Internet Infrastructure: DHS Faces Challenges in Developing a Joint Public/Private Recovery Plan
Published: 2006-06-16T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Since the early 1990s, growth in the use of the Internet has revolutionized the way that our nation communicates and conducts business. While the Internet was originally developed by the Department of Defense, the vast majority of its infrastructure is currently owned and operated by the private sector. Federal policy recognizes the need to prepare for debilitating Internet disruptions and tasks the Department of Homeland Security (DHS) with developing an integrated public/private plan for Internet recovery. GAO was asked to (1) identify examples of major disruptions to the Internet, (2) identify the primary laws and regulations governing recovery of the Internet in the event of a major disruption, (3) evaluate DHS plans for facilitating recovery from Internet disruptions, and (4) assess challenges to such efforts.
section_title: What GAO Found
paragraphs: A major disruption to the Internet could be caused by a cyber incident (such as a software malfunction or a malicious virus), a physical incident (such as a natural disaster or an attack that affects key facilities), or a combination of both cyber and physical incidents. Recent cyber and physical incidents have caused localized or regional disruptions but have not caused a catastrophic Internet failure. Federal laws and regulations addressing critical infrastructure protection, disaster recovery, and the telecommunications infrastructure provide broad guidance that applies to the Internet, but it is not clear how useful these authorities would be in helping to recover from a major Internet disruption. Specifically, key legislation on critical infrastructure protection does not address roles and responsibilities in the event of an Internet disruption. Other laws and regulations governing disaster response and emergency communications have never been used for Internet recovery. DHS has begun a variety of initiatives to fulfill its responsibility for developing an integrated public/private plan for Internet recovery, but these efforts are not complete or comprehensive. Specifically, DHS has developed high-level plans for infrastructure protection and incident response, but the components of these plans that address the Internet infrastructure are not complete. In addition, the department has started a variety of initiatives to improve the nation's ability to recover from Internet disruptions, including working groups to facilitate coordination and exercises in which government and private industry practice responding to cyber events. However, progress to date on these initiatives has been limited, and other initiatives lack time frames for completion. Also, the relationships among these initiatives are not evident. As a result, the government is not yet adequately prepared to effectively coordinate public/private plans for recovering from a major Internet disruption. Key challenges to establishing a plan for recovering from Internet disruptions include (1) innate characteristics of the Internet (such as the diffuse control of the many networks making up the Internet and private sector ownership of core components) that make planning for and responding to disruptions difficult, (2) a lack of consensus on DHS's role and when the department should get involved in responding to a disruption, (3) legal issues affecting DHS's ability to provide assistance to restore Internet service, (4) reluctance of many in the private sector to share information on Internet disruptions with DHS, and (5) leadership and organizational uncertainties within DHS. Until these challenges are addressed, DHS will have difficulty achieving results in its role as a focal point for helping to recover the Internet from a major disruption.

section_title: Letter
paragraphs: Since the early 1990s, increasing computer interconnectivity—most  notably growth in the use of the Internet—has revolutionized the way that  our government, our nation, and much of the world communicate and  conduct business. Our country has come to rely on the Internet as a critical  infrastructure supporting commerce, education, and communication.  While the benefits of this technology have been enormous, this widespread  interconnectivity poses significant risks to the government’s and our  nation’s computer systems and, more importantly, to the critical operations  and infrastructures they support.
Federal regulation establishes the Department of Homeland Security  (DHS) as the focal point for the security of cyberspace—including analysis,  warning, information sharing, vulnerability reduction, mitigation, and  recovery efforts for public and private critical infrastructure systems. To  accomplish this mission, DHS is to work with federal agencies, state and  local governments, and the private sector. Federal policy also recognizes  the need to be prepared for the possibility of debilitating disruptions in  cyberspace and, because the vast majority of the Internet infrastructure is  owned and operated by the private sector, tasks DHS with developing an  integrated public/private plan for Internet recovery. Last year, we reported  on DHS efforts to fulfill its cybersecurity responsibilities and noted that the  department had not developed key cybersecurity recovery  plans—including a plan for recovering key Internet functions.
Because of your interest in DHS’s efforts to develop a joint plan for  recovering the Internet in case of a major disruption, you asked that we (1)  identify examples of major disruptions to the Internet, (2) identify the  primary laws and regulations governing recovery of the Internet in the  event of a major disruption, (3) evaluate DHS’s plans for facilitating  recovery from Internet disruptions, and (4) assess challenges to such  efforts.
To accomplish these objectives, we assessed documentation of disruptions  to the Internet and compiled case studies of incidents that have affected  the Internet. We also reviewed relevant laws and regulations related to  critical infrastructure protection, disaster response, and the  telecommunications infrastructure. We assessed DHS progress and plans  for handling Internet disruptions. In order to identify challenges to  effective Internet recovery planning, we also interviewed officials from  DHS, other federal agencies, and representatives of the private sector who  have a role in operating the Internet infrastructure. Appendix I provides  additional details on our objectives, scope, and methodology. We  performed our work from August 2005 to May 2006 in accordance with  generally accepted government auditing standards.
subsections: section_title: Background
subsections: section_title: The Internet: An Overview
paragraphs: The Internet is a vast network of interconnected networks. It is used by  governments, businesses, research institutions, and individuals around the  world to communicate, engage in commerce, do research, educate, and  entertain. While most Americans are familiar with Internet service  providers—such as America Online and EarthLink—that provide  consumers with a pathway, or “on-ramp,” to the Internet, many are less  familiar with how the Internet was developed, the underlying structure of  the Internet, and how it works.
In the late 1960s and the 1970s, the Department of Defense’s Advanced  Research Projects Agency developed a network to allow multiple  universities to communicate and share computing resources. In the  ensuing decades, this project grew to become a large network of networks  and was joined with an array of scientific and academic computers funded  by the National Science Foundation. This expanded network provided the  backbone infrastructure of today’s Internet. In 1995, the federal  government began to turn the backbone of the Internet over to a  consortium of commercial backbone providers. From that point on, the  Internet infrastructure was owned and operated by private  companies—including telecommunications companies, cable companies,  and  Internet service providers.
Today’s Internet connects millions of small, medium, and large networks.  When an Internet user wants to access a Web site or to send an e-mail to  someone who is connected to the Internet through a different Internet  service provider, the data must be transferred between networks. Transit  across the Internet is provided by either national backbone providers,  regional network operators, or a combination of both. National backbone  providers are companies that own and operate high-capacity, long-haul  backbone networks. These providers transmit data traffic over long  distances using high-speed, fiber-optic lines. Because national backbone  operators do not service all locations worldwide, regional network  providers supplement the long-haul traffic by providing regional service.  Data cross between networks at Internet exchange points—which can be  either hub points where multiple networks exchange data or private  interconnection points arranged by transit providers. At these exchange  points, computer systems called routers determine the optimal path for the  data to reach their destination. The data then continue their path through  the national and regional networks and exchange points, as necessary, to  reach the recipient’s Internet service provider and the recipient (see fig. 1).
The networks that make up the Internet communicate via standardized  rules called protocols. These rules can be considered voluntary because  there is no formal institutional or governmental mechanism for enforcing  them. However, if any computer deviates from accepted standards, it risks  losing the ability to communicate with other computers that follow the  standards. Thus, the rules are essentially self enforcing. One critical set of  rules is the Transmission Control Protocol/Internet Protocol suite. These  protocols define a detailed process that a sender and receiver agree upon  for exchanging data. They describe the flow of data between the physical  connection to the network and on to the end-user application. Specifically,  these protocols control the addressing of a message by the sender, its  division into packets, its transmission across networks, and its reassembly  and verification by the receiver. This protocol suite has become the de  facto communication standard of the Internet because many standard  services (including mail transfer, news, and Web pages) are available on  systems that support these protocols.
Another critical set of protocols, collectively known as the Domain Name  System, ensures the uniqueness of each e-mail and Web site address. This  system links names like www.senate.gov with the underlying numerical  addresses that computers use to communicate with each other. It  translates names into addresses and back again in a process invisible to the  end user. This process relies on a system of servers, called domain name  servers, which store data linking names with numbers. Each domain name  server stores a limited set of names and numbers. They are linked by a  series of 13 root servers, which coordinate the data and allow users to find  the server that identifies the sites they want to reach. Domain name servers  are organized into a hierarchy that parallels the organization of the domain  names. For example, when someone wants to reach the Web site at  www.senate.gov, his or her computer will ask one of the root servers for  help. The root server will direct the query to a second server that knows  the location of names ending in the .gov top-level domain. If the address  includes a subdomain, the second server refers the query to a third  server—in this case, one that knows the addresses for all names ending in  senate.gov. The third server will then respond to the request with a  numerical address, which the original requester uses to establish a direct  connection with the www.senate.gov site. Figure 2 illustrates this example.
Another critical set of rules is called the Border Gateway Protocol—a  protocol for routing packets between autonomous systems. This protocol  is used by routers located at network nodes to direct traffic across the  Internet. Typically, routers that use this protocol maintain a routing table  that lists all feasible paths to a particular network. They also determine  metrics associated with each path (such as cost, stability, and speed), so  that the best available path can be chosen. This protocol is important  because if a certain path becomes unavailable, the system will send data  over the next best path (see fig. 3).
section_title: The Internet Is a Critical Information Infrastructure
paragraphs: From its origins in the 1960s as a research project sponsored by the U.S.  government, the Internet has grown increasingly important to both  American and foreign businesses and consumers, serving as the medium  for hundreds of billions of dollars of commerce each year. According to the  U.S. Census Bureau, retail e-commerce sales in the United States were an  estimated $86 billion in 2005. The Internet has also become an extended  information and communications infrastructure, supporting vital services  such as power distribution, health care, law enforcement, and national  defense.
Federal regulation recognizes the need to protect critical infrastructures. In  December 2003, the President updated a national directive for federal  departments and agencies to identify and prioritize critical infrastructure  sectors and key resources and to protect them from terrorist attack. (See table 1 for a list of critical infrastructure sectors.) This directive  recognized that since a large portion of these critical infrastructures is  owned and operated by the private sector, a public/private partnership is  crucial for the successful protection of these critical infrastructures.
