s jurisdiction.
The Department of Defense (DOD) is responsible for security  systems, including mobile devices that use its networks or contain  DOD data. While it has no responsibility with regards to consumer  mobile devices, its guidance can be useful for consumers. For  example, the DOD Security Technical Implementation Guides are  available to the public. These guides contain technical guidance to  secure information systems or software that might otherwise be  vulnerable to a malicious computer attack. In addition, certain guides  address aspects of mobile device security.
The Office of Management and Budget (OMB) is responsible for  overseeing and providing guidance to federal agencies on the use of  information technology, which can include mobile devices. One OMB  memorandum to federal agencies, for example, instructs agencies to  properly safeguard information stored on federal systems (including  mobile devices) by requiring the use of encryption and a “time-out”  function for re-authentication after 30 minutes of inactivity.
section_title: Mobile Devices Face a Broad Range of Security Threats and Vulnerabilities
paragraphs: Threats to the security of mobile devices and the information they store  and process have been increasing significantly. Many of these threats  are similar to those that have long plagued traditional computing devices  connected to the Internet. For example, cyber criminals and hackers have  a variety of attack methods readily available to them, including using  software tools to intercept data as they are transmitted to and from a  mobile device, inserting malicious software code into the operating  systems of mobile devices by including it in seemingly harmless software  applications, and using e-mail phishing techniques to gain access to  mobile-device users’ sensitive information. The significance of these  threats, which are growing in number and kind, is magnified by the  vulnerabilities associated with mobile devices. Common vulnerabilities  in mobile devices include a failure to enable password protection, the lack  of the capability to intercept malware, and operating systems that are not  kept up to date with the latest security patches.
subsections: section_title: Attacks on Mobile Devices Are Increasing
paragraphs: Cyber-based attacks against mobile devices are evolving and increasing.  Examples of recent incidents include:  In May 2012, a regulatory agency in the United Kingdom fined a  company for distributing malware versions of popular gaming  applications that triggered mobile devices to send costly text  messages to a premium-rate telephone number.
In February 2012, a cybersecurity firm, Symantec Corporation,  reported that a large number of Android devices in China were  infected with malware that connected them to a botnet.operator was able to remotely control the devices and incur charges  on user accounts for premium services such as sending text  messages to premium numbers, contacting premium telephony  services, and connecting to pay-per-view video services. The number  of infected devices able to generate revenue on any given day ranged  from 10,000 to 30,000, enough to potentially net the botnet’s operator  millions of dollars annually if infection rates were sustained.
In January 2012, an antivirus company reported that hackers had  subverted the search results for certain popular mobile applications so  that they would redirect users to a web page where they were  encouraged to download a fake antivirus program containing  malware.
In October 2011, FTC reached a settlement of an unfair practice case  with a company after alleging that its mobile application was likely to  cause consumers to unwittingly disclose personal files, such as  pictures and videos, stored on their smartphones and tablet  computers. The company had configured the application’s default  settings so that upon installation and set-up it would publicly share  users’ photos, videos, documents, and other files stored on those  devices.
Symantec Corporation, Internet Security Threat Report, 2011 Trends Vol.17 (Mountain  View, Calif.: April 2012). an estimated half million to one million people had malware on their  Android devices in the first half of 2011; and
3 out of 10 Android owners are likely to encounter a threat on their  device each year as of 2011.
According to a networking technology company, Juniper Networks,  malware aimed at mobile devices is increasing. For example, the number  of variants of malicious software, known as “malware,” aimed at mobile  devices has reportedly risen from about 14,000 to 40,000, a 185 percent  increase in less than a year. Figure 2 shows the increase in malware  variants between July 2011 and May 2012.
The increasing prevalence of attacks against mobile devices makes it  important to assess and understand the nature of the threats they face  and the vulnerabilities these attacks exploit.
section_title: Sources of Threats and Attack Methods Vary
paragraphs: Mobile devices face a range of cybersecurity threats. These threats can  be unintentional or intentional. Unintentional threats can be caused by  software upgrades or defective equipment that inadvertently disrupt  systems. Intentional threats include both targeted and untargeted attacks  from a variety of sources, including botnet operators, cyber criminals,  hackers, foreign nations engaged in espionage, and terrorists. These  threat sources vary in terms of the capabilities of the actors, their  willingness to act, and their motives, which can include monetary gain or  political advantage, among others. For example, cyber criminals are using  various attack methods to access sensitive information stored and  transmitted by mobile devices.
Table 1 summarizes those groups or individuals that are key sources of  threats for mobile devices.
These threat sources may use a variety of techniques, or exploits, to gain  control of mobile devices or to access sensitive information on them.  Common mobile attacks are presented in table 2.
Attacks against mobile devices generally occur through four different  channels of activities:
Software downloads. Malicious applications may be disguised as a  game, device patch, or utility, which is available for download by  unsuspecting users and provides the means for unauthorized users to  gain unauthorized use of mobile devices and access to private  information or system resources on mobile devices.
Visiting a malicious website. Malicious websites may automatically  download malware to a mobile device when a user visits. In some  cases, the user must take action (such as clicking on a hyperlink) to  download the application, while in other cases the application may  download automatically.
Direct attack through the communication network. Rather than  targeting the mobile device itself, some attacks try to intercept  communications to and from the device in order to gain unauthorized  use of mobile devices and access to sensitive information.
Physical attacks. Unauthorized individuals may gain possession of  lost or stolen devices and have unauthorized use of mobile devices  and access sensitive information stored on the device.
section_title: A Range of Vulnerabilities Facilitate Attacks
paragraphs: Mobile devices are subject to numerous security vulnerabilities, including  a failure to enable password protection, the inability to intercept malware,  and operating systems that are not kept up to date with the latest security  patches. While not a comprehensive list of all possible vulnerabilities, the  following 10 vulnerabilities can be found on all mobile platforms.
Mobile devices often do not have passwords enabled. Mobile  devices often lack passwords to authenticate users and control  access to data stored on the devices. Many devices have the  technical capability to support passwords, personal identification  numbers (PIN), or pattern screen locks for authentication. Some  mobile devices also include a biometric reader to scan a fingerprint for  authentication. However, anecdotal information indicates that  consumers seldom employ these mechanisms. Additionally, if users  do use a password or PIN they often choose passwords or PINs that  can be easily determined or bypassed, such as 1234 or 0000. Without  passwords or PINs to lock the device, there is increased risk that  stolen or lost phones’ information could be accessed by unauthorized  users who could view sensitive information and misuse mobile  devices.
Two-factor authentication is not always used when conducting  sensitive transactions on mobile devices. According to studies,  consumers generally use static passwords instead of two-factor  authentication when conducting online sensitive transactions while  using mobile devices. Using static passwords for authentication has  security drawbacks: passwords can be guessed, forgotten, written  down and stolen, or eavesdropped. Two-factor authentication  generally provides a higher level of security than traditional passwords  and PINs, and this higher level may be important for sensitive  transactions. Two-factor refers to an authentication system in which  users are required to authenticate using at least two different  “factors”—something you know, something you have, or something  you are—before being granted access. Mobile devices themselves  can be used as a second factor in some two-factor authentication  schemes. The mobile device can generate pass codes, or the codes  can be sent via a text message to the phone. Without two-factor  authentication, increased risk exists that unauthorized users could  gain access to sensitive information and misuse mobile devices.
Wireless transmissions are not always encrypted. Information  such as e-mails sent by a mobile device is usually not encrypted while  in transit. In addition, many applications do not encrypt the data they  transmit and receive over the network, making it easy for the data to  be intercepted. For example, if an application is transmitting data over  an unencrypted WiFi network using hypertext transfer protocol (http)  (rather than secure http), the data can be easily intercepted. When a  wireless transmission is not encrypted, data can be easily intercepted  by eavesdroppers, who may gain unauthorized access to sensitive  information.
Mobile devices may contain malware. Consumers may download  applications that contain malware. Consumers download malware  unknowingly because it can be disguised as a game, security patch,  utility, or other useful application. It is difficult for users to tell the  difference between a legitimate application and one containing  malware. For example, figure 3 shows how an application could be  repackaged with malware and a consumer could inadvertently  download it onto a mobile device.
Mobile devices often do not use security software. Many mobile  devices do not come preinstalled with security software to protect  against malicious applications, spyware, and malware-based attacks.  Further, users do not always install security software, in part because  mobile devices often do not come preloaded with such software.  While such software may slow operations and affect battery life on  some mobile devices, without it, the risk may be increased that an  attacker could successfully distribute malware such as viruses,  Trojans, spyware, and spam, to lure users into revealing passwords or  other confidential information.
Operating systems may be out-of-date. Security patches or fixes  for mobile devices’ operating systems are not always installed on  mobile devices in a timely manner. It can take weeks to months  before security updates are provided to consumers’ devices.  Depending on the nature of the vulnerability, the patching process  may be complex and involve many parties. For example, Google  develops updates to fix security vulnerabilities in the Android OS, but  it is up to device manufacturers to produce a device-specific update  incorporating the vulnerability fix, which can take time if there are  proprietary modifications to the device’s software. Once a  manufacturer produces an update, it is up to each carrier to test it and  transmit the updates to consumers’ devices. However, carriers can be  delayed in providing the updates because they need time to test  whether they interfere with other aspects of the device or the software  installed on it.
In addition, mobile devices that are older than 2 years may not receive  security updates because manufacturers may no longer support these  devices. Many manufacturers stop supporting smartphones as soon  as 12 to 18 months after their release. Such devices may face  increased risk if manufacturers do not develop patches for newly  discovered vulnerabilities.
Software on mobile devices may be out-of-date. Security patches  for third-party applications are not always developed and released in a  timely manner. In addition, mobile third-party applications, including  web browsers, do not always notify consumers when updates are  available. Unlike traditional web browsers, mobile browsers rarely get  updates. Using outdated software increases the risk that an attacker  may exploit vulnerabilities associated with these devices.
Mobile devices often do not limit Internet connections. Many  mobile devices do not have firewalls to limit connections. When the  device is connected to a wide area network it uses communications  ports to connect with other devices and the Internet. These ports are  similar to doorways to the device. A hacker could access the mobile  device through a port that is not secured. A firewall secures these ports  and allows the user to choose what connections he or she wants to  allow into the mobile device. The firewall intercepts both incoming and  outgoing connection attempts and blocks or permits them based on a  list of rules. Without a firewall, the mobile device may be open to  intrusion through an unsecured communications port, and an intruder  may be able to obtain sensitive information on the device and misuse it.
Mobile devices may have unauthorized modifications. The  process of modifying a mobile device to remove its limitations so  consumers can add additional features (known as “jailbreaking” or  “rooting”) changes how security for the device is managed and could  increase security risks. Jailbreaking allows users to gain access to the  operating system of a device so as to permit the installation of  unauthorized software functions and applications and/or to not be tied  to a particular wireless carrier. While some users may jailbreak or root  their mobile devices specifically to install security enhancements such  as firewalls, others may simply be looking for a less expensive or  easier way to install desirable applications. In the latter case, users  face increased security risks, because they are bypassing the  application vetting process established by the manufacturer and thus  have less protection against inadvertently installing malware. Further,  jailbroken devices may not receive notifications of security updates  from the manufacturer and may require extra effort from the user to  maintain up-to-date software.
Communication channels may be poorly secured. Having  communication channels, such as Bluetooth communications, “open”  or in “discovery” mode (which allows the device to be seen by other  Bluetooth-enabled devices so that connections can be made) could  allow an attacker to install malware through that connection, or  surreptitiously activate a microphone or camera to eavesdrop on the  user. In addition, using unsecured public wireless Internet networks or  WiFi spots could allow an attacker to connect to the device and view  sensitive information.
In addition, connecting to an unsecured WiFi network could allow an  attacker to access personal information from a device, putting users at  risk for data and identity theft. One type of attack that exploits the WiFi  network is known as man-in-the-middle, where an attacker inserts  himself in the middle of the communication stream and steals  information. For example, figure 4 depicts a man-in-the-middle attack  using an unsecured WiFi network. As a result, an attacker within  range could connect to a user’s mobile device and access sensitive  information.
The number and variety of threats aimed at mobile devices combined with  the vulnerabilities in the way the devices are configured and used by  consumers means that consumers face significant risks that the proper  functioning of their devices as well as the sensitive information contained  on them could be compromised.
section_title: Security Controls and Practices Identified by Experts Can Reduce Vulnerabilities
paragraphs: Mobile device manufacturers and wireless carriers can implement a  number of technical features, such as enabling passwords and  encryption, to limit or prevent attacks. In addition, consumers can adopt  key practices, such as setting passwords, installing software to combat  malware, and limiting the use of public wireless connections for sensitive  transactions, which also can significantly mitigate the risk that their  devices will be compromised.
subsections: section_title: Security Controls for Mobile Devices
paragraphs: Table 3 outlines security controls that can be enabled on mobile devices  to help protect against common security threats and vulnerabilities. The  security controls and practices described are not a comprehensive list,  but are consistent with recent studies and guidance from NIST and  DHS, as well as recommended practices identified by the FCC CSRIC  advisory committee. In addition, security experts, device manufacturers,  and wireless carriers agreed that the security controls and practices  identified are comprehensive and are in agreement with the lists.  Appendix III provides links to federal websites that provide information on  mobile security.
Organizations may face different issues than individual consumers and  thus may need to have more extensive security controls in place. For  example, organizations may need additional security controls to protect  proprietary and other confidential business data that could be stolen from  mobile devices and need to ensure that mobile devices connected to the  organization’s network do not threaten the security of the network itself.  Table 4 outlines controls that may be appropriate for organizations to  implement to protect their networks, users, and mobile devices.
In addition to using mobile devices with security controls enabled,  consumers can also adopt recommended security practices to mitigate  threats and vulnerabilities. Table 5 outlines security practices consumers  can adopt to protect the information on their devices. The practices are  consistent with guidance from NIST and DHS, as well as recommended  practices identified by FCC’s CSRIC advisory committee.
Organizations also benefit from establishing security practices for mobile  device users. Table 6 outlines additional security practices organizations  can take to safeguard mobile devices.
section_title: Public and Private- Sector Entities Have Taken Initial Steps to Address Security of Mobile Devices, but Consumers Remain Vulnerable to Threats
paragraphs: Federal agencies and mobile industry companies have taken steps to  develop standards for mobile device security and have participated in  initiatives to develop and implement certain types of security controls.  However, these efforts have been limited in scope, and mobile device  manufacturers and carriers do not consistently implement security  safeguards on mobile devices. Although FCC has facilitated public-private  coordination to address specific challenges, such as cellphone theft, and  developed cybersecurity best practices, it has not yet taken similar steps  to encourage device manufacturers and wireless carriers to implement a  more complete industry baseline of mobile security safeguards.  Furthermore, DHS, FTC, NIST, and the private sector have taken steps to  raise public awareness about mobile security threats. However, security  experts agree that many consumers still do not know how to protect  themselves from mobile security vulnerabilities. DHS and NIST have not  yet developed performance measures that would allow them to determine  whether they are making progress in improving awareness of mobile  security issues.
section_title: Efforts Have Been Made to Address Security Vulnerabilities, but Controls Are Not Always Implemented
paragraphs: Federal agencies and mobile industry companies have worked to develop  best practices and taken steps to address certain aspects of mobile  security.
FCC has worked with mobile companies on several initiatives. For  example, FCC tasked its advisory committee, CSRIC, with developing  cybersecurity best practices, including recommended practices for  wireless and mobile security. In March 2011, CSRIC released its report  recommending that wireless carriers and device manufacturers consider  adopting practices such as: working closely and regularly with customers to provide  recommendations concerning existing default settings and to identify  future default settings that may introduce vulnerabilities; employing fraud detection systems to detect customer calling  anomalies (e.g., system access from a single user from widely  dispersed geographic areas); having processes in place to ensure that all third-party software has  been properly patched with the latest security patches and that the  system works correctly with those patches installed; establishing application support for cryptography that is based on  open and widely reviewed and implemented encryption algorithms  and protocols; and enforcing strong passwords for mobile device access and network  access.
In addition, in March 2012 FCC tasked CSRIC with examining three major  cybersecurity threats to networks that allow cyber criminals to access  Internet traffic for theft of personal information and intellectual property. In  response, CSRIC recommended that wireless carriers (1) use key  practices when mitigating botnet threats, (2) use best practices for  deploying and managing Domain Name System Security Extensions,    and (3) develop an industry framework to prevent Internet route hijacking  via security weaknesses in the Border Gateway Protocol.working with the wireless carriers to implement these recommendations  and is tasked with developing ways to measure the effectiveness of the  recommendations.
FCC also tasked the Technological Advisory Council’s Wireless Security  and Privacy working group to examine mobile security issues, such as  vulnerabilities of WiFi networks, security of older generation cellular  networks, malicious applications, and text messaging security. The  working group is scheduled to issue its recommendations in December  2012.
Moreover, in April 2012, FCC announced that it had reached agreement  with the CTIA-the Wireless Association, and multiple wireless carriers to  establish processes to deter theft of mobile devices. Under the antitheft  agreement, participating wireless carriers are to take several specific  actions and submit quarterly progress reports to FCC. For example, the  antitheft agreement calls for wireless carriers to initiate, implement, and  deploy database solutions by October 31, 2012, to prevent reportedly lost  or stolen smartphones from being used on another wireless network. The  FCC plans to monitor progress in developing these databases and CTIA  agreed to report progress quarterly, beginning June 30, 2012. The  agreement also will result in the launch of a public education campaign by  July 1, 2012, to inform consumers about the ability to lock or locate and  erase data from a smartphone.
In addition, wireless carriers and device manufacturers reported that they  participate in private-sector standards-setting organizations, which have  addressed aspects of mobile security. For example, the Open Mobile  Alliance, an industry standards group, has developed a specification to  provide a common means for mobile developers to implement standards  for secure and reliable data transport between two communicating  parties. Furthermore, a consortium of wireless carriers and mobile device  manufacturers known as the Messaging, Malware and Mobile Anti-Abuse  Working Group has an initiative underway to address text-message-based spam. Under this initiative, wireless carriers encourage customers  to forward spam text messages back to the carriers, who can use the  messages to identify the source of spam and take corrective action to  block its content from their networks. According to FCC officials, the  current chairman of the Messaging, Malware and Mobile Anti-Abuse  Working Group is a member of CSRIC and the chair of the working group  that developed recommended solutions for the botnet threats.
