Defense Infrastructure: Actions Needed to Guide DOD's Efforts to Identify, Prioritize, and Assess Its Critical Infrastructure
Published: 2007-05-24T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Department of Defense (DOD) relies on a network of DOD and non-DOD infrastructure assets in the United States and abroad so critical that its unavailability could hinder DOD's ability to project, support, and sustain its forces and operations worldwide. DOD established the Defense Critical Infrastructure Program (DCIP) to identify and assure the availability of mission-critical infrastructure. GAO was asked to evaluate the extent to which DOD has (1) developed a comprehensive management plan to implement DCIP and (2) identified, prioritized, and assessed its critical infrastructure. GAO analyzed relevant DCIP documents and guidance and met with officials from more than 30 DOD organizations that have DCIP responsibilities, and with Department of Homeland Security (DHS) officials involved in protecting critical infrastructure.
section_title: What GAO Found
paragraphs: While DOD has taken important steps to implement DCIP, it has not developed a comprehensive management plan to guide its efforts. GAO's prior work has shown the importance of developing a plan that incorporates sound management practices, such as issuing guidance, coordinating stakeholders' efforts, and identifying resource requirements and sources. Most of DOD's DCIP guidance and policies are either newly issued or in draft form, leading some DOD components to rely on other, better-defined programs, such as the antiterrorism program, to implement DCIP. Although DOD issued a DCIP directive in August 2005, the lead office responsible for DCIP lacks a chartering directive that defines important roles, responsibilities, and relationships with other DOD organizations and missions. DOD has created several information sharing and coordination mechanisms; however, additional measures could be taken. Also, DOD's reliance on supplemental appropriations to fund DCIP makes it difficult to effectively plan future resource needs. Until DOD completes a comprehensive DCIP management plan, its ability to implement DCIP will be challenged. DOD estimates that it has identified about 25 percent of the critical infrastructure it owns, and expects to identify the remaining 75 percent by the end of fiscal year 2009. In contrast, DOD has identified significantly less of the critical infrastructure that it does not own, and does not have a target date for its completion. Among the non-DOD-owned critical infrastructure that has been identified are some 200 assets belonging to private sector companies that comprise the defense industrial base--the focus of another report we plan to issue later this year. DOD estimates that about 85 percent of its mission-critical infrastructure assets are owned by non-DOD entities, such as the private sector; state, local, and tribal governments; and foreign governments. DOD has conducted vulnerability assessments on some DOD-owned infrastructure. While these assessments can provide useful information about specific assets, until DOD identifies and prioritizes all of the critical infrastructure it owns, assessment results have limited value for deciding where to target funding investments. For the most part, DOD cannot assess assets it does not own, and DOD has not coordinated with DHS to include them among DHS's assessments of the nation's critical infrastructure. DOD has delayed coordinating the assessment of non-DOD-owned infrastructure located abroad while it focuses on identifying the critical infrastructure that it does own. Regarding current and future DCIP funding levels, they do not include the cost to remediate vulnerabilities that are identified through the assessments. When DOD identifies, prioritizes, and assesses its critical infrastructure, and includes remediation in its funding requirements, its ability to perform risk-based decision making and target funding to priority needs will be improved.

section_title: Letter
paragraphs: The Department of Defense (DOD) relies on a network of physical and  cyber infrastructure so critical that its incapacitation, exploitation, or  destruction could have a debilitating effect on DOD’s ability to project,  support, and sustain its forces and operations worldwide. This defense  critical infrastructure consists of DOD and non-DOD assets located within  and outside the United States (see fig. 1). According to DOD, about 85  percent of the infrastructure it relies on is owned by non-DOD entities.  Because of its importance to DOD operations, defense infrastructure  represents an attractive target to adversaries; but it is also vulnerable to  natural disasters and accidents. DOD has recognized and emphasized the  importance of ensuring the availability of critical infrastructure in the most   recent versions of the National Military Strategy and the Quadrennial  Defense Review Report.
Homeland Security Presidential Directive 7, issued in December 2003,  designates the Secretary of the Department of Homeland Security (DHS)  as the principal federal official responsible for leading, integrating, and  coordinating the overall national effort to protect the nation’s critical  infrastructure and key resources. The Homeland Security Act of 2002 and  the Presidential Directive also direct DHS to produce a national plan for  critical infrastructure and key resources protection, and on June 30, 2006,  DHS issued the National Infrastructure Protection Plan. This plan  provides an overarching approach for protecting critical infrastructure and  key resources against terrorist attacks, major disasters, and other  emergencies. The cornerstone of the National Infrastructure Protection  Plan is its risk-management framework to establish priorities based on  risk, and determine protection and business continuity initiatives that  provide the greatest mitigation of risk. The National Infrastructure  Protection Plan identifies 17 infrastructure and key resources sectors, and  designates one or more lead federal agencies—referred to as a sector- specific agency—for each sector. For example, the Departments of  Defense and Energy are the sector-specific agencies for the Defense  Industrial Base and the Energy sectors, respectively. DHS is the sector- specific agency for 10 of the 17 sectors. Sector-specific agencies are  responsible for, among other things, coordinating with all relevant federal,  state, and local governments and the private sector; encouraging risk  management strategies; and conducting or facilitating vulnerability  assessments of their sector.
Homeland Security Presidential Directive 7 also requires all federal  departments and agencies to identify, prioritize, and coordinate the  protection of critical infrastructure and key resources from terrorist  attacks. The Office of the Assistant Secretary of Defense for Homeland  Defense and Americas’ Security Affairs (ASD), within the Office  of the Under Secretary of Defense for Policy, serves as the principal  civilian advisor to the Secretary of Defense on the identification,  prioritization, and protection of DOD’s critical infrastructure. DOD  established the Defense Critical Infrastructure Program (DCIP) to identify  and assure the availability of mission-critical infrastructure. DCIP  encompasses the full spectrum of threats—ranging from terrorist attacks  to natural disasters and catastrophic accidents—that can adversely affect  critical infrastructure. Earlier programs analogous to DCIP can be traced  back to 1998. ASD(HD&ASA) has been responsible for developing and  ensuring implementation of critical infrastructure protection policy and  program guidance activities since September 2003. Within DOD, several  organizations play a role in DCIP, including the combatant commands  (COCOM) and the military services. DOD also identified 10 virtual,  functionally-based defense sectors to consider critical infrastructure that  cross traditional organizational boundaries. The 10 defense sectors are  financial services; global information grid; intelligence, surveillance, and  reconnaissance; space; health affairs; logistics; personnel; public works;  transportation; and the defense industrial base. Over the last 4 fiscal years  (2004 to 2007), DOD has spent about $160 million on DCIP.
In our recent report on DOD’s collective protection for military forces, we  discussed DOD’s collective protection management problems, including  fragmented policies and operating concepts among the varied programs  and organizations involved. DOD has been unable to reach consensus on  what criteria to use to identify its most critical facilities. As we reported,  these management problems make it difficult for DOD to balance  competing needs and prudently allocate funding resources for collective  protection improvements. We recommended, among other things, that  DOD provide clearer, more consistent policies to guide the funding of  collective protection and other installation preparedness activities.
As you requested, we have begun a body of work reviewing actions DOD  has taken to identify, protect, and otherwise assure the availability of  infrastructure necessary to sustain its operations. This initial report  focuses on key organizational, structural, and programmatic aspects of  DCIP. Specifically, this report evaluates the extent to which DOD has   (1) developed a comprehensive management plan to implement DCIP and  (2) identified, prioritized, and assessed its critical infrastructure. We plan  to issue additional products of interest to you, including a report later this  year that examines the defense industrial base. Accordingly, this report  does not address the Defense Industrial Base defense sector, unless  indicated otherwise.
To evaluate the extent to which DOD has developed a comprehensive  management plan to implement DCIP, we reviewed and analyzed relevant  DCIP guidance, met with key officials responsible for DCIP from the  military services, the COCOMs (hereafter referred to in this report as  “DOD components”), and the defense sector lead agents; several offices  within the Office of the Secretary of Defense; and the Joint Staff’s  Directorate for Antiterrorism and Homeland Defense. In addition, we  reviewed and analyzed pertinent funding data from the past 4 fiscal years,  met with the Office of the Under Secretary of Defense (Comptroller)/Chief  Financial Officer to discuss the budgeting process, and interviewed  officials responsible for determining funding requirements for the  program. To evaluate the extent to which DOD has identified, prioritized,  and assessed its critical infrastructure, we reviewed and analyzed relevant  DCIP guidance including the DCIP Assessment Standards and  Benchmarks and DCIP Criticality Process Guidance Document. We  interviewed DOD officials responsible for critical infrastructure and  reviewed DOD’s critical infrastructure vulnerability assessment process.  We also met with Defense Threat Reduction Agency (DTRA) officials  involved in implementing infrastructure vulnerability assessments.
We conducted our work between June 2006 and May 2007 in accordance  with generally accepted government auditing standards. A more thorough  description of our scope and methodology is provided in appendix I.
subsections: section_title: Background
paragraphs: DOD recognizes that it is neither practical nor feasible to protect its entire  infrastructure against every possible threat and, similar to DHS, it is  pursuing a risk-management approach to prioritize resource and  operational requirements. Risk management is a systematic, analytical  process to determine the likelihood that a threat will harm assets, and then  to identify actions to reduce risk and mitigate the consequences of the  threat. While risk generally cannot be eliminated, enhancing protection  from threats or taking actions—such as establishing backup systems or  hardening infrastructure—to reduce the effect of an incident can serve to  significantly reduce risk.
DOD’s risk-management approach is based on assessing threats,  vulnerabilities, criticalities, and the ability to respond to incidents. Threat  assessments identify and evaluate potential threats on the basis of  capabilities, intentions, and past activities before they materialize.  Vulnerability assessments identify weaknesses that may be exploited by  identified threats and suggest options that address those weaknesses. For  example, a vulnerability assessment might reveal weaknesses in  unprotected infrastructure, such as satellites, bridges, and personnel  records. Criticality assessments evaluate and prioritize assets on the basis  of their importance to mission success. For example, certain power plants,  computer networks, or population centers might be identified as  important to the operation of a mission-critical seaport. These  assessments help prioritize limited resources while reducing the potential  for expending resources on lower-priority assets. DOD’s risk-management  approach also includes an assessment of the ability to respond to, and  recover from, an incident.
The amount of non-DOD infrastructure that DOD relies on to carry out  missions has not been identified; however, it is immense. To date, DHS has  identified about 80,000 items of non-DOD infrastructure, some of which is  also critical to DOD. Additionally, according to the Office of the Deputy  Under Secretary of Defense for Installations and Environment, DOD owns  more than 3,700 sites with more than half a million real property assets  worldwide that could also qualify as critical infrastructure. The  methodology DOD uses to identify critical infrastructure involves linking  DOD missions to supporting critical infrastructure. Figure 2 shows three  representative types of DOD-owned and non-DOD-owned critical  infrastructure.
In 1998, the Office of the Assistant Secretary of Defense for Command,  Control, Communications, and Intelligence was responsible for DOD’s  critical infrastructure protection efforts; however, in September 2003, the  Deputy Secretary of Defense moved this program to the newly established  Office of the Assistant Secretary of Defense for Homeland Defense. DOD’s  critical infrastructure efforts were formalized in August 2005 with the  issuance of DOD Directive 3020.40, which established DCIP. On December  13, 2006, this office was renamed the Office of the Assistant Secretary of  Defense for Homeland Defense and Americas’ Security Affairs.
Shortly after the office became responsible for DOD’s critical  infrastructure protection efforts in October 2003, ASD(HD&ASA)  established the Defense Program Office for Mission Assurance in  Dahlgren, Virginia, to manage the day-to-day activities of DCIP. The  Program Office—now a Mission Assurance Division—was responsible for  coordinating DCIP efforts across DOD components and sector lead agents,  developing training and exercise programs, overseeing the development of  analytical tools and standards to permit DOD-wide analyses, and  developing a comprehensive system to track and evaluate critical  infrastructure.
DOD organizations that have significant DCIP roles and responsibilities  are shown in figure 3.
The COCOMs, in collaboration with the Joint Staff, identify and prioritize  DOD missions that are the basis for determining infrastructure criticality.  The military services, as the principal owners of DOD infrastructure,  identify and link infrastructure to specific COCOM mission requirements.  Defense sector lead agents address the interdependencies among  infrastructure that cross organizational boundaries, and evaluate the  cascading effects of degraded or lost infrastructure on other infrastructure  assets. Further, DOD officials told us that DTRA performs infrastructure  vulnerability assessments for the Joint Staff in support of DCIP to  determine single points of failure from all hazards.
section_title: DOD Has Taken Important Steps to Implement DCIP but Needs a Comprehensive Management Plan to Guide Its Efforts
paragraphs: DOD has taken some important steps to implement DCIP; however, it has  not developed a comprehensive management plan to guide its efforts.  Although an ASD(HD&ASA) official told us they are preparing an outline  for a plan to implement DCIP, it is unclear the extent to which such a plan  will address key elements associated with sound management practices,  including issuing guidance, coordinating program stakeholders’ efforts,  and identifying resource requirements. DOD has been slow finalizing DCIP  guidance and policies. As of May 2007, most of DOD’s DCIP guidance and  policies were either newly issued or still in draft, which has resulted in  DOD’s components pursuing varying approaches to implement DCIP. DOD  has taken steps to improve information sharing and coordination within  and outside of DOD. Finally, through DOD’s budget process, DCIP has  received over $160 million from fiscal years 2004 to 2007. Of this amount,  the components and sector lead agents have received $68.6 million, of  which about 21 percent is from supplemental appropriations. Our prior  work has shown that supplemental funding is not an effective means for  decision makers to effectively and efficiently plan for future years  resource needs, weigh priorities, and assess budget trade-offs. Until DOD  completes a comprehensive management plan to implement DCIP, which  includes issuing remaining DCIP guidance and fully identifying funding  requirements, its ability to implement DCIP will be challenged.
subsections: section_title: Most DCIP Guidance and Policies Are Newly Issued or Still in Draft
paragraphs: While our prior work has shown that issuing timely guidance is a key  element of sound management, as of May 2007, the majority of DCIP  guidance and policies were either newly issued or still in draft form, more  than 3½ years after the Deputy Secretary of Defense assigned DCIP to  ASD(HD&ASA) in September 2003 (see table 1).
In the absence of finalized guidance and policies, DOD components have  been pursuing varying approaches to implement their critical  infrastructure programs, a condition that has not changed markedly with  the issuance of several guidance documents in the past year. According to  officials responsible for the critical infrastructure programs from several  of the DOD components, they were either unaware that the guidance had  been finalized or had decided to continue the approach they had  previously adopted.
Although DOD issued a DCIP directive in August 2005, ASD(HD&ASA)  lacks a chartering directive that, among other things, clearly defines  important roles, responsibilities, and relationships with other DOD  organizations and missions—including the relationship between  ASD(HD&ASA) and the Assistant Secretary of Defense for Special  Operations and Low-Intensity Conflict and Interdependent Capabilities. At  present, responsibility for antiterrorism guidance resides with the  Assistant Secretary of Defense for Special Operations and Low-Intensity  Conflict and Interdependent Capabilities. A memorandum entitled  Implementation Guidance Regarding the Office of the Assistant  Secretary of Defense for Homeland Defense issued by the Deputy  Secretary of Defense in March 2003 required the Director of  Administration and Management within the Office of the Secretary of  Defense to develop and coordinate within 45 days a chartering DOD  Directive that would define, among other things, the relationship between  ASD(HD&ASA) and the Assistant Secretary of Defense for Special  Operations and Low-Intensity Conflict and Interdependent Capabilities.  However, more than 4 years later, this chartering DOD directive still has  not been accomplished.
Currently, DCIP implementation is diffused among program stakeholders,  such as the COCOMs and the military services. As a consequence, some  components, such as the U.S. Northern Command and U.S. Special  Operations Command, leveraged DOD’s antiterrorism guidance to develop  critical infrastructure programs, while other components, such as the U.S.  Strategic Command and U.S. European Command, have kept the two  programs separate. Until DOD addresses the need for a chartering  directive to properly identify the relationship between DCIP and the  antiterrorism program, and sets timelines for finalizing its remaining  guidance, it cannot be assured that components and sector lead agents  identify, prioritize, and assess their critical infrastructure in a consistent  manner. This lack of consistency could impair DOD’s ability to perform  risk-based decision making across component lines over the long term.
section_title: Although DOD Has Taken Steps to Facilitate Information Sharing and Coordination, Additional Measures Could Be Taken
paragraphs: Existing DCIP guidance emphasizes information sharing and collaboration  with relevant government and private-sector entities. While DOD has taken  steps to facilitate information sharing and coordination within the  department, as well as with other federal agencies and private sector  companies, we believe additional measures could be taken, such as  greater cooperation with federal-level counterparts on the identification,  prioritization, and assessment of critical infrastructure. Since 2003,  ASD(HD&ASA) has established and sponsored several information sharing  and coordination forums, such as the Defense Infrastructure Sector  Council and Critical Infrastructure Program Integration Staff. The Defense  Infrastructure Sector Council provides a recurring forum for DCIP sector  lead agents to share information, identify common areas of interest, and  leverage the individual activities of each sector to eliminate duplication.  The Critical Infrastructure Program Integration Staff is comprised of  representatives from more than 30 DOD organizations. Additionally,  ASD(HD&ASA) maintains an Internet site that is used to post relevant  information, such as policies, available training, and announcement of  meetings and conferences. ASD(HD&ASA) also is a member of several  critical infrastructure forums whose membership extends beyond DOD,  such as the Homeland Infrastructure Foundation Level Database Working  Group, and several Critical Infrastructure Partnership Advisory Council  Committees, including those pertaining to communications, electricity,  and dams. In another effort to coordinate DOD components’ and sector  lead agents’ critical infrastructure protection practices, DOD released, in  September 2006, its DCIP Geospatial Data Strategy, which lays out a  standardized approach to depict geographically critical infrastructure  data.
Both DHS and DOD officials acknowledged the potential benefits of  increasing collaborative efforts, particularly with respect to critical  infrastructure identification, tracking, and assessing. To promote clear and  streamlined communication, ASD(HD&ASA) has directed DOD  components and sector lead agents to channel their interactions with DHS  through them. However, with the exception of the Health Affairs and  Financial Services defense sectors, there has been little to no coordination  between the defense sectors and their corresponding federal-level critical  infrastructure sector counterparts due to the immaturity of the program.  Table 2 shows the defense-level sectors that are comparable to those at  the federal level.
DOD components are collecting different data to track and monitor their  critical infrastructure to meet the needs of DCIP as well as their own,  which could impede information sharing and analysis over time, and  hinder DOD’s ability to identify and prioritize critical infrastructure across  DOD components and sector lead agents. ASD(HD&ASA) guidance on  how DOD components and sector lead agents should track and monitor  their critical infrastructure is in various stages of development and review.  For example, in May 2006, ASD(HD&ASA) issued a draft version of the  DCIP Data Collection Essential Elements of Information Data Sets  requiring DOD components and sector lead agents to collect a common set  of data on their critical infrastructure. However, officials from several of  the COCOMs and defense sectors told us that they have not incorporated  the DCIP Data Collection Essential Elements of Information Data Sets  into their data collection efforts because the guidance has not been  finalized. These officials further stated that they are following  departmental guidance not specific to DCIP that pertains to database  interoperability and data sharing. During fiscal year 2006, ASD(HD&ASA)  tasked the Mission Assurance Division to develop the capability to  geospatially display DOD components’ and sector lead agents’ critical  infrastructure and interdependencies. The Mission Assurance Division has  received and modeled critical infrastructure data from several defense  sector lead agents, but according to division officials, the combination of  funding constraints and the components and sector lead agents  independently acquiring technical support for their individual critical  infrastructure programs, has limited its utility.
In an effort to maximize the potential information DOD could receive  about critical infrastructure it does not own, DOD officials told us that  they plan to obtain Protected Critical Infrastructure Information (PCII)  accreditation from DHS. The PCII program was established by DHS  pursuant to the Critical Infrastructure Information Act of 2002. The act  provides that critical infrastructure information that is voluntarily  submitted to DHS for use by DHS regarding the security of critical  infrastructure and protected systems, analysis, warning, interdependency  study, recovery, reconstitution, or other informational purpose, when  accompanied with an express statement, shall receive various protections,  including exemption from disclosure under the Freedom of Information  Act. If such information is validated by DHS as PCII, then the information  can only be shared with authorized users. Before accessing and storing  PCII, organizations or entities must be accredited and have a PCII officer.  Authorized users can request access to PCII on a need-to-know basis, but  users outside of DHS do not have the authority to store PCII until their  agency is accredited. However, the lack of accreditation does not  otherwise prevent entities from sharing information directly with DOD.  For example, in the aftermath of September 11, 2001, the Association of  American Railroads began prioritizing railroad assets and vulnerabilities— information that it shares with DOD—on the more than 30,000 miles of  commercial rail line used to transport defense critical assets.
DOD officials told us that DOD has not yet fully evaluated the costs and  benefits of accreditation for its purposes. We noted in our April 2006  report that nonfederal entities continued to be reluctant to provide their  sensitive information to DHS because they were not certain that their  information will be fully protected, used for future legal or regulatory  action, or inadvertently released. Since our April report, DHS published  on September 1, 2006, its final rule implementing the act, but we have not  examined whether nonfederal entities are more willing to provide  sensitive information to DHS under the act at this time, or DOD’s cost to  apply for, receive, and maintain accreditation. It is unclear to us, at this  time, the extent to which obtaining accreditation would be beneficial to  DOD when weighed against potential costs.
section_title: DOD Components and Sector Lead Agents Have Relied on Supplemental Appropriations to Fund Their Critical Infrastructure Programs
paragraphs: DCIP has received about $160 million from fiscal years 2004 to 2007,  through DOD’s budget process. Of this amount, ASD(HD&ASA) received  approximately $86.8 million, while the Joint Staff received approximately  $5.3 million. The DOD components and sector lead agents, which are  responsible for identifying critical infrastructure, received $68.5 million  during the same 4-year period, of which $14.3 million (about 21 percent of  the component and sector lead agents’ combined funding) has come from  supplemental appropriations. Figures 4 and 5 show how much DCIP  funding was received by the components and sector lead agents during  fiscal years 2004 to 2007.
The extent to which individual components and sector lead agents relied  on supplemental funding for their critical infrastructure programs varied  by fiscal year. In fiscal year 2005, for example, both the U.S. Special  Operations Command and the Health Affairs defense sector did not  receive any programmed funding and relied exclusively on supplemental  appropriations. The Defense Intelligence Agency, the lead agent for the  Intelligence, Surveillance, and Reconnaissance defense sector, received 78  percent of its fiscal year 2005 critical infrastructure funding from  supplemental appropriations. Likewise, the U.S. Northern Command  received almost three-quarters (72 percent) of its critical infrastructure  funding from supplemental appropriations in fiscal year 2006. Management  control standards contained in the Standards for Internal Control in the  Federal Government and sound management practices emphasize the  importance of effective and efficient resource use. Relying on  supplemental funding to varying degrees for their DCIP budget prevents  the components and sector lead agents from effectively planning future  years’ resource needs, weighing priorities, and assessing budget trade-offs.
DCIP funding has been centralized in ASD(HD&ASA) since fiscal year  2004; however, beginning in fiscal year 2008, the military departments will  be required to fund service critical infrastructure programs as well as the  nine COCOM critical infrastructure programs. According to DOD Directive  3020.40, the military departments and COCOMs are required to provide  resources for programs supporting DCIP. This responsibility is reiterated  and amplified in a memorandum from the Principal Deputy Assistant  Secretary of Defense for Homeland Defense that instructs the military  departments and the COCOMs to include DCIP funding in their fiscal year  2008 to 2013 budget submissions. ASD(HD&ASA) will continue to fund  defense sector critical infrastructure programs for fiscal years 2008 and  2009, and ASD(HD&ASA) officials stated that they will work with the  defense sector lead agents to obtain funding through the lead agents’  regular budget process, beginning in fiscal year 2010. Including DCIP in  the lead agents’ baseline budgets should reduce reliance on supplemental  appropriations to implement critical infrastructure responsibilities.
Overall DCIP funding received (fiscal years 2004 to 2007), and requested  (fiscal years 2008 to 2013) is shown in figure 6.
If DCIP is funded at requested levels in future years, then it will represent  a substantial increase over current actual funding levels. However, in  previous years, DCIP consistently has been funded at less than the  requested amounts. For example, in fiscal year 2005, the military services  collectively requested approximately $8 million in DCIP funding from  ASD(HD&ASA) and received $2.1 million. That year, the military services  also received an additional $2.3 million in supplemental appropriations,  raising their total funding in fiscal year 2005 to $4.4 million, which is  approximately 55 percent of what was requested. Even if DCIP funding is  substantially increased, without a comprehensive management plan in  place, it is not clear that the funds would be allocated to priority needs.
section_title: DOD Estimates That It Has Identified about 25 Percent of the Critical Infrastructure It Owns, and Most of the Non-DOD-Owned Critical Infrastructure Remains Unidentified
paragraphs: DOD estimates that it has identified about 25 percent of the critical  infrastructure it owns, and expects to finish identifying the remaining 75  percent by the end of fiscal year 2009. DOD has identified considerably  less of its critical infrastructure owned by non-DOD entities, and has not  set a target date for its completion. A principal reason why DOD has not  identified a greater amount of its critical infrastructure is the lack of timely  DCIP guidance and policies, which has resulted in DOD’s components  pursuing varying approaches in identifying their critical infrastructure.  DOD has been performing a limited number of vulnerability assessments  on DOD-owned infrastructure; however, until DOD identifies and  prioritizes all of the critical infrastructure it owns, results have  questionable value for deciding where to target funding investments.  Currently, DOD includes the vulnerability assessment of DOD-owned  infrastructure as a module to an existing assessment. However, it has not  formally adopted this practice DOD-wide, which would reduce the burden  on installation personnel and asset owners. Moreover, DOD does not have  a mechanism to flag domestic mission-critical infrastructure for DHS to  consider including among its assessments of the nation’s critical  infrastructure, and has delayed coordinating the assessments of non-DOD  critical infrastructure located abroad. DOD has not identified funding to  remediate vulnerabilities identified through the assessment process.
subsections: section_title: DOD Has Identified Some of Its Mission-Critical Infrastructure
paragraphs: DOD estimates that it has identified about 25 percent of the critical  infrastructure it owns, and ASD(HD&ASA) officials anticipate identifying  all DOD-owned critical infrastructure (estimated to be about 15 percent of  the total) by the fiscal year 2008–2009 time frame. DOD has identified  considerably less critical infrastructure that it does not own (estimated to  be about 85 percent of the total), but that it relies upon to perform its  missions (see fig. 7).
Without knowing how much non-DOD-owned infrastructure is mission  critical, ASD(HD&ASA) officials were unable to estimate how much of the  non-DOD infrastructure has already been identified or a completion date.  DOD has determined that a small portion of the non-DOD infrastructure— about 200 assets—that belongs to the defense industrial base sector are  mission critical.
The Mission Assurance Division developed a database to track and  geospatially display defense critical infrastructure both within the United  States and overseas, and its associated interdependencies. According to  Mission Assurance Division officials, the willingness of DOD components  to share their critical infrastructure information has varied. For example,  division officials told us that the defense sectors have been more  forthcoming than either the military services or the COCOMs.  Consequently, the database provides an incomplete view of defense  critical infrastructure, which significantly reduces DOD’s ability to analyze  the importance of infrastructure across the components and sector lead  agents. ASD(HD&ASA) officials are aware that several of the DOD  components and sector lead agents have developed databases to track  their specific infrastructure. For example, the Air Force, Marine Corps,  Health Affairs sector, Space sector and Personnel sector have each  developed their own databases. According to ASD(HD&ASA) officials,  they are focusing on ensuring compatibility among the databases rather  than prescribing a central database. Until DOD identifies the remaining  portion of its critical infrastructure, including the portion owned by non- DOD entities, it cannot accurately prioritize and assess the risks  associated with that infrastructure.
Table 3 shows the amount of infrastructure assets—rounded to the nearest  hundred—that the DOD components have provisionally identified as  critical as of December 2006. DOD officials cautioned that not all of this  information has been validated and is subject to change. For example,  some infrastructure may be counted more than once due to components  performing multiple missions or being assigned dual roles. The numbers in  table 3 are presented to provide an order of magnitude.
According to the Standards for Internal Control in the Federal  Government, appropriate policies and procedures should exist with  respect to an agency’s planning and implementation activities. The length  of time DOD has taken to issue DCIP guidance and policies has resulted in  components pursuing varying approaches in identifying and prioritizing  critical infrastructure, approaches that may not be complementary. For  example, Navy officials told us that, prior to 2004, they were basing  infrastructure criticality on its importance to Operation Enduring  Freedom, whereas Army officials indicated that they are using wartime  planning scenarios based on the 2006 Quadrennial Defense Review to  determine criticality. The COCOMs and the Joint Staff are basing  infrastructure criticality on its importance in accomplishing individual  COCOM mission requirements—an idea proposed by the Mission  Assurance Division. In 2003, the Mission Assurance Division proposed  linking infrastructure criticality with COCOM mission requirements, and  Joint Staff officials stated that a preliminary list has been formulated and  will undergo further review in 2007. Furthermore, defense sector lead  agents, such as Financial Services and Personnel, are identifying all of  their infrastructure regardless of COCOM mission requirements. These  variations in approaches used to determine criticality exist because DOD’s  published policy, the DCIP Criticality Process Guidance Document,  which directs the components and sector lead agents to use one set of  criteria—COCOM mission requirements—was not finalized until  December 2006.
section_title: Vulnerability Assessments of DOD-Owned Infrastructure Have Limited Value without Knowing Infrastructure Criticality, and DOD Would Benefit from Formally Adopting a Departmentwide Practice, and Flagging Non-DOD- Owned Infrastructure for DHS’s Consideration
paragraphs: DOD has begun conducting a limited number of infrastructure  vulnerability assessments on the infrastructure it owns. Between calendar  years 2004 and 2007, DTRA will have conducted approximately 361  antiterrorism vulnerability assessments, 45 (about 12 percent) of which  will include an assessment of critical infrastructure. Which installations  receive antiterrorism vulnerability assessments with a module that focuses  on critical infrastructure is based on perceived infrastructure criticality, as  determined by the Joint Staff in coordination with the COCOMs, and to a  lesser extent the military services. However, we believe DOD cannot  effectively target infrastructure vulnerability assessments without first  identifying and prioritizing its mission-critical infrastructure. Depending  on the amount of infrastructure that DOD deems critical, it may not be  able to perform an on-site assessment of every DOD asset. To address this  limitation, ASD(HD&ASA) officials told us that they plan to implement a  self-assessment program that the military services—the infrastructure  owners—can conduct in lieu of or in between the scheduled vulnerability  assessments. DOD is in the process of developing a vulnerability self- assessment handbook that would provide guidance on how to conduct  these assessments but, as of May 2007, a release date had not been set.
To reduce the burden of multiple assessments on installation personnel  and asset owners, in 2005, DOD incorporated an all-hazards infrastructure  assessment module into its existing antiterrorism vulnerability  assessments. Including the vulnerability assessment of DOD infrastructure  in an established assessment program, such as the one that exists for  antiterrorism, has not been formally adopted as a departmentwide  practice. Unless this practice is adopted, it is possible that infrastructure  assessments could be conducted independently, thereby increasing the  burden on installation personnel and asset owners that the modular  approach alleviates. Beginning in calendar year 2006, the Air Force piloted  its own critical infrastructure assessments at those Air Force installations  not receiving DTRA-led vulnerability assessments. The Air Force  completed two of these pilot critical infrastructure assessments in 2006,  and has nine additional assessments planned in 2007. Unlike the DTRA-led  assessments, the Air Force pilot assessments are based on risk rather than  vulnerabilities. We did not examine the quality or the sources of the threat,  asset criticality, and vulnerability data that the Air Force is using to  perform its risk assessments. We did not evaluate the effectiveness of  either the DTRA-led or Air Force assessments as part of our review.
DOD is not in a position to address domestic, non-DOD, mission-critical  infrastructure, with the exception of defense industrial base assets and  transportation infrastructure supporting seaports and airports, much less  perform vulnerability assessments on them. DHS conducts on-site  vulnerability assessments of domestic non-DOD-owned critical  infrastructure and has developed a model that enables owners of private- sector critical infrastructure to perform vulnerability self-assessments.  DOD currently does not have a mechanism to flag mission-critical  infrastructure for DHS to consider including among its assessments of the  nation’s critical infrastructure. For example, if DOD knew that DHS was  planning to conduct a vulnerability assessment of critical infrastructure in  the Atlanta, Georgia, area, it could flag for DHS’s consideration privately- owned infrastructure that DOD deemed critical—such as an electrical  substation or a railroad junction. Officials from both agencies expressed  an interest in coordinating vulnerability assessments of non-DOD-owned  critical infrastructure. DOD has delayed coordinating the assessments of  non-DOD-owned infrastructure located abroad because it has decided to  focus on identifying infrastructure that it owns. For example, U.S.  European Command and U.S. Central Command officials stated that they  are concentrating on identifying critical infrastructure located on their  installations. In addition, DTRA officials pointed out that gaining access to  relevant information about foreign-owned infrastructure is more  challenging than for infrastructure owned domestically.
section_title: DCIP Funding Requirements Do Not Include Remediation
paragraphs: Future DCIP funding requests may be understated because current  funding levels, including supplemental appropriations, do not include the  resources that may be needed to remediate vulnerabilities. Our prior work  has shown the importance of identifying all program costs to enable  decision makers to weigh competing priorities. According to critical  infrastructure officials from several DOD components and sector lead  agents, there is insufficient funding to remediate vulnerabilities identified  through the assessment process. Remediation in the form of added  protective measures, backup systems, hardening infrastructure against  perceived threats, and building redundancy could be costly. As a point of  reference, the Joint Staff spent $233.7 million from fiscal years 2004  through 2007 to correct high-priority antiterrorism vulnerabilities—more  than the $160 million spent on all DCIP activities over this same period.
Additionally, these antiterrorism remediation expenditures were for DOD- owned assets only and do not reflect costs to remediate vulnerabilities to  infrastructure not owned by DOD. In 2000, the Congress directed the  Secretary of Defense to establish a loan guarantee program that makes a  maximum of $10 million loan principal guarantee available each fiscal year  for qualified commercial firms to improve the protection of their critical  infrastructure at their facilities or refinance improvements previously  made. Once DOD identifies the critical infrastructure it relies on but does  not own and its associated vulnerabilities, this program could potentially  be utilized to help qualified commercial firms obtain funding for  remediation.
section_title: Conclusions
paragraphs: DOD depends on critical infrastructure to project, support, and sustain its  forces and operations worldwide, but its lack of a comprehensive  management plan to guide its efforts that addresses guidance,  coordination of program stakeholders’ efforts, and resource requirements,  has prevented the department from effectively implementing an efficient  critical infrastructure program. ASD(HD&ASA) has overseen DCIP since  September 2003; however, because key DCIP guidance has either recently  been issued or remains in draft more than 3½ years later, DOD  components have been pursuing different approaches to fulfill their DCIP  missions—approaches that are not optimally coordinated and may conflict  with each other or their federal-level counterparts. Moreover, because the  relationship between the Directorates for HD&ASA and Special  Operations and Low-Intensity Conflict and Interdependent Capabilities  regarding the DCIP and antiterrorism missions remains undefined, some  components are relying on antiterrorism guidance to implement their  critical infrastructure programs while others take different approaches.  Furthermore, some DCIP funding for the components and sector lead  agents has come from supplemental appropriations, which, as we have  reported previously, is not a reliable means for decision makers to  effectively and efficiently assess resource needs. Until DOD develops a  comprehensive management plan for DCIP—that includes timelines for  finalizing remaining guidance and actions to improve information sharing,  its ability to implement DCIP will be challenged.
In addition, until DOD identifies and prioritizes what infrastructure is  critical, the utility of vulnerability assessments is limited in targeting  funding and investments and could lead to an inefficient use of DOD  resources. Combining the infrastructure vulnerability assessment with an  existing assessment, as DOD is currently doing on infrastructure that it  owns, has the added advantage of reducing the burden of multiple  assessments on installation personnel and asset owners. However,  because DOD has not formally adopted this modular approach as a DOD- wide practice, the possibility exists that infrastructure vulnerability could  be assessed separately. Still, to date, no DCIP funds have been spent on  reducing vulnerabilities to infrastructure. Remediation of risk identified in  the assessment process could be costly—possibly more than doubling  current identified funding requirements. Finally, by not coordinating with  DHS on vulnerability assessments of non-DOD domestic infrastructure,  DOD is missing an opportunity to increase awareness of matters affecting  the availability of assets that it relies on but does not control. When DOD  components and sector lead agents consistently identify, prioritize, and  assess their critical infrastructure, as well as including the remediation of  vulnerabilities in their funding requirements, DOD’s ability to perform risk- based decision making and target funding to priority needs will be  improved.
section_title: Recommendations for Executive Action
paragraphs: To guide DCIP implementation, we recommend that the Secretary of  Defense direct ASD(HD&ASA) to develop and implement a comprehensive  management plan that addresses guidance, coordination of stakeholders’  efforts, and resources needed to implement DCIP. Such a plan should  include establishing timelines for finalizing the DCIP Data Collection  Essential Elements of Information Data Sets to enhance the likelihood  that DOD components and sector lead agents will take a consistent  approach in implementing DCIP.
To implement the intent of the Deputy Secretary of Defense’s  memorandum Implementation Guidance Regarding the Office of the  Assistant Secretary of Defense for Homeland Defense dated March 25,  2003, we recommend that the Secretary of Defense direct the Director of  Administration and Management to issue a chartering directive to, among  other things, define the relationship between the Directorates for HD&ASA  and Special Operations and Low-Intensity Conflict and Interdependent  Capabilities.
As part of this comprehensive management plan, to increase the likelihood  that the defense sector lead agents are able to make effective budgetary  decisions, we recommend that the Secretary of Defense direct  ASD(HD&ASA) to assist the defense sector lead agents in identifying,  prioritizing, and including DCIP funding requirements through the regular  budgeting process beginning in fiscal year 2010.
In addition, as part of developing a comprehensive management plan for  DCIP, we recommend that the Secretary of Defense direct ASD(HD&ASA),  in coordination with the DOD components and sector lead agents, to  determine funding levels and sources needed to avoid reliance on  supplemental appropriations and identify funding for DCIP remediation.
We further recommend that the Secretary of Defense direct  ASD(HD&ASA) to take the following actions to increase the utility of  vulnerability assessments:    Complete the identification and prioritization of critical infrastructure  before increasing the number of infrastructure vulnerability  assessments performed.
Adopt the practice of combining the defense critical infrastructure  vulnerability assessment module with an existing assessment as the  DOD-wide practice.  Issue guidance and criteria for performing infrastructure vulnerability  self-assessments.  Identify and prioritize domestic non-DOD-owned critical infrastructure  for DHS to consider including among its assessments of the nation’s  critical infrastructure.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of this report, DOD concurred with all of  our recommendations. DOD also provided us with technical comments,  which we incorporated in the report, as appropriate. DOD’s comments are  reprinted in appendix II. DHS also was provided with an opportunity to  comment on a draft of this report, but informed us that it had no  comments.
In its written comments, DOD stated that it expects to issue its DCIP  management plan by September 2007 and a chartering directive for  ASD(HD&ASA) by July 2007—guidance that we believe will contribute to  a more efficient and effective critical infrastructure program. Although  DOD did not describe the contents of the management plan, we encourage  the department to address points raised in our report—guidance,  coordination of stakeholders’ efforts, and resource requirements. DOD  concurred with our recommendations pertaining to infrastructure  vulnerability assessments. Specifically, it agreed to identify and prioritize  all DOD-owned critical infrastructure before increasing the number of  assessments; to codify the practice of combining the infrastructure  assessment with an existing vulnerability assessment, thereby reducing  the burden of multiple assessments on installation personnel and asset  owners; and to issue self-assessment guidance and criteria. In its  comments, DOD stated that vulnerability assessments are a valid tool to  address risk and support risk management decisions, and that delaying  these assessments until all assets are identified—projected in fiscal year  2009—is unadvisable. While we agree that infrastructure vulnerability  assessments can reveal exploitable weaknesses, without evaluating the  capabilities, intentions, or probability of occurrence of human and natural  threats, as well as the importance of a particular asset to accomplishing  the mission, reducing vulnerabilities may result in little, if any, risk  reduction. We agree with the department that it should continue to  perform infrastructure vulnerability assessments, but believe that  increasing the number of assessments performed above current levels will  have limited value without considering threat and asset criticality. With  respect to our recommendation on vulnerability self-assessments, DOD’s  expectation that installation personnel and asset owners have the  expertise and resources to apply standards and criteria that mirror what  DTRA is using to perform its DCIP vulnerability assessments may be  unrealistic. We believe that DOD’s earlier approach of preparing a self- assessment handbook tailored to meet a range of installation and asset  requirements and capabilities will likely result in more and higher-quality  self-assessments. DOD also agreed with our recommendation to identify  and prioritize non-DOD-owned domestic infrastructure for DHS to  consider including among its assessments of the nation’s critical  infrastructure. We expect that this action will increase DOD’s awareness  of vulnerabilities associated with infrastructure that it relies on but does  not control.
As agreed with your offices, we are sending copies of this report to the  Chairman and Ranking Member of the Senate and House Committees on  Appropriations, Senate and House Committees on Armed Services, and  other interested congressional parties. We also are sending copies of this  report to the Secretary of Defense; the Secretary of Homeland Security;  the Director, Office of Management and Budget; and the Chairman of the  Joint Chiefs of Staff. We will also make copies available to others upon  request. In addition, this report will be available at no charge on the GAO  Web site at http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact me at (202) 512-5431 or by e-mail at dagostinod@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. GAO staff who made major  contributions to this report are listed in appendix III.