In its plan for protecting these critical infrastructures, DHS recognizes that  the Internet is a key resource composed of assets within both the  information technology and the telecommunications sectors. It notes that  the Internet is used by all sectors to varying degrees, and that it provides  information and communications to meet the needs of businesses,  government, and the other critical infrastructure sectors. Similarly, the  national cyberspace strategy states that cyberspace is the nervous system  supporting our nation’s critical infrastructures and recognizes the Internet  as the core of our information infrastructure.
It is also important to note that there are critical interdependencies  between sectors. For example, the telecommunications and information  technology sectors, like many other sectors, depend heavily on the energy  sector.
section_title: Attacks on the Information Infrastructure Are Increasing
paragraphs: In recent years, cyber attacks involving malicious software or hacking have  been increasing in frequency and complexity. These attacks can come from  a variety of actors. Table 2 lists sources of cyber threats that have been  identified by the U.S. intelligence community.
An intelligence report on global trends forecast that terrorists may  develop capabilities to conduct both cyber and physical attacks against  nodes of the world’s information infrastructure—including the Internet and  other systems that control critical industrial processes—such as electricity  grids, refineries, and flood control mechanisms. The report stated that  terrorists already have specified the U.S. information infrastructure as a  target and currently are capable of physical attacks that would cause at  least brief, isolated disruptions.
According to a Congressional Research Service report, the annual  worldwide cost of major cyber attacks was, on average, $13.5 billion from  2000 to 2003. A more recently published report estimated that the  worldwide financial impact of virus attacks was $17.5 billion in 2004 and  $14.2 billion in 2005.
section_title: Multiple Organizations Could Help in Recovering the Internet from a Major Disruption
paragraphs: In the event of a major Internet disruption, multiple organizations could  help recover Internet service. These organizations include private industry,  collaborative groups, and government organizations. Private industry is  central to Internet recovery because private companies own the vast  majority of the Internet’s infrastructure and often have response plans.  Collaborative groups—including working groups and industry  councils—provide information-sharing mechanisms to allow private  organizations to restore services. Additionally, government initiatives could  facilitate responding to major Internet disruptions.
subsections: section_title: Private Industry
paragraphs: Private industry organizations are critical to recovering Internet services in  the event of a major disruption because they own and operate the vast  majority of the Internet’s infrastructure. This group of Internet  infrastructure owners and operators includes telecommunications  companies (such as AT&T and Verizon Communications), cable companies  (such as Cox Communications and Time Warner Cable), Internet service  providers (such as AOL and EarthLink), and root server operators (such as  VeriSign and the University of Maryland). These entities own or operate  cable lines; telephone lines; fiber-optic cables; or critical core systems,  such as network routers and domain name servers.
These private companies currently deal with cyber attacks and physical  disruptions on the Internet on a regular basis. According to representatives  of Internet infrastructure owners and operators, these firms typically have  disaster recovery plans in place. For example, a representative from a  major telecommunications company stated that the company has  emergency response plans for its primary and secondary emergency  operations centers. Similarly, representatives of a cable trade association  reported that most cable companies have standard disaster recovery plans  and a network operations center from which they can monitor recovery  operations.
Infrastructure representatives also noted that in the event of a network  disruption, companies that are competitors work together to resolve the  disruption. They said that although the companies are competitors, they  have a business interest in cooperating because it is common to rely on  each other’s networks. For example, a representative of a major  telecommunications company noted that the company has “mutual-aid”  agreements with its competitors to exchange technicians and hardware in  the event of an emergency.
section_title: Collaborative Groups
paragraphs: Collaborative groups—working groups and industry councils that the  private and public sectors have established to allow technical information  sharing—help handle and recover from Internet disruptions. These  collaborative groups are usually composed of individuals and experts from  separate organizations. In the event of a major Internet disruption, these  groups allow individuals from different companies to exchange  information in order to assess the scope of the disruption and to restore  services. Table 3 provides descriptions of selected collaborative groups.
section_title: Government Organizations—DHS
paragraphs: Federal policies and plans assign DHS lead responsibility for facilitating a  public/private response to and recovery from major Internet disruptions.  Within DHS, responsibilities reside in two divisions within the  Preparedness Directorate: the National Cyber Security Division (NCSD)  and the National Communications System (NCS). NCSD operates the U.S.  Computer Emergency Readiness Team (US-CERT), which coordinates  defense against and response to cyber attacks. The other division, NCS,  provides programs and services that ensure the resilience of the  telecommunications infrastructure in times of crisis.
In June 2003, DHS created NCSD to serve as a national focal point for  addressing cybersecurity issues and to coordinate the implementation of  the National Strategy to Secure Cyberspace. Its mission is to secure  cyberspace and America’s cyber assets in cooperation with public, private,  and international entities.
NCSD is the government lead on a public/private partnership supporting  the US-CERT, an operational organization responsible for analyzing and  addressing cyber threats and vulnerabilities and disseminating cyber-threat  warning information. In the event of an Internet disruption, US-CERT  facilitates coordination of recovery activities with the network and security  operations centers of owners and operators of the Internet and with  government incident response teams.
NCSD also serves as the lead for the federal government’s cyber incident  response through the National Cyber Response Coordination Group. This  group is the principal federal interagency mechanism for coordinating the  preparation for, and response to, significant cyber incidents—such as a  major Internet disruption. In the event of a major disruption, the group  convenes to facilitate intragovernmental and public/private preparedness  and operations. The group brings together officials from national security,  law enforcement, defense, intelligence, and other government agencies  that maintain significant cybersecurity responsibilities and capabilities.  Members use their established relationships with the private sector and  with state and local governments to help coordinate and share situational  awareness, manage a cyber crisis, develop courses of action, and devise  response and recovery strategies.
NCSD also recently formed the Internet Disruption Working Group, which  is a partnership between NCSD, NCS, the Department of the Treasury, the  Department of Defense, and private-sector companies, to plan for ways to  improve DHS’s ability to respond to and recover from major Internet  disruptions. The goals of the working group are to identify and prioritize  the short-term protective measures necessary to prevent major disruptions  to the Internet or reduce their consequences and to identify reconstitution  measures in the event of a major disruption.
NCS is responsible for ensuring a communications infrastructure for the  federal government under all conditions—ranging from normal situations  to national emergencies and international crises. NCS is composed of  members from 23 federal departments and agencies. Although originally  focused on traditional telephone service, due to the convergence of the  Internet and telecommunications NCS has taken a larger role in  Internet-related issues and has partnered with NCSD and private  companies to address issues related to major Internet disruptions. For  example, NCS now helps manage issues related to disruptions of the  Internet backbone (e.g., high-capacity data routes).
The National Coordinating Center for Telecommunications (National  Coordinating Center), which serves as the operational component of NCS,  also has a role in Internet recovery. The center has eight resident industry  members (representing companies that were originally telephone  providers) as well as additional nonresident members, including  representatives of newer, more Internet-oriented companies. During a  major disruption to telecommunications services, the center  communicates with both resident and nonresident members, with the goal  of restoring service as soon as possible. In the event of a major Internet  disruption, the National Coordinating Center plays a role in the recovery  effort through its partnerships and collaboration with telecommunications  and Internet-related companies.
subsections: section_title: Government Organizations—Federal Communications Commission
paragraphs: The Federal Communications Commission can support Internet recovery  by coordinating resources for restoring the basic communications  infrastructures over which Internet services run. For example, after  Hurricane Katrina, the commission granted temporary authority for private  companies to set up wireless Internet communications supporting various  relief groups; federal, state, and local government agencies; businesses;  and victims in the disaster areas.
The commission also sponsors the Network Reliability and Interoperability  Council. A primary goal of the council is to prevent Internet disruptions  from occurring in the first place. The council has developed a list of best  practices for Internet disaster recovery that provides guidance on strategic  issues (such as exercising disaster recovery plans) as well as operational  issues (such as how to restore a corrupt domain name server).
section_title: Prior Evaluations of DHS’s Cybersecurity Responsibilities Have Highlighted Issues and Challenges Facing the Department
paragraphs: In May 2005, we issued a report on DHS’s efforts to fulfill its cybersecurity  responsibilities. We noted that while DHS had initiated multiple efforts to  fulfill its responsibilities, it had not fully addressed any of the 13 key  cybersecurity responsibilities (see table 4) noted in federal law and policy.  For example, we noted that the department established US-CERT as a  public/private partnership to make cybersecurity a coordinated national  effort, and it established forums to build greater trust and information  sharing among federal officials with information security responsibilities  and with law enforcement entities. However, DHS had not yet developed  national cyber threat and vulnerability assessment or government/industry  cybersecurity recovery plans—including a plan for recovering key Internet  functions.
We also noted in our May 2005 report that DHS faced a number of  challenges that have impeded its ability to fulfill its cyber responsibilities.  These challenges included achieving organizational stability, gaining  organizational authority, overcoming hiring and contracting issues,  increasing awareness of cybersecurity roles and capabilities, establishing  effective partnerships with stakeholders, achieving two-way information  sharing with stakeholders, and demonstrating the value that DHS can  provide. We made recommendations to the department to strengthen its  ability to implement key responsibilities by completing critical activities  and resolving underlying challenges. DHS agreed that strengthening  cybersecurity is central to protecting the nation’s critical infrastructures  and that much remained to be done, but it has not yet addressed our  recommendations. We continue to evaluate DHS’s progress in  implementing our recommendations.
section_title: Although Both Cyber and Physical Incidents Have Caused Disruptions, the Internet Has Not Yet Suffered a Catastrophic Failure
paragraphs: The Internet’s infrastructure is vulnerable to disruptions in service due to  terrorist and other malicious attacks, natural disasters, accidents,  technological problems, or a combination of the above. Disruptions to  Internet service can be caused by cyber and physical incidents—both  intentional and unintentional. Private network operators routinely deal  with Internet disruptions of both types. Recent cyber and physical  incidents have caused localized or regional disruptions, highlighting the  importance of recovery planning. However, these incidents have also  shown the Internet as a whole to be flexible and resilient. Even in severe  circumstances, the Internet has not yet suffered a catastrophic failure.
subsections: section_title: Internet Disruptions Have Been Caused by Both Cyber and Physical Incidents
paragraphs: The Internet can be disrupted by either cyber or physical incidents, or by a  combination of the two. These incidents can be intentional (such as a cyber  attack or a terrorist attack on our nation’s physical infrastructure) or  unintentional (such as a software malfunction or a natural disaster). Table  5 provides examples of intentional and unintentional cyber and physical  incidents.
A cyber incident could cause a disruption if it affects a network protocol or  an application that is integral to the working of the Internet. A cyber  incident could be unintended (such as a software problem) or intended  (such as an attack using malicious software or hacking that causes a  disruption of service). Unintended incidents have caused significant  disruptions in the past. For example, in 1998, a major Internet backbone  provider had a massive outage due to a software flaw in the infrastructure  that caused systems to crash; in 2002, a different provider had an outage  due to a router with a faulty configuration.
Intentional incidents, or malicious attacks, have been increasing in  frequency and complexity and recently have been linked to organized  crime. Examples of malicious attacks include viruses and worms. Viruses  and worms are often used to launch denial-of-service attacks, which flood  targeted networks and systems with so much data that regular traffic is  either slowed or stopped. Such attacks have been used ever since the  groundbreaking Morris worm in November 1988, which brought 10 percent  of the systems connected to the Internet to a halt. More recently, in 2001,  the Code Red worm used a denial-of-service attack to affect millions of  computer users by shutting down Web sites, slowing Internet service, and  disrupting business and government operations.
Cyber attacks can also cause Internet disruptions by targeting specific  protocols, such as the Border Gateway Protocol or the Domain Name  System. If a vulnerability in the Border Gateway Protocol was exploited,  the ability of Internet traffic to reach its destination could be limited or  halted. Some experts believe that it could take weeks to recover from a  major attack on the Border Gateway Protocol. The Domain Name System is  also susceptible to various attacks, including the corruption of stored  domain name information and the misdirection of addresses. Recently,  hackers have used domain name servers to launch denial-of-service  attacks—thereby amplifying the strength of the attacks. A network security  expert stated that there have been numerous attacks of this type recently,  and that some attacks have targeted top-level domains and Internet  service providers. Attacks against top-level domain servers could disrupt  users’ capability to connect to various Internet addresses. It could take  several days to recover from a massive disruption of the domain name  server system.
As the number of individuals with computer skills has increased, more  intrusion, or hacking, tools have become readily available and relatively  easy to use. Frequently, skilled hackers develop exploitation tools and post  them on Internet hacking sites. These tools are then readily available for  others to download, allowing even inexperienced programmers to create a  computer virus or to literally point and click to launch an attack. According  to the National Institute of Standards and Technology, 30 to 40 new attack  tools are posted on the Internet every month. Experts also agree that there  has been a steady advance in the sophistication and effectiveness of attack  technology.
In the case of insider incidents, these tools may not even be necessary,  because insiders often have unfettered access to their employers’ computer  systems. In one incident, an insider installed unauthorized backdoor access  to his employer’s systems. After his termination, the insider used these  back doors to gain access to the systems and to delete accounts, change  passwords, and delete security logs. While this is a case of an insider  disrupting a single network, an insider could also use this knowledge to  disrupt the operation of an Internet service provider. For example, an  insider at a company that develops critical routing hardware might be able  to use specific technical knowledge of the products to create an attack that  could disrupt networks that use that particular equipment.
To date, cyber attacks have caused various degrees of damage. The  following case studies provide examples of cyber attacks; the effects of  these attacks; and the government’s role, if any, in recovery (see figs. 4 and  5).
A physical incident could be caused by an intentional attack, a natural  disaster, or an accident. For example, terrorist attacks, storms,  earthquakes, and unintentional cutting of cables can all cause physical  disruptions. Physical incidents causing Internet and telecommunications  disruptions occur regularly—often as a result of the accidental cutting of  cable lines. Physical incidents could affect various aspects of the Internet  infrastructure, including underground or undersea cables and facilities that  house telecommunications equipment, Internet exchange points, or  Internet service providers. Such incidents could also disrupt the power  infrastructure—leading to an extended power outage and thereby  disrupting telecommunications and Internet service. The following case  studies provide examples of physical incidents that caused Internet  disruptions and the effect of these incidents (see figs. 6 to 8).
section_title: The Internet Has Not Yet Experienced a Catastrophic Disruption
paragraphs: Since its inception, the Internet has experienced disruptions of varying  scale—from fast-spreading worms, to denial-of-service attacks, to physical  destruction of key infrastructure components. However, the Internet has  yet to experience a catastrophic disruption. Experts agree—and case  studies show—that the Internet is resilient and flexible enough to handle  and recover from many types of disruptions. While specific regions may  experience Internet disruptions, backup servers and the ability to reroute  traffic limit the effect of many targeted attacks. These efforts highlight the  importance of recovery planning.
However, it is possible that a complex attack or set of attacks could cause  the Internet to fail. It is also possible that a series of attacks against the  Internet could undermine users’ trust—and thereby reduce the Internet’s  utility.
section_title: Existing Laws and Regulations Apply to the Internet, but Numerous Uncertainties Exist in Using Them for Internet Recovery
paragraphs: Several federal laws and regulations provide broad guidance that applies to  the Internet infrastructure, but it is not clear how useful these authorities  would be in helping to recover from a major Internet disruption, because  some do not specifically address Internet recovery and others have seldom  been used. Pertinent laws and regulations address critical infrastructure  protection, federal disaster response, and the telecommunications  infrastructure (see app. II for additional details).
Specifically, the Homeland Security Act of 2002 and Homeland Security  Presidential Directive 7 establish critical infrastructure protection as a  national goal and describe a strategy for cooperative efforts by the  government and the private-sector to protect the cyber- and physical-based  systems that are essential to the operations of both the economy and the  government. These authorities apply to the Internet because it is a core  communications infrastructure supporting the information technology and  telecommunications sectors. However, this law and regulation do not  specifically address roles and responsibilities in the event of an Internet  disruption.
Regarding federal disaster response, the Defense Production Act and the  Stafford Act provide authority to federal agencies to plan for and respond  to incidents of national significance—like disasters and terrorist attacks.  Specifically, the Defense Production Act authorizes the President to ensure  the timely availability of products, materials, and services needed to meet  the requirements of a national emergency. The act is applicable to critical  infrastructure protection and restoration, but it has never been used for  Internet recovery. The Stafford Act authorizes federal assistance to states,  local governments, nonprofit entities, and individuals in the event of a  major disaster or emergency. However, the act does not authorize  assistance to for-profit companies—such as those that own and operate  core Internet components. Several representatives of private companies  reported that they were unable to obtain needed resources to restore the  communications infrastructure in the aftermath of Hurricane Katrina  because the act does not extend to for-profit companies.
Other legislation and regulations, including the Communications Act of  1934 and the National Communications System (NCS) authorities,  govern the telecommunications infrastructure and help ensure  communications during national emergencies. The act governs the  regulation of the telecommunications infrastructure upon which the  Internet depends. However, coverage of the Internet is subsumed in  provisions that govern interstate wire and radio communications, and there  is no specific provision governing Internet recovery. NCS authorities  establish guidance for operationally coordinating with industry to protect  and restore key national security and emergency preparedness  communications services. These authorities grant the President certain  emergency powers regarding telecommunications, including the authority  to require any carrier subject to the Communications Act of 1934 to grant  preference or priority to essential communications. The President may  also, in the event of war or national emergency, suspend regulations  governing wire and radio transmissions and authorize the use or control of  any such facility or station and its apparatus and equipment by any  department of the government. Although these authorities remain in force  and are implemented in the Code of Federal Regulations, they have been  seldom used—and never for Internet recovery. Thus, it is not clear how  effective they would be if used for this purpose. “The Internet infrastructure is owned and operated by the private sector. Although certain  policies direct DHS to work with the private sector to ensure infrastructure protection, DHS  does not have the authority to direct Internet owners and operators in their recovery  efforts.”
section_title: DHS Initiatives Supporting Internet Recovery Planning Are under Way, but Much Remains to Be Done and the Relationships among Initiatives Are Not Evident
paragraphs: DHS has begun a variety of initiatives to fulfill its responsibility for  developing an integrated public/private plan for Internet recovery, but  these efforts are not complete or comprehensive. Specifically, DHS has  developed high-level plans for infrastructure protection and national  disaster response, but the components of these plans that address the  Internet infrastructure are not complete. In addition, DHS has started a  variety of initiatives to improve the nation’s ability to recover from Internet  disruptions, including working groups to facilitate coordination and  exercises in which government and private industry practice responding to  cyber events. While these activities are promising, some initiatives are not  complete, others lack time lines and priorities, and still others lack  effective mechanisms for incorporating lessons learned. In addition, the  relationships among these initiatives are not evident. As a result, the nation  is not prepared to effectively coordinate public/private plans for recovering  from a major Internet disruption.
subsections: section_title: DHS Has Developed High-level Protection and Response Plans, but Key Components Are Not Complete
paragraphs: Federal policy establishes DHS as the central coordinator for cyberspace  security efforts and tasks the department with developing an integrated  public/private plan for Internet recovery. DHS has two key documents  that guide its infrastructure protection and recovery efforts, but  components of these plans dealing with Internet recovery are not  complete.
The National Response Plan is DHS’s overarching framework for  responding to domestic incidents. The plan, which was released in  December 2004, contains the following two components that address  issues related to telecommunications and the Internet:    The Emergency Support Function 2 of the plan identifies federal actions  to provide temporary emergency telecommunications during a  significant incident and to restore telecommunications after the  incident. It assigns roles and responsibilities to different federal  agencies; provides guidelines for incident response; and identifies  actions to take before, during, and after the incident. Because the  Internet is supported by the telecommunications infrastructure, this  section of the plan could help with Internet recovery efforts.
The Cyber Incident Annex identifies policies and organizational  responsibilities for preparing for, responding to, and recovering from  cyber-related incidents impacting critical national processes and the  national economy. The annex recognizes the National Cyber Response  Coordination Group as the principal federal interagency mechanism to  coordinate the government’s preparation for, response to, and recovery  from a major Internet disruption or significant cyber incident.
These components, however, are not complete in that the Emergency  Support Function 2 does not directly address Internet recovery, and the  Cyber Incident Annex does not reflect the National Cyber Response  Coordination Group’s current operating procedures. DHS officials  acknowledged that both Emergency Support Function 2 and the Cyber  Incident Annex need to be revised to reflect the maturing capabilities of the  National Cyber Response Coordination Group, the planned organizational  changes affecting NCS and NCSD, and the convergence of voice and  Internet networks. However, DHS has not reached consensus on the best  approach for revising these components, and it has not established a  schedule for revising the overall plan.
The Draft National Infrastructure Protection Plan consists of both a base  plan and sector-specific plans, but these have not been finalized. A January  2006 draft of the base plan identifies roles, responsibilities, and a high-level  strategy for infrastructure protection across all sectors. It emphasizes the  need to protect and recover the cyber infrastructure, including the Internet.  Additionally, the sector plans are expected to apply the strategies identified  in the base plan to the infrastructure sectors. For example, the information  technology sector plan identifies relationships within the information  technology sector and with other infrastructure sectors. It also identifies  preliminary steps for infrastructure protection, such as identifying key  assets and the consequences of the failure of those assets.
DHS is planning to finalize its base plan in 2006, but it has not yet set a date  for doing so. Once this plan is released, it will lead to the development of  the more detailed sector-specific plans. The next versions of the  information technology and telecommunications sector plans are due to  DHS within 180 days of the release of the final base plan.
While DHS’s intentions to revise these plans are necessary steps in the right  direction, the plans do not fulfill the department’s responsibility to develop  an integrated public/private plan for Internet recovery. Several  representatives of private-sector firms supporting the Internet  infrastructure expressed concerns about both plans, noting that the plans  would be difficult to execute in times of crisis. Other representatives were  uneasy about the government developing recovery plans, because they  were not confident in the government’s ability to successfully execute the  plans. DHS officials acknowledged that it will be important to obtain input  from private-sector organizations as they refine these plans and initiate  more detailed public/private planning.
Until both the National Response Plan and the National Infrastructure  Protection Plan are updated and more detailed public/private planning  begins, DHS lacks the integrated approach to Internet recovery called for in  the cyberspace strategy and risks not being prepared to effectively  coordinate such a recovery.
section_title: Other DHS Initiatives Related to Internet Recovery Planning Are under Way, but They Are Incomplete and the Relationships among the Initiatives Are Not Evident
paragraphs: While the National Response Plan outlines an overall framework for  incident response, it is designed to be supplemented by more specific plans  and activities. DHS has numerous initiatives under way to better define its  ability to assist in responding to major Internet disruptions. These  initiatives include task forces, working groups, and exercises. While these  activities are promising, some initiatives are incomplete, others still lack  time lines and priorities, and others lack an effective mechanism for  incorporating lessons learned. In addition, the relationships and  interdependencies among different initiatives are not evident.
As a result, tangible progress toward improving the government’s ability to  help recover from a major Internet disruption has been limited.
subsections: section_title: DHS Plans to Revise the Role and Mission of the National Communications System, but This Effort Is Not Yet Complete
paragraphs: DHS plans to revise the role and mission of the National Communications  System (NCS) to reflect the convergence of voice and data  communications, but this effort is not yet complete. NCS is responsible for  ensuring the availability of a viable national security and emergency  preparedness communications infrastructure. Originally focused on  traditional telephone service, NCS has recently taken on a larger role in  Internet-related issues due to the convergence of the infrastructures that  serve traditional telephone traffic and those that serve data (such as  Internet traffic). A presidential advisory committee on  telecommunications has established two task forces to recommend  changes to NCS’s role, mission, and functions to reflect this convergence.  One task force focused on changes due to next-generation network  technologies, while the other focused on revising the role and mission of  NCS’s National Communications Center. Appendix III provides additional  details on the two task forces.
Both task forces have made recommendations to improve NCS’s  operations, but DHS has not yet developed plans to address these  recommendations. Until NCS completes efforts to revise its role and  mission, the group is at risk of not being prepared to address the unique  issues that could be caused by future Internet disruptions.
section_title: National Cyber Response Coordination Group Is Defining Its Roles and Responsibilities, but Much Remains to Be Done
paragraphs: As a primary entity responsible for coordinating governmentwide  responses to cyber incidents—such as major Internet disruptions—DHS’s  National Cyber Response Coordination Group is working to define its roles  and responsibilities, but much remains to be done. The group reported that  it has begun efforts to define its roles, responsibilities, capabilities, and  activities. For example, the group has developed a concept of  operations—which includes a high-level recovery function—but is waiting  for the results of additional analyses before revising and enhancing the  concept of operations. The group also drafted operating procedures that it  used during a national cyber exercise in February 2006, and it plans to  incorporate lessons learned from the exercise into the operating  procedures and to issue revised procedures by June 2006. The group also  reported that it has made progress on initiatives to (1) map the current  capabilities of government agencies to detect, respond to, and recover from  cyber incidents; (2) identify secure communications capabilities within the  government that can be used to respond to cyber incidents; (3) perform a  gap analysis of different agencies’ capabilities for responding to cyber  incidents; and (4) establish formal resource-sharing agreements with other  federal agencies as well as state and local governments. However, much  remains to be done to complete these initiatives.
One challenge facing the National Cyber Response Coordination Group is  the “trigger” for government involvement. Currently, the group can be  activated by  a cyber incident that may relate to or constitute a terrorist attack, a  terrorist threat, a threat to national security, a disaster, or any other  cyber emergency requiring federal government response;  a confirmed, significant cyber incident directed at one or more national   a cyber incident that impacts or potentially impacts national security,  national economic security, public health or safety, or public confidence  and morale;    discovery of an exploitable vulnerability in a widely used protocol;   other complex or unusual circumstances related to a cyber incident that  requires interagency coordination; or  any cyber incident briefed to the President.
DHS officials acknowledged that the trigger to activate this group is  imprecise and will need to be clarified. Because key activities to define  roles, responsibilities, capabilities, and the appropriate trigger for  government involvement are still under way, the group is at risk of not  being able to act quickly and definitively during a major Internet disruption.
section_title: The Internet Disruption Working Group Was Established to Work with the Private Sector to Establish Plans to Respond to Major Internet Disruptions, but It Lacks Time Lines and Priorities for Its Initiatives
paragraphs: Since most of the Internet is owned and operated by the private sector,  NCSD and NCS established the Internet Disruption Working Group to work  with the private sector to establish priorities and develop action plans to  prevent major disruptions of the Internet and to identify recovery measures  in the event of a major disruption. The group includes representatives of  both domestic and international government agencies and private  Internet-related companies. According to DHS officials who organized the  group, the group held its first forum in November 2005 to begin to identify  real versus perceived threats to the Internet, refine the definition of an  Internet disruption, determine the scope of a planned analysis of  disruptions, and identify near-term protective measures.
DHS officials stated that they had identified a number of potential future  plans, including meeting with industry representatives to  better understand what constitutes normal network activity and what   further refine the definition of an Internet disruption;  determine which public/private organizations would be contacted in an  emergency and what contingency plans the government could establish;   encourage implementation of best practices for protecting key Internet  infrastructure, including the Domain Name System; and   consider requiring improved security technologies for the Domain Name  System and the Border Gateway Protocol in government contracts.
Efforts such as those previously mentioned appear to be worthwhile;  however, agency officials have not yet finalized plans, resources, or  milestones for these efforts. Until they do, the benefits of these efforts will  not be fully realized.
section_title: The North American Incident Response Group Is an Additional Mechanism for Outreach to the Private Sector, but Its Efforts Are Early
paragraphs: In addition to the Internet Disruption Working Group, US-CERT officials  formed the North American Incident Response Group. The group, modeled  on similar groups in Asia and Europe, includes both public and  private-sector network operators who would be the first to recognize and  respond to cyber disruptions. In September 2005, US-CERT officials  conducted regional workshops with group members to share information  on structure and programs and incident response, and to seek ways for the  government and industry to work together operationally. The attendees  included 32 organizations, such as computer security incident response  teams; information sharing and analysis centers; members of private firms  that provide security services; information technology vendors; and other  organizations that participate in cyber watch, warning, and response  functions. US-CERT officials stated that these events were highly  successful, and that they hope to continue to hold such events quarterly  beginning in 2006.
As a result of the first meetings, US-CERT officials developed a list of  action items and assigned milestones to some of these items. For example,  US-CERT has established a secure instant messaging capability to  communicate with group members. In addition, it plans to conduct a survey  of the group members to determine what they need from US-CERT and  what types of information they can provide.
While the outreach efforts of the North American Incident Response Group  are promising, DHS has only just begun developing plans and activities to  address the concerns of private-sector stakeholders.
section_title: DHS Has Conducted Initial Exercises That Address Cyber Disruption, but Efforts to Incorporate Lessons Learned into DHS Operations Are Lacking
paragraphs: Over the last few years, DHS has conducted several broad  intergovernmental exercises to test regional responses to significant  incidents that could affect the critical infrastructure. These regional  exercises included incidents that could cause localized Internet  disruptions, and they resulted in numerous findings and recommendations  regarding the government’s ability to respond to and recover from a major  Internet disruption. For example, selected exercises found that both the  government and private-sector organizations were poorly prepared to  effectively respond to cyber events. They cited the lack of clarity on roles  and responsibilities, the lack of coordination and communication, and a  limited understanding of cybersecurity concerns as serious obstacles to  effective response and recovery from cyber attacks and disruptions.  Furthermore, regional participants reported being unclear regarding who  was in charge of incident management at the local, state, and national  levels.
More recently, in February 2006, DHS conducted an exercise called Cyber  Storm, which was focused primarily on testing responses to a cyber-related  incident of national significance. The exercise involved a simulated  large-scale attack affecting the energy and transportation infrastructures,  using the telecommunications infrastructure as a medium for the attack.  The results of this exercise have not yet been published. (Details on these  exercises are provided in app. IV.)
Exercises that include Internet disruptions can help to identify issues and  interdependencies that need to be addressed. However, DHS has not yet  identified planned activities and milestones or identified which group  should be responsible for incorporating into its plans and initiatives lessons  learned from the regional and Cyber Storm exercises. Without a  coordination process, plans, and milestones, there is less chance that the  lessons learned from the exercises will be successfully transferred to  operational improvements.
section_title: The Relationships and Interdependencies among Various DHS Initiatives Are Not Evident
paragraphs: While DHS has various initiatives under way—including efforts to update  the National Response Plan, task forces assessing changes to NCS,  working groups on responding to cyber incidents, and exercises to practice  recovery efforts—the relationships and interdependencies among these  various efforts are not evident. For example, plans to update the National  Response Plan to better reflect the Internet infrastructure are related to  task force efforts to suggest changes to NCS to deal with the convergence  of voice and data technologies. However, it is not clear how these  initiatives are being coordinated. Furthermore, the National Cyber  Response Coordination Group, the Internet Disruption Working Group, and  the North American Incident Response Group are all meeting to discuss  ways to address Internet recovery, but the interdependencies among the  groups have not been clearly established. Additionally, it is not evident that  lessons learned from the various cyber-related exercises are being  incorporated in the planned revision of the National Response Plan or the  ongoing efforts of the various working groups. Without a thorough  understanding of the interrelationships among its various initiatives, DHS  risks pursuing redundant efforts and missing opportunities to build on  related efforts.
DHS officials acknowledged that they have not yet fully coordinated the  various initiatives aimed at enhancing the department’s ability to help  respond to and recover from a major Internet disruption, but they noted  that the complexity of this undertaking and the number of entities involved  in Internet recovery make this effort challenging.
section_title: Multiple Challenges Exist to Planning for Recovery from Internet Disruptions
paragraphs: Although DHS has various initiatives under way to improve Internet  recovery planning, it faces key challenges in developing a public/private  plan for Internet recovery, including (1) innate characteristics of the  Internet that make planning for and responding to a disruption difficult,   (2) a lack of consensus on DHS’s role and on when the department should  get involved in responding to a disruption, (3) legal issues affecting DHS’s  ability to provide assistance to restore Internet service, (4) reluctance of  the private-sector to share information on Internet disruptions with DHS,  and (5) leadership and organizational uncertainties within DHS. Until it  addresses these challenges, DHS will have difficulty achieving results in its  role as the focal point for recovering the Internet from a major disruption.
subsections: section_title: Key Internet Characteristics Make Recovery More Difficult
paragraphs: The Internet’s diffuse structure, vulnerabilities in its basic protocols, and  lack of agreed-upon performance measures make planning for and  responding to a disruption more difficult.
subsections: section_title: Control of the Internet Is Diffuse
paragraphs: The diffuse control of the Internet makes planning for recovering from a  disruption more challenging. The components of the Internet are not all  governed by the same organization. Some components of the Internet are  controlled by government organizations, while others are controlled by  academic or research institutions. However, the vast majority of the  Internet is owned and operated by the private sector. Each organization  makes decisions to implement or not implement various standards based  on issues such as security, cost, and ease of use. Therefore, any plan for  responding to a disruption requires the agreement and cooperation of these  private-sector organizations.
In addition, the Internet is international. According to private-sector  estimates, only about 20 percent of Internet users are in the United States.  Cyber actors in one country have the potential to impact systems  connected to the Internet in another country. This geographical diversity  makes planning for Internet recovery more difficult.
section_title: Vulnerabilities in Internet-Related Protocols Make Responding to Disruptions Difficult
paragraphs: The Internet’s protocols have vulnerabilities that can be exploited.  Examples of these vulnerabilities include the following:  The version of Internet Protocol (IPv4) that is widely used today has  certain security limitations that have been addressed but are not fully  integrated into the protocol. The newest version of the protocol (IPv6)  addresses some of these limitations, but it has not yet been fully  adopted.
The Domain Name System, which directs users to the correct Web site  based on the name they typed in, was not originally built with the intent  of being resistant to attacks. Domain name servers or caches storing  Domain Name System information can be corrupted. Although some  protective measures have been implemented, a method to encrypt and  protect Domain Name System information has not yet been widely  deployed.
Border Gateway Protocol, the protocol that transmits routing  information among separate networks, has vulnerabilities that, if not  mitigated, could subject those networks to attack. For example, a  malicious actor could advertise incorrect routing information. Because  this protocol provides the basis for all Internet connectivity, a successful  attack could have wide-ranging effects.
section_title: Lack of Standards for Measuring Internet Performance Hinders the Ability to Recognize Disruptions and Recover Accordingly
paragraphs: There are no well-accepted standards for measuring and monitoring the  Internet infrastructure’s availability and performance. Instead, individuals  and organizations rate the Internet’s performance according to their own  priorities.
The commonly used version of Internet Protocol (IPv4) does not guarantee  a priority or speed for delivery, but rather provides “best effort” service.  The next version (IPv6) has features that may help the delivery of future  Internet traffic, but it is not yet widely used. The topic of guaranteeing a  particular level of service, called “quality of service,” is currently the  subject of much research. For example, NCS requested information from  private companies on the potential for prioritizing certain types of Internet  service over others if network capacity was limited; NCS found that there is  currently no offering of a priority service, nor is there any consensus by  industry on a standard approach to prioritization. Obstacles to offering the  service include both technical and financial challenges. Since there are no  clear standards for quality of service, prioritizing service if capacity is  limited or setting thresholds that indicate a disrupted network can be  difficult.
Private-sector representatives identified additional challenges to network  measurement and performance standards, including a reluctance to share  proprietary performance data that other companies could use for  competitive advantage, flaws in measurement techniques, and the ability to  “spoof” performance data.
The lack of agreement on standards for measurement and performance  limits the ability of the government and private sector to readily identify  poor performance and identify when recovery efforts should begin.
section_title: There Is No Consensus on DHS’s Role in Responding to Internet Disruption or the Appropriate Trigger for Its Involvement
paragraphs: There is a lack of consensus about the role DHS should play in responding  to a major Internet disruption and about the appropriate trigger for its  involvement. As we previously noted in this report, the lack of clear  legislative authority for Internet recovery efforts complicates the definition  of this role.
subsections: section_title: DHS’s Role Lacks Consensus
paragraphs: DHS is currently providing information to private industry through existing  US-CERT and National Coordinating Center relationships and conducting  exercises such as Cyber Storm. US-CERT and National Coordinating  Center officials are also working to improve their relationships with the  private sector. However, DHS officials acknowledged that their role in  recovering from an Internet disruption needs additional clarification,  because private industry owns and operates the vast majority of the  Internet.
Private-sector officials representing telecommunication backbone  providers and Internet service providers were also unclear about the types  of assistance DHS could provide in responding to an incident and about the  value of such assistance. While many officials stated that the government  did not have a direct recovery role, others identified a variety of roles  ranging from providing information on specific threats (which DHS  currently does through US-CERT), providing security and disaster relief  support during a crisis, funding backup communication infrastructures,  and driving improved Internet security through requirements for its own  procurement. Clearly, there was no consensus among the officials on this  issue. Table 6 summarizes potential roles suggested by private-sector  representatives and DHS officials’ assessments of each area.
The difference between a minor and a major Internet disruption can be a  combination of factors. The severity of a disruption can be influenced by  the length of time that the disruption lasts;  the impact of the disruption on the operation of the Internet, both in  quality of operation (e.g., if the speed of the Internet is affected), and the  number of users that cannot access the Internet;  the impact that the disruption has on society, such as the impact on  national security or economic security; and  the simultaneity of events (e.g., a disruption coinciding with a national  disaster or terrorist attack could be more severe than a disruption  occurring on an uneventful day).
However, it is not clear when the government should get involved in a  disruption. For example, the lessons learned from the DHS-sponsored  regional exercises show that   organizations do not know how and to whom they should report a cyber  attack and what information to convey;  local and state emergency operations centers often lack procedures to  determine when they should activate for a cyber event;  private-sector participants often do not inform government authorities  about what they see as routine events because of company policy, legal  constraints, or liability concerns; and  it is unclear when a cybersecurity incident becomes a source of concern  and what types of incidents should be communicated to local and  federal law enforcement.
The trigger for the National Response Plan, which is DHS’s overall  framework for incident response, is poorly defined and has been found by  both GAO and the White House to need revision. DHS officials  acknowledged that the definition for activation of its National Cyber  Response Coordination Group is very broad and needs clarification. In  addition, other DHS officials stated that, in their meetings with  private-sector firms and other government agencies, they have determined  that they need to further refine the definition of when government should  be involved during an Internet disruption.
DHS officials have stated that a successful public/private partnership is  critical to the success of efforts to plan for responding to Internet  disruptions. Since private-sector participation in DHS planning activities  for Internet disruption is voluntary, agreement on the appropriate trigger  for government involvement and on the role of government in resolving an  Internet disruption are essential to any plan’s success. Without a consensus  on the appropriate role of government in responding to the disruption, or  on the trigger for government involvement, planning for response to the  disruption is difficult.
section_title: Legal Issues Affect DHS’s Ability to Provide Assistance during Recovery Efforts
paragraphs: There are key legal issues affecting DHS’s ability to provide assistance to  help restore Internet service. As previously noted, key legislation and  regulations guiding critical infrastructure protection, disaster recovery, and  the telecommunications infrastructure do not provide specific authorities  for Internet recovery. As a result, there is no clear legislative guidance on  what government entity would be responsible in the case of a major  Internet disruption.
In addition, while the Stafford Act authorizes the government to provide  federal assistance to states, local governments, nonprofit entities, and  individuals in the event of a major disaster or emergency, it does not  authorize assistance to for-profit corporations. Several representatives of  telecommunications companies reported that they had requested federal  assistance from DHS during Hurricane Katrina. Specifically, they requested  food, water, and security for the teams they were sending in to restore the  communications infrastructure, and fuel to power their generators. DHS  responded that it could not fulfill these requests, noting that the Stafford  Act did not extend to for-profit companies.
section_title: Many in the Private Sector Are Reluctant to Share Internet Information with the Government
paragraphs: Because a large percentage of the nation’s critical  infrastructure—including the Internet—is owned and operated by the  private sector, public/private partnerships are crucial for successful critical  infrastructure protection. Although certain policies direct DHS to work  with the private sector to ensure infrastructure protection, DHS does not  have the authority to direct Internet owners and operators in their recovery  efforts. Instead, it must rely on the private sector to share information on  incidents, disruptions, and recovery efforts.
We have previously reported that many in the private sector are reluctant to  share information with the federal government. Many private-sector  representatives questioned the value of providing information to DHS  regarding planning for and recovery from Internet disruption. Concerns  included the potential for disclosure of the information and the perceived  lack of benefit in providing the information. In addition, DHS identified  provisions of the Federal Advisory Committee Act as having a “chilling  effect” on cooperation with the private sector. The act governs the  structure of certain federal advisory groups and requires that membership  in and information about the groups’ activities be public record. However,  both the act itself and other federal legislation provide the ability to limit  disclosure of sensitive information provided to the government. While DHS  officials stated that the agency was working on a solution to problems  posed by the act, they did not provide us with information on potential  solutions or milestones for completing these activities.  The uncertainties  regarding the value and risks of cooperation with the government limit  incentives for the private sector to cooperate in Internet recovery planning  efforts.
section_title: DHS’s Leadership and Organizational Issues Impact Its Ability to Address Internet Disruption
paragraphs: In 2003 and again in 2005, we identified the transformation of DHS from 22  agencies into one department as a high-risk area. As part of this body of  work, we noted that organizational and management practices are critical  to successfully transforming an organization. Additionally, we reported on  the importance of top leadership driving any transformation and the need  for a stable and authoritative organizational structure. However, DHS has  lacked permanent leadership while developing its plans for Internet  recovery and reconstitution. In addition, the organizations with roles in  Internet recovery have overlapping responsibilities and may be reorganized  once DHS selects permanent leadership. As a result, it is difficult for DHS  to develop a clear set of organizational priorities and to coordinate among  the various activities responsible for Internet recovery planning.
subsections: section_title: DHS Has Lacked Permanent Leadership in Key Roles
paragraphs: In recent years, DHS has experienced a high level of turnover in its  cybersecurity division and has lacked permanent leadership in key roles. In  May 2005, we reported that multiple senior DHS cybersecurity officials had  recently left the department. These officials included the NCSD Director,  the Deputy Director responsible for Outreach and Awareness, the Director  of the US-CERT Control Systems Security Center, the Under Secretary for  the Information Analysis and Infrastructure Protection Directorate, and the  Assistant Secretary responsible for the Information Protection Office.
Subsequently, in July 2005, the DHS Secretary announced a major  reorganization of the department. Under this reorganization, the  Information Analysis and Infrastructure Protection Directorate, which  contained NCS and NCSD, was renamed the Directorate for Preparedness,  which would be managed by an appointed under secretary. The  responsibilities of NCS and NCSD were placed under a new Assistant  Secretary for Cyber Security and Telecommunications. DHS stated that the  creation of a position for Assistant Secretary for Cyber Security and  Telecommunications within the department would elevate the position of  cybersecurity in the department and by doing so raise visibility for the  issue. However, as of May 2006, no candidate for the assistant secretary  position had yet been publicly announced. In addition, the current head of  NCSD is in an acting position and has been since October 2004.
While DHS stated that the lack of a permanent assistant secretary has not  hampered its efforts in protecting critical infrastructure, several  private-sector representatives stated that DHS’s lack of leadership in this  area has limited progress. Specifically, these representatives stated that  filling key leadership positions would enhance DHS’s visibility to the  Internet industry and potentially improve its reputation.
section_title: DHS Organizations Have Overlapping Responsibilities
paragraphs: DHS officials acknowledged that the current organizational structure has  overlapping responsibilities in planning for and recovering from a major  Internet disruption. NCSD is responsible for planning and response  activities governing information technology, while NCS has the lead for  telecommunications. However, because of the convergence of voice and  data networks, NCS has become more involved in Internet issues.
There is currently no written division of responsibilities between NCS and  NCSD related to Internet recovery. NCS officials stated that a revision of  the Emergency Support Function 2 would help address the apparent  overlap, but DHS has not established a date for finalizing this document.  Furthermore, DHS officials stated that the new assistant secretary would  have discretion to reorganize NCS and NCSD. For example, NCS and NCSD  could be combined, or one or more program areas could be modified. As a  result, it is difficult for DHS to develop a clear set of organizational  priorities and to coordinate among the various activities responsible for  Internet recovery planning.
section_title: Conclusions
paragraphs: As a critical information infrastructure supporting our nation’s commerce  and communications, the Internet is subject to disruption—from both  intentional and unintentional incidents. While major incidents to date have  had regional or local impacts, the Internet has not yet suffered a  catastrophic failure. Should such a failure occur, however, existing  legislation and regulations supporting critical infrastructure protection,  disaster response, and the telecommunications infrastructure do not  specifically address roles and responsibilities for Internet recovery.
A national policy, the National Strategy to Secure Cyberspace, establishes  DHS as the focal point for ensuring the security of cyberspace—a role that  includes developing joint public/private plans for facilitating a recovery  from a major Internet disruption. While DHS has initiated efforts to refine  high-level disaster recovery plans, the components of these plans that  pertain to the Internet are not complete. Additionally, while DHS has  undertaken several initiatives to improve Internet recovery planning, much  remains to be done. Specifically, some initiatives lack clear time lines,  lessons learned are not consistently being incorporated in recovery plans,  and the relationships between the various initiatives are not clear.
DHS faces numerous challenges to developing integrated public/private  recovery plans—not the least of which is the fact that the government does  not own or operate much of the Internet. In addition, there is no consensus  among public and private stakeholders about the appropriate role of DHS  and when it should get involved; legal issues limit the actions the  government can take; the private sector is reluctant to share information  on Internet performance with the government; and DHS is undergoing  important organizational and leadership changes. As a result, the exact role  of the government in helping to recover the Internet infrastructure  following a major disruption remains unclear.
section_title: Matters for Congressional Consideration
paragraphs: Given the importance of the Internet as a critical infrastructure supporting  our nation’s communications and commerce, Congress should consider  clarifying the legal framework that guides roles and responsibilities for  Internet recovery in the event of a major disruption. This effort could  include providing specific authorities for Internet recovery as well as  examining potential roles for the federal government, such as providing  access to disaster areas, prioritizing selected entities for service recovery,  and using federal contracting mechanisms to encourage more secure  technologies. This effort also could include examining the Stafford Act to  determine if there would be benefits in establishing specific authority for  the government to provide for-profit companies—such as those that own or  operate critical communications infrastructures—with limited assistance  during a crisis.
section_title: Recommendations for Executive Action
paragraphs: To improve DHS’s ability to facilitate public/private efforts to recover the  Internet in case of a major disruption, we recommend that the Secretary of  the Department of Homeland Security implement the following nine  actions:  Establish dates for revising the National Response Plan and finalizing  the National Infrastructure Protection Plan—including efforts to  update key components relevant to the Internet.
Use the planned revisions to the National Response Plan and the  National Infrastructure Protection Plan as a basis, draft public/private  plans for Internet recovery, and obtain input from key Internet  infrastructure companies.
Review the NCS and NCSD organizational structures and roles in light of  the convergence of voice and data communications.
Identify the relationships and interdependencies among the various  Internet recovery-related activities currently under way in NCS and  NCSD, including initiatives by US-CERT, the National Cyber Response  Coordination Group, the Internet Disruption Working Group, the North  American Incident Response Group, and the groups responsible for  developing and implementing cyber recovery exercises.
Establish time lines and priorities for key efforts identified by the  Internet Disruption Working Group.
Identify ways to incorporate lessons learned from actual incidents and  during cyber exercises into recovery plans and procedures.
Work with private-sector stakeholders representing the Internet  infrastructure to address challenges to effective Internet recovery by  further defining needed government functions in responding to a  major Internet disruption (this effort should include a careful  consideration of the potential government functions identified by the  private sector in table 6 of this report),  defining a trigger for government involvement in responding to such   documenting assumptions and developing approaches to deal with  key challenges that are not within the government’s control.
section_title: Agency Comments
paragraphs: We received written comments from DHS on a draft of this report (see app.  V). In DHS’s response, the Director of the Departmental GAO/Office of  Inspector General Liaison Office concurred with our recommendations.  DHS stated that it recognizes that the Internet is an important component  of the information infrastructure in which both the information technology  and telecommunications sectors share an interest. It also stated that  because of the increasing reliance of various critical infrastructure sectors  on interconnected information systems, the Internet represents a  significant source of interdependencies for many sectors. DHS agreed that  strengthened collaboration between the public and private sectors is  critical to protecting the Internet. DHS also provided information on initial  actions it is taking to implement our recommendations.
DHS officials, as well as others who were quoted in our report, also  provided technical corrections, which we have incorporated in this report  as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution of it until 30 days from  the report date. At that time, we will send copies of this report to interested  congressional committees, the Secretary of the Department of Homeland  Security, and other interested parties. In addition, this report will be  available at no charge on GAO’s Web site at www.gao.gov.
If you have any questions on matters discussed in this report, please  contact us at (202) 512-9286 and at (202) 512-6412, or by e-mail at  pownerd@gao.gov and rhodesk@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix VI.
section_title: Objectives, Scope, and Methodology
paragraphs: Our objectives were to (1) identify examples of major disruptions to the  Internet, (2) identify the primary laws and regulations governing recovery  of the Internet in the event of a major disruption, (3) evaluate the  Department of Homeland Security’s (DHS) plans for facilitating recovery  from Internet disruptions, and (4) assess challenges to such efforts.
To determine the types of major disruptions to the Internet, we analyzed  our prior work on cybersecurity issues as well as reports by private  organizations, research experts, and government agencies. We identified  incidents that were representative of types of disruptions that have actually  occurred. We compiled case studies by reviewing and summarizing  research reports and interviewing private-industry experts and government  officials. We also conducted interviews with individuals in the  private/public sectors, including representatives of private companies that  operate portions of Internet infrastructure.
To determine the primary laws and regulations for recovering the Internet  in the event of a major disruption, we analyzed relevant laws and  regulations related to infrastructure protection, disaster response, and the  telecommunications infrastructure. These laws and regulations included  the Homeland Security Act of 2002, Homeland Security Presidential  Directive 7, the Defense Production Act, the Stafford Act, the  Communications Act of 1934, and the National Communications System  (NCS) authorities. We also obtained the perspectives of DHS and the  Federal Communications Commission on the laws and regulations that  govern Internet recovery. Additionally, we conducted interviews with DHS  and other government officials as well as representatives of the  telecommunications and information technology sectors.
To assess plans for recovery of Internet service in the event of a major  disruption, we analyzed key documents, such as the interim National  Infrastructure Protection Plan, the National Response Plan, a report from  the National Coordinating Center Task Force, and reports from regional  tabletop security exercises. We observed a portion of DHS’s Cyber Storm  exercise, which focused on facilitating government and private industry  organizations to address an array of cybersecurity issues. We also spoke  with the Deputy Manager of NCS and the Deputy Director of the NCSD to  identify DHS’s initiatives in the area of Internet protection and recovery.  Additionally, we interviewed representatives from private companies that  operate portions of Internet infrastructure. These included representatives  of major telecommunications and cable companies, Internet service  providers, and root server operators. We also interviewed representatives  from three information sharing and analysis centers to obtain their  perspectives on DHS’s capabilities in the area of Internet recovery.
To identify the challenges that may affect current recovery plans, we  analyzed DHS plans, congressional testimony, and other evaluations of  challenges to Internet recovery. We also interviewed officials at DHS,  including NCSD’s Deputy Director of Strategic Initiatives and Deputy  Director of Operations and NCS’s Chief of the Critical Infrastructure  Protection Division. In addition, we interviewed other agencies that are  involved with the government’s efforts in the area of Internet recovery and  experts in the private sector and academia. We performed our work from  August 2005 to May 2006 in accordance with generally accepted  government auditing standards.
section_title: Legislation and Regulations Govern Critical Infrastructure Protection, Disaster Response, and the Telecommunications Infrastructure
subsections: section_title: Multiple Laws and Regulations Govern Protection of Critical Infrastructure
paragraphs: Federal laws and policies establish critical infrastructure protection as a  national goal and describe a strategy for cooperative efforts by government  and the private sector to protect the cyber- and physical-based systems that  are essential to the minimum operations of the economy and the  government. The primary authorities governing protection of critical  infrastructure include the Homeland Security Act of 2002 and Homeland  Security Presidential Directive 7.
subsections: section_title: The Homeland Security Act of 2002
paragraphs: The Homeland Security Act of 2002 established DHS and gave it lead  responsibility for preventing terrorist attacks in the United States, reducing  the vulnerability of the United States to terrorist attacks, and minimizing  the damage and assisting in the recovery from attacks that do occur.
The act also assigns DHS a number of responsibilities for critical  infrastructure protection, including (1) developing a comprehensive  national plan for securing the key resources and critical infrastructure of  the United States; (2) recommending measures to protect the key  resources and critical infrastructure of the United States in coordination  with other federal agencies and in cooperation with state and local  government agencies and authorities, the private sector, and other entities;  and (3) disseminating, as appropriate, information analyzed by the  department—both within the department and to other federal, state, and  local government agencies and private-sector entities—to assist in the  deterrence, prevention, or preemption of or response to terrorist attacks.
Additionally, the act specifically charged DHS with providing state and  local government entities and, upon request, private entities that own or  operate critical infrastructure, with  analyses and warnings concerning vulnerabilities and threats to critical   crisis management support in response to threats or attacks on critical   technical assistance with respect to recovery plans to respond to major  failures of critical information systems.
section_title: Homeland Security Presidential Directive 7
paragraphs: Homeland Security Presidential Directive 7, dated December 17, 2003,  superseded Presidential Decision Directive 63 and established a national  policy for federal departments and agencies to identify and prioritize  critical infrastructures and key resources and to protect them from  terrorist attack. The directive defines responsibilities for (1) DHS,   (2) sector-specific federal agencies that are responsible for addressing  specific critical infrastructure sectors, and (3) other departments and  agencies.
The directive also makes DHS responsible for coordinating the national  effort to enhance the protection of the critical infrastructure and key  resources of the United States. Under the directive, the Secretary of DHS is  to serve as the principal federal official to lead, integrate, and coordinate  implementation of efforts among federal departments and agencies, state  and local governments, and the private sector to protect critical  infrastructure and key resources. The Secretary also is to work closely with  other federal departments and agencies, state and local governments, and  the private sector in accomplishing the objectives of the directive.  The  Secretary is given responsibility to coordinate protection activities for  several key infrastructure sectors, including the information technology  and telecommunications sectors.
Homeland Security Presidential Directive 7 provides that DHS is to  collaborate with the appropriate private-sector entities and to encourage  the development of information-sharing and analysis mechanisms.  Additionally, the department and sector-specific agencies are to collaborate  with the private sector and continue to support sector-coordinating  mechanisms to  identify, prioritize, and coordinate the protection of critical  infrastructure and key resources and  facilitate sharing of information about cyber and physical threats,  vulnerabilities, incidents, potential protective measures, and best  practices.
section_title: Multiple Laws Govern Federal Response to Disasters and Incidents of National Significance
paragraphs: Federal planning for disaster recovery is governed by legislation including  the Defense Production Act and the Stafford Act.
subsections: section_title: Defense Production Act
paragraphs: The Defense Production Act was enacted at the outset of the Korean War to  ensure the availability of industrial resources to meet the needs of the  Department of Defense. The act is intended to facilitate the supply and  timely delivery of products, materials, and services to military and civilian  agencies, in times of peace as well as in times of war. Presently, only titles I,  III, and VII of the Defense Production Act remain in effect. DHS identified  the act as a primary authority that supports telecommunications  emergency planning and response functions.
Title I of the act authorizes the President to ensure the timely availability of  products, materials, and services needed to meet current defense  preparedness and military readiness requirements as well as the  requirements of a national emergency. Under section 101 of the act, the  President may require preferential performance on contracts and orders to  meet approved national defense requirements and may allocate materials,  services, and facilities as necessary to promote the national defense in a  national emergency. Homeland Security Presidential Directive 7, previously  discussed, specifically acknowledges the authority of the Department of  Commerce to use the act to ensure the timely availability of industrial  products, materials, and services to meet homeland security requirements.
Title III of the act authorizes the use of financial incentives to expand  productive capacity and supply. It authorizes loan guarantees, loans,  purchases, purchase guarantees, and installation of equipment in  contractor facilities for those goods necessary for national defense. It is  used only in cases where domestic sources are required and domestic firms  cannot, or will not, act on their own to meet a national defense production  need.
Title VII of the Defense Production Act defines national defense to include  domestic emergency preparedness and critical infrastructure protection  and restoration activities. The act’s authorities, therefore, are available to  meet requirements in a civil disaster, such as a major Internet disruption.
The act also authorizes the President to provide antitrust defenses to  private firms participating in voluntary agreements aimed at solving  production and distribution problems.
The Year 2000 computer transition and the September 11, 2001, attacks  prompted new interest in the act and its application to information  technology and cybersecurity. Some commentators indicated that the act  would be a useful tool in managing a critical infrastructure emergency. In  January 2001, President Clinton directed the Secretary of Energy to  exercise authority under the act, among other statutes, to ensure the  availability of natural gas for high-priority uses in California. President  Clinton found that ensuring natural gas supplies to California was  necessary and appropriate to maximize domestic supplies and to promote  the national defense. President Bush subsequently extended this executive  order.
In recent years, Congress has expanded the Defense Production Act’s  coverage to include crises resulting from natural disasters or “man-caused  events” not amounting to an armed attack on the United States. The  definition of national defense in the act was expanded in 1994 to include emergency preparedness activities authorized by the Stafford Act. In 2003,  the act was reauthorized through September 30, 2008. It was also amended  to add explicit authority to use the act for critical infrastructure protection  and restoration. In addition, the 2003 Act (section 5) added a definition of  critical infrastructure to the act.
section_title: The Stafford Act
paragraphs: “Major disaster means any natural catastrophe (including any hurricane, tornado, storm,  high water, winddriven water, tidal wave, tsunami, earthquake, volcanic eruption, landslide,  mudslide, snowstorm, or drought), or, regardless of cause, any fire, flood, or explosion, in  any part of the United States, which in the determination of the President causes damage of  sufficient severity and magnitude to warrant major disaster assistance under this Act to  supplement the efforts and available resources of States, local governments, and disaster  relief organizations in alleviating the damage, loss, hardship, or suffering caused thereby.”
A presidential declaration that a major disaster has occurred activates the  federal response plan for the delivery of federal disaster assistance. The  Federal Emergency Management Agency is responsible for coordinating  the federal and private response effort. A presidential declaration of a  major disaster triggers several Stafford Act authorities, including, for  example, federal activities to  support state and local governments to facilitate the distribution of   help distribute aid to victims through state and local governments and  voluntary organizations, perform life- and property-saving assistance,  clear debris, and use the resources of the Department of Defense;   repair and reconstruct federal facilities;   repair, restore, and replace damaged facilities owned by state and local  governments, as well as private nonprofit facilities that provide essential  services or contributions for other facilities or hazard mitigation  measures in lieu of repairing or restoring damaged facilities; and  establish—during or in anticipation of an emergency—temporary  communications systems, and make such communications available to  state and local government officials.
section_title: Specific Laws and Regulations Govern the Telecommunications Infrastructure That Supports the Internet
paragraphs: The Internet is enabled by the telecommunications infrastructure that  supports transmission of data. Key laws and regulations include the  Communications Act of 1934, as amended, and the National  Communications System (NCS) authorities.
subsections: section_title: Communications Act of 1934, as Amended
paragraphs: The primary federal telecommunications law is the Communications Act of  1934. Its original purpose was to regulate interstate and foreign commerce  in communications by wire and radio by licensing radio stations and  regulating the telecommunications monopolies of the time. The 1934 Act  also created the Federal Communications Commission to implement the  act. The 1934 act, as amended, has remained for more than 60 years as the basis of federal regulation of telecommunications services. The  Telecommunications Act of 1996 amended the 1934 Act to enhance  competition in the telecommunications market. These laws govern  regulation of forms of transmission upon which the Internet depends.  There is, however, no general regulatory provision for the Internet in the  act and no specific provision providing authorities and responsibilities for  Internet recovery.
section_title: NCS Authorities
paragraphs: NCS was established by a memorandum signed by President Kennedy in  1963, following the Cuban Missile Crisis. The memorandum called for  establishing a national communications system by linking together and  improving the communication facilities and components of various federal  agencies. This original memorandum has since been amended and  superseded over time.
The executive order currently in force is Executive Order 12472, April 3,  1984, which was amended slightly by Executive Order 13286 on February  28, 2003. Executive Order 12472, as amended by Executive Order 13286,  established NCS and provided that its mission was to assist the President,  the National Security Council, the Homeland Security Council, the Director  of the Office of Science and Technology Policy, and the Director of the  Office of Management and Budget in, among other responsibilities, “the  coordination of the planning for and provision of national security and  emergency preparedness communications for the Federal government  under all circumstances, including crisis or emergency, attack, recovery  and reconstitution.”
The administrative structure includes a National Communications System  Committee of Principals, an executive agent, and a manager. The  Homeland Security Act of 2002 transferred NCS to DHS. To reflect this  change, Executive Order 13286 made the Secretary of DHS the Executive  Agent.
NCS’s mission with regard to critical infrastructure protection is to ensure  the reliability and availability of telecommunications for national security  and emergency preparedness. Its mission includes, but it is not necessarily  limited to, responsibility for (1) ensuring the government’s ability to receive  priority services for national security and emergency preparedness  purposes in current and future telecommunications networks by  conducting research and development and participating in national and  international standards bodies and (2) operationally coordinating with  industry for protecting and restoring national security and emergency  preparedness services in an all-hazards environment.
Section 706 of the Communications Act of 1934 grants the President certain  emergency powers regarding telecommunications, including the authority  to grant essential communications “preference or priority with any carrier”  subject to this act. The President may also, in the event of war or national  emergency, suspend regulations governing wire and radio transmissions  and “authorize the use or control of any such facility or station and its  apparatus and equipment by any department of the Government.” Section  706 is implemented in Executive Order 12472, which provides that the  Director of the Office of Science and Technology Policy shall direct the  exercise of the war power functions of the President under section 706(a),  (c)-(e) of the Communications Act of 1934, as amended (47 U.S.C. 606).  Section 706 is implemented in the Code of Federal Regulations at title 47,  chapter II.
section_title: Two Task Forces Have Assessed NCS Roles and Mission
paragraphs: The National Security Telecommunications Advisory Committee advises  the President on issues and problems related to implementing national  security and emergency preparedness telecommunications policy. The  committee recently formed two task forces to provide recommendations  on changes to DHS’s NCS division and operations.
subsections: section_title: Next Generation Network Task Force
paragraphs: In May 2004, the Next Generation Network Task Force was formed to  develop recommendations on changes that needed to be made to NCS as a  result of issues such as the convergence of voice and data communications.  The task force was to (1) define the expected structure for next-generation  networks, such as those using Internet-based protocols; (2) identify  national security and emergency preparedness user requirements for next- generation networks and outline how these requirements will be met; and  (3) examine relevant user scenarios and expected cyber threats and  recommend optimal actions to address these threats.
The task force agreed to present its findings and recommendations in two  separate reports to the President—a near-term recommendations report  and a final comprehensive report.
In March 2005, the task force issued near-term recommendations for the  federal government. While the recommendations did not address NCS’s  role in recovering from an Internet disruption, they included   exploring the use of government networks as alternatives for critical  emergency communications during times of national crisis;   using and testing existing and leading-edge technologies and  commercial capabilities to support critical emergency user  requirements for security and availability;  studying and supporting industry efforts in areas that present the  greatest emergency communications risks during the period of  convergence, including gateways, control systems, and first responder  communications systems; and  reviewing the value of satellite systems as a broad alternative  transmission channel for critical emergency communications.
The final report, issued in March 2006, contained recommendations that  the federal government  require federal agencies to plan for and invest in resilient and alternate  communications mechanisms to be used in a crisis,  develop identity management tools to support priority emergency  communication on next-generation networks,  develop supporting policies for emergency communications on next-  improve DHS incident management capabilities.
DHS has not yet developed specific plans to address the recommendations  from either report.
section_title: National Coordinating Center Task Force
paragraphs: In October 2004, a task force was established to examine the future mission  and role of the National Coordinating Center, which is part of NCS. This  task force was to study the direction of the center over the next year, 3  years, and 5 years, including how industry members of the center should  continue to partner with the government and how the center should be  structured.
The task force researched the center’s functions and mapped the center’s  authorities to its missions. It studied the center’s organizational structure,  information sharing and analysis, incident management and leadership, and  international mutual-aid abilities.
In its report issued in May 2006, the task force found that since the  September 11 attacks the number of companies participating in the  National Coordinating Center has more than doubled, but the influx of new  members has hindered information sharing because of the time it takes to  develop trusted relationships between members. The report also found that  members wanted government to increase its sharing of threat information  with the communications industry through the National Coordinating  Center. The report recommended that  the National Coordinating Center broaden center membership by  including additional firms, such as cable operators, satellite operators,  and Internet service providers;  NCS examine the possible combination of the National Coordinating  Center and the Information Technology Information Sharing and  Analysis Center;  DHS clarify responsibilities and authorities in emergency situations to  facilitate response to telecommunications disruptions;  DHS revise the Cyber Incident Annex to the National Response Plan to  clarify the trigger for the annex and the appropriate role of the  government in responding to such an incident;  the National Coordinating Center develop a concept of operations for  responding to cyber events; and  DHS resolve confusion over legal or jurisdictional issues in responding  to cyber or communications crises.
DHS has not yet developed a plan to address these findings and  recommendations.
section_title: DHS Has Conducted Disaster Response Exercises That Include Cyber Incidents
subsections: section_title: DHS Has Conducted Regional Exercises Involving Cyber Attacks
paragraphs: Over the last few years, DHS has conducted several exercises to test the  federal and regional response to incidents affecting critical infrastructures.  Among other events, these exercises included incidents that could cause  localized Internet disruptions. Specifically, DHS sponsored two cyber  tabletop exercises with Connecticut and New Jersey, as well as a series of  exercises in the Pacific Northwest and Gulf Coast regions of the United  States.
The series of exercises in the Pacific Northwest was named Blue Cascades.  Blue Cascades II, conducted in September 2004, addressed a scenario  involving cyber attacks and attacks that disrupted infrastructure, including  telecommunications and electric power. The scenario explored regional  capabilities to deal with threats, interdependences, cascading impacts, and  incident response. Blue Cascades III, conducted in March 2006, focused on  the impact of a major earthquake in the area and the resulting efforts to  recover and restore services. Both exercises were sponsored by NCSD and  organized by the Pacific Northwest Economic Region.
Purple Crescent II, held in New Orleans, Louisiana, in October 2004, was  also designed to raise awareness of infrastructure interdependencies and  to identify how to improve regional preparedness. The scenario involved a  cell of terrorists that used an approaching major hurricane to test their  ability to disrupt regional infrastructures, government and private  organizations, and particularly disaster preparedness operations using  cyber attacks. The exercise was sponsored by the Gulf Coast Regional  Partnership for Infrastructure Security and funded by NCSD.
The objectives of these exercises included  raising awareness of infrastructure-related cybersecurity issues and   identifying response and recovery challenges;   bringing together physical security, emergency management, and other  disciplines involved in homeland security and disaster response;   identifying roles and responsibilities in addressing cyber attacks and  disruptions;   determining ways to foster public/private cooperation and information   identifying preparedness gaps associated with cybersecurity and related   producing an action plan of activities.
The exercises resulted in many findings regarding the overall preparedness  for cyber incidents (see table 7). Overall, the exercises found that both the  government and private-sector organizations were poorly prepared to  effectively respond to cyber events. The lack of clarity on roles and  responsibilities coupled with both the lack of coordination and  communication and limited understanding of cybersecurity concerns pose  serious obstacles to effective response and recovery from cyber attacks  and disruptions. Furthermore, it was unclear who was in charge of incident  management at the local, state, or national levels.
The after-action reports from the exercises recommended areas for  additional study and planning, including   additional study of the vulnerabilities of critical infrastructures to cyber   improved information on training, assessments, and resources to be  used against cyber attacks;  improved federal, state, local, and private-sector planning and   defined thresholds for what constitutes a major cyber attack.
section_title: Cyber Storm Was DHS’s First National Exercise Focused on Cyber Attacks
paragraphs: Cyber Storm, held in February 2006 in Washington, D.C., was the first DHS- sponsored national exercise to test response to a cyber-related incident of  national significance. The exercise involved a simulated, large-scale attack  affecting the energy, information technology, telecommunications, and  transportation infrastructures. DHS officials stated that they plan to hold a  similar exercise every other year.
According to information provided by agency officials, the exercise  involved eight federal departments and three agencies, three states, and  four foreign countries. The exercise also involved representatives from the  private sector, including nine information technology companies, six  electric companies, and two airlines. The exercise objectives included  testing interagency, intergovernmental, and public/private coordination of  incident response.
Representatives of private-sector companies provided mixed responses on  the value of exercises such as Cyber Storm. Selected representatives  expressed concerns about the overly broad scope and the difficulty in  justifying dedicating resources for the exercises due to the lack of clear  goals and outcomes. Another representative stated that government  exercises help the government but exercises involving private-sector  coordination with multiple agencies would also be helpful. Another  representative stated that exercises were only of value if there was a  process for integrating lessons learned from the exercises into policies and  procedures. Two representatives, from a private-sector company that  participated in Cyber Storm, stated that, while useful, the exercise was not  designed for network operators, who would benefit from more  comprehensive training in incident response.
section_title: Comments from the Department of Homeland Security
section_title: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to those named above, Don R. Adams, Naba Barkakati, Scott  Borre, Neil Doherty, Vijay D’Souza, Joshua A. Hammerstein, Bert Japikse,  Joanne Landesman, Frank Maguire, Teresa M. Neven, and Colleen M.  Phillips made key contributions to this report.