While private and public sector entities have initiated activities to identify  mobile security safeguards, these safeguards are not always available on  mobile devices or activated by users. According to a 2012 study by NQ  Mobile and the National Cyber Security Alliance (NCSA), approximately  30 percent of respondents said they did not have mobile security  features on their smartphones. In addition, approximately 66 percent of  respondents did not report that they activated password protection on  their devices to prevent unauthorized access and that at least 67 percent  did not report activating a remote-wipe or remote-locate security feature.  Security company representatives told us that these results were  generally consistent with their experiences and observations.
In addition, mobile device manufacturers and wireless carriers do not  consistently implement or activate security safeguards on their mobile  devices. According to most of the device manufacturers and several  wireless carriers we spoke with, safeguards such as passwords,  encryption, and remote wipe/lock/locate can be made available on their  mobile devices, although one wireless carrier noted that encryption might  be inappropriate for certain types of devices. Several of these companies  also acknowledged that it is possible to preconfigure mobile devices to  prompt the user to implement safeguards when the phone is first set up.  However, with the exception of password protection for online voicemail  accounts, none of the device manufacturers or wireless carriers stated  that they generally configure their devices to prompt the user to  implement these controls. We also observed that general cybersecurity  instructions were not directly accessible from either carriers or device  manufacturers, although instructions for implementing controls could be  found by searching the company’s website for information about  individual models of smartphones.
FCC has the ability to encourage broad implementation of mobile security  safeguards among mobile industry companies. While it has taken steps to  encourage implementation of safeguards in certain areas, it has not yet  taken similar steps to encourage industry implementation of a broad  baseline of mobile security safeguards. For example, in its recent antitheft  agreement with CTIA, and participating wireless carriers, FCC took an  active role in encouraging major wireless carriers to adopt specific  procedures to discourage the theft of mobile devices. This effort  demonstrates that FCC can facilitate private sector efforts to establish an  industry baseline and milestones for addressing mobile security  challenges. Moreover, representatives from multiple companies agreed  that FCC could play a role in coordinating private sector efforts to improve  mobile security.
FCC has also facilitated private sector efforts to establish cybersecurity  best practices in areas not specific to mobile security. As mentioned  previously, FCC tasked CSRIC to review best practices for botnet threats,  Domain Name System attacks, and Internet route hijacking. CSRIC  developed voluntary recommendations in these areas and has been  working with wireless carriers to implement them. According to FCC  officials, wireless carriers representing 90 percent of the domestic  customer base have committed to adopting and using these practices.  Although these recommendations are not specific to mobile devices, FCC  officials stated that the process of seeking voluntary compliance from  carriers had been successful and demonstrated the willingness of carriers  to adopt best practices.
FCC officials stated that they hope to have the same cooperation from  wireless carriers when the Technological Advisory Council’s Wireless  Security and Privacy working group releases its recommendations on  mobile security issues, scheduled for December 2012. While it is not clear  that the working group will develop a baseline of recommended practices  for implementation by mobile industry companies, the council’s  recommendations nevertheless could be part of such a baseline.
Another candidate for a set of baseline mobile security standards that  mobile industry companies could be encouraged to implement is the  collection of cybersecurity best practices developed by CSRIC in 2011.  Those practices have not yet been adopted as a baseline within the  mobile industry. FCC officials from the Public Safety and Homeland  Security Bureau stated that they had not yet taken action to promote this  specific set of recommended practices, although they had held informal  meetings with industry to discuss the implementation of cybersecurity  practices. Whether mobile industry companies adopt the CSRIC- recommended practices or choose other baseline practices and controls,  it will be important for FCC to encourage industry to adopt recommended  practices. If such practices are not implemented, vulnerabilities in mobile  devices are likely to continue to pose risks for consumers.
subsections: section_title: The Effectiveness of Public and Private Sector Efforts to Raise Awareness about Mobile Security Is Unclear
paragraphs: Many of the key practices that have been identified as effective in  mitigating mobile security risks depend on the active participation of  users. Thus it is important that an appropriate level of awareness is  achieved among consumers who use mobile devices on a regular basis.  To address this need, federal agencies have developed and distributed a  variety of educational materials. For example:
DHS’s US-Computer Emergency Readiness Team (US-CERT) has  developed cybersecurity tip sheets and technical papers related to  mobile security. These materials, which are published on the US- CERT website, provide lists of suggestions, such as the use of  passwords and encryption, to help consumers to protect their devices  and sensitive data from network attacks and theft.
DHS coordinates domestic and international engagements and  cybersecurity outreach endeavors. For example, as the lead agency  for the awareness component of the NICE initiative, DHS coordinates  the National Cyber Security Awareness Month and a national  cybersecurity public awareness campaign called “Stop. Think.  Connect.” As part of these efforts, DHS has developed educational  materials that, although not specifically related to mobile security,  encourage users to adopt safe practices when using the Internet. The  DHS website related to this effort also provides links to educational  materials hosted on third-party websites, such as StaySafeOnline.org.
FTC manages the OnGuardOnline website, which provides  individuals with information about how to use the Internet in a safe,  secure, and responsible manner. As part of this effort, FTC has  developed educational materials specifically related to mobile  security, such as avoiding malicious mobile applications and  protecting children who use mobile devices. In addition, FTC and  DHS have developed and distributed printed cybersecurity guides to  schools, business, and other entities, according to an FTC staff  member.
NIST published guidelines on the security of cellphones and personal  digital assistants in 2008. provides users with information about how to secure their devices. For  example, the guidance discusses the value of implementing  authentication (e.g., password protection) and remotely erasing or  locking devices that are lost or stolen.
Among other things, this guidance  DHS and nonprofit organizations also have developed and distributed  cybersecurity educational materials in collaboration with NCSA. In  addition to funding from the private sector, DHS officials stated that DHS  has contributed a grant to NCSA to conduct surveys and other activities.  NCSA has produced educational materials that specifically relate to  mobile security. For example, NCSA’s website provides tips that  individuals can follow to protect their mobile devices such as avoiding  malware, using trusted internet connections, and securing personal  information through the use of strong passwords.
NIST, Special Publication 800-124, Guidelines on Cell Phone and PDA Security  (October 2008). According to NIST officials, they are revising this publication and will  release a draft update in fiscal year 2012. mobile phone theft, (2) spam and mobile phones, and (3) computer  viruses and mobile phones. Similarly, CTIA maintains a blog with  information on topics such as establishing passwords and using  applications that can track, locate, lock, and/or wipe wireless devices that  are lost or stolen. In addition, as part of the antitheft initiative discussed  above, CTIA agreed that its members would implement a system to  inform users about security safeguards on mobile devices as well as  launch an education campaign regarding the safe use of smartphones.
Despite the efforts underway by the federal government and the private  sector to develop and distribute educational materials, it is unclear whether  consumer awareness has improved as a result. Representatives from  companies that specialize in information security told us that many  consumers do not understand the importance of implementing mobile  security safeguards or do not know how to implement them. Their views  are consistent with the results of the 2012 NCSA study, which suggested  that many mobile users do not know how to implement mobile security  safeguards. The survey reported that more than half of respondents felt  that they required additional information in order to select and/or implement  security solutions for their mobile devices. Further, the study reported that  approximately three-quarters of respondents reported that they did not  receive information about the need for security solutions at the time they  purchased their phone. The survey did not include data that would indicate  whether consumer awareness had improved or worsened over time.
While DHS and NIST have conducted or supported several consumer  cybersecurity awareness efforts, neither has developed outcome-oriented  performance measures to assess the effectiveness of government efforts  to enhance consumer awareness of mobile security. An outcome-oriented  performance measure is an assessment of the result, effect, or  consequence that will occur from carrying out a program or activity  compared to its intended purpose. NIST officials stated that they do not  currently measure progress related to awareness activities associated  with NICE. Furthermore, although DHS officials stated that the  department assesses the effectiveness of several of the awareness  activities, these assessments are not based on outcome-oriented  measures. For example, DHS officials stated that they assess the “Stop.
Think. Connect.” events by (1) the number of individuals who join the  campaign and agree to receive additional information, such as  newsletters, concerning cybersecurity; (2) the total number of events  held; (3) the number of agencies and states that join the campaign; and  (4) the number of times the campaign website is visited. However, these  measures are not outcome-oriented because they do not indicate how, if  at all, these activities have (1) improved citizens’ knowledge about  managing online risk, (2) improved knowledge of cybersecurity within  organizations, or (3) enabled access to cybersecurity resources.
To develop measures of the impact of government efforts on consumer  awareness of mobile security issues, a baseline measure of consumer  awareness would be needed from which to mark progress. However,  neither DHS nor NIST has developed a baseline measure of the state of  national cybersecurity awareness. Establishing a baseline measure and  regularly assessing consumer awareness and behavior regarding a  particular issue can enable organizations to document where problems  exist, identify causes, prioritize efforts, and monitor progress. DHS  officials stated that the department has considered conducting a study on  consumer behavior and awareness related to general cybersecurity but  has not yet done so.
Without a baseline measure of consumer awareness, it will remain  difficult for NIST and DHS to measure any correlation between the  government’s activities and enhanced consumer awareness. Further,  without outcome-oriented performance measures, the government will be  limited in its ability to determine whether it is achieving its identified goals  and objectives, including whether cybersecurity awareness efforts are  effective at increasing adoption of recommended security practices.
section_title: Conclusions
paragraphs: Mobile devices face an array of threats that take advantage of numerous  vulnerabilities commonly found in such devices. These vulnerabilities can  be the result of inadequate technical controls, but they can also result  from the poor security practices of consumers.
Private sector entities and relevant federal agencies have taken steps to  improve the security of mobile devices, including making certain controls  available for consumers to use if they wish and promulgating information  about recommended mobile security practices. However, security controls  are not always consistently implemented on mobile devices, and it is  unclear whether consumers are aware of the importance of enabling  security controls on their devices and adopting recommended practices.
Although FCC has taken steps to work with industry to develop  cybersecurity best practices, it has not yet taken steps to encourage  wireless carriers and device manufacturers to implement a more complete  industry baseline of mobile security safeguards, and NIST and DHS have  not determined whether consumer awareness of mobile security issues has  improved since the government’s efforts have been initiated.
section_title: Recommendations for Executive Action
paragraphs: To help mitigate vulnerabilities in mobile devices, we recommend that the  Chairman of the Federal Communications Commission  continue to work with wireless carriers and device manufacturers on  implementing cybersecurity best practices by encouraging them to  implement a complete industry baseline of mobile security safeguards  based on commonly accepted security features and practices; and monitor progress of wireless carriers and device manufacturers in  achieving their milestones and time frames once an industry baseline  of mobile security safeguards has been implemented.
To determine whether the NICE initiative is having a beneficial effect in  enhancing consumer awareness of mobile security issues, we  recommend that the Secretary of Homeland Security in collaboration with  the Secretary of Commerce establish a baseline measure of consumer awareness and behavior  related to mobile security and develop performance measures that use the awareness baseline to  assess the effectiveness of the awareness component of the NICE  initiative.
section_title: Agency Comments and Our Evaluation
paragraphs: We received written comments on a draft of this report from the Chief of  FCC’s Public Safety and Homeland Security Bureau, the Director of  DHS’s Departmental GAO-OIG Liaison Office, and the Acting Secretary  of Commerce. These officials generally concurred with our  recommendations and provided technical comments, which we have  considered and incorporated as appropriate into the final report. FTC did  not provide written comments on the draft report, but an attorney in FTC’s  Office of the General Counsel did provide technical comments in an   e-mail that we addressed as appropriate. DOD did not provide comments  on the draft report. The comments we received are summarized below.
In addition to FCC’s written comments, the Chief of FCC’s Public  Safety and Homeland Security Bureau stated in e-mail comments that  the commission generally concurred with our recommendations that it  encourage wireless carriers and device manufacturers to implement a  complete industry baseline of mobile security safeguards; and to  monitor progress of wireless carriers and device manufacturers in  achieving their milestones and time frames once a baseline has been  implemented. In the written comments, the Chief added that FCC has  facilitated private sector efforts, for example, through advisory  committees such as CSRIC to establish and promote the  implementation of cybersecurity best practices that secure the  underlying Internet infrastructure. FCC officials also provided  preliminary oral and written technical comments, which we addressed  as appropriate (FCC’s written comments are reprinted in app. II).
The Director of DHS’s Departmental GAO-OIG Liaison Office  provided written comments in which the department concurred with  our recommendations that it work with Commerce to establish a  baseline measure of consumer awareness and behavior related to  mobile security and develop performance measures that use the  baseline to assess the effectiveness of the awareness component of  the NICE initiative. He stated that the department will coordinate with  its counterparts at Commerce to assess the feasibility of different  methods to create a baseline measure of consumer awareness and  continue to promote initiatives to educate the public about  cybersecurity. He also stated that the department will coordinate with  its NIST counterparts on the development of performance measures  using the awareness campaign and other methods. He also provided  technical comments, which we have incorporated as appropriate  (DHS’s comments are reprinted in app. III).
The Acting Secretary of Commerce provided written comments in  which the department concurred in principle with our  recommendations that NIST work with DHS to establish a baseline  measure of consumer awareness and behavior related to mobile  security and that it develop performance measures that use the  baseline to assess the effectiveness of the awareness component of  the NICE initiative. The Acting Secretary provided technical comments  and asked that we consider replacing “baseline understanding” with  “baseline measure,” which we have incorporated into the final report.  She also provided suggested revised text. However, we believe that  the information in the draft is correct and communicates appropriately  as written. Therefore, we have not added the suggested text  (Commerce’s comments are reprinted in app. IV).
We are sending copies of this report to the appropriate congressional  committees; the Chairmen of the Federal Communications Commission  and Federal Trade Commission; the Secretaries of Commerce, Defense,  and Homeland Security; and other interested congressional parties. The  report also is available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact:  Gregory C. Wilshusen at (202) 512-6244 or Dr. Nabajyoti Barkakati at  (202) 512-4499, or by e-mail at wilshuseng@gao.gov or  barkakatin@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this report.  Key contributors to this report are listed in appendix VI.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The objectives of our review were to determine: (1) what common  security threats and vulnerabilities currently exist in mobile devices, (2)  what security features are currently available and what practices have  been identified to mitigate the risks associated with these vulnerabilities,  and (3) the extent to which government and private entities are  addressing security vulnerabilities of mobile devices.
To determine the common security threats and vulnerabilities that  currently exist in mobile devices (cellphones, smartphones, and tablets),  as well as security features and practices to mitigate them, we identified  agencies and private companies with responsibilities in the  telecommunication and cybersecurity arena, and reviewed and analyzed  information security-related websites, white papers, and mobile security  studies. We interviewed officials, and obtained and analyzed  documentation from the Federal Communications Commission (FCC),  Department of Homeland Security (DHS), Department of Defense (DOD),  Department of Commerce (Commerce), and Federal Trade Commission  (FTC) to determine the extent to which they have identified mobile  security vulnerabilities and developed standards and guidance on the  security of mobile devices. We interviewed and obtained documents from  an industry group and an advisory council, both of which have  representation from the telecommunication industry; these included the  CTIA-The Wireless Association and the Communications Security,  Reliability, and Interoperability Council (CSRIC). We also analyzed  information from the US-Computer Emergency Readiness Team (US- CERT) and the National Vulnerability Database on mobile security  vulnerabilities.
Further, we obtained input from the private companies who make up the  largest market share for mobile devices in the United States to determine  what steps they are taking to provide security for their mobile devices.  These included mobile device manufacturers—HTC Corporation,  Research In Motion, Corp, Motorola Mobility Inc., Samsung, and LG  Electronics—as well as wireless carriers—Verizon Wireless, AT&T Inc.,  T-Mobile USA Inc., and Sprint. We also met with representatives of  information security companies, including Symantec Corporation and  Juniper Networks. We approached Apple Inc. and Google Inc.; however,  Apple officials did not agree to meet with us and Google officials did not  provide responses to our questions. We developed draft lists of common  vulnerabilities and security practices based on our analysis of government  security guidance as well as private sector studies and reports. We  provided copies of these lists to each of the companies listed above and  addressed their comments as appropriate.
To determine the extent to which government and private entities are  addressing security vulnerabilities of mobile devices, we analyzed  statutes and regulations to determine federal roles related to mobile  security. In order to identify initiatives related to improving mobile security  or raising consumer awareness, we interviewed the federal and private  sector officials mentioned above, and members of a private sector  working group devoted to mobile security issues, known as the  Messaging, Malware, and Mobile Anti-Abuse Working Group. In addition,  we analyzed multiple studies related to consumer attitudes and practices  related to mobile devices. Specifically, we assessed available  methodological information against general criteria for survey quality and  relevant principles derived from the Office of Management and Budget  (OMB) Standards and Guidelines for Statistical Surveys. Because the  available methodological documentation did not allow us to fully assess  the quality of the survey data, the risk of error in the surveys makes it  possible that reported results may not be very accurate or precise.  Although we corroborated the study’s general findings with information  security experts, readers should be cautious in drawing conclusions  based on these results.
We conducted this performance audit from November 2011 to September  2012 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Federal Communications Commission
section_title: Appendix III: Comments from the Department of Homeland Security
section_title: Appendix IV: Comments from the Department of Commerce
section_title: Appendix V: Federal Websites for Information Related to Mobile Security
paragraphs: The table below provides information and website links to federal sites  that include information related to mobile security. Website links are  current as of July 10, 2012.
section_title: Appendix VI: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to the individuals named above, key contributions to this report  were made by John de Ferrari (Assistant Director), West E. Coile, Neil J.  Doherty, Rebecca E. Eyler, Richard J. Hagerman, Tammi N. Kalugdan,  David F. Plocher, Carl M. Ramirez, Meredith R. Raymond, and Brandon  C. Sanders.