GPS Disruptions: Efforts to Assess Risks to Critical Infrastructure and Coordinate Agency Actions Should Be Enhanced
Published: 2013-11-06T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: GPS provides positioning, navigation, and timing data to users worldwide and is used extensively in many of the nation's 16 critical infrastructure sectors, such as communications and transportation. GPS is also a key component in many of the modern conveniences that people rely on or interact with daily. However, sectors' increasing dependency on GPS leaves them potentially vulnerable to disruptions. GAO was asked to review the effects of GPS disruptions on the nation's critical infrastructure. GAO examined (1) the extent to which DHS has assessed the risks and potential effects of GPS disruptions on critical infrastructure, (2) the extent to which DOT and DHS have developed backup strategies to mitigate GPS disruptions, and (3) what strategies, if any, selected critical infrastructure sectors employ to mitigate GPS disruptions and any remaining challenges. GAO reviewed documents, compared them to relevant federal guidance, and interviewed representatives and experts from federal and state governments, industry, and academia. The focus of this review was on civilian GPS uses within four critical infrastructure sectors.
section_title: What GAO Found
paragraphs: To assess the risks and potential effects from disruptions in the Global Positioning System (GPS) on critical infrastructure, the Department of Homeland Security (DHS) published the GPS National Risk Estimate (NRE) in 2012. In doing so, DHS conducted a scenario-based risk assessment for four critical infrastructure sectors using subject matter experts from inside and outside of government. Risk assessments involve complex analysis, and conducting a risk assessment across multiple sectors with many unknowns and little data is challenging. DHS's risk management guidance can be used to help address such challenges. However, we found the NRE lacks key characteristics of risk assessments outlined in DHS's risk management guidance and, as a result, is incomplete and has limited usefulness to inform mitigation planning, priorities, and resource allocation. A plan to collect and assess additional data and subsequent efforts to ensure that the risk assessment is consistent with DHS guidance would contribute to more effective GPS risk management.
A 2004 presidential directive requires the Department of Transportation (DOT), in coordination with DHS, to develop backup capabilities to mitigate GPS disruptions, and the agencies have initiated a variety of efforts that contribute to fulfilling the directive. For example, DOT is researching GPS alternatives for aviation, and DHS began efforts on GPS interference detection and mitigation and is researching possibilities for a nationwide backup to GPS timing, which is used widely in critical infrastructure. However, due to resource constraints and other reasons, the agencies have made limited progress in meeting the directive, and many tasks remain incomplete, including identifying GPS backup requirements and determining suitability of backup capabilities. Furthermore, the agencies' efforts have been hampered by a lack of effective collaboration. In particular, DOT and DHS have not clearly defined their respective roles, responsibilities, and authorities or what outcomes would satisfy the presidential directive. Without clearly defining both roles and desired outcomes, DOT and DHS cannot ensure that they will satisfy mutual responsibilities. Implementing key elements of effective collaboration would allow the agencies to address many uncertainties regarding fulfillment of their presidential policy directive.
Selected critical infrastructure sectors employ various strategies to mitigate GPS disruptions. For example, some sectors can rely on timing capabilities from other sources of precise time in the event of GPS signal loss. However, both the NRE and stakeholders we interviewed raised concerns about the sufficiency of the sectors' mitigation strategies. Federal risk management guidance requires DHS to work with federal agencies and critical infrastructure sector partners to measure the nation's ability to reduce risks to critical infrastructure by using a process that includes metrics. We found that DHS has not measