Critical Infrastructure Protection: Significant Challenges in Developing National Capabilities
Published: 2001-04-25T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: To better protect the nation's critical computer-dependent infrastructures from computer-based attacks and disruption, the President issued Presidential Decision Directive (PDD) 63 in 1998. The directive established the National Infrastructure Protection Center as a national focal point for gathering information on threats and facilitating the federal government's response to computer-based incidents. This report evaluates the center's progress in (1) developing national capabilities for analyzing cyber threat and vulnerability data and issuing warnings, (2) enhancing its capabilities for responding to cyber attacks, and (3) developing outreach and information-sharing initiatives with government and private-sector entities.
section_title: What GAO Found
paragraphs: GAO found that although the center has taken some steps to develop analysis and warning capabilities, the strategic capabilities described in PDD 63 have not been achieved. The center has provided important support to the Federal Bureau of Investigation's investigations of computer crimes by coordinating investigations and providing technical assistance. The center has also developed crisis management procedures and drafted an emergency law enforcement sector plan, which is now being reviewed by sector members. The center's information-sharing relationships are still evolving and will probably have limited effectiveness until reporting procedures and thresholds are defined and trust relationships are established.

section_title: Letter
paragraphs: In response to your request of May 16, 2000, this report describes the progress of the National  Infrastructure Protection Center (NIPC) in (1) developing national capabilities for analyzing cyber  threat and vulnerability data and issuing warnings, (2) enhancing its capabilities for responding to  cyber attacks, and (3) developing outreach and information-sharing initiatives with government and  private-sector entities.  In addition, we were asked to determine the purposes for which the NIPC  used funding provided for fiscal years 1999 and 2000.
As arranged with your offices, unless you publicly announce its contents earlier, we plan no further  distribution of this report until 30 days from the date of this letter.  At that time, we will send copies to  other interested congressional committees; the Honorable Condoleezza Rice, Assistant to the  President for National Security Affairs; the Honorable John Ashcroft, Attorney General; the  Honorable Louis Freeh, Director of the Federal Bureau of Investigation; and the Honorable Mitchell  E. Daniels, Jr., Director of the Office of Management and Budget.  The report will also be available on  GAO’s Web site at www.gao.gov.
If you or your offices have any questions about matters discussed in this report, please call me at  (202) 512-3317 or Jean Boltz, Assistant Director, at (202) 512-5247.  We can also be reached by e-mail  at daceyr@gao.gov and boltzj@gao.gov, respectively.  Major contributors to this report include Michael Gilmore, Rahul Gupta, Danielle Hollomon, William McDaniel, Paul Nicholas, Patrick Sullivan, and Thomas Wiley.
subsections: section_title: Introduction
paragraphs: Since the early 1990s, an explosion in computer interconnectivity, most  notably growth in the use of the Internet, has revolutionized the way that  our government, nation, and much of the world communicate and conduct  business.  The benefits have been enormous.  Vast amounts of information  are now literally at our fingertips, facilitating research and government  services. Financial and other business transactions can be executed almost  instantaneously, and electronic mail, Internet Web sites, and computer  bulletin boards allow us to communicate quickly and easily with virtually  an unlimited number of other individuals and groups.  However, this  widespread interconnectivity also poses enormous risks to our computer  systems and, more importantly, to the critical operations and  infrastructures they support, such as telecommunications, power  distribution, national defense, and critical government services.
To reduce these risks, in 1998, the President issued Presidential Decision  Directive 63 (PDD 63), which describes a strategy for cooperative efforts  by government and the private sector to protect critical, computer- dependent operations.  A key element of this strategy is the establishment  of the National Infrastructure Protection Center (NIPC) as “a national focal  point” for gathering information on threats and providing the principal  means of facilitating the federal government’s response to computer-based  incidents.
To determine how effectively the NIPC is addressing current and future  cyber threats to our national security, the Subcommittee on Technology,  Terrorism, and Government Information, Senate Committee on the  Judiciary, asked that we examine the NIPC’s progress in developing  national capabilities for analyzing data about, issuing warnings on, and  responding to computer-based attacks.  In addition, the Subcommittee  asked that we determine the purposes for which the NIPC used funding  provided for fiscal years 1999 and 2000.
subsections: section_title: Cyber Risks to Critical Infrastructures Are Substantial and Increasing
paragraphs: The risks associated with our nation’s reliance on interconnected computer  systems are substantial and varied.  Attacks can come from anywhere in  the world, over the Internet, other networks, and dial-up lines.  By  launching attacks across a span of communications systems and  computers, attackers can effectively disguise their identity, location, and  intent, thereby making them difficult and time-consuming to trace.
Such attacks could severely disrupt computer-supported operations, compromise the confidentiality of sensitive information, and diminish the integrity of critical data. A significant concern is that terrorists or hostile foreign states could launch computer-based attacks on critical systems to severely damage or disrupt national defense or other critical operations or steal sensitive data, resulting in harm to the public welfare. According to the National Security Agency, foreign governments already have or are developing computer attack capabilities, and potential adversaries are developing a body of knowledge about U.S. systems and about methods to attack these systems. Figure 1 provides an overview of the various types of risks.
While cyber-based attacks have not yet caused devastating disruptions, the  number of attacks is increasing.  Complete summary data are not available  because many incidents are not reported.  However, the number of  reported incidents handled by Carnegie-Mellon University’s CERT  Coordination Center has increased from about 1,300 in 1993 to about 9,800  in 1999 and to over 21,000 in 2000.  Similarly, the Federal Bureau of  Investigation (FBI) reports that its caseload of computer intrusion-related  investigations more than doubled from 1998 to 2000.  This greater number  of attacks increases the risk of incidents with devastating consequences.
According to the FBI, the following threats have been observed: Criminal groups. There is an increased use of cyber intrusions by criminal  groups who attack systems for purposes of monetary gain.
Foreign intelligence services. Foreign intelligence services use cyber tools  as part of their information gathering and espionage activities.
Hackers. Hackers sometimes crack into networks for the thrill of the  challenge or for bragging rights in the hacker community.  While remote  cracking once required a fair amount of skill or computer knowledge,  hackers can now download attack scripts and protocols from the Internet  and launch them against victim sites.  Thus, while attack tools have become  more sophisticated, they have also become easier to use.
Hacktivists.   Hacktivism refers to politically motivated attacks on publicly  accessible Web pages or e-mail servers.  These groups and individuals  overload e-mail servers and hack into Web sites to send a political message.
Information warfare. Several nations are aggressively working to develop  information warfare doctrine, programs, and capabilities.  Such capabilities  enable a single entity to have a significant and serious impact by disrupting  the supply, communications, and economic infrastructures that support  military power—impacts that, according to the Director of Central  Intelligence, can affect the daily lives of Americans across the country.
Insider threat.  The disgruntled organization insider is a principal source of  computer crimes.  Insiders may not need a great deal of knowledge about  computer intrusions because their knowledge of victim systems often  allows them to gain unrestricted access to cause damage to the system or  to steal system data.
Virus writers.  Virus writers are posing an increasingly serious threat.   Several destructive computer viruses and “worms” have harmed files and  hard drives, including the Melissa Macro Virus, the Explore.Zip worm, and  the CIH (Chernobyl) Virus.
section_title: Concern About Critical Infrastructure Protection Has Been Growing
paragraphs: Concerns about computer-based vulnerabilities have been publicly  reported repeatedly during the 1990s.  Examples of these concerns include  the following:     In 1991, the National Research Council studied the issue and reported  that “as computer systems become more prevalent, sophisticated,  embedded in physical processes and interconnected, society becomes  more vulnerable to poor system design, accidents that disable systems,  and attacks on computer systems.”  The report generated a great deal of  interest in both the government and private sectors, alerting them to  vulnerabilities and dangers being rapidly introduced with technology  dependence.
In June 1995, a Critical Infrastructure Working Group, led by the  Attorney General, was formed to (1) identify critical infrastructures and  assess the scope and nature of threats to them, (2) survey existing  government mechanisms for addressing these threats, and (3) propose  options for a full-time group to consider long-term government response  to threats to critical infrastructures.  The working group identified  critical infrastructures, characterized threats to them, and  recommended creating a commission to investigate such issues.
In February 1996, the National Defense Authorization Act required the  executive branch to provide a report to the Congress on the policies and  plans for developing capabilities, such as warnings of strategic attacks  against the national information infrastructure.  Later that year, the  Permanent Subcommittee on Investigations, Senate Committee on  Governmental Affairs, began to hold hearings on security in cyberspace.   Since then, congressional interest in protecting national infrastructures  has remained strong.
In July 1996, the President’s Commission on Critical Infrastructure  Protection was established to investigate the nation’s vulnerability to  both cyber and physical threats.
Since 1997—most recently in January 2001—we have designated  information security as a governmentwide high-risk area, in reports to  the Congress.
In October 1997, the President’s Commission issued its report, which  described the potentially devastating implications of poor information  security from a national perspective.  The report stated that a  comprehensive effort would need to “include a system of surveillance,  assessment, early warning, and response mechanisms to mitigate the  potential for cyber threats.”  It said that the FBI had already begun to  develop warning and threat analysis capabilities and urged it to continue  in these efforts.  In addition, the report noted that the FBI could serve as  the preliminary national warning center for infrastructure attacks and  provide law enforcement, intelligence, and other information needed to  ensure the highest quality analysis possible.
section_title: PDD 63 Outlined a National Critical Infrastructure Protection Strategy
paragraphs: In response to the commission’s report, the President initiated actions to  implement a cooperative public-private approach to protecting the nation’s  critical infrastructures by issuing PDD 63 in May 1998.  The directive called  for a range of activities to improve federal agency security programs,  establish a partnership between the government and private sector, and  improve the nation’s ability to detect and respond to serious attacks.  The  directive established critical infrastructure protection as a national goal,  stating that, by the close of 2000, the United States was to have achieved an  initial operating capability and, no later than 2003, the capability to protect  the nation’s critical infrastructures from intentional destructive acts.
To accomplish its goals, PDD-63 designated the National Coordinator for  Security, Infrastructure Protection, and Counter-Terrorism, who reports to  the Assistant to the President for National Security Affairs, to oversee  national policy development and implementation.  The directive also  established the National Plan Coordination staff, which became the Critical  Infrastructure Assurance Office, an interagency office that is housed in the  Department of Commerce and is responsible for planning infrastructure  protection efforts.  In addition, the directive designated “lead agencies” to  work with private-sector and government entities in each of eight  infrastructure sectors and five special function areas.  For example, the  Department of the Treasury is responsible for working with the banking  and finance sector, and the Department of Energy is responsible for  working with the electric power industry.  Similarly, regarding special  function areas, the Department of Defense (DOD) is responsible for  national defense, and the Department of State is responsible for foreign  affairs.  To facilitate private-sector participation, PDD 63 encouraged  creation of Information Sharing and Analysis Centers (ISAC) that could  serve as mechanisms for gathering, analyzing, and appropriately sanitizing  and disseminating information to and from infrastructure sectors and the  NIPC.  Figure 2 depicts the entities with critical infrastructure protection  responsibilities as outlined by PDD 63.
section_title: The NIPC Is Assigned A Broad Set Of Responsibilities
paragraphs: The NIPC was originally established by the Attorney General in February  1998 as an outgrowth of the FBI’s Computer Investigations and  Infrastructure Threat Assessment Center, which is a joint criminal and  intelligence operation focused on computer crimes and threats to the  national information infrastructure.  According to the Attorney General, the  NIPC was to become the government’s lead mechanism for responding to  infrastructure attacks.
In May 1998, PDD 63 authorized the FBI to expand the NIPC and directed  the NIPC to gather information on threats and coordinate the federal  government’s response to incidents affecting infrastructures.  According to  the NIPC legal counsel, the NIPC was placed in the FBI because of the  bureau’s broad legal authority to collect, retain, and share information  about potential cyber threats to the nation’s critical infrastructures.  In  addition, the NIPC benefited from the FBI’s jurisdictional authority and  investigative capability, including conducting and coordinating criminal  and foreign counterintelligence investigations within the United States.   The directive further assigned the NIPC, operating under these authorities,  specific responsibilities for  issuing timely warnings on threats and attacks;  providing comprehensive analyses on threats, vulnerabilities, and   facilitating and coordinating the government’s response to cyber   providing law enforcement investigation and response;  mitigating cyber attacks;  monitoring reconstitution efforts; and   promoting outreach and information sharing.
The following documents provide additional detail on the NIPC’s mission  and operational requirements:   The FBI’s National Infrastructure Protection and Computer Intrusion  Program Plan, issued in April 1999 and updated in October 2000,  outlines specific goals and strategies aimed primarily at developing a  national investigative and response capability, especially as they relate  to FBI field office activities.
The unclassified version of the Attorney General’s Five-Year Interagency  Counterterrorism and Technology Crime Plan, issued in September  1999, stresses the need for the NIPC to interact with other federal  counterterrorism and law enforcement efforts and provides specific  details on NIPC programs, objectives, and requirements, such as  analysis and warning operations, crisis management responsibilities, the  Key Asset Initiative, and the InfraGard Program.
The President’s National Plan for Information Systems Protection,  issued in January 2000, reiterates much of what was contained in the  FBI’s April 1999 program plan and the Attorney General’s plan.   However, it contained a broader description of governmentwide efforts  and described how other federal entities might interact with the NIPC.
PDD 63 covered both physical and computer-based threats.  However, the  NIPC’s efforts have pertained almost exclusively to computer-based  threats, since this was an area that the leaders of the administration’s  critical infrastructure protection strategy viewed as needing attention.  For  example, the FBI 1998 Strategic Plan identified the protection of the  national information infrastructure as one of the Bureau’s highest  priorities.  The President’s issuance of the National Plan further illustrated  the administration’s interest in this area.  In addition, other components of  the FBI had a lead role in addressing physical threats.  Specifically, the  Attorney General’s 1999 plan noted that in the event of physical attacks on  key infrastructures, the investigative response would be handled by FBI  criminal investigative or counterterrorism components.  In such cases, the  NIPC would serve in a supporting role, providing relevant information  about the victim infrastructure and other focused analytical or intelligence  products.
Currently, the NIPC is located in the FBI’s Counterterrorism Division,  which is 1 of 11 FBI headquarters divisions headed by assistant directors  who report to the FBI Director.  The NIPC Director reports directly to the  Assistant Director for Counterterrorism.
The NIPC is organized into three sections reflecting the mission areas  identified by PDD 63.
The Computer Investigations and Operations Section is to support and,  where necessary, coordinate computer investigations conducted by the  FBI’s 56 field offices and approximately 400 sublocations throughout the  country; provide expert technical assistance to investigations; and  coordinate the response to a national-level cyber incident.
The Analysis and Warning Section is to provide tactical analytical  support during a cyber incident and develop strategic analyses of  threats for dissemination to both government and private-sector entities  so that they can take appropriate steps to protect themselves.
The Training, Outreach, and Strategy Section is to coordinate the  training of investigators in the FBI field offices, other federal agencies,  and state and local law enforcement regarding computer-based threats.   It also is to coordinate outreach activities with private industry and  government agencies to build the partnerships that are key to the NIPC’s  investigative and warning missions.  In addition, this section manages  efforts to catalog information about individual "key infrastructure  assets" and manages the InfraGard Program, which provides a forum for  private industry and the NIPC to share information.
