Critical Infrastructure Protection: Preliminary Observations on DHS Efforts to Address Electromagnetic Threats to the Electric Grid
Published: 2015-07-22T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The threat posed by an electromagnetic pulse (EMP) or solar weather event could have a debilitating impact on the nation's critical electrical infrastructure, as well as other key assets that depend on electricity. These events could lead to power outages over broad geographic areas for extended durations. Addressing these risks requires collaboration among multiple government and industry stakeholders; with DHS in the lead role for overall infrastructure protection efforts, working in coordination with DOE.
The EMP Commission, established by statute and comprised of subject matter experts, issued recommendations in 2008 addressing the preparation, protection and recovery of critical infrastructures against a possible EMP attack. The majority of these recommendations were made to DHS and DOE.
This testimony is based on preliminary observations from GAO's ongoing review of DHS's efforts to address electromagnetic threats. Specifically, this testimony addresses the extent to which DHS has: (1) taken action to address recommendations from the 2008 EMP Commission Report and (2) coordinated with other principal federal agencies, such as DOE and industry stakeholders to mitigate risks to the electric grid from electromagnetic threats.
GAO reviewed EMP Commission recommendations and DHS program documents, and interviewed relevant stakeholders who provided insights on key issues and coordination activities with the federal government to address these threats.
section_title: What GAO Found
paragraphs: As of July 2015, the Department of Homeland Security (DHS) reported taking several actions that could help address electromagnetic threats to the electric grid. GAO's preliminary analysis of DHS's actions indicates that they generally fell under four categories: (1) developing reports, (2) identifying mitigation efforts, (3) strategy development and planning, and (4) conducting exercises. For example:
Impacts of Severe Space Weather on the Electric Grid . This 2011 report evaluated how previous solar storms have affected electric grids, and identified potential cost-effective mitigation equipment available to protect these grids, among other topics.
RecX . In 2012, DHS Science &Technology partnered with industry to develop a prototype transformer that could significantly reduce the time to transport, install, and energize a transformer to aid recovery from power outages associated with transformer failures from several months to less than one week.
DHS reported its actions were not taken in response to the 2008 recommendations of the Commission to Assess the Threat to the United States from Electromagnetic Pulse Attack (EMP Commission). GAO also recognizes that DHS does not have a statutory obligation to specifically address the recommendations, but implementation of them could help mitigate electromagnetic impacts to the electric grid, such as helping to assure the protection of high-value transmission assets. Moreover, GAO's preliminary work suggests that DHS, in conjunction with the Department of Energy (DOE), has not fully addressed a key critical infrastructure protection responsibility—identification of clear internal agency roles and responsibilities related to addressing electromagnetic threats. For example, although DHS recognized one component as the lead for assessing solar weather risks, the component has not yet identified any specific roles related to collecting or analyzing risk information.
DHS has also coordinated with federal and industry stakeholders to address some, but not all risks to the electrical grid since the EMP Commission issued its recommendations. GAO preliminarily identified eight projects in which DHS coordinated with stakeholders to help protect the grid including developing plans to address long term power outages, participation in exercises, and research and development activities. Although these are positive steps, GAO's preliminary work indicates that DHS has not effectively coordinated with stakeholders to identify critical assets or collect necessary risk information, among other responsibilities. GAO will continue to assess the issues in this statement as it completes its work and will issue a report with the final results later this year.

section_title: Letter
paragraphs: Thank you for the opportunity to discuss our work regarding the  Department of Homeland Security’s (DHS) efforts to address  electromagnetic threats to the electric grid. The threat posed by an  electromagnetic pulse (EMP) or solar weather event could have a  debilitating impact on critical electrical infrastructure and communications  systems, as well as other key assets and infrastructure that depend on  electric utilities for power. EMP and solar weather events could potentially  lead to power outages over broad geographic areas for extended  durations, which experts have reported could result in severe economic  disruption and significant impacts to public health and safety. Addressing  these threats necessitates effective collaboration among multiple  government agencies and industry partners and no singular federal  program or entity has sole responsibility for addressing electromagnetic  threats. However, the National Infrastructure Protection Plan (NIPP)  outlines the roles and responsibilities of DHS and applicable sector- specific agencies for each of the 16 critical infrastructure sectors. Within  the NIPP framework, DHS has the lead role in coordinating the overall  federal effort to promote the security and resilience of the nation’s critical  infrastructure. For the energy sector, which includes critical electrical  infrastructure, the Department of Energy (DOE) is the sector-specific  agency and shares responsibility with DHS.
In April 2008, the Commission to Assess the Threat to the United States  from Electromagnetic Pulse Attack (EMP Commission) issued a report  which included recommendations addressing the preparation, protection  and recovery of U.S. critical infrastructures against a possible EMP  attack.to DOE. (See Appendix I for a summary of the 2008 EMP Commission  recommendations addressing electrical infrastructure.)
The majority of these recommendations were made to DHS and  My statement today is based on preliminary observations and analyses  from our ongoing review of DHS’s efforts to address electromagnetic  threats. taken actions to address recommendations from the 2008 EMP  Commission Report, and (2) coordinated with other principal federal  agencies and industry stakeholders to mitigate risks to the electric grid  from electromagnetic threats.
Specifically, I will be discussing the extent to which DHS has: (1)
We are conducting this work at the request of the Senate Committee on Homeland  Security and Governmental Affairs and the House Committee on Homeland Security. Two  individual Members of Congress are also requesters for this work. background research, as key stakeholders and subject matter experts  within the electrical sector. While we intend to conduct additional  interviews with industry stakeholders and researchers as part of our  ongoing review, we believe the meetings conducted to date provided  valuable insights regarding key issues and applicable coordination  activities with the federal government to address electromagnetic threats.
We are conducting the work on which this statement is based in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe the  evidence obtained provides a reasonable basis for our preliminary  findings and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: An EMP is a burst of high power electromagnetic radiation resulting from  the detonation of nuclear and non-nuclear devices that are designed to  intentionally disrupt or destroy electronic equipment. EMP events may be  further categorized into a number of different types, based on their  specific source of initiation. The threat focused on primarily by the EMP  Commission is the high-altitude EMP (HEMP). A HEMP event is caused  by the detonation of a nuclear device at a high-altitude, about 40 to 400  kilometers, above the Earth’s atmosphere. A HEMP attack is not  intended to cause direct physical impacts at the Earth’s surface, such as  injury or damage directly from heat or blast, but instead interacts with the  atmosphere to create an intense electromagnetic energy field that can  overload computer circuitry and could cause significant damage to critical  electrical infrastructure.
In addition to manmade EMPs, naturally occurring solar weather events  can also cause related electromagnetic impacts that can adversely affect  components of the commercial electric grid. This type of event is  commonly referred to as a geomagnetic disturbance (GMD). In 1989, a  GMD caused wide-scale impacts on the Hydro-Quebec power system in  Canada which caused the electric grid to collapse within 92 seconds and  left six million customers without power for 9 hours. As noted in  Presidential Policy Directive 21 (PPD-21), energy sector infrastructure is  uniquely critical due to the enabling functions it provides to other critical  infrastructure sectors. Given this interdependency, an EMP or major  GMD event that disrupts the electric grid could also result in potential  cascading impacts on fuel distribution, transportation systems, food and  water supplies, and communications and equipment for emergency  services, as well as other communication systems which utilize the  civilian infrastructure. PPD-21 also recognizes that DHS has numerous  responsibilities to protect critical infrastructure, including such things as  analyzing threats to, vulnerabilities of, and potential consequences from  all hazards on critical infrastructure.