section_title: Appendix I: Scope and Methodology
paragraphs: To conduct our review of the Department of Defense’s (DOD) Defense  Critical Infrastructure Program (DCIP), we obtained relevant  documentation and interviewed officials from the following DOD  organizations:    Office of the Secretary of Defense    Under Secretary of Defense for Personnel and Readiness,    Under Secretary of Defense for Acquisition, Technology, and  Logistics, Office of the Deputy Under Secretary of Defense for  Industrial Policy;    Under Secretary of Defense for Intelligence, Counterintelligence &  Security, Physical Security Programs;    DOD Counterintelligence Field Activity, Critical Infrastructure  Protection Program Management Directorate;    Under Secretary of Defense (Comptroller)/Chief Financial Officer;    Deputy Under Secretary of Defense for Installations and  Environment, Business Enterprise Integration Directorate;    Assistant Secretary of Defense for Homeland Defense and  Americas’ Security Affairs (ASD), Critical Infrastructure  Protection Office;    Assistant Secretary of Defense for Special Operations and Low- Intensity Conflict and Interdependent Capabilities, Antiterrorism  Policy;    Assistant Secretary of Defense for International Security Policy,  Deputy Assistant Secretary of Defense for Forces Policy, Office of  Space Policy;    Assistant Secretary of Defense for Health Affairs, Force Health  Protection & Readiness; and    Assistant Secretary of Defense for Networks and Information  Integration, Information Management & Technology Directorate;    Joint Staff, Directorate for Operations, Antiterrorism and Homeland    Defense Threat Reduction Agency (DTRA), Combat Support    Department of the Army, Asymmetric Warfare Office, Critical  Infrastructure Risk Management Branch;    Office of the Chief Information Officer;    Mission Assurance Division, Naval Surface Warfare Center,  Dahlgren Division, Dahlgren, Virginia;    Department of the Air Force, Air, Space and Information  Operations, Plans, and Requirements, Homeland Defense Division;  and    Headquarters, U.S. Marine Corps, Security Division, Critical    Headquarters, U.S. Central Command, Defense Critical  Infrastructure Program Office, MacDill Air Force Base, Florida;    Headquarters, U.S. European Command, Critical Infrastructure  Protection Program Office, Patch Barracks, Germany;    Headquarters, U.S. Joint Forces Command, Critical Infrastructure  Protection Office, Norfolk, Virginia;    Headquarters, U.S. Northern Command, Force Protection/Mission  Assurance Division, Peterson Air Force Base, Colorado;    Headquarters, U.S. Pacific Command, Critical Infrastructure  Protection Plans & Policy Office, Camp H.M. Smith, Hawaii;    Headquarters, U.S. Southern Command, Joint Operations Support  Division, Miami, Florida;    Headquarters, U.S. Special Operations Command, Mission  Assurance Division, MacDill Air Force Base, Florida;    Headquarters, U.S. Strategic Command, Mission Assurance  Division, Offutt Air Force Base, Nebraska; and    Headquarters, U.S. Transportation Command, Critical  Infrastructure Program, Scott Air Force Base, Illinois;    Headquarters, Defense Intelligence Agency, Office for Critical  Infrastructure Protection & Homeland Security/Defense;    Headquarters, Defense Information Systems Agency, Critical    Headquarters, Defense Finance and Accounting Service, Critical  Infrastructure Protection Program Office, Indianapolis, Indiana;    Headquarters, Defense Logistics Agency, Logistics Sector Critical    Headquarters, U.S. Army Corps of Engineers, Directorate of Military    Under Secretary of Defense for Personnel and Readiness,    Assistant Secretary of Defense for Health Affairs, Directorate of  Force Health Protection & Readiness;    Headquarters, U.S. Transportation Command, Critical  Infrastructure Program, Operations Directorate, Scott Air Force  Base, Illinois; and    Headquarters, U.S. Strategic Command, Mission Assurance  Division, Offutt Air Force Base, Nebraska.
To evaluate the extent to which DOD has developed a comprehensive  management plan to implement DCIP, we reviewed and analyzed policies,  assurance plans, strategies, handbooks, directives, and instructions, and  met with officials from each of the military services, combatant commands  (COCOM) (hereafter referred to as “DOD components”), and the defense  sector lead agents, as well as the Joint Staff. We compared DOD’s current  approach to issuing guidance, stakeholder coordination, and resource  requirements to management control standards contained in the  Standards for Internal Control in the Federal Government. We also  attended the August 2006 DCIP tabletop exercise sponsored by the  Defense Intelligence Agency, and the October 2006 Homeland  Infrastructure Foundation Level Database Working Group meeting. We  met with representatives from ASD(HD&ASA), the Joint Staff, and several  offices within the Office of the Secretary of Defense assigned DCIP  responsibilities in DOD Directive 3020.40, Defense Critical Infrastructure  Protection (DCIP), as well as the Office of the Assistant Secretary of  Defense for Special Operations and Low-Intensity Conflict and  Interdependent Capabilities. Further, we met with officials from the  Department of Homeland Security’s (DHS) Office of Infrastructure  Protection to discuss mechanisms to coordinate and share critical  infrastructure information with DOD.
To determine DCIP funding levels for fiscal years 2004 through 2013, we  met with officials from ASD(HD&ASA) and each of the DOD components  and sector lead agents, and analyzed actual and projected funding data.  We also met with an official from the Office of the Under Secretary of  Defense (Comptroller)/Chief Financial Officer familiar with DCIP.  Additionally, we obtained information from the Joint Staff on funds  expended to remediate high-priority antiterrorism vulnerabilities to  illustrate the potential cost of critical infrastructure remediation. We found  the data provided by DOD to be sufficiently reliable for representing the  nature and extent of DCIP funding.
To evaluate the extent to which DOD has identified, prioritized, and  assessed its critical infrastructure, we met with officials and obtained  relevant documentation from each of the DOD components, sector lead  agents, ASD(HD&ASA), the Joint Staff, and the Mission Assurance  Division. We examined various data collection instruments and databases  DOD components and sector lead agents are using to catalog, track, and  map infrastructure, including the Mission Assurance Division’s database,  the Air Force’s Critical Asset Management System, the Health Affairs  defense sector’s Primary Health Assets Staging Tool, the Personnel  defense sector’s Characterization and Dependency Analysis Tool, and the  Space defense sector’s Strategic Mission Assurance Data System. We also  received a demonstration of DHS’s National Asset Database, which  catalogs the nation’s infrastructure. We did not verify the accuracy of  infrastructure provisionally identified as critical by the DOD components  and sector lead agents because the data is incomplete and, has not been  validated by the department. Further, we did not verify the interoperability  of these databases because it was outside the scope of our review. We met  with DTRA officials to obtain information on the scope, conduct, and  results of infrastructure vulnerability assessments. We also met with Air  Force officials to discuss their infrastructure risk assessments. We did not  evaluate the effectiveness of either the DTRA-led or Air Force assessments  as part of our review.
Finally, to become familiar with prior work relevant to defense critical  infrastructure, we met in Arlington, Virginia, with officials from the George  Mason University School of Law’s Critical Infrastructure Protection  Program and in Washington, D.C., with the Congressional Research  Service (Resources, Science, and Industry Division and Foreign Affairs,  Defense, and Trade Division).
We conducted our review from June 2006 through May 2007 in accordance  with generally accepted government auditing standards.
section_title: Appendix II: Comments from the Department of Defense
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: Mark A. Pross, Assistant Director; Burns D. Chamberlain; Alissa Czyz;  Michael Gilmore; Cody Goebel; James Krustapentus; Kate Lenane; Thomas  C. Murphy; Maria-Alaina Rambus; Terry Richardson; Jamie A. Roberts;  Marc Schwartz; and Tim Wilson made key contributions to this report.