Figure 3 shows the NIPC’s organization and identifies subunits in each of  its three major functional sections.
section_title: Objectives, Scope, and Methodology
paragraphs: Our objectives were to evaluate the progress that the NIPC has made in  developing national capabilities regarding cyber threats for analyzing  threat and vulnerability data and issuing warnings;   enhancing its capabilities for responding to cyber attacks; and  outreach and sharing information with government and private-sector  entities, including the progress made regarding the InfraGard Program  and development of the key asset database.
In addition, we were asked to determine the purposes for which the NIPC  used funding provided for fiscal years 1999 and 2000.
To determine the NIPC’s progress in developing capabilities for issuing  warnings and analyzing threat and vulnerability data, we reviewed  analytical reports that the NIPC had issued and held discussions with  officials from the NIPC’s Analysis and Warning Section.  We observed a  demonstration of the NIPC’s watch and warning procedures and reviewed  pertinent policies, guidance, and plans.  To gain a more thorough  understanding of the challenges associated with analyzing and reporting  computer-based incidents and determine how the NIPC’s responsibilities  relate to those of other federal agencies, we met with officials in the  intelligence community and in DOD who were involved in threat analysis  and warning activities.
To determine the NIPC’s progress in enhancing its capabilities for  responding to cyber attacks, we reviewed pertinent policies, guidance,  plans, and other supporting documentation and interviewed officials in the  NIPC’s Computer Investigations and Operations Section and Analysis and  Warning Section.  We visited 4 of the FBI’s 56 field offices, which we  selected because they were performing a diverse set of NIPC-related  activities.  Three of these field offices—in New Orleans, San Francisco, and  Washington, D.C.—had full NIPC squads.  The fourth field office, in  Pittsburgh, had a NIPC team and the only interagency task force for  investigating computer intrusions.  During these visits, we observed  operations related to investigating and responding to computer-based  incidents and met with FBI agents involved in these activities.
To determine the NIPC’s progress in outreach and information sharing with  government and private-sector entities, we interviewed officials from the  NIPC’s Training, Outreach, and Strategy Section and from the three  Information Sharing and Analysis Centers (ISAC) that had been established  at the time of our review.  (A fourth ISAC for the information technology  industry, announced in January 2001, was not covered by our review.)   These centers pertained to the financial services industry, the  telecommunications industry, and the electric power industry.  In addition,  we observed a meeting sponsored by the FBI’s Washington, D.C., field  office to promote participation in the NIPC’s InfraGard information-sharing  program, and a training session on collaborative efforts by the North  American Electric Reliability Council and the NIPC.  We also discussed the  InfraGard Program and efforts to develop a database of key infrastructure  assets with responsible officials at the NIPC and four FBI field offices.
Further, we reviewed a variety of documents related to these outreach and  information-sharing efforts.
To gain a more thorough understanding of the adequacy of the NIPC’s  progress regarding our first three objectives, we reviewed various  documents that describe the NIPC’s responsibilities.  These included the  Attorney General’s Five-Year Interagency Counterterrorism and  Technology Crime Plan and The National Plan for Information Systems  Protection, issued by the President in January 2000.  We also met with  federal officials outside of the FBI who were involved with federal critical  infrastructure protection efforts.  These included the National Coordinator  and officials from the Office of Management and Budget (OMB) , the  intelligence community, DOD, the Critical Infrastructure Assurance Office,  a former Commissioner from the President’s Commission on Critical  Infrastructure Protection, current and former detailees to the NIPC from  other organizations, and key persons involved in the creation of PDD 63.  In  addition, we interviewed the NIPC’s Director, deputy director, and principal  legal counsel.
To determine the purposes for which the NIPC used funding provided for  fiscal years 1999 and 2000, we reviewed pertinent congressional reports,  plans, guidance, and budget documents and reports on obligations  developed for us by FBI and NIPC officials.  We also held discussions with  FBI finance division officials and NIPC headquarters officials responsible  for funding-related decisions and for accounting for those funds.  We  reviewed the provided information for consistency; however, we did not  independently verify the data on obligations or review the NIPC’s related  internal-control procedures.
We performed our audit work from May 2000 through February 2001 in  accordance with generally accepted government auditing standards.   We  received comments on a draft of this report from the Director of the NIPC  and the Special Assistant to the President and Senior Director for  Legislative Affairs.  The comments are printed in full in appendixes I and II,  respectively.
section_title: Multiple Factors Limit Progress in Developing National Analysis and Warning Capabilities
paragraphs: The NIPC’s progress in developing national capabilities for analyzing  vulnerability and threat data and issuing timely warnings of computer- based attacks, as described in PDD 63, has been limited.  However, the  NIPC has laid a foundation for further governmentwide efforts in these  areas.  Analysis and warning capabilities are needed to improve the  government’s ability to recognize changes in threat conditions, detect  impending attacks, or effectively warn government and industry of such  attacks in time to prevent serious damage.
Since it was established in 1998, the NIPC has issued a variety of analytical  products.  Most of these products have been based on the work of others,  with some original NIPC analysis.  The majority of the NIPC’s original  analysis has been tactical analysis performed in support of investigations of  individual incidents.  Progress in developing strategic analysis to assess the  broader, long-term implications of such threats has been impeded because  there is no generally accepted methodology for threat analysis, adequate  staff and expertise have not been supplied, and data on infrastructure  vulnerabilities have not been provided by industry sectors.  Overcoming  these obstacles will require significant interagency efforts and resources.
The NIPC has developed rudimentary capabilities for issuing warnings.   From February 1998 through December 2000, it issued 81 alerts, advisories,  and assessments.  However, most of these warnings pertained to attacks  already underway and, therefore, may have been too late for recipients to  take mitigating action.  The NIPC’s efforts to develop a more robust  warning capability have been impeded by a lack of staff expertise and  because a governmentwide or nationwide framework for promptly  collecting and analyzing incident information has not been established.  In  addition, issuance of timely warnings has been hindered by the need to  protect sensitive information and verify the accuracy and significance of  reported incidents before issuing related warnings.
Further, two fundamental problems make it difficult to measure the NIPC’s  progress and determine its needs for developing more substantive analysis  and warning capabilities.  First, the NIPC’s roles and responsibilities have  not been fully defined and are not consistently interpreted by other federal  agencies responsible for critical infrastructure protection, and these  entities have not provided the NIPC the support envisioned by PDD 63.   Second, the NIPC has not developed a comprehensive and integrated,  multiyear plan of action to prioritize and guide its analysis and warning  efforts and to identify needed resources.
NIPC officials are aware of these problems and have taken some steps to  address them.   However, many of these problems cannot be resolved by  the NIPC alone and will require governmentwide efforts.  At the close of  our review, the National Coordinator for Security, Infrastructure  Protection, and Counter-Terrorism said that options for adjusting the  federal strategy for critical infrastructure protection were being  considered, including a reassessment of roles and responsibilities  pertaining to the development of analysis and warning capabilities.
subsections: section_title: PDD 63 Directs the NIPC to Develop Analysis and Warning Capabilities
paragraphs: The analysis and warning capabilities called for by PDD 63 presume that  analytical processes can be developed to detect precursors to computer- based attacks so that advance warnings can be issued and protective  measures implemented.  Since the 1990s, the national security community  and the Congress have identified a need to establish analytical and warning  capabilities, which are sometimes referred to as “indications and  warnings,” to protect against strategic computer attacks against the  nation’s critical computer-dependent infrastructures.  Such capabilities  involve (1) gathering and analyzing information for the purpose of  detecting and reporting hostile or otherwise potentially damaging actions  or intentions and (2) implementing a process for warning policymakers and  allowing them time to determine the magnitude of the related risks.
PDD 63 specifically assigns the NIPC the responsibility for developing  analytical capabilities to provide comprehensive information on changes in  threat conditions and newly identified system vulnerabilities and timely  warnings of actual or potential attacks.  According to the Attorney  General’s Five-Year Interagency Counterterrorism and Technology Crime  Plan, issued in 1999, the NIPC’s functions are to include analyzing risks to  infrastructures, understanding the indicators of a computer-based attack,  establishing the technical capability to identify indicators, and determining  what constitutes an attack by a foreign power.  The January 2000 National  Plan for Information Systems Protection further specifies that the NIPC  will combine the information it obtains on computer-based attacks with  intelligence, law enforcement, and other indicator information to identify  patterns that may signal that an attack is underway or imminent.
section_title: Analyses Have Primarily Supported Investigations of Individual Incidents
paragraphs: To develop the analytical capabilities specified in PDD 63 and related  requirements, the NIPC created the Analysis and Information Sharing Unit  (AISU) in May 1998.  According to the National Infrastructure Protection  and Computer Intrusion Program Plan, the AISU is to provide both (1)  tactical analytical support during a cyber incident and (2) strategic  analyses of threats.  Tactical support involves providing current  information on specific factors associated with incidents under  investigation or specific identified vulnerabilities.  Examples of tactical  support include analysis of (1) a computer virus delivery mechanism to  issue immediate guidance on ways to prevent or mitigate damage related to  an imminent threat or (2) a specific computer intrusion or set of intrusions  to determine the perpetrator, motive, and method of attack.
In contrast, strategic analysis looks beyond one specific incident to  consider a broader set of incidents or implications that may indicate a  potential threat of national importance.  For example, strategic analyses  may identify long-term vulnerability and threat trends that provide advance  warnings of increased risk, such as emerging attack methods.  Strategic  analyses are intended to provide policymakers with information that they  can use to anticipate and prepare for attacks, thereby diminishing such  attacks’ damage.
subsections: section_title: Analyses Have Primarily Addressed Tactical Issues
paragraphs: Since its establishment, most of the AISU’s activities have been focused on  tactical analyses related to investigations of individual cyber incidents or  notices of recently reported vulnerabilities.  As of early November 2000, the  AISU had produced 15 tactical situation reports related to law enforcement  investigations.  Twelve of these situation reports were associated with  investigations of denial-of-service attacks that affected numerous Internet  entities, including E-Bay and Yahoo, in February 2000.  In addition to  efforts resulting in written products, the AISU has assisted in investigations  of other incidents that were quickly resolved and did not result in formal  reports.  For example, in July 2000, AISU analysts spent several days  supporting efforts to monitor an incident associated with a classified  system that did not evolve into a significant incident and, therefore, did not  result in a written report.
In addition, since 1998, the AISU has provided analytical support related to  a counterintelligence investigation, which involves a complicated series of  computer intrusions into federal agencies, universities, and private-sector  systems.  As of December 2000, this effort had resulted in 12 analytical  documents, which, unlike most of the AISU’s other efforts, included both  tactical and strategic analyses.  NIPC officials say that these analyses have  provided valuable experience that the AISU is using to develop improved  methods for identifying perpetrators and understanding their actions.  For  example, the NIPC initiated Project La Resistance, which is a strategic  effort to analyze information gathered from disparate sources, including  law enforcement and intelligence agencies, private industry, and other  open sources, to identify linkages and commonalties among incidents and  perpetrators.
The AISU has also issued a variety of publications, most of which were  compilations of information previously reported by others with some NIPC  analysis.  Its most widely disseminated documents include a biweekly  publication called CyberNotes, a compilation of reports by other sources  on software vulnerabilities, hacker techniques, and virus information,  which is intended for use by security professionals.  CyberNotes is  presented in a summary table format that includes pertinent information on  each vulnerability, such as vendor and operating system, software name,  potential impact, remedies, and an indication of whether any attacks have  actually exploited the vulnerability or attack technique.  The NIPC also  produces and broadly distributes the Daily Watch, a listing of daily  developments affecting infrastructures, which is compiled from a range of  sources. In January 2001, the NIPC introduced Highlights (formerly known  as Critical Infrastructure Developments) as a publication intended to  provide information on infrastructure protection issues, with a specific  emphasis on computer and network security matters.
section_title: Limited Strategic Analysis Performed
paragraphs: While the NIPC has provided support to the previously mentioned  counterintelligence investigation and input into two intelligence  community documents, including the recent National Intelligence Estimate  on cyber threats, overall, it has performed limited strategic analysis.  As a  result, information on individual incidents or groups of incidents has not  been fully taken advantage of to assist in identifying broader, longer-term  risks. For example, in October 1999, the NIPC issued an advisory on a  Trojan-horse program dubbed  “RingZero,” describing it as an “aggressive  reconnaissance technique” used to obtain detailed information on systems  that could be used to facilitate future attacks. The NIPC advisory was  based on analyses obtained from the Systems Administration, Networking,  and Security (SANS) Institute, which is a cooperative research and  education organization, and the Naval Surface Warfare Center.  These  analyses highlighted the possible malicious uses of RingZero for  anonymously performing large distributed attacks.  However, the NIPC  made no attempt to determine the potential strategic implications of  RingZero and more thoroughly understand the related risks to national  infrastructures.  Additional analysis was not performed because, according  to the Chief of the AISU, staff were diverted to other incidents of more  immediate concern.
NIPC officials told us that the RingZero analysis was an example of how  their efforts to develop strategic analysis capabilities had been limited  because the AISU’s analysts were fully engaged in supporting a growing  stream of new and ongoing investigations of computer-based incidents.   This point was corroborated in an October 2000 National Infrastructure  Protection and Computer Intrusion Program Plan, issued by the FBI’s  Counterterrorism Division, which stated that, while over 1,000 computer  crime investigations were underway, the NIPC could only provide regular  analytical support to fewer than a dozen of the most important cases.
section_title: Impediments to Developing More Substantive Analytical Capabilities
paragraphs: The experts we interviewed at the NIPC and other federal agencies agreed  that developing substantive capabilities for analyzing computer-based  threats is a formidable task, especially in the area of strategic analysis.  No  generally accepted methodology in this area exists, and analytical expertise  and reliable data on infrastructure vulnerabilities are in short supply.   These factors have impeded the NIPC’s progress in this area.
subsections: section_title: Lack of Methodology for Strategic Analysis
paragraphs: According to federal intelligence and national security officials, no  generally accepted methodology for strategic analysis of cyber threats to  the nation’s infrastructures has been developed.  Lacking are a standard  terminology, a standard set of factors to consider, and established  thresholds for determining the sophistication of attack techniques.  As a  result, no proven or generally accepted approach exists that the NIPC can  readily adopt to perform such analyses.  The intelligence community  officials we met with said that developing such a methodology would  require an intense interagency effort and a dedication of significant  resources.
section_title: Lack of Needed Staff and Expertise
paragraphs: According to senior NIPC officials, the AISU has depended to a large extent  on detailees from other agencies to supplement FBI staff.  Although the FBI  has investigative capabilities, it acknowledges that it lacks staff who are  experienced in critical infrastructure operations and intelligence analysis.   The NIPC Director told us that the use of detailees was intended to be a  means of rapidly assembling an analytical capability from existing  expertise within the federal government and that, in his view, it was  important for the NIPC to draw on the expertise and diverse perspectives  of personnel from other agencies.  Accordingly, the chief of the Analysis  and Warning Section, which includes the AISU, and the AISU chief, at the  time of our review, were detailees from the intelligence community.
NIPC officials also attribute the limited progress of the Analysis and  Warning Section and the AISU to sustained leadership vacancies.   According to NIPC records, the Chief of the Analysis and Warning Section  position, which was to be filled by the Central Intelligence Agency (CIA),  was vacant for about half of the NIPC’s 3-year existence.  Similarly, NIPC  records show that a National Security Agency detailee position was vacant  for approximately 17 months between May 1998 and April 2000.   As a  result, the NIPC could not fully benefit from the experience of these  intelligence community officials in developing the required capabilities.
In addition, fewer detailees have been provided for other AISU positions  than were originally anticipated, and most positions have been filled with  FBI analysts.  Since its creation in 1998 through the end of fiscal year 2000,  the AISU has operated with an average of about 13 analysts. Ten of these  positions have been held by FBI analysts, and three positions have been  held, sometimes on an intermittent basis, by detailees from other federal  agencies or from international partners, such as Canada and the United  Kingdom.  An additional three detailee positions were designated by the  NIPC but were not staffed by the other involved federal agencies.   In  August 2000, the Analysis and Warning Chief estimated that the AISU  needed about 24 analysts to provide a foundation for building adequate  analytical capabilities.  This would allow the NIPC to devote about three  analysts to each of the eight industry sectors identified in PDD 63.
Through interviews with NIPC officials and individuals from other federal  agencies who had been detailed to or otherwise associated with the NIPC,  we identified two factors that contributed to agencies’ not providing the  number of experienced detailees originally anticipated.  First, federal  employees with experience in computer security and information  technology management are in short supply, and agencies need those  available to support their own operations.  As a result, agencies are  reluctant to provide such valued staff to the NIPC.  Second, of the 25  individuals we interviewed who had been detailed to the NIPC, 16  expressed negative comments about their work experience there.  In  particular, the detailees noted that FBI procedures prevented them from  being involved in decisionmaking and limited their access to information.   Some of the detailees felt that they were not provided the same level of  respect and support as were the FBI agents who were assigned to the  NIPC.  For example, one detailee assigned to the NIPC for almost 18  months during 1999 to 2000, observed that detailees had different badges,  could not access some computer systems, and could not sign procurement  orders.  However, by the summer of 2000, the situation had improved;  detailees were given badges similar to FBI personnel, increased access to  computer systems, and authority to sign some procurement forms.
Although NIPC officials cited a need for more personnel, they also cited a  need for personnel with more experience and expertise in computers,  infrastructure operations, and intelligence analysis.  NIPC officials said that  most of the FBI employees assigned to the AISU have had limited expertise  in these areas and have lacked the skills necessary to perform the assigned  functions. The FBI’s 1998–2003 Strategic Plan corroborated these  assertions, noting that FBI analysts often have had little or no training in  intelligence analysis and lack experience in the subject matter for which  they are responsible.  According to one NIPC manager, additional expertise  could be obtained by hiring analysts from outside of the FBI.  However,  NIPC officials say they have been precluded from doing so because the  NIPC must stay within the authorized FBI staffing levels.  NIPC officials  said that this shortage of expertise and skills has especially limited the  NIPC’s ability to establish a viable strategic analysis capability, since this  requires sustained efforts over a period of time. FBI and NIPC officials are  aware of this problem and, in 1998 and 2000, the Attorney General and the  FBI director wrote to agency heads requesting detailees. Also, in November  2000, the FBI Director sent a letter to the Assistant to the President for  National Security Affairs stating that “without additional support from  other federal agencies, our ability to effectively detect, warn of, and  respond to cyber attacks will not be adequate to address the ever growing  threat.”   In addition, NIPC officials told us they were developing a plan and  budget justification that detailed the need for an increase in NIPC staff.
section_title: Inadequate Data on Infrastructure Vulnerabilities
paragraphs: The AISU’s strategic analysis capabilities depend to a large extent on the  availability of technical infrastructure assessments that provide industry- specific data on factors such as critical system components, known  vulnerabilities, and interdependencies.  Under PDD 63, eight infrastructure  segments were to be assessed by each industry sector’s lead agency and  industry representatives.  For example, the Department of Transportation  was directed to work with the transportation industry, and Commerce was  to work with the telecommunications sector to develop their respective  sector technical assessments.
According to the National Plan, the NIPC was to use these assessments in  combination with foreign intelligence information, information from law  enforcement investigations and operations, and voluntary private-sector  reports, to develop comprehensive strategic assessments of risk.   According to the Attorney General’s plan, such comprehensive  assessments are important because they are to form the basis for  identifying indicators of potentially malicious or damaging activity and  developing related intelligence collection requirements.  In addition, these  assessments provide input for a variety of NIPC products, including alerts  and advisories.
Most of the industry assessments have not, however, been performed, and  none have been provided to the NIPC.  NIPC officials told us that  assessments had been at least partially performed for the electric power,  transportation, and water sectors.  However, they had received no detailed  written assessments and, as a result, could not benefit from their findings.   In addition, in 2000, NIPC initiated assessments of telecommunications and  electric power.   According to NIPC officials, these assessments were  intended to develop relevant products for the industry sectors and  encourage sectors to participate more in PDD 63.  At the close of our  review, these documents remained in draft form.
section_title: The NIPC Has Developed a Rudimentary Warning Capability
paragraphs: To provide a warning capability as required by PDD 63, the NIPC  established the Watch and Warning Unit.  The unit’s objective is to identify  attacks that appear imminent and alert government entities, businesses,  and the public, so that significant damage can be averted.   While some  warnings have been issued in time to avert damage, most of the warnings,  especially those related to viruses, have pertained to attacks that were  already underway.
Several factors, some of which are beyond the NIPC’s control, have  hindered the NIPC’s ability to provide advance warnings.  Specifically, no  comprehensive governmentwide or nationwide data-collection and  analysis framework has been established to provide the NIPC with  information on unusual or suspicious computer-based activity before the  occurrence of actual incidents.  In addition, the Watch and Warning Unit’s  ability to issue warnings is slowed by a shortage of experienced watch  officers and the need to verify the accuracy of the input it receives and  ensure that sensitive information is protected.
subsections: section_title: Number of Warnings Has Increased, but Value in Protecting Systems Is Largely Unknown
paragraphs: Since its establishment in 1998, the NIPC has issued 81 warnings that were  based on the work of its Watch and Warning Unit.  Many of these alerts  were posted on the Internet and were available to the public.  Other alerts  were targeted to specific industries or individual organizations that the  NIPC deemed to be at special risk.
The NIPC categorizes its warnings as follows.  The most serious is an  "alert," which provides information on a major threat or on imminent or in- progress attacks targeting specific national networks or critical  infrastructures.  The second most serious type of warning is an "advisory,"  which provides information on significant threats or incidents and suggests  that organizations strengthen their readiness posture.  The third and least  serious type of warning is an "assessment," which provides broad, general  incident or issue awareness information that is both significant and current  but does not necessarily suggest immediate action.  Before March 2000, the  NIPC issued notifications referred to as “warnings,” which were similar to  what it now refers to as alerts.  The NIPC deleted this category and added  the assessment category so that its warning system would more closely be  aligned with the FBI’s system for warnings about terrorist acts.  In some  cases, multiple warnings are issued that pertain to only one type of attack  or incident.  For example, in May, June, and August 2000, the NIPC issued  nine alerts on the ILOVEYOU virus and related variations.  The number and  type of warnings issued by the NIPC in 1998 (February - December), 1999,  and 2000 are summarized in table 1.
Most of the NIPC’s warnings illustrated in table 1 pertained to attacks  underway; few preceded an imminent attack.  One senior NIPC official  noted that the NIPC currently lacks the information and the necessary  understanding to identify discrete indicators that might be precursors to a  computer-based attack.  As a result, most of its warnings are based on  reports of attacks in progress.  However, in late 1999 and 2000, there were  several instances when the NIPC was able to provide warnings before an  attack was actually launched.  These included the following examples:  In April 2000, the NIPC obtained information from a law enforcement  investigation that 478 serious (root-level) compromises had been  perpetrated globally in an effort to create a distributed denial-of-service  attack.  The NIPC coordinated efforts to warn victims, individually, by  working with 11 FBI legal attachés located abroad and through the FBI  field offices in the United States.  According to the NIPC, many victims  had been unaware of their systems’ compromise before the warning.
In December 1999, multiple reports of the presence of distributed  denial-of-service tools on computer systems in the United States  prompted the NIPC to issue an alert, its most urgent warning.   According to the NIPC, these tools were capable of generating sufficient  network traffic to congest targeted networks or systems, thus rendering  them inoperable.  The NIPC supplemented its alert with a software  program that system administrators could use to detect the presence of  denial-of-service attack tools on their systems.
While the NIPC has issued warnings directly to hundreds of individuals and  entities, and made many of its alerts, advisories, and assessments publicly  available through its Web site, it does not have any reliable information on  the effectiveness of these warnings.  For example, NIPC does not develop  statistics on the number of visitors to its Web site or routinely solicit  feedback on the effectiveness of its warnings from industry or the public.   NIPC officials told us that they informally solicit feedback and had received  a great deal of unsolicited feedback on NIPC products.  They said that  further efforts in this area were constrained by limited resources.  Also,  they noted that a challenge inherent in providing warnings is that there is  no way to ensure that potential victims will hear or heed the warning.
section_title: Watch and Warning Procedures Formalized During 2000
paragraphs: During the last half of 2000, the Watch and Warning Unit formalized  standard operating procedures to guide the activities of watch officers.   Before this, informal procedures had evolved as the unit gained experience,  but many had not been fully documented.  In addition, many watch officers  were detailees from other agencies, and turnover of staff had been rapid,  making the need for standard, documented procedures especially  important.
The new procedures are intended to ensure that watch officers perform  their duties completely and consistently and establish standard criteria and  procedures for issuing warnings.  As such, they describe watch officer  responsibilities and provide a detailed list of activities to be conducted at  specified intervals.  The procedures also describe a carefully ordered  process for assessing an incident; convening a watch advisory committee;  developing alerts, advisories, and assessments; and disseminating  warnings.
section_title: Barriers to Issuing Early Warnings
paragraphs: Even when the NIPC becomes aware of an imminent threat, four factors  hinder its ability to issue early warnings:  (1) a lack of a comprehensive  governmentwide or nationwide framework for promptly obtaining and  analyzing information on imminent attacks; (2) a shortage of skilled staff;  (3) the need to ensure that the NIPC does not raise undue alarm for  insignificant incidents; and (4) the need to ensure that sensitive  information is protected, especially when such information pertains to law  enforcement investigations underway.
subsections: section_title: No Comprehensive Data- Collection and Analysis Framework
paragraphs: Unlike watch and warning efforts for attacks from nuclear and  conventional weapons, which are supported by an array of satellites and  other data-collection and analysis mechanisms, no comprehensive  governmentwide or nationwide data-collection and analysis framework has  been established for (1) developing information on what constitutes  unusual or suspicious activity associated with computers supporting  critical operations, (2) recognizing such activity, and (3) promptly reporting  the activity to the NIPC or others for further analysis to determine if a  warning is appropriate.  As a result, the Watch and Warning Unit develops  its warnings on the basis of analyses developed by the AISU, which it  supplements with information gathered from the Internet and from  telephone calls and e-mails from government and industry sources.
Officials involved in developing indications and warnings at DOD told us  that establishing more comprehensive and effective mechanisms for  detecting computer-based attacks are likely to take significant effort.   According to the 1996 Report of the Defense Science Board Task Force on  Information Warfare Defense, it took the United States over four decades  to identify the indicators for nuclear and conventional attacks and optimize  the collection and reporting systems to perform analysis needed for watch  and warning.  Defense officials told us that developing reliable indications  of impending computer-based attacks would be even more difficult  because attacks can be launched by small, loosely aligned groups.  Such  planned attacks are difficult to identify because the perpetrators do not  always have the bureaucratic organization or command and control  structure that allows their doctrine, organization, and capability to be  observed in advance of an attack.  In addition, the ability of such groups to  quickly develop networks and maintain anonymity makes it very difficult to  create the types of predictive methodologies that have evolved for  monitoring traditional, noncyber threats.
Several federal efforts are planned or underway to develop warning  indicators and mechanisms for promptly communicating alert data.  For  example, the NIPC and the electric power industry have developed a  voluntary set of reporting requirements and thresholds for voluntary  information sharing and data analysis.  This "Indications, Analysis and  Warning" program, piloted in 1999, is intended to (1) establish computer  connectivity with electric power industry components, (2) develop agreed- upon criteria for attack indicators, and (3) implement criteria for  information sharing with the NIPC.  (Chapter 4 of this report discusses in  greater detail the NIPC’s efforts to establish cooperative, information- sharing relationships with government and private-sector sources.)  In  addition, the National Security Agency’s National Security Incident  Response Center, which acts as a focal point for addressing computer  incidents affecting national security information systems, maintains a  database on computer incidents and their sources.  In 1998, the response  center recorded more than 5,700 computer incidents, which originated  from foreign and domestic sources.  However, no such data-collection  framework is being developed on a governmentwide or national basis.
section_title: Shortage of Skilled Staff
paragraphs: NIPC has difficulty staffing its 24-hour watch operations with skilled staff.   During 1999 and 2000, the Watch and Warning Unit had an average of 12  employees, who monitored the Internet and other media to identify reports  on computer-based attacks.  Initially, the unit operated 5 days a week, 16  hours a day.  In December 1999, the NIPC initiated continuous watch  operations—24 hours a day, 7 days a week.  The NIPC’s goal is to have four  people on each 12-hour shift.  NIPC officials said that they have not met  this goal because they have not had enough staff who possess an  understanding of the Internet and the implications of computer attack  techniques to recognize potentially serious incidents.  Officials told us that,  as a result, some shifts could not be adequately staffed.
section_title: Avoiding Undue Alarm
paragraphs: While the NIPC considers all types of incidents and attacks, it is important  that the NIPC limit its public warnings to those that appear to present  significant risk.  Computer-based attacks and other potentially destructive  incidents are becoming more common, but, according to NIPC officials,  most incidents result in little or no significant damage.  For example,  officials assert that approximately 20 to 30 new computer viruses are  disseminated daily, with over 50,000 known viruses being in existence.   From their experience, NIPC officials determined that most of these  viruses did not warrant a public warning because they were not very  damaging, did not propagate easily, or were readily detected by existing  antivirus software.
Issuing too many warnings on incidents that ultimately do little or no harm  would diminish the NIPC’s credibility, and computer users might begin to  ignore important warnings.  In May 2000, the NIPC Director stated that  “creating an unnecessary panic or perpetuating a virus hoax could be just  as damaging as a real virus if it caused people to unnecessarily disconnect  from the Internet or shut down e-mail.” Accordingly, the NIPC takes time  to ensure that the reports it obtains are credible and to determine if  incidents, attacks, and viruses are significant enough, in terms of their  potentially destructive impact, to warrant a public warning.  The  procedures defined by the NIPC in August 2000 state that analyzing a  potential threat, determining the need for a warning, and disseminating the  warning can take several hours and involve a wide range of contacts with  NIPC personnel and outside entities, including computer incident response  centers and software manufacturers.
The NIPC’s ability to perform such analyses in a timely manner is closely  linked to the extent of technical and analytical expertise that it has  available on a 24-hour basis.  Shortfalls in such expertise have limited the  NIPC’s ability to promptly determine which incidents merit issuance of an  immediate warning.
section_title: Protecting Sensitive Information
paragraphs: In many cases, the NIPC learns of a computer-based threat from  intelligence sources or as part of a criminal investigation.  In these cases,  the NIPC takes special precautions to ensure that warnings do not  inappropriately disclose sensitive information, thus balancing the need to  protect evidentiary data with the need to issue timely warnings.
Such precautions can be tedious and time-consuming.  Before  disseminating national security or intelligence information, the NIPC  works with the originating agency to delete sensitive information, which is  a process often referred to as sanitizing the information.  For example, to  release information from a classified source, such as an intelligence report,  the NIPC obtains permission from the analyst who wrote the report.  Then,  according to NIPC officials, they must submit a draft of the sanitized  version to the originating intelligence analyst for review and release.  This  process can involve several exchanges of drafts, thereby slowing the  warning process.
Sanitizing law enforcement information can also cause delay.  According to  NIPC officials, while there is a common understanding about procedures  for handling classified information and the punishments for mishandling it,  there is no legal framework detailing how law enforcement sensitive  information is to be handled.  As a result, many in the law enforcement  community are hesitant to share information with officials in the defense  and intelligence communities or with the private sector.  Another deterrent  is that law enforcement sensitive information, such as classified  intelligence information, may impact undercover operations, and  mishandling it may seriously harm operations and place sources of  information at risk.
Several officials we met with outside of the NIPC noted the difficulty  inherent in balancing the benefits of warning the public with the benefits of  protecting information needed to apprehend a perpetrator and prosecute a  criminal case.  Investigations may yield unique information that, when  translated into warnings, can both prevent damage as well as help identify  additional victims of a related attack.  NIPC officials agreed and said that,  during 1999 and 2000, they have attempted to make warning a priority by  encouraging investigators and analysts to disseminate warnings that  protect law enforcement, while still providing industry and government  information needed to mitigate damage from computer-based attacks.   According to NIPC records, on 18 occasions from March 1999 through  October 2000, the NIPC issued warnings that were based on information  from ongoing criminal and foreign counterintelligence investigations.
However, in February 2001, the National Coordinator for Security,  Infrastructure Protection, and Counter-Terrorism told us that issues still  remained to be resolved to facilitate the sharing of such information.  For  example, he asserted that, in some instances, it would be helpful if the  NIPC shared more information during the initial phase of an investigation  so that other federal entities can take appropriate action to protect their  operations.
section_title: Other Factors Impeding Development of Analysis and Warning Capabilities
paragraphs: In addition to the impediments discussed, two significant factors make it  difficult to evaluate the NIPC’s progress in developing analysis and warning  capabilities and may impact the viability of the government’s broader  strategy for protecting the nation’s critical infrastructures from computer- based attacks.  The first factor is that the NIPC’s roles and responsibilities  have not been fully defined and are not consistently interpreted by other  entities responsible for critical infrastructure protection.  The second  factor is that the NIPC has not developed a comprehensive, integrated plan  that describes its goals for developing analysis and warning capabilities  and the actions and related resources needed to achieve them.
subsections: section_title: Details of NIPC Roles and Priorities Inadequately Defined and Communicated
paragraphs: The government’s strategy and subordinate plans for protecting the nation’s  critical infrastructures from computer-based attacks, including the NIPC’s  role, have not been clearly articulated.  While PDD 63 established  December 2000 as the deadline for achieving an initial operating capability  and May 2003 for achieving full operational capability of key functions,  such as warning capability, neither the directive nor the subsequent  National Plan for Information Systems Protection defined what such  capabilities would include.   PDD 63 describes general goals and provides  an outline of the responsibilities assigned to the NIPC, but the directive  provides few details regarding the NIPC role and its relationship to other  entities, especially those involved in analysis and warning for national  security.  The National Plan provided little additional information  pertaining to the NIPC, noting that the plan “will evolve and be updated as  we deepen our knowledge of our vulnerabilities and the emerging threats.”
subsections: section_title: Interpretation of NIPC’s Role Is Not Consistent
paragraphs: In a September 1998 report, shortly after the initial issuance of PDD 63, we  noted the importance of developing a governmentwide strategy that clearly  defines and coordinates the roles of new and existing federal entities to  ensure governmentwide cooperation and support for PDD 63. At that time,  we recommended that OMB, which, by law, is responsible for overseeing  federal information security, and the Assistant to the President for National  Security Affairs ensure such coordination.  In written comments on that  report and at a November 1998 meeting, senior officials involved in  implementing PDD 63 told us that plans for such coordination were being  implemented.  However, our more recent meetings with representatives of  the entities involved in the government’s critical infrastructure protection  showed that they do not share a consistent interpretation of the NIPC’s  roles and responsibilities in these efforts. “The NIPC will provide a national focal point for gathering information on threats to the  infrastructures.  Additionally, the NIPC will provide the principal means of facilitating and  coordinating the federal government’s response to an incident, mitigating attacks,  investigating threats and monitoring reconstitution efforts.”
However, our discussions with officials in the defense, intelligence, and  civilian agencies involved in critical infrastructure protection, and with  OMB and the National Security Council showed that their views of the  NIPC’s roles and responsibilities differ from one another and, in some  cases, from those outlined in PDD 63.  Several expressed an opinion that  this lack of consensus has hindered the NIPC’s progress and diminished  support from other federal agencies.  Examples of their comments follow:   The National Coordinator for Security, Infrastructure Protection, and  Counter-Terrorism, who is responsible for implementation of PDD 63,  told us that there is a conflict between the NIPC’s responsibilities to (1)  broadly gather, analyze, and share information on computer-based  threats and (2) support the FBI’s investigative activities, which usually  preclude sharing of information associated with cases under  investigation.  He said that this conflict has impeded the NIPC’s ability to  fulfill its analytical and warning responsibilities and diminished the level  of support it has received from other agencies and the private sector.  He  said that he believes the NIPC role should be limited to investigating  incidents.
OMB officials told us that they did not view the NIPC, as “the” national  focal point for gathering information on threats, but as one of several  centers devoted to providing information on threats to U.S.  infrastructures.  In addition, they said that the NIPC’s focus was to be on  law enforcement, as indicated by its placement within the FBI.
Officials in the intelligence community said that they were uncertain  what role the NIPC was supposed to play, and several noted that, for  national security purposes, they viewed the NIPC as a second-tier  participant that primarily received finished intelligence, rather than an  organization that generated original, analytical products.
Several officials involved in critical infrastructure protection efforts said  that PDD 63 envisioned that the NIPC would combine the strength of  agencies responsible for national defense, intelligence, and domestic  law enforcement.  However, fulfilling this vision sometimes conflicts  with the FBI’s primary mission of apprehending criminals and bringing  them to justice.  In particular, this conflict has led to questions about the  NIPC’s ability to lead response efforts should a widespread computer- based crisis occur.
NIPC officials maintain that PDD 63 and the National Plan clearly outline  the functional responsibilities of the NIPC.  Further, NIPC officials told us  that, in their view, some agency officials say the NIPC’s role is not defined  properly either as an excuse for not providing support in the form of  detailees or because the agencies believe that parts of the NIPC’s mission  should be performed elsewhere.  The FBI Director corroborated this in a  November 2000 letter to the Assistant to the President for National Security  Affairs in which he stated “some agencies appear to question PDD 63 itself  and would like to take parts of the NIPC’s mission.”
section_title: Lines of Authority Are Not Clear
paragraphs: It is unclear who has direct authority for the NIPC, who sets its priorities  and procedures, and who provides oversight.  PDD 63 states that the  National Coordinator, who reports to the Assistant to the President for  National Security Affairs, shall be responsible for coordinating the  implementation of the directive.  Accordingly, the National Coordinator  contends that responsibility for NIPC oversight rests with him.  However,  because the NIPC is located within the FBI and the NIPC Director is  subordinate to an FBI Assistant Director, the NIPC is also subject to FBI  direction.
This situation may be impeding the NIPC’s ability to carry out its mission.    Examples include the following:  The NIPC’s budget requests—including staffing and other financial  resources—are controlled by the FBI and the Department of Justice,  raising concern among NIPC officials that the NIPC’s priorities, which  are intended to reflect the interests of national critical infrastructure  protection, may be subordinated to the FBI’s law enforcement priorities.  NIPC officials told us that their repeated requests for additional  resources as part of the budget process had not been approved by the  FBI.
Requests for detailees of agencies, such as the Departments of State,  Energy, Defense, and the Treasury and the CIA, to support the NIPC  have come from the FBI and Justice, rather than from the National  Coordinator or the National Security Council, possibly raising questions  regarding whether the NIPC’s request for detailees had the full support  of the Executive Office of the President.
The NIPC proposal to create an operational advisory board comprising  senior representatives from other agencies with key critical  infrastructure protection roles and intended to resolve several issues— including the need for detailees and interagency expertise—was  approved by the FBI Director but subsequently rejected by the National  Coordinator, leaving the issues unaddressed.
Existing agreements between the Executive Office of the President and  Justice restricting disclosure of law enforcement information have  inhibited the NIPC’s ability to share information with the National  Coordinator.  For example, in a recent case, the NIPC Director was  unable to share information about an investigation with the National  Coordinator until officials in Justice had approved it.
section_title: The NIPC Has Not Been Integrated Into National Security Warning Procedures
paragraphs: The NIPC’s role in providing warning has not been integrated into the  national security warnings process, which provide a means of alerting the  most senior federal officials, including the President, of serious or  imminent threats to national security.  Such warnings are developed and  issued by the National Intelligence Council, which includes members from  each federal intelligence agency.  According to the Attorney General’s Five- Year Interagency Counterterrorism and Technology Crime Plan, the  National Intelligence Council, the Joint Chiefs of Staff, the National  Communications System, and the NIPC met in 1998 and 1999 to discuss  how the NIPC should be integrated into the national warning system.  The  goal was to produce a warning system that met the requirements for  national defense, law enforcement, and intelligence.  However, no  consensus was reached and no additional meetings were held.  As a result,  NIPC’s role has not been formally recognized as part of the national  security warning procedures.
section_title: Rules for Recognizing and Responding to a National Security Incident Have Not Been Established
paragraphs: The NIPC and the Defense and intelligence communities have not  developed (1) criteria for determining when a computer-based attack  should be treated as a national security event rather than as a crime and (2)  protocols for placing the NIPC in a support role, rather than a lead role,  should such a national security event occur.  While computer-based  attacks, to date, have not caused devastating damage and have not been  treated as acts of war, NIPC and DOD officials agree that, under certain  circumstances, such an attack could constitute an act of war or other  immediate threat to national security.
PDD 63 recognized that, should an incident be deemed a threat to national  security, responsibility for coordinating the response would fall to DOD or  the intelligence community.  Specifically, PDD 63 stated that, “depending  on the nature and level of a foreign threat/attack, protocols established  between special function agencies (DOJ/DOD/CIA), and the ultimate  decision of the President, the NIPC may be placed in a direct support role  to either DOD or the Intelligence Community.”   Accordingly, NIPC officials  said that there is a need to establish response protocols that will  differentiate between national security concerns, criminal activity, and  malicious mischief.  DOD’s Director for Information Assurance agreed,  stating that, without such protocols, a national security crisis may not be  recognized and addressed in a timely manner.
While some legal provisions and detailed protocols exist for placing the FBI  in support of DOD for responses to terrorism, it is not yet certain whether  the same provisions would apply to computer-based attacks.  Such  provisions and protocols are important because they provide, under certain  circumstances, exemptions from prohibitions of the Posse Comitatus Act,  which bars DOD from participating in domestic law enforcement activities.   A number of statutory exemptions permit DOD’s involvement in dealing  with domestic terrorist incidents.  For example, if an exceptionally grave  physical terrorist threat or incident exceeds FBI capabilities, a special  operations task force may be established that places DOD in the lead and  the FBI in a support role.  According to Justice officials, these statutory  exemptions often require a request from the Attorney General;  concurrence by the Secretary of Defense; and, as a matter of policy, in most  instances, approval by the President.  To initiate this process, the President  must issue an executive order and a proclamation—documents that are  maintained in draft form so that they are ready for the President’s  signature, if needed.
Senior NIPC officials told us that they intended that the operational  advisory board that they had proposed establishing during 2000 would  examine the existing protocols developed for physical terrorism and  determine if they were sufficient in the event of a serious computer-based  attack or if new protocols were needed.   However, as previously  mentioned, the National Coordinator turned down this proposal, and, as of  December 2000, Defense and intelligence officials told us that there were  no efforts underway to resolve this issue.
section_title: The NIPC Has Not Integrated Plans for Developing Analysis and Warning Capabilities
paragraphs: An additional factor impeding evaluation of its progress is that, as of  December 31, 2000, the NIPC had not developed a comprehensive,  integrated plan outlining its goals for developing analysis and warning  capabilities and identifying needed resources.  Instead, it has developed  elements of a plan, which are contained in a variety of different documents.   These include the following:  In 1999, the FBI outlined general goals and challenges related to  developing analysis and warning capabilities in the National  Infrastructure Protection and Computer Intrusion Program Plan. This  plan recognized the need to (1) institutionalize a process for receiving  real-time information relative to threats, incidents, and vulnerabilities  pertaining to critical infrastructures and (2) develop analytical and  communications skills and expertise in computer technologies.  An  updated version of the plan was issued in October 2000.  However, both  the 1999 plan and the 2000 update focus primarily on investigative  capabilities being developed in FBI field offices.
In 1999, the Attorney General’s Five-Year Interagency Counterterrorism  and Technology Crime Plan provided detailed information on the  intended operations of the NIPC, including analysis and warning as well  as the identification of indicators.  It also recognized that the  development of NIPC capabilities was highly dependent on interagency  cooperation.
In 2000, the NIPC drafted the National Infrastructure Protection Center  Priorities and Goals 2000-2002 document, which was intended for  approval and input from a proposed advisory board. The document  contains an outline of goals and objectives for analysis and warning  capabilities, but does not address the interim steps needed to achieve  them.
In 2000, the Analysis and Warning Section developed seven detailed  goals and related objectives for fiscal year 2001.  However, this  document did not provide an explanation or strategy on how NIPC  would achieve them.
NIPC officials provided us documents they say were used to support  their 1999, 2000, 2001 budget requests for analysis and warning efforts.  These documents identify resources, strategies and current shortfalls.
While these documents provide information on the NIPC’s general plans  and needed resources, the information is fragmented and incomplete.  As a  result, it does not provide a comprehensive road map to guide,  communicate, and measure progress.  Such plans are also important  because they serve to clarify and communicate objectives and goals. In  addition, the plans can highlight potential problems, describe resource  needs, and provide a means for measuring performance.  The Government  Performance and Results Act of 1993 required federal agencies to develop  strategic plans that included six key elements.  Although that act does not  require such plans for individual agency programs, the following six key  elements it identifies serve as a useful guide:    a comprehensive agency mission statement;  general goals and objectives for all major functions and operations;   a description of how the goals and objectives are to be achieved,  including operational processes, skills, and technology and the human  capital and other resources needed;  a description of the relationship between the general goals and  objectives and annual performance goals;   identification of key factors, external to the agency and beyond its  control, that could significantly affect the achievement of the general  objectives and goals; and   a description of how program evaluations were used to establish or  revise general objectives and goals, and a schedule for future program  evaluations.
The documents described above contained some of these elements;  however, they did not (1) establish milestones and performance measures;  (2) describe the specific operational processes, skills, and technology  necessary to achieve the stated goals and objectives; (3) describe the  relationship between the general goals and objectives and annual NIPC  performance goals; and (4) describe how program evaluations would be  used to establish or revise general objectives and goals and a schedule for  future program evaluations.
section_title: Changes to NIPC Responsibilities Being Considered
paragraphs: At the close of our review, in February 2001, the National Coordinator told  us that the administration had begun to consider options for adjusting the  federal strategy for critical infrastructure protection originally outlined in  PDD 63.  He said that adjustments being considered included provisions  related to the development of analysis and warning capabilities currently  assigned to the NIPC and that one intent of any such changes would be to  clarify roles and responsibilities in this area.
section_title: Conclusions
paragraphs: While the NIPC has taken some steps to develop analysis and warning  capabilities, the strategic capabilities described in PDD 63 have not been  achieved.  Many of the factors that have impeded the NIPC’s progress in  this area, such as the absence of a methodology for strategic threat  analysis, the lack of needed staff and expertise, and inadequate data on  infrastructures, will require coordinated information-sharing and analysis  efforts by the federal agencies that have pertinent expertise.  Similarly, the  NIPC efforts in warning have also been impeded by the lack of a  comprehensive, governmentwide data-collection framework for identifying  imminent computer-based attacks.  Further, the NIPC faces other barriers  in issuing timely warnings, including a shortage of skilled staff, avoiding  undue alarm for insignificant incidents, and ensuring that sensitive  information is protected.
Evaluating the NIPC’s progress is difficult because its roles and  responsibilities have not been fully defined and are not consistently  interpreted by other entities responsible for critical infrastructure  protection.  Specifically, it remains unclear who has direct authority for the  NIPC and if the NIPC is to be integrated into the national security warning  process.  Further, no criteria have been developed for determining when a  computer-based incident threatens national security and what related  protocols would be used to place the NIPC in support of DOD or the  intelligence community.  Clarifying such issues and engendering  governmentwide support and assistance will be important elements of  ensuring the successful development of the analysis and warning  capabilities envisioned by PDD 63.   In addition, developing a  comprehensive, integrated plan to guide activities related to establishing  analysis and warning capabilities, outline related resource needs, and  identify impediments to progress would provide valuable input for  consideration as the government moves forward with efforts to protect  critical infrastructures.
section_title: Recommendations for Executive Action
paragraphs: On the basis of the criteria provided in PDD 63 and related plans, we  recommend that the Assistant to the President for National Security  Affairs, in coordination with pertinent executive agencies,    establish a capability for strategic analysis of computer-based threats,  including developing a related methodology, acquiring staff expertise,  and obtaining infrastructure data;    develop a comprehensive governmentwide data-collection and analysis  framework and ensure that national watch and warning operations for  computer-based attacks are supported by sufficient staff and resources;  and  clearly define the role of the NIPC in relation to other government and  private-sector entities, including  lines of authority among the NIPC and the National Security Council,  Justice, the FBI, and other entities;  the NIPC’s integration into the national warning system; and  protocols that articulate how and under what circumstances the  NIPC would be placed in a support function to either the DOD or the  intelligence community.
We recommend that the Attorney General task the FBI Director to require  the NIPC Director to develop a comprehensive written plan for establishing  analysis and warning capabilities that integrates existing planning elements  and includes   milestones and performance measures;  approaches (or strategies) and the various resources needed to achieve  the goals and objectives;   a description of the relationship between the long-term goals and  objectives and the annual performance goals; and  a description of how program evaluations could be used to establish or  revise strategic goals, along with a schedule for future program  evaluations.
section_title: Agency Comments and Our Evaluation
paragraphs: In commenting on a draft of this report, the Director of the NIPC generally  agreed with the report’s findings and stated that the NIPC considers it of  the utmost urgency to address the shortcomings identified.  The Director  expressed the view that it is most important that the NIPC receive adequate  staffing, particularly from the defense and intelligence communities, to  address the lack of strategic analysis.  In particular, the Director said that  the report should reflect that many executive branch components had not  heeded the call set out in PDD 63 to “provide such assistance, information  and advice that the NIPC may request.”  In addition, the Director  recommended that the report recognize the NIPC’s performance in the  context of its recent formation, noting that the NIPC has been in existence  for only 3 years.  Finally, the Director noted that our report did not  recommend a change to the basic PDD 63 framework.  In this regard, he  expressed the view that the FBI is the only locus where law enforcement,  counterintelligence, foreign intelligence, and private-sector information  may be lawfully and collectively analyzed and disseminated, all under well- developed statutory protections and oversight of the Department of  Justice.  The Director’s letter did not comment on our recommendations to  the NIPC regarding the need for a comprehensive, integrated plan for  developing analysis and warning capabilities.
The NIPC’s comments regarding the need for additional staff largely  reiterate our findings, which note that the NIPC has not received the  anticipated number of detailees from other executive departments.  In  addition, our report repeatedly notes that the NIPC was established in early  1998.  We have no additional information to add on these two topics.   Further, as the NIPC Director states, we did not recommend a change to  the basic PDD 63 framework, including changing the placement of the  NIPC.  We did not make such a recommendation because moving the NIPC  from the FBI to another agency or establishing it as a stand-alone entity  would not necessarily ensure that the deficiencies we identified would be  addressed.  These deficiencies, which included lack of a generally accepted  methodology for strategic analysis, lack of data on infrastructure  vulnerabilities and incidents, and insufficient staff resources, are problems  that need to be addressed regardless of the NIPC’s organizational  placement.
The Special Assistant to the President and Senior Director for Legislative  Affairs at the National Security Council also provided comments, saying  that our report highlighted the need for a review of the roles and  responsibilities of the federal agencies involved in U.S. critical  infrastructure protection support.  The comments stated that the  administration will consider our recommendations as it reviews federal  cyber activities to determine how the critical infrastructure protection  function should be organized.  The Special Assistant to the President noted  that some functions might be better accomplished by distributing the tasks  across several existing federal agencies, creating a “virtual analysis center”  that would provide not only a governmentwide analysis and reporting  capability, but that could also support rapid dissemination of cyber threat  and warning information.
The comments from the NIPC and the National Security Council are  printed in full in appendixes I and II, respectively.
section_title: The NIPC Has Provided Valuable Support and Coordination in Improving Investigation and Response Capabilities
paragraphs: PDD 63 directed the NIPC to provide the principal means of facilitating and  coordinating the federal government's response to computer-based  incidents, mitigating attacks, and monitoring reconstitution efforts.  In  response, the NIPC has undertaken efforts in two major areas.
First, the NIPC has provided coordination and technical support to FBI  field offices, which have established special squads and teams and one  regional task force to address the growing number of computer crime  cases.  The NIPC’s support has provided benefits, but activities in several  areas have not yet met expectations outlined in the FBI’s April 1999  National Infrastructure Protection and Computer Intrusion Program Plan.   For example, insufficient computer capacity and data transmission  capabilities have limited the NIPC’s ability to perform technical analyses  quickly.  In addition, FBI field offices are not yet providing the NIPC with  the comprehensive information that NIPC officials say is needed to  facilitate prompt identification and response to such cyber incidents.
Second, the NIPC has developed crisis management capabilities to support  a multiagency response to the most serious incidents.  Procedures for  establishing crisis-management teams have been developed and, on the  basis of experience with actual incidents, refined.  In addition, the NIPC  has developed a draft emergency law enforcement sector plan to guide the  response of federal, state, and local entities.  As of mid-February 2001, the  draft plan was being reviewed by law enforcement sector members.
Regarding the requirement that the NIPC develop capabilities to “monitor  reconstitution” of computer systems, NIPC officials told us that virtually  nothing has been done because specific expectations for the NIPC in this  area have not been defined.  The National Coordinator for Security,  Infrastructure Protection, and Counter-Terrorism agreed that the NIPC’s  specific role in this area was not clear and said that this issue would  probably be addressed as the administration reviews the government’s  critical infrastructure protection strategy and the specific requirements of  PDD 63.
subsections: section_title: The NIPC Has Provided Coordination and Technical Support to FBI Field Squads
paragraphs: Since 1998, FBI investigative units and the NIPC have worked together to  address the growing number of computer crime cases, which federal law  enforcement guidelines define as attacks on computer systems for the  purpose of acquiring information or to damage or disrupt the target  computer system.  Such cases do not include computer-facilitated crimes,  such as Internet fraud, e-mail extortion, or child pornography, which are  handled by other FBI investigative programs.  The NIPC’s support has  provided benefits, but activities in several areas have not yet met  expectations outlined in the National Infrastructure Protection and  Computer Intrusion Program Plan.
section_title: Increase in Computer Crime Cases Has Prompted the Need for Increased Coordination and Technical Support
paragraphs: According to the FBI Director and NIPC officials, the number of computer  crime cases more than doubled from fiscal years 1998 to 2000, as shown in  table 2.  NIPC officials estimate that the number of pending cases for such  crimes will increase to 3,150 by fiscal year 2002.
In addition to increasing in numbers, computer crime cases tend to be  technically complex and resource-intensive to investigate, frequently  involving more than one state or nation and often requiring coordination of  efforts by many FBI field offices and other law enforcement entities.  In  February 1998, one such multiagency investigation demonstrated the need  for an interagency center like the NIPC to coordinate investigative  activities that relate to potentially serious intrusions.  The investigation,  referred to as Solar Sunrise, involved a series of related intrusions into  more than 500 military, civilian government, and private-sector computer  systems.  Because the intrusions took place during the build-up of U.S.  military personnel in the Middle East in response to tensions with Iraq and  because the source of the intrusions could not immediately be determined,  the episode raised serious national security concerns.  The FBI worked  closely with Israeli law enforcement authorities to solve the case, and,  within several days, the investigation determined that juveniles in  California and individuals in Israel were the perpetrators.
Other cases illustrating the need for coordination include investigation of  the ILOVEYOU virus in 2000, which involved 50 FBI agents from various  locations and coordination with the government of the Philippines, and  investigation of a denial-of-service attack in late 1999, which involved 36  FBI field offices and 13 legal attachés, who are FBI agents stationed  abroad.   In addition, the cases identified in table 2 include 12 foreign  counterintelligence cases, which, according to NIPC officials, usually  require more time-consuming technical analysis—2 such cases took over  18,000 hours of analysis.  At the end of fiscal year 2000, over 15 percent of  the 1,123 pending computer crime investigations were being conducted  jointly with other investigative agencies.
subsections: section_title: FBI Field Squads and Regional Task Force Established to Facilitate Investigations
paragraphs: In October 1998, the FBI created the National Infrastructure Protection and  Computer Intrusion Program to strengthen its ability to investigate  computer-based attacks on critical infrastructures and tasked the NIPC to  provide administrative and operational support.  The program called for  the establishment of special squads, referred to as NIPC squads, in the FBI  field offices to serve as centers of expertise for investigating computer  crime.  The National Infrastructure Protection and Computer Intrusion  Program Plan set a goal of establishing an NIPC squad in each FBI field  office by 2003.
As of December 31, 2000, the FBI had established such squads, each  consisting of approximately 8 FBI agents, in 16 of the FBI’s 56 field offices.   In addition, 40 smaller teams of from 1 to 5 agents, dedicated to working  computer crime cases, have been established in other FBI field offices.   These squads and teams have served as focal points for computer crime  investigations in their regions.  The number of agents assigned to the NIPC  squads has increased from 76 agents in fiscal year 1998 to approximately  200 agents in fiscal years 1999 and 2000, most of these agents were  transferred from other FBI investigative programs.
While the NIPC provides support and coordination, the NIPC squads are  under the FBI field offices’ direct supervision.  Accordingly, the field offices  determine when a case is to be opened and whether an incident needs to be  referred to other federal, state, or local law enforcement entities.  In  addition, FBI field offices are usually the first to be alerted to potential  computer crime cases, most often by victims or informants.  Generally, the  NIPC becomes involved when notified by the field squads through case- initiation paperwork, requests for technical assistance or direct  notification by telephone.
The National Infrastructure Protection and Computer Intrusion Program  Plan also called for the NIPC field squads to establish interagency task  forces to coordinate investigative work and facilitate information sharing  and coordinate investigations regarding computer crimes with other law  enforcement entities.  As of December 31, 2000, only one task force had  been created.  However, NIPC officials expected the task force to serve as a  model for similar task forces in other locations.
Comprising representatives from Justice, the U.S. Postal Service, Secret  Service, Defense Criminal Investigative Service, Internal Revenue Service,  and state and local law enforcement entities, the task force was established  in March 2000 in the FBI’s Pittsburgh field office.  Since then, the task force  has undertaken several efforts that NIPC officials and task force members  agree have improved computer crime investigative capabilities in that  region.  For example, the task force has  investigated 28 cases jointly with other law enforcement entities— accounting for approximately 15 percent of the FBI’s 177 joint computer  crime cases;  briefed other members of the law enforcement community and private  industry on investigative techniques, including the handling of  electronic evidence related to computer crime;   sponsored development of a computer laboratory to facilitate  collaboration on investigations and leverage resources donated by  member agencies, including computers and analytical tools; and  served as a forum for discussing common challenges and issues.
section_title: NIPC Support Has Provided Benefits
paragraphs: The NIPC has benefited computer crime investigations by (1) coordinating  investigations among FBI field offices, thereby bringing a national  perspective to individual cases; (2) providing technical support in the form  of analyses, expert assistance for interviews, and tools for analyzing and  mitigating computer-based attacks; and (3) providing administrative  support to NIPC field agents.  For example, the NIPC reports that it has    produced over 250 written technical reportsduring 1999 and 2000, over  80 percent of which supported investigations led by other law  enforcement agencies;  responded to an average of six requests per day for technical analysis;  developed analytical tools—some of which are classified—to assist in  investigating and mitigating computer-based attacks, including both  original software and modified commercial software;  created and posted software tools, including tools issued in December  1999 and May 2000, for detecting the presence of denial-of-service  software, one of which was downloaded 1,200 times in one 24-hour  period, indicating that it was widely used;  managed the procurement and installation of hardware and software  tools for each of the NIPC field squads and teams;   managed development of a data warehousing project, referred to as the  Early Warning System, which is intended to link numerous sources of  electronic information so that they can be searched as a single entity,  thereby facilitating searches and accelerating investigations—a  capability that, according to officials, will also benefit tactical and  strategic analysis;  provided legal guidance and coordination with Justice units and assisted  in obtaining the necessary court orders to conduct data intercepts;  analyzed case-initiation paperwork to identify cases with similarities so  that they could be coordinated;   identified and shared improved investigative techniques regarding   streamlined administrative procedures for the increasing number of  foreign counterintelligence cases, such as the recent investigations into  the possible theft of nuclear secrets from the Los Alamos National  Laboratory.
Examples of significant cases that the NIPC has coordinated or supported  include the following:  In March 1999, the NIPC coordinated the FBI field office investigation  into the Melissa macro virus, which caused an estimated $80 million in  losses.  Although the Melissa virus did not actually destroy or alter data,  it generated large volumes of e-mail that congested and shut down  computers.  Within less than a month, the virus’ author was arrested.
In June 1999, the NIPC coordinated an investigation of a Trojan horse  virus, referred to as the Explore.Zip worm, with six FBI field offices.   The virus had infected various private-sector computer systems and  propagated through the Internet via an e-mail attachment, destroying  certain files on computer hard drives.  At the close of our review, the  investigation had been ongoing for over a year.
From January to March 2000, the NIPC supported an investigation of  two teenagers who had used a computer in the United Kingdom to break  into e-commerce sites in five countries and steal information resulting in  estimated losses totaling over $3 million.  The case, referred to as  “Curador,” was based on investigative work by the FBI and police in the  United Kingdom and Canada.  The perpetrators were arrested and  charged in the United Kingdom in March 2000.
section_title: Problems Affecting the NIPC’s Effectiveness in Supporting Investigative Efforts
paragraphs: The National Infrastructure Protection and Computer Intrusion Program  Plan and the NIPC budget justifications identified several deficiencies that  are impeding the NIPC’s ability to coordinate and support investigations of  computer crime cases.  First, according to NIPC officials, delays had  occurred because the NIPC’s Special Technologies and Applications Unit  did not have computers capable of rapidly analyzing the large amounts of  data associated with some cases.  Recent investigations have required the  unit to collect and analyze multiterabytes of data (equivalent to one or  more times the amount of information contained in the Library of  Congress).  However, to analyze these data on its existing equipment, they  must be broken into segments and examined separately because the unit’s  computer capacity was insufficient to handle the large amount of data.   According to NIPC officials, the inadequacy of its current computer system  is contributing to a 30-day backlog in meeting requests for analysis from the  field offices.
In addition, agents in some field offices told us that they lack the means to  securely transmit large amounts of data between field offices and the NIPC  for analysis.  These factors prolong the time needed to transmit and analyze  data and have contributed to the backlog of analyses that need to be  performed.  According to NIPC officials and internal budget documents,  funding for additional computer equipment will be requested for fiscal year  2002.
Further, NIPC field squads are not reporting all of the information they  have on unusual or suspicious computer-based activity to the NIPC.  The  National Infrastructure Protection and Computer Intrusion Program Plan  states that it is imperative that all field offices document and report all  complaints regarding computer intrusion activity and forward the  information to the NIPC.  NIPC officials told us that receiving such  comprehensive information provides the NIPC with a broader and more  complete view of suspicious and unusual activity and facilitates prompt  identification of potentially widespread problems.  Such information is of  value to the NIPC’s analysis and warning functions as well as its support of  NIPC investigations.  However, NIPC field squad members told us that  minor incidents that did not merit opening a case were not always reported  to the NIPC because many incidents were deemed to be insignificant.
To provide an increased incentive for sharing information, the NIPC  established new performance measures for fiscal year 2001 so that field  squads receive credit for the amount of information shared about potential  cyber incidents, regardless of whether or not a case is opened.
section_title: Crisis Management Plans Have Been Developed
paragraphs: According to the Attorney General’s Five-Year Interagency  Counterterrorism and Technology Crime Plan, as the lead entity  responsible for coordinating the federal government’s crisis management  and response to computer-based attacks, the NIPC must be able to respond  quickly in the initial stages of a crisis situation and pursue the appropriate  law enforcement or national security strategies.  The NIPC’s primary  efforts to fulfill these responsibilities have been related to developing  procedures for implementing crisis action teams in response to computer- based attacks and intrusions.  Since 1998, the NIPC has formed seven such  teams, comprising a combination of NIPC personnel—agents and detailees,  which have responded to a range of classified and unclassified events  lasting from a day to over a year.  Generally, these teams have served as the  focal point for coordinating the investigation and response to incidents  with national impact, including the Melissa virus in April, May, and June  1999; the transition to the year 2000; and denial-of-service attacks in  February and March 2000.  In 1999, the FBI established an expanded  Strategic Information Operations Center, a crisis management center at  FBI headquarters, which has provided the teams with a collaborative  working environment and access to information through computer and  telecommunications support.
In August 2000, the NIPC standardized its procedures for initiating crisis  action teams and developed a detailed concept of operations to guide  future response.  The detailed document identifies thresholds for activating  crisis teams, delineates the missions of the team members, and provides a  framework for involving individuals from the NIPC and other agencies.
In addition, the NIPC has drafted an emergency law enforcement sector  plan.  PDD 63 designated Justice and the FBI as the lead agencies for the  emergency law enforcement services sector, and the FBI delegated this  responsibility, including development of the sector plan, to the NIPC.  The  plan covers the roles and responsibilities for the more than 18,000 law  enforcement agencies throughout the United States that the NIPC says  have volunteered to participate.  In addition, the plan describes approaches  for assessing the vulnerability of critical law enforcement systems,  developing remediation and mitigation plans, and improving awareness of  law enforcement personnel.  As of mid-February 2001, the NIPC had  provided the draft plan to sector members and was awaiting their  comments.
In addition to the NIPC’s crisis management efforts, in July 2000, the  National Coordinator for Security, Infrastructure Protection, and Counter- Terrorism created two new entities involving the NIPC that are designed to  improve federal policymaking and response to computer-based attacks.   The Cyber Incident Steering Group is responsible for determining the  appropriate policy for response, and the Cyber Incident Working Group is  responsible for executing and coordinating a response.  The National  Coordinator chairs the steering group, of which the NIPC Director is a  member, while the NIPC Director chairs the working group.
According to a process defined by the National Coordinator, the NIPC  Director is to convene the working group when an unauthorized cyber  event occurs that has a significant national security, economic, or public  safety impact.  The working group is primarily to share information on  specific incidents and discuss related mitigating actions.  In addition to the  NIPC Director, the group’s membership includes the Commander of the  Joint Task Force for Computer Network Defense, U.S. Space Command;  the Program Director of the Federal Computer Incident Response  Capability, the General Services Administration (GSA); and the Chief,  Defensive Information Operations Group at the National Security Agency.   Other agency representatives may be added, as appropriate.  At the close of  our review, the Cyber Incident Working Group had convened once, in  November 2000, to discuss issues related to hostile computer-based activity  in the Middle East.
section_title: Requirements for Monitoring Reconstitution Have Not Been Defined
paragraphs: PDD 63 states that there will be a system to rapidly reconstitute the  minimum required capabilities after an infrastructure attack, and it  specifically assigns the NIPC responsibility for monitoring reconstitution.   The National Plan states that the NIPC’s responsibility in this area includes  monitoring reconstitution of telecommunications and computer networks  on which the government relies.
NIPC officials told us that they have not planned or taken any action in this  regard because specific expectations for meeting the requirements briefly  mentioned in PDD 63 and the National Plan have not been further defined.   As a result, while the NIPC has established procedures for crisis  management teams, previously discussed, it is not clear what  responsibilities these teams would have regarding any reconstitution  efforts that may be needed as the result of a seriously damaging attack.
The National Coordinator for Security, Infrastructure Protection, and  Counter-Terrorism agreed that the NIPC’s specific role in this area was not  clear and said that this issue would probably be addressed as the  administration reviews the government’s critical infrastructure protection  strategy and the specific requirements of PDD 63.
section_title: Conclusions
paragraphs: The NIPC has provided important support in increasing the FBI’s ability to  investigate computer crimes by coordinating investigations and providing  technical assistance.  However, at some locations, insufficient computer  and communications capabilities have hindered the NIPC’s ability to  promptly and efficiently analyze large amounts of data in support of  investigations, and FBI field office personnel are not providing the NIPC  with all of the information they have on potentially damaging or hostile  computer-based activity.  The NIPC has also developed crisis management  procedures and drafted an emergency law enforcement sector plan, which  is currently being reviewed by sector members.  In 2000, the National  Coordinator supplemented these efforts by establishing the Cyber Incident  Steering Group, to develop response policies, and the Cyber Incident  Working Group, which is responsible for executing and coordinating a  response.   No actions had been taken to develop capabilities to monitor  reconstitution of computer systems because specific expectations for the  NIPC in this area have not been defined.
section_title: Recommendations for Executive Action
paragraphs: To ensure that the NIPC develops the response, investigative, and crisis  management capabilities required by PDD 63, we recommend that the  Attorney General direct the FBI Director to task the NIPC Director to  ensure that the Special Technologies and Applications Unit has access  to the computer and communications resources necessary to analyze  data associated with the increasing number of complex investigations;   monitor implementation of new performance measures to ensure that  they result in field offices' fully reporting information on potential  computer crimes to the NIPC; and   complete development of the emergency law enforcement plan, after  comments are received from law enforcement sector members.
As the national strategy for critical infrastructure protection is reviewed  and possible changes considered, we recommend that the Assistant to the  President for National Security Affairs define the NIPC’s responsibilities for  monitoring reconstitution.
section_title: Agency Comments and Our Evaluation
paragraphs: In commenting on a draft of this report, the Director of the NIPC expressed  the view that, despite formidable hurdles, the NIPC has achieved  remarkable success, noting the establishment of a nationwide program for  investigating computer crime in 56 FBI field offices.  He also said that the  NIPC, in conjunction with the Emergency Law Enforcement Sector Forum,  had developed the only sector infrastructure protection plan, which was  delivered to the National Coordinator in March 2001. The Director’s  comments did not address our recommendations to the NIPC regarding the  need to (1) ensure that the Special Technologies and Applications Unit had  access to adequate computer and communications resources and (2)  monitor implementation of new performance measures regarding field  office reporting of information on potential computer crimes.
Our report describes the National Infrastructure Protection and Computer  Intrusion Program, under which NIPC units in 56 FBI field offices have  been established, and the report commends the NIPC for providing  valuable coordination and technical support to this program.  Our report  also credits the NIPC with leading development of the Emergency Law  Enforcement sector plan.  We did not review the progress of other  infrastructure sectors in developing similar plans because such efforts  were not within the scope of our review.  As a result, we cannot compare  progress on the Emergency Law Enforcement sector plan with progress on  similar plans for other infrastructure sectors.
In commenting on a draft of this report, the Special Assistant to the  President and Senior Director for Legislative Affairs at the National  Security Council said that our comments would be considered as the  administration reviews federal cyber activities to determine how the  critical infrastructure protection function should be organized.  The  comments did not specifically address our recommendation that the NIPC’s  responsibilities for monitoring reconstitution be defined.
The comments from the NIPC and the National Security Council are  printed in full in appendixes I and II, respectively.
section_title: Progress In Information Sharing And Outreach Has Been Mixed
paragraphs: To help ensure that computer-based attacks are promptly detected and that  mitigation and recovery efforts are effective, PDD 63 calls for extensive  cooperation and information sharing among government and private-sector  entities.  According to the January 2000 National Plan for Information  Systems Protection, the role of the federal government is to (1) create  federal capabilities for enhanced information sharing and (2) encourage  nonfederal entities (the private sector and state and local governments) to  organize themselves for efficient information exchange about cyber threats  and incidents.  The National Plan further states that “the NIPC has a vital  role in collecting and disseminating information from all relevant sources”  and that it is to accomplish this by “establishing a network of relationships  with entities in both the government and the private sector.”
Since 1998, the NIPC has undertaken a range of initiatives designed to  foster information sharing among private-sector, government, and  international entities with mixed results.  Regarding the private sector, the  NIPC has developed a collaborative relationship with the electric power  industry, but two-way information-sharing relationships between the NIPC  and other information-sharing and analysis centers has not developed.  In  addition, the NIPC has increased the membership of its InfraGard Program,  which is designed to build direct relationships with individual companies,  but has made limited progress in developing its Key Asset Initiative, which  is designed to create a database of critical infrastructure components,  including those that are privately controlled.
NIPC efforts to establish information-sharing and coordination  relationships with other government entities have met with less success.   Federal agencies have not routinely reported incident information to the  NIPC, DOD and the NIPC agree that their information sharing needs  improvement, and Secret Service expertise has not been integrated into the  NIPC efforts.  However, NIPC efforts to provide training on investigating  computer crime, which it views as an element of its outreach efforts, have  involved an increasing number of personnel from federal, state and local,  and international entities, and the NIPC has participated with several other  countries in infrastructure protection efforts.
subsections: section_title: Information Sharing And Coordination Are Essential To Combat Cyber Attacks, But Present Challenges
paragraphs: Information sharing and coordination among organizations are key  elements in developing comprehensive and practical approaches to  defending against cyber threats.  Having information on threats and actual  incidents experienced by others can help an organization better understand  the risks it faces and determine what preventive measures should be  implemented.  In addition, prompt warnings can help an organization take  immediate steps to mitigate an imminent attack.  Information sharing and  coordination are also important after an attack, to facilitate recovery and  criminal investigations.
In July 2000, we testified on the importance of information sharing on  cyber threats and related challenges, noting that creating partnerships for  information sharing and coordination is a formidable task.  Most important,  trust must be established among parties who may have varying interests  and expectations.  For example, private-sector entities are usually  motivated by business concerns and profits, whereas governments are  driven by national and economic security concerns.  These disparate  interests can lead to profoundly different views and perceptions about  threats, vulnerabilities, and risks, and they can affect the level of risk each  party is willing to accept and the costs each is willing to bear.  Further, the  private sector may have reservations about sharing information with law  enforcement agencies because compliance with law enforcement  procedures can be costly, or a business may not wish to report an incident  that might tarnish its image.  Government entities, on the other hand, may  be reluctant to share information for national security reasons, and  declassifying and sanitizing such data takes time and could delay response.   In addition to developing trust relationships, reporting needs and  mechanisms for sharing are necessary to ensure that the right type of  information is provided and that effective and secure procedures are in  place for handling the information.  This effort requires agreeing, in  advance, on the types of data to be collected and reported and the  processes to be used.
section_title: Information-sharing Success With Private Sector Has Varied
paragraphs: To improve communication and information sharing with private-sector  entities, the NIPC has   attempted to establish relationships with ISACs for individual   established a mutually beneficial relationship with CERT/CC;  expanded the FBI’s InfraGard Program to facilitate secure information  sharing with individual entities; and   begun developing a database of key infrastructure components, referred  to as the Key Asset Initiative.
All of these efforts are in relatively early stages of development, and their  success to date has varied.
subsections: section_title: The NIPC Has Developed Two-Way Information Sharing With One Industry Sector
paragraphs: PDD 63 introduced the concept of establishing a private-sector ISAC to  gather and analyze industry-provided information on threats and incidents  and share this information with government entities.  The National Plan  detailed the government’s plans in this area, on the basis of discussions  held with government and industry officials, encouraging establishment of  ISACs for major industry sectors.  The National Plan noted that ISACs  could serve as a means of  (1) sharing information on attempted intrusions  and attacks with industry partners and government entities and (2)  obtaining warning information from the government.  Specifically, the  National Plan stated that the NIPC would use the ISACs as a means of  disseminating information to industry sectors.  It also encouraged private  companies to inform federal agencies about attempted intrusions and  attacks, possibly by reporting through the ISACs.  However, it stated that  such reporting was voluntary.  Details of the ISACs’ design and operations  were to be determined by the private sector, in consultation with and with  assistance from the federal government.
During 1999 and 2000, ISACs were established for the financial services and  telecommunications sectors.  In addition, the North American Electric  Reliability Council recently formally declared itself the electric power  industry ISAC, although it had functioned in this fashion for some time.    Another ISAC, for the information technology industry, was announced by  the Secretary of Commerce on January 16, 2001, just prior to the close of  our review.
subsections: section_title: Collaboration With Electric Power Industry Illustrates Value of Public-Private Coordination
paragraphs: According to NIPC and industry officials, the “Indications, Analysis and  Warning Program” established with the North American Electric Reliability  Council on behalf of the electric power industry has provided useful  information to both the NIPC and the industry sector and may prove to be a  model for future efforts in other industry sectors.  The relationship  between the NIPC and the council has been successful, in part, because the  electric power industry has had a history of working directly with the FBI,  so there was an existing relationship on which to build.  The council is  made up of 10 regional councils from all segments of the electric industry— investor-owned, federal, rural electric cooperatives, state/municipal and  provincial utilities, independent power producers, and power marketers.   Its members control virtually all of the electricity supplied in the United  States, Canada, and Mexico.
In March 1999, the NIPC and the council began the Indications, Analysis,  and Warning Program with the intention of developing standard methods  for sharing and reporting information.  By October 1999, they had initiated  a pilot program to test these methods and develop thresholds for incident  reporting.  The council encourages the electric utility companies to  voluntarily provide the NIPC with information on unscheduled service  outages, degraded operations, and serious threats to facilities, activities,  and information systems, according to agreed-upon methods and criteria.   The agreement also stipulated requirements for the NIPC’s handling of  incident reports.  For example, the NIPC is to log all reports immediately  and acknowledge receipt to the report’s originator.  The NIPC then is to  record the report in an incident database and make it available to others  only in accordance with established protocols.  In October and November  2000, the NIPC held training conferences with the electric power industry  on general guidelines for electric utility companies to follow in voluntarily  reporting information to the NIPC.
According to NIPC and council officials, in addition to establishing an  information-sharing mechanism, the program has better defined the NIPC’s  information needs and provided industry members with information on  vulnerabilities and threats that they may not have otherwise obtained.  For  example, in December 2000, information gathered through the electric  power industry led to detection of a potentially damaging computer exploit  and issuance of a warning to industry members and the public.
section_title: Two-Way Communication Between the NIPC and Other ISACs Has Not Developed
paragraphs: Establishing a two-way means of communication with the  telecommunications and financial services ISACs has been less successful.   Although both ISACs receive information from the NIPC, neither has  provided information in return because of reporting incompatibilities and  concerns about confidentiality.
The telecommunications ISAC was officially recognized in a January 2000  memorandum from the National Coordinator for Security, Infrastructure  Protection, and Counter-Terrorism.  This ISAC is a consortium of private  carriers and federal agencies, but it is managed by the National  Communications System, an interagency entity established in the early  1960s to ensure reliable communication for the government in all  situations.
According to National Communications System officials, the  telecommunications ISAC has received information from the NIPC,  including telephone calls and electronic alerts, which the ISAC, in turn, has  distributed to its membership.  However, as of December 2000, these  officials said that the ISAC had not shared any incident reports with the  NIPC because ISAC members had not identified anything that was deemed  important enough to share, noting that the NIPC and the  telecommunications ISAC have not agreed to any thresholds for reporting  incidents such as those established with the electric power industry.   Furthermore, no standard thresholds have been developed between the  telecommunications ISAC and its member companies.  During attempts to  develop criteria for reporting thresholds, the companies determined that it  was not currently possible due to differences in internal operational  thresholds and network monitoring software.
The Financial Services ISAC’s objective is to help ensure the viability and  continuity of the banking and finance sector from any intentional acts that  could impact critical services or the orderly functions of the economy.   Formed in October 1999, the financial services ISAC provides a data  collection and analysis center, which is managed by a private contractor  and funded by participating corporations and is structured to provide a  globally distributed analytical capability that enables broad access to  current information.
According to its operating rules established in April 2000, information on  threats and vulnerabilities from government or law enforcement sources  may be accepted by the ISAC.  However, this is a one-way transfer of  information.  According to ISAC documents, the ISAC is for the exclusive  use of the banking, securities, and insurance industries, and no U.S.  government entity can access its resources.  As a result, the NIPC has not  benefited from information that it could have used to alert others.   For  example, officials at both organizations told us that the financial services  ISAC knew about the May 2000 ILOVEYOU virus hours before the NIPC,  but the ISAC did not warn the NIPC.
section_title: The NIPC Has Begun a Mutually Beneficial Relationship With CERT/CC
paragraphs: An additional information-sharing relationship has been established  between the NIPC team at the FBI’s Pittsburgh Field Office and CERT/CC.   Although not an industry-related ISAC, CERT/CC, funded primarily by  DOD, is involved in gathering, analyzing, and sharing information on  computer-based vulnerabilities with private- and public-sector entities.  In  April 1999, the NIPC team in Pittsburgh assigned an agent to work with  CERT/CC for 18 months.  According to CERT/CC personnel, having a law  enforcement officer work with them helped them better understand the  legal issues, including standards of evidence, involved in dealing with a  computer attack or compromise and allowed them to better advise their  clients in this regard, including collaborating on an evidence handling  paper with the CERT/CC in July 2000.  In addition, they said, the NIPC team  provided technical information about a recent denial-of-service attack that  helped CERT/CC develop a better solution.
section_title: InfraGard Program Has Expanded Nationwide
paragraphs: To facilitate information sharing directly with individual private-sector  entities, the NIPC adopted and expanded the InfraGard Program, which  had begun in 1996 in the FBI’s Cleveland Field Office as a pilot project.   According to InfraGard documents, the program is intended to establish a  secure mechanism for electronic two-way information sharing about  intrusion incidents and system vulnerabilities and a secure channel over  which the NIPC can disseminate analytical reports on threats to private- sector entities.  The National Plan provided more detailed objectives,  stating that the InfraGard Program would  provide members with prompt, value-added threat advisories, alerts,   increase the quantity and quality of infrastructure threat information  and incident reports provided to local FBI field offices (for  coordination, investigation, and follow up) and the NIPC (for national- level analysis and warning);  increase interaction and information sharing among InfraGard  members, their local FBI field offices, and the NIPC, on infrastructure  threats, vulnerabilities, and interdependencies;  ensure the protection of cyber and physical threat data shared among  InfraGard members, FBI field offices, and the NIPC through compliance  with proprietary, legal, and security requirements; and    provide members with a forum for education and training on  infrastructure vulnerabilities and protection measures.
By October 2000, 56 InfraGard chapters and subchapters had been  established across the country with a membership of over 277 entities.  In  early January 2001, NIPC officials announced that membership had grown  to 518 entities, including representatives from the FBI, private industry,  other government agencies, state and local law enforcement, and the  academic community.
InfraGard has two categories of membership—secure and nonsecure.   According to NIPC records, as of September 2000, about 78 percent of  InfraGard members had established secure memberships and could access  the InfraGard Alert Network and secure Web page.  Secure memberships  require a background check verifying that applicants are not known  computer hackers or criminals.  Nonsecure members do not have access to  these features, but they can attend meetings and fully participate in chapter  activities.  The large percentage of secure memberships may indicate that  members value InfraGard participation.  However, we did not interview  InfraGard members, so we cannot comment on their satisfaction with the  program.
NIPC officials have stated publicly that the InfraGard Program illustrates  the success of their efforts in establishing trusted relationships with  private-sector entities.  In addition, the officials say the program has  benefited efforts to combat computer-based attacks.  For example, on the  basis of information received from an InfraGard member, NIPC officials  said they were able to warn approximately 100 companies about a possible  computer attack that had been placed in their systems.  However, agents in  one field office expressed concern that the NIPC may not be able to  support the InfraGard secure Web site with in-depth analysis, due to the  deficiencies in the NIPC’s analytical capabilities previously discussed in  chapter 2.  As a result, these agents said that they were concerned that  InfraGard members’ expectations may not be met.
section_title: Limited Progress in Identifying Key Assets
paragraphs: According to the National Plan, the Attorney General’s plan, and the  National Infrastructure Protection and Computer Intrusion Program Plan,  the Key Asset Initiative was established to identify national, regional, and  local infrastructure components, such as certain telecommunications  switching nodes, whose loss would potentially have widespread and dire  social and economic consequences.  Identifying such infrastructure  components, or “key assets,” would allow the NIPC and others involved in  critical infrastructure protection to focus their analysis, protection,  warning, and reconstitution efforts on the most important elements of the  nation’s infrastructure and facilitate recovery efforts should severe damage  occur.   In addition, such information is essential to understanding the  significance of individual points of failure and assessing the potential  criticality of an attack.  Without this information, organizations may  underprotect certain vital assets while overprotecting assets of lesser  importance.
The NIPC and the NIPC squads at FBI field offices began identifying key  assets and developing a related database in 1998 by building on previous  FBI work, which had identified about 400 such assets.  During 1999 and  2000, the NIPC hosted six training sessions, covering five industry sectors,  for Key Asset Initiative coordinators, who are typically members of NIPC  field squads and teams.  According to training documents, agents in NIPC  field squads are to conduct a thorough search for key assets in their regions  for each of the eight major industry sectors.  Then, the agents are to  categorize the assets according to criteria provided.  Once the list is  developed, the agents are to contact the infrastructure owners or operators  to ensure that all key assets have been identified.  Lastly, they are to assist  key asset owners in the development of contingency plans, if such plans do  not exist.
At the close of our review, field squads had identified over 5,000 assets and  categorized them as being of either national, regional, or local importance,  as prescribed in NIPC training documents.   However, our review of several  segments of the database and related discussions with field squad  personnel identified several indications that the field offices had not  applied a consistent methodology in identifying assets.  One agent told us  that he had purposely omitted certain assets because, in his judgment, they  were too sensitive to be included.  Another agent told us he had used a  telephone book as a primary source of identifying key facilities.  In  addition, there was great disparity between the number of assets identified  for two large cities—over 800 assets had been identified for one city and  only 34 for the other city.  NIPC officials acknowledged that a process for  reviewing database entries to ensure that FBI field offices are consistently  applying the criteria outlined in training documents was needed but had  not yet been implemented.
In addition, field squads had not yet been successful in obtaining the  agreement of industry sectors regarding the importance of the assets they  had identified because private companies have been hesitant to share  information on their most critical assets.  Such validation is important  because many of the FBI agents who attempted to identify and rank  infrastructure components did not have extensive industry knowledge.
Further, according to the Attorney General’s plan, the Key Asset Initiative  was to be developed in coordination with DOD and other agencies.   Coordination among such efforts would help ensure that similar efforts  underway at the NIPC and other agencies avoid inappropriate duplication  of efforts and take advantage of the methods and findings that others have  developed.
However, such coordination had not taken place.  In particular, the Key  Asset Initiative was not being coordinated with similar efforts in other  agencies, primarily because agreements on sharing sensitive information  had not been reached, as described below:  NIPC officials held discussions with officials from Commerce’s Critical  Infrastructure Assurance Office regarding “Project Matrix,” which is an  effort led by that office to identify critical infrastructure components  and related interdependencies affecting government operations.   However, the officials did not reach any formal agreements to share  information.  An official involved with Project Matrix noted that the  information gathered through Project Matrix efforts belonged to  individual federal agencies and could not be shared without their  express permission.
NIPC and DOD officials exchanged multiple drafts of a memorandum of  understanding regarding coordination between the NIPC and DOD’s  Joint Program Office for Special Technology Countermeasures and  Infrastructure Assurance to identify infrastructure vulnerabilities that  may affect DOD bases.  However, the officials had not reached any  agreements to share information as of December 2000.
Officials with the National Communications System told us that they  were approached by the NIPC about sharing information on important  telecommunications components and facilities but declined because the  industry provided such information for internal use only and to facilitate  priority restoration during emergencies.
Senior NIPC officials agreed that much more needs to be done to validate  the key asset database.  They said that significant efforts to obtain industry  support and coordinate with other federal entities were not undertaken due  to other priorities.
section_title: Information Sharing and Coordination With Other Government Entities Have Been Limited
paragraphs: PDD 63 directs other federal agencies to share information about threats  and attacks with the NIPC, where permitted by law.  However, as with the  previously discussed efforts to identify key assets, the NIPC’s broader  efforts to share information and coordinate with government entities have  not yielded significant results.  Specifically, federal agencies have not  routinely reported incident information to the NIPC, at least in part  because OMB has directed civilian agencies to report incident information  to GSA’s Federal Computer Incident Response Capability, rather than to the  NIPC.  Also, DOD and the NIPC officials say that improved information- sharing agreements would be beneficial to their operations.  Finally, the  Secret Service withdrew the detailees it had originally provided to the NIPC  because Secret Service officials felt that the Service’s personnel were not  provided appropriate responsibilities.  The NIPC has been more successful  in providing training to government entities, an effort that it considers to be  an important component of its outreach efforts, and in coordinating with  foreign governments that are establishing entities similar to the NIPC.
subsections: section_title: Recent Guidance Does Not Require Agencies to Report to the NIPC
paragraphs: In October 2000, the Chief Information Officers Council issued a  memorandum, developed in cooperation with OMB and GSA, stating that  agencies should share information on incidents and vulnerabilities with  GSA’s Federal Computer Incident Response Capability (FedCIRC), which,  according to the National Plan, is to provide a means for federal agencies to  work together to handle security incidents, share related information, solve  common security problems, and collaborate with the NIPC and pertinent  DOD entities.  While the council’s guidance did not preclude agencies from  reporting to the other organizations, it did not specifically require agencies  to report to the NIPC.  Specifically it stated that agencies “should contact  FedCIRC as soon as they identify security incidents with origins external to  the agency.”  Then, depending on the nature and severity of the incident  reported, FedCIRC would provide further guidance, including determining  if additional reporting to law enforcement or national security officials was  appropriate.
This divergence in guidance reflects unresolved differences in the  interpretation of NIPC’s role in this area.  Senior NIPC officials told us that  they believe the guidance from the Chief Information Officers Council  contradicts PDD 63’s reporting requirements and that, in their view,  FedCIRC’s role as a focal point for federal reporting of computer-based  incidents and vulnerabilities is a potentially detrimental and inefficient  duplication of a portion of the NIPC’s responsibilities.  These officials  would prefer that agencies report directly to the NIPC so that they can  promptly integrate such information with intelligence and law enforcement  information.  NIPC officials believe that when agencies report first to  another entity, such as FedCIRC, it compromises the NIPC’s ability to  promptly issue warnings and could result in unnecessary delay and damage  should a serious incident occur.  Conversely, OMB and FedCIRC officials  have contended that FedCIRC is more focused on providing assistance and  guidance to federal agencies and, therefore, is in a better position to  respond to agencies’ requests for assistance; analyze the initial information;  and, if appropriate, forward it to the NIPC or others.
section_title: DOD and NIPC Information Sharing and Coordination Have Been Impeded by Lack of Formal Agreements
paragraphs: Both NIPC and DOD officials have identified the need to improve  information sharing on their respective cyber-threat analysis efforts.  The  NIPC was designed to include a senior DOD manager to facilitate this  process, and DOD’s Deputy Assistant Secretary for Information Security  and Operations said that, overall, the department has a good working  relationship with the NIPC and the NIPC was very important to its efforts in  this area.  However, officials from both organizations said that a more  structured process is needed.
DOD has significant efforts underway to gather and analyze threat and  vulnerability data and to detect attacks against DOD computer systems that  are either imminent or underway.   For example, the Joint Task Force for  Computer Network Defense, which is under the U.S. Space Command,  monitors incidents and potential threats and coordinates across DOD to  plan and direct actions to stop or contain damage and restore network  functionality.  The task force’s specific functions include (1) synchronizing  technical, operational, and intelligence assessments of computer network  attacks; (2) assessing and reporting impacts on military operations and  capabilities; (3) coordinating the appropriate DOD actions to stop the  attack and contain damage; and (4) coordinating, as required, with other  government entities, including the NIPC, the private sector, and U.S. allies.   Similarly, the National Security Incident Response Center, at the National  Security Agency, provides warnings of threats and expert assistance to  defense and civil agencies in isolating, containing, and resolving incidents  that threaten national security systems.  The center currently manages a  database of computer incidents reported by DOD, other federal agencies,  and many foreign sources.
NIPC officials maintain that they have had numerous discussions with DOD  to develop formal requirements from defense specifying the type of  information it wanted from the NIPC.  However, no procedures or  mechanisms have been developed to bring this about.  An April 2000  memorandum from DOD’s Director of Infrastructure and Information  Assurance to the Assistant Secretary of Defense for Command, Control and  Communications and Intelligence recommended several actions to  facilitate information sharing and cooperation.  These actions included    establishing a more actively managed information clearinghouse and  protocol to foster reciprocal exchanges of information and fulfill the  NIPC’s information-sharing mandate;  ensuring that sensitive information is appropriately sanitized and   ensuring that the NIPC verifies incident reports pertaining to DOD with  DOD prior to issuing the reports; and   ensuring that the NIPC provides DOD with more information about all  incidents, not just those directly affecting DOD, so that preventive  measures can be implemented before DOD becomes a “victim.”