Within DHS, the National Protection and Programs Directorate (NPPD) is  responsible for working with public and industry infrastructure partners  and leads the coordinated national effort to mitigate risk to the nation’s  infrastructure through the development and implementation of the  infrastructure protection program. NPPD has two principal offices with  responsibilities to facilitate protection of critical infrastructure that could be  at risk from EMP and GMD events—the Office of Infrastructure Protection  (IP) and the Office of Cyber Security and Communications (CS&C). In  addition, DHS’s Federal Emergency Management Agency (FEMA) and  Science and Technology Directorate (S&T) have roles related to  addressing potential impacts to the electric grid, which could include EMP  and GMD threats.
DOE also has a significant role as the sector-specific agency for the  energy sector, which includes critical infrastructure and key resources  related to electricity. For example, DOE is responsible for developing an  Energy Sector Specific Plan—in collaboration with other stakeholders,  including DHS—that applies the NIPP risk management model to critical  infrastructure and key resources within the sector. Within DOE, the Office  of Electricity Delivery and Energy Reliability leads national efforts to  increase the security and reliability of the energy infrastructure and  facilitate recovery from disruptions to the energy supply. DOE national  laboratories also provide research support and technical expertise to  federal and industry stakeholders regarding EMP and GMD impacts.
Other principal federal agencies working to address the threat of EMP  and GMD include the Department of Defense (DOD) and the Federal  Energy Regulatory Commission (FERC), as well as the National Oceanic  and Atmospheric Administration (NOAA), and National Aeronautics and  Space Administration (NASA).
Electrical infrastructure is primarily operated by private industry which  owns approximately 85 percent of the nation’s critical electrical  infrastructure. Industry entities are represented, in part, through  membership in industry associations such as the American Public Power  Association and the Edison Electric Institute. The North American Electric  Reliability Corporation (NERC) also serves as the delegated authority to  regulate the protection and improvement of the reliability and security of  the electrical infrastructure.
section_title: Preliminary Findings Indicate that DHS Actions to Address Electromagnetic Threats were Conducted Independently of the EMP Commission Recommendations
paragraphs: As of July 2015, DHS reported taking several actions that could help  address electromagnetic threats to the electric grid, but these efforts were  conducted independently of the 2008 EMP Commission  recommendations. Our preliminary analysis of DHS’s actions indicates  that they generally fell under four categories of effort: (1) developing  reports, (2) identifying mitigation efforts, (3) strategy development and  planning, and (4) conducting training exercises.
subsections: section_title: Developing Reports
paragraphs: Since 2008, DHS has produced three reports that specifically address  electromagnetic threats to the electric grid. Below is a summary of each  report.
Electromagnetic Pulse Impacts on Extra High Voltage Power  Transformers. This 2010 report analyzed the potential impact of an  EMP on extra high voltage transformers—focusing primarily on  transformer equipment designs and identifying specific mitigation  efforts such as blocking devices that minimize the impact of  geomagnetically induced currents (GIC) on the electric grid. The  report concluded that the similarity of EMP effects, regardless of  source, indicates that geomagnetic storms provide a useful basis for  transformer impact analysis and that selective installation of blocking  devices would minimize the impacts of GIC on transformers, among  other findings.
Impacts of Severe Space Weather on the Electric Grid. This  2011 report assessed the impacts of space weather on the electric  grid, seeking to understand how previous solar storms have affected  some power grids, and what cost-effective mitigation efforts are  available to protect the electric grid, among other topics. Some of the  key findings and recommendations include the need for a rigorous risk  assessment to determine how plausible a worse-case scenario may  be and additional research to better understand how transformers  may be impacted by electromagnetic threats. This report also  recommended installation of blocking devices to minimize the impacts  of GIC.
Sector Resilience Report: Electric Power Delivery.
This 2014  report summarizes an analysis of key electric power dependencies  and interdependencies, such as communications, transportation, and  other lifeline infrastructure systems. The report included an  assessment of, and best practices for, improving infrastructure  resilience such as: modeling to identify potential vulnerabilities,  conducting a cost-benefit analysis of alternative, technology-based  options, and installing protective measures and hardening at-risk  equipment, among others.
section_title: Identifying Mitigation Efforts
paragraphs: DHS identified two specific efforts implemented since 2008 that could  help to mitigate electromagnetic impacts to the electric grid. They are: (1)  Recovery Transformer Project (RecX), and (2) Cyber Emergency  Response Team.
RecX. In 2012, S&T partnered with industry to develop a prototype  transformer that could significantly reduce the time to transport, install,  and energize a transformer to aid recovery from power outages  associated with transformer failures from several months to less than  one week. S&T, along with industry partners, demonstrated the RecX  prototype for 2.5 years, ending in September 2014. DHS reported that  RecX proved to be successful in an operational environment and has  the capacity to reduce the impact of power outages.
Cyber Emergency Response Team. CS&C operates the Industrial  Control Systems-Cyber Emergency Response Team to assist critical  infrastructure owners in the 16 sectors, including the energy sector, to  improve overall cybersecurity posture of their control systems.Industrial control systems are among the types of critical electrical  infrastructure that could be impacted in the event of an EMP attack.
section_title: Strategy Development and Planning
paragraphs: DHS has taken actions to support the development of two key strategies  and plans that could help to address electromagnetic threats. These  include areas: 1) Power Outage Incident Annex, and 2) the National  Space Weather Strategy.
Power Outage Incident Annex. In 2014, FEMA began developing a  Power Outage Incident Annex (incident annex) to provide incident- specific information, which supplements the National Response  Framework. According to FEMA officials, the incident annex will  describe the process and organizational constructs that the federal  government will utilize to respond to and recover from loss of power  resulting from deliberate acts of terrorism or natural disasters. Among  other tasks, the incident annex is designed to identify key federal  government capabilities and resources, prioritize core capabilities,  and outline response and recovery resource requirements. FEMA  officials reported that the incident annex is scheduled to be completed  by October 2015.
National Space Weather Strategy. In collaboration with the White  House Office of Science and Technology Policy and NOAA, DHS has  been working since 2014 to help develop a National Space Weather  Strategy. As a co-chair of the Space Weather Operations, Research  and Mitigation Task Force, DHS is in the process of developing a  strategy to achieve several goals, including efforts to establish  benchmarks for space weather events, improve protection and  mitigation efforts, and improve assessment, modeling, and prediction  of impacts on critical infrastructure, among other goals. According to  officials at S&T, a draft of the National Space Weather Strategy is  currently being updated to incorporate stakeholder comments and is  scheduled to be completed in September 2015.
section_title: Conducting Training Exercises
paragraphs: DHS has also conducted two training exercises that could help address  the potential impact of power outages caused by electromagnetic events,  GridEx II and Eagle Horizon.
GridEx II. In November 2013, DHS, along with the Federal Bureau of  Investigation, DOE, and other relevant government agencies,  participated in an industry-wide exercise assessing the readiness of  the electricity industry to respond to a physical or cyber attack on the  bulk power system. The key goals of GridEx II were to review existing  command, control, and communication plans and tools, incorporate  lessons learned from a previous exercise, and to identify potential  improvements in cyber and physical security plans and programs.  Upon completing the exercises, participants identified key lessons  learned, which included the need for enhanced information sharing,  and clarification of roles and responsibilities during a physical or cyber  attack.
Eagle Horizon. Since 2004, FEMA has conducted a mandatory,  annual continuity exercise for all federal executive branch  departments and agencies to ensure the preservation and continuing  performance of essential functions. Key objectives of the training  exercise include: assessing the implementation of continuity plans,  demonstrating communication capabilities, and examining broader  national continuity capabilities with state, local, and private sector  partners.
For our ongoing review, DHS did not identify its actions as specifically  responsive to the EMP Commission’s recommendations; nonetheless,  some of the actions DHS has taken since 2008 could help to mitigate  some electromagnetic impacts to the electric grid. For example, the three  identified reports provide some insights on how the electric grid may be  impacted by electromagnetic threats. Additionally, the RecX project  provided a functional prototype that may facilitate industry efforts to  further develop more mobile transformers and assist with recovery efforts  in the event of an electromagnetic attack on the electric grid. Similarly,  DHS planning efforts to develop the power outage incident annex and  space weather strategy are also steps that could help to mitigate the  negative effects of an electromagnetic threat to the electric grid by  improving critical planning and response efforts.
While DHS has taken several positive steps to address electromagnetic  threats to the electric grid since the EMP Commission issued its  recommendations in 2008, our preliminary analysis indicates that these  actions may fall short of the expectations for DHS regarding overall  responsibilities to oversee and coordinate national efforts to protect  critical electrical infrastructure, consistent with PPD-21 and the NIPP. For  example, DHS’s efforts to clearly identify agency roles and responsibilities  to date have been limited. Specifically, DHS has had difficulty identifying  the relevant DHS components, officials, or ongoing internal DHS activities  with an EMP nexus. For example, DHS officials were unable to determine  internally which component would serve as the lead—S&T or NPPD—in  regards to addressing EMP threats. In addition, NPPD has not yet  identified its specific roles and activities in addressing electromagnetic  threats even though it has been identified by the DHS Office of Policy as  the proposed risk analysis “owner” relative to space weather threats.
We recognize that DHS does not have a statutory obligation to address  the specific recommendations of the EMP Commission and many of  these recommendations were also directed to DOE. Nevertheless, we  believe that implementation of them could help mitigate electromagnetic  impacts to the electric grid, such as helping to assure the protection of  high-value transmission assets. Moreover, PPD-21 articulates DHS’s  roles and responsibilities to safeguard the nation’s critical infrastructure,  which are consistent with such recommendations. For example, PPD-21  states that DHS, in carrying out its responsibilities under the Homeland  Security Act of 2002, as amended, is to, among other things, evaluate  national capabilities, opportunities, and challenges in protecting critical  infrastructure; analyze threats to, vulnerabilities of, and potential  consequences from all hazards on critical infrastructure; identify security  and resilience functions that are necessary for effective stakeholder  engagement with all critical infrastructure sectors; integrate and  coordinate federal cross-sector security and resilience activities; and  identify and analyze key interdependencies among critical infrastructure  sectors. Moreover, PPD-21 calls for DHS to specifically consider sector  dependencies on energy and communications systems, and identify pre- event and mitigation measures or alternate capabilities during disruptions  to those systems in updating the NIPP. To date, our preliminary analysis  suggests that DHS has not fully addressed some key responsibilities  related to effectively preparing for and responding to electromagnetic  threats to the electric grid, in conjunction with DOE as the sector-specific  agency for the energy sector, which is responsible for critical electrical  infrastructure. Specifically, DHS did not identify any efforts it conducted to  support the identification of key electrical infrastructure assets or assess  cross-sector dependencies on these assets, for which DHS would be  expected to play a key role. According to officials within NPPD and the  DHS Office of Policy, factors such as competing priorities and a focus on  all hazards may contribute to limited efforts being taken by DHS to  specifically address electromagnetic threats. We will continue to assess  the extent to which DHS’s efforts align with the EMP Commission  recommendations as well as the extent to which DHS’s current and  planned actions align with its own risk management framework, as  identified in the NIPP, as we complete our work. We will report our final  results later this year.
section_title: Preliminary Analysis Indicates DHS Has Not Fully Coordinated with Stakeholders to Address some Risks to the Electric Grid
paragraphs: Our preliminary analysis indicates that since the EMP Commission issued  its recommendations in 2008, DHS has coordinated with federal and  industry stakeholders to address some, but not all risks to the electric  grid. Specifically, DHS has not fully coordinated with stakeholders in  certain areas such as identifying critical assets or collecting information  necessary to assess electromagnetic risks. Our preliminary work has  identified eight projects in which DHS coordinated with other federal  agencies or industry to help protect the electric grid. These projects  encompass a range of different protective efforts, including the  development of plans to address long term power outages, participation  in exercises, and research and development activities which address the  resiliency of electrical infrastructure (See Appendix II for a list of projects  we identified.)
Four of the eight projects we identified were initiated within the past 2  years and three specifically address the risks associated with an EMP or  GMD event. The three EMP or GMD-related projects include 1)  participation in a White House Task Force to support development of an  interagency space weather action plan; 2) collaboration with NASA to  develop precise, localized forecasts that can help utilities better respond  to solar weather events; and 3) development of EMP protection  guidelines for critical equipment, facilities, and communications/data  centers.
In addition to the specific projects identified above, DHS also coordinates  with sector stakeholders through the Energy Sector Government  Coordinating Council (EGCC)—which it co-chairs with DOE—and the  Electricity Subsector Coordinating Council (ESCC) through the Critical  Infrastructure Partnership Advisory Council. While federal officials  generally identified that EMP and GMD issues have been discussed via  these groups in recent years, they noted that the EMP threat has not  been an area of particular focus.
Although DHS participation in the identified projects is a positive step to  help mitigate some potential impacts of electromagnetic threats, our  preliminary work suggests that DHS has not fully coordinated with  stakeholders in other areas to help facilitate EMP and GMD protective  efforts. Specifically, our preliminary analysis indicates that DHS has not  fully coordinated with stakeholders to address electromagnetic threats to  the electric grid in the following areas:  Providing threat information. DHS has not identified any efforts to  specifically provide EMP-related threat information to industry  stakeholders. Industry officials we spoke with generally stated that they  do not have sufficient threat information to determine the extent to which  specific actions should be taken to mitigate the effects of an EMP event.  Whereas industry officials reported having a greater understanding of the  potential likelihood of a major GMD caused by solar weather, they noted  that applicable EMP threat briefings by DOD or DHS could help them to  better justify to their management or stockholders the level of investment  required to take protective actions. According to the Quadrennial Energy  Review, incomplete or ambiguous threat information may lead to  inconsistency in physical security among grid owners, inefficient spending  on security measures, or deployment of security measures against the  wrong threat.
This concern generally aligns with previous work related to cyber threats  in which we reported that federal partners’ efforts to share information did  not consistently meet industry’s expectations, in part, due to restrictions  on the threat information that can be shared with industry partners. generally concurred with our prior recommendations directed at  strengthening its partnership and information-sharing efforts, and has  since taken steps to enhance its information sharing activities, including  granting security clearances, and establishing a secure mechanism to  share cyber threat information. We will continue to assess DHS’s actions  regarding providing threat information on EMP as part of our ongoing  work.
Identifying key infrastructure assets. Our preliminary analysis indicates  that DHS and DOE have not taken action to identify the most critical  substations and transformers on the electric grid. According to the NIPP  risk management framework, such information is important to better  understand system dependencies and cascading impacts, as well as help  determine priorities for collecting additional information on specific asset  vulnerabilities or potential mitigation actions.
GAO, Critical Infrastructure Protection, Observations on Key Factors in DHS’s  Implementation of its Partnership Approach, GAO-14-464T (Washington, D.C.: March 6,  2014). and other federal agencies regarding the identification of key  infrastructure assets.
Collecting risk information. DHS has not fully leveraged existing  programs or utilized collaboration opportunities with federal partners to  collect additional vulnerability and consequence information related to  potential impacts to the electric grid. For example, DHS-IP has not fully  leveraged the Infrastructure Survey Tool and Regional Resiliency  Assessment Program (RRAP) to help collect additional information  related to infrastructure vulnerabilities and impacts related to  electromagnetic threats. As we have concluded previously, coordination  with other federal partners may also help ensure an integrated approach  to vulnerability assessment activities.fully leveraged other agency efforts such as DOD’s Defense Critical  Infrastructure Protection program which could provide useful information  about potential consequences of electric grid failure. According to the  NIPP, to assess risk effectively, critical infrastructure partners—including  owners and operators, sector councils, and government agencies—need  timely, reliable, and actionable information regarding threats,  vulnerabilities, and consequences. As part of our ongoing work, we will  continue to assess actions by DHS and other federal agencies regarding  the collection of applicable risk information.