To begin to address these concerns, DOD officials told us that they planned  to develop a system for monitoring requests for information from the NIPC  so that they could better assess the success of their responses, and NIPC  officials said that they had asked DOD to develop specific information  requirements.
section_title: Secret Service Not Adequately Integrated Into NIPC
paragraphs: According to PDD 63, the NIPC was to include FBI and Secret Service  agents as well as other investigators with experience in computer crime  and infrastructure protection.  The Secret Service is authorized by statute  to investigate fraud related to electronic fund transfers, credit cards, and  identification documents.  Accordingly, it has developed relationships with  the financial services community and technical expertise, since 1987,  through its Electronic Crimes Special Agent Program.
When the NIPC was formed in 1998, the Secretary of the Treasury  requested seven positions in a letter to the Attorney General—a request  with which the former NIPC director told us he agreed.  Subsequently, two  supervisory special agents from the Secret Service were assigned to the  NIPC.
However, according to a June 2000 Secret Service letter to Senator  Grassley and our interviews with Secret Service officials, contrary to  Secret Service expectations, neither of the agents was allowed to  participate in investigative activities or assigned responsibilities  commensurate with their experience or grade.   NIPC and Secret Service  officials say that there were several attempts by both entities to discuss the  issues, but satisfactory agreements were not reached.  As a result, the  Secret Service withdrew its detailees in October 1999, a factor that has  contributed to the NIPC’s shortage of skilled personnel.  In November 2000,  the Deputy Assistant Director for Investigations at Secret Service told us he  maintains a liaison with the NIPC and that information sharing between the  two entities was improving.  However, as of December 31, 2000, no Secret  Service detailees were assigned to the NIPC.
section_title: NIPC-sponsored Training Has Served as an Additional Element of Its Outreach Efforts
paragraphs: PDD 63 also required the NIPC to include training as part of its mission,  and the National Plan noted that the NIPC was to provide training to  federal, state, and local officials on infrastructure protection.   In response,  the NIPC has made training a key element of its outreach and information  sharing to state and local entities. Since 1998, the NIPC has trained about  100 individuals from other federal agencies, as well as over 180 state and  local government personnel, on investigating computer crime.  Table 3  provides a summary of the number of personnel trained from May 1998  through August 2000.
section_title: The NIPC Has Undertaken International Initiatives
paragraphs: The NIPC has worked on a range of international initiatives designed to  foster better information sharing and communication across national  borders.  Since its founding in 1998, the NIPC has advised representatives  from Canada, Germany, Japan, Sweden, and the United Kingdom, all of  which are in the process of forming interagency entities like the NIPC.   Also, in October 2000, the NIPC and the United Kingdom’s National  Infrastructure Security Coordination Center formed an operational  subgroup to address (1) connectivity between the NIPC and the center, (2)  coordination of outreach and information-sharing activities, and (3) ways  to improve and accelerate the flow of information between the two entities  and their respective partners.
Another international initiative that the NIPC has been involved in is a high- tech crime subgroup sponsored by eight major industrialized countries,  including Canada, France, Germany, Italy, Japan, the United Kingdom, the  United States, and Russia, collectively referred to as the G-8.  An NIPC  representative serves as a member of the U.S. delegation to the subgroup,  which has been considering several issues concerning international cyber  crime investigations, including the establishment of a 24-hour-a-day, high- tech crime network; international training conferences; reviews of legal  systems in G-8 countries; and the development of principles on transborder  access to stored computer data.
Finally, the NIPC has provided training to investigators from several  nations through international law enforcement academies in Hungary and  Thailand.  In addition, a small number of select international investigators  have received training in NIPC-sponsored classes in the United States.
During 2000, the NIPC records show that it participated in about 56  international events and provided briefings to visitors from 23 countries.
section_title: Conclusions
paragraphs: The NIPC’s information-sharing relationships are still evolving and will  probably have limited effectiveness until reporting procedures and  thresholds are defined and trust relationships are established.  While a  growing number of entities have entered into information-sharing  agreements with the NIPC and the FBI, two-way information-sharing  partnerships have not developed between the NIPC and certain industry  ISACs.  This lack of cooperation impedes efforts to identify key assets that  merit special protective efforts and identify and address vulnerabilities,  and it increases the risk that a broad computer-based attack would not be  detected or mitigated until significant damage had occurred.   In addition,  much work remains to develop cooperative relationships among  government entities, including civilian agencies, DOD, and law  enforcement entities, to ensure that similar or related critical infrastructure  protection efforts are coordinated and that the expertise of agency  personnel is used effectively.
section_title: Recommendations for Executive Action
paragraphs: To develop the information-sharing goals identified in PDD 63 and related  plans, we recommend that the Assistant to the President for National  Security Affairs (1) direct federal agencies and encourage the private  sector to better define the types of information that are necessary and  appropriate to exchange in order to combat computer-based attacks and  procedures for performing such exchanges; (2) initiate development of a  strategy for identifying assets of national significance that includes  coordinating efforts already underway, such as those at DOD and  Commerce; and (3) resolve discrepancies between PDD 63 requirements  and guidance provided by the federal Chief Information Officers Council  regarding computer incident reporting by federal agencies.
We further recommend that the Attorney General direct the FBI Director to  direct the NIPC Director to  (1) formalize relationships between the NIPC  and other federal entities, including DOD and the Secret Service, and  private-sector ISACs so that a clear understanding of what is expected from  the respective organizations exists; (2) develop a plan to foster the two-way  exchange of information between the NIPC and the ISACs; and (3) ensure  that the Key Asset Initiative is integrated with other similar federal  activities.
section_title: Agency Comments and Our Evaluation
paragraphs: In comments pertaining to this chapter, the Director of the NIPC  recommended that our report more fully discuss the underlying causes that  have led some in the private sector to offer limited or uneven cooperation  with the government regarding the sharing of information related to  infrastructure protection.  The Director noted that each component in  infrastructure protection operates under internal and external constraints  on information sharing, which are based on important considerations in  each component’s mission.  In this regard, he stated that Justice and the  NIPC have worked, and will continue to work, to develop effective  protocols for information sharing within the bounds of each component’s  legal and policy structures and provide a level of certainty that shared  information will be appropriately protected.  He asserted that, through  such protocols, information necessary for protecting infrastructures can be  effectively shared on a timely basis.  He further cited several reasons why  some private-sector organizations have been reluctant to share information  with the government, including the NIPC.  The reasons cited include (1) a  lack of understanding or confidence in the exceptions found in the  Freedom of Information Act, (2) concerns about whether Justice would  pursue prosecutions at the expense of private-sector business interests,  and (3) concerns about disclosing proprietary information to an entity  beyond their control. The Director said that, to address these concerns, the  NIPC has reached out to communities across the nation to build trust and  educate the public on the legal and security aspects of information sharing  and protection, citing the InfraGard Program and the NIPC’s successful  information-sharing relationship with the electric power ISAC.  In addition,  he cited two specific instances in which NIPC advisories were coordinated  in advance with private-sector entities, including three ISACs, as evidence  of the growing cooperative arrangement between the NIPC and the private  sector.  The Director did not specifically address our recommendations to  the NIPC regarding the need to formalize relationships with other federal  entities or ensure that the Key Asset Initiative is integrated with other  similar federal activities.
The NIPC’s comments reiterate many of the points made in our report  regarding the challenges associated with building productive information- sharing relationships between private and public-sector entities, and they  provide some additional specific detail.  We agree that the underlying  factors that inhibit information sharing are important, and our report cites  our July 2000 testimony, which provides a much more detailed discussion  of the related challenges.  We also agree that the NIPC has taken a number  of steps to address these concerns through the InfraGard Program and by  establishing cooperative relationships with the electric power ISAC and  others.  It is important that these efforts continue.  In addition, as our  report states, it is important that the NIPC strive for improved cooperative  relationships with other federal entities involved in critical infrastructure  protection.
In commenting on a draft of this report, the Special Assistant to the  President and Senior Director for Legislative Affairs at the National  Security Council said that the administration will consider our  recommendations as it reviews federal cyber activities to determine how  the critical infrastructure protection function should be organized.  The  comments did not specifically address our recommendations regarding (1)  better defining needed information for combating cyber attacks, (2)  developing a strategy for identifying assets of national significance, and (3)  resolving discrepancies in guidance on computer incident reporting by  federal agencies.
The comments from the NIPC and the National Security Council are  printed in full in appendixes I and II, respectively.
section_title: Funding Used For a Variety of NIPC-related Activities
paragraphs: Following congressional direction and on the basis of requirements  estimated by NIPC officials, the FBI reportedly provided the NIPC with  about $32 million and about $28 million for fiscal years 1999 and 2000,  respectively.  In addition, the FBI provided the NIPC with administrative  services, including budgeting, accounting, training, telecommunications,  and facilities, at no cost to the NIPC.  Other government agencies provided  the NIPC with additional resources in the form of at least 39 detailees over  fiscal years 1999 and 2000.  The detailees filled a variety of NIPC positions  on a nonreimbursable basis.
On the basis of our analysis of information provided to us by the FBI  Finance Division and the NIPC, the NIPC obligated about 84 percent of its  available fiscal years 1999 and 2000 funds.  The rest of the available funds  that the NIPC did not obligate were “no-year” funds that remained available  for fiscal year 2001.  The NIPC used the funds to support its analysis and  warning activities, investigation of computer crime, and outreach and  information sharing with government and private-sector entities.
Most of the funding was reportedly used for activities performed by NIPC  staff located at FBI headquarters in Washington, D.C.  On the basis of the  documents provided, the NIPC used about 16 percent of its fiscal years  1999 and 2000 funds to pay for training, travel, and information technology  for NIPC field squads and teams located in FBI field offices.  These funds  were in addition to the salaries and expense amounts provided by the FBI  field offices to the NIPC field squads and teams.  According to FBI officials,  the amounts reportedly used to support the NIPC field squads and teams by  their respective FBI field offices could not be readily determined because  those amounts are not accounted for separately from other FBI field  operations.  In addition, the salary amounts for the FBI agents and support  staff assigned to the NIPC were estimated because the agents’ salaries are  not accounted for separately from other FBI operations.
subsections: section_title: The FBI Provided Funds to the NIPC on the Basis of Congressional Direction and NIPC Requirements
paragraphs: Justice appropriations laws for fiscal years 1999 and 2000 did not specify  funding or provide specific direction for the NIPC; however, funding  guidance was provided in congressional conference reports related to  Justice’s fiscal years 1999 and 2000 appropriations. The sources and  amounts specified in this funding guidance are identified in tables 4 and 5.
The conference report earmarked $10.1 million from the fiscal year 1999  FBI salaries and expenses appropriation for the following purposes:  $8.7 million for positions to establish four additional Computer  Intrusion Threat Assessment field squads, which became NIPC field  squads;  $0.5 million for equipment for the new field squads;  $0.4 million for additional positions for the NIPC’s Watch and Warning   $0.5 million for training programs related to computer crime detection.
The fiscal year 2000 conference report noted that the new funding  combined with the estimated carryover from fiscal years 1998 and 1999  would provide the NIPC with “approximately the same level of funding  available in fiscal year 1999, adjusted for some nonrecurring requirements.”   According to FBI officials, the carryover discussed in the report was an  estimated amount provided to congressional appropriations staff and was  not meant to represent the final amount available because, at the time of  congressional conferences, the fiscal year-end amount of carryover was not  known.  In addition, the conference report designated $1,250,000 from the  fiscal year 2000 FBI salaries and expenses appropriation for the  establishment of a “cybercrime” partnership with the Thayer School of  Engineering at Dartmouth College.
On the basis of subsequent discussions with appropriations committee  staffs, the FBI ultimately provided funding to the NIPC that differed from  the amounts specified in the conference reports.  According to FBI Finance  Division officials, the funding amounts agreed to and provided by the FBI  were based on the NIPC’s estimated requirements, as established in the  President’s budget requests.  Tables 6 and 7 summarize the sources and  amounts of NIPC funding for fiscal years 1999 and 2000.  In fiscal year 1999,  the FBI provided the NIPC with $15.9 million less than specified in the  conference report and, in fiscal year 2000, $7.3 million more than specified  in the conference report.
In addition to the funding provided from the FBI, the NIPC received  resources during fiscal years 1999 and 2000 in the form of administrative  services from other FBI divisions and detailees from other government  agencies.  The FBI provided to the NIPC budgeting, accounting, training,  telecommunications, and facilities services, which are typically provided to  all FBI operational organizations, including the Counterterrorism Division,  at no cost to the NIPC.  For example, the FBI Finance Division provided  support for NIPC’s budget formulation and execution and maintained  accounting records, and the FBI’s National Security Division provided  requisition processing and document maintenance.  Also, some of the  training and related travel expenses for NIPC personnel were covered by  the FBI’s Quantico training facility without reimbursement.  In addition, the  Information Resources Division provided the NIPC with basic  telecommunications services at no cost to the NIPC, but the NIPC had to  pay for specialized telecommunications requirements, which are reflected  in table 8.  Further, the FBI provided the NIPC with the facilities occupied  in the FBI building without reimbursement.
At least 39 detailees also served at the NIPC for varying periods.  Although  information regarding departure dates for some detailees was incomplete,  at least 19 of the 39 people served for less than 12 months.  All detailees  were provided on a nonreimbursable basis.
section_title: Funds Primarily Used to Support The NIPC
paragraphs: On the basis of our analysis of documents provided by the NIPC and the  FBI Finance Division, about 84 percent of the funds that the NIPC obligated  in fiscal years 1999 and 2000 were for activities conducted at the NIPC in  Washington, D.C.  The NIPC used the rest of the funds it obligated to  support the NIPC field squads and other NIPC teams located in FBI field  offices.  Table 8 details the amounts obligated for the NIPC in fiscal years  1999 and 2000.  FBI Finance Division and NIPC officials developed all of  the amounts shown on the basis of information extracted from FBI  accounting records.  Amounts for salaries, including compensation and  benefits, were estimated because the FBI’s accounting records did not  segregate funds applicable to the FBI agents and support personnel  assigned to the NIPC from other FBI obligations.
For fiscal years 1999 and 2000, combined, the NIPC obligated funds for the  following key items:   Salaries for FBI personnel assigned to the NIPC (32 agents and about 60  support personnel) ($14.9 million).
Information technology, including hardware and software, for the NIPC  ($7.1 million) and the field squads and teams ($4.8 million).
Contracts ($12 million) that supported  a foreign counterintelligence investigation;  the NIPC’s emergency law enforcement sector responsibilities,  including providing case summaries and an emergency law  enforcement services sector draft plan;  development of InfraGard Program information;  development of periodic articles;   development of training courses, exercises, and software tools;  development of an incident analysis database;   development of an early warning system that is intended to link  numerous sources of electronic information to facilitate searches  and accelerate investigations;   research of existing and future Internet topology, including  development of related tools to support investigations; and   a “help desk” function for the NIPC.
NIPC field squad training, including related travel, for Key Asset  Initiative conferences, technical courses, and NIPC-related courses at  the FBI’s Quantico, VA, training facility ($3.3 million).
section_title: Conclusions
paragraphs: From the information provided by the NIPC and the FBI Finance Division,  the FBI appears to be funding the NIPC on the basis of the congressional  direction provided in the relevant conference reports and subsequent  discussions with appropriations committee staffs.  The NIPC used those  funds primarily to support activities performed by NIPC staff located at FBI  headquarters in Washington, D.C.  About 16 percent of the NIPC’s available  funding was used to support the NIPC squads and teams at FBI field  offices.  We are making no recommendations regarding the NIPC’s use of  funds.
section_title: Agency Comments
paragraphs: In commenting on a draft of this report, the Director of the NIPC noted that  our report stated that the FBI appears to be funding the NIPC on the basis  of congressional direction.  Neither the NIPC comments nor those of the  Special Assistant to the President provided any additional references to  this chapter.