For example, DHS has also not  Engaging with industry to identify research priorities and funding  mechanisms. Enhanced collaboration among federal and industry  partners is critical to help identify and address key research gaps and  priorities, and leverage available funding mechanisms. Our preliminary  analysis identified two areas—assessing transformer impacts and  development of mitigation tools—where DHS has not fully pursued  opportunities to collaborate with federal and industry stakeholders on  research, testing and identifying funding sources that could help facilitate  efforts to address electromagnetic threats to the electric grid. With respect  to transformer impacts, industry and government officials identified the  need for additional modeling and assessment as the most critical  research gap. For example, the 2012 NERC GMD Task Force found that  modeling the effects of GIC flows on transformers during a GMD event is  not sufficiently developed. Stakeholders also noted that additional action  is needed for evaluating and testing equipment that could help mitigate  electromagnetic impacts to key infrastructure assets. Specifically,  stakeholders identified that there are limited sites available for large-scale  testing, and opportunities may exist to further leverage DOE research  laboratories and other federal resources, including potential funding  mechanisms.
In our ongoing review, we will continue to evaluate federal and industry  actions to determine where specific coordination efforts could be  improved and we will report the final results later this year.
Chairman Johnson, Ranking Member Carper and Members of the  Committee, this completes my prepared statement. I would be pleased to  respond to any questions that you may have at this time.
section_title: Appendix I: Summary of 2008 EMP Commission Recommendations Addressing Electrical Infrastructure
subsections: section_title: EMP Commission Recommendations 1. The Commission recommends research be conducted to better understand infrastructure system
paragraphs: interdependencies and interactions, along with the effects of various EMP attack scenarios. In particular,  the Commission recommended that such research include a strong component of interdependency  modeling. Funding could be directed through a number of avenues, including the Department of  Homeland Security (DHS) and National Science Foundation.  2.  Expand activities to address the vulnerability of Supervisory Control and Data Acquisition (SCADA)  systems to other forms of electronic assault, such as EMP.  3.  It is vital that DHS, as early as practicable, make clear its authority and responsibility to respond to an  EMP attack and delineate the responsibilities and functioning interfaces with all other governmental  institutions with individual jurisdictions over the broad and diverse electric power system. This is  necessary for private industry and individuals to act to carry out the necessary protections assigned to  them and to sort out liability and funding responsibility.   4.  DHS particularly needs to interact with the Federal Energy Regulatory Commission (FERC), North  American Electric Reliability Corporation (NERC), state regulatory bodies, other governmental institutions  at all levels, and industry in defining liability and funding relative to private and government facilities, such  as independent power plants, to contribute their capability in a time of national need, yet not interfere with  market creation and operation to the maximum extent practical.  5.  DHS must establish the methods and systems that allow it to know, on a continuous basis, the state of the  infrastructure, its topology, and key elements. Testing standards and measurable improvement metrics  should be defined as early as possible and kept up to date.  6.  Working closely with industry and private institutions, DHS should provide for the necessary capability to  control the system in order to minimize self-destruction in the event of an EMP attack and to recover as  rapidly and effectively as possible.
section_title: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: For questions about this statement, please contact Chris Currie at (404)  679-1875 or curriec@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this statement.
section_title: Staff Acknowledgments
paragraphs: Individuals making key contributions to this statement include Dawn Hoff  (Assistant Director), Chuck Bausell, Kendall Childers, Josh Diosomito,  Ryan Lambert, Tom Lombardi, and John Rastler. Additional support was  provided by Andrew Curry, Katherine Davis, Linda Miller, and Steven  Putansu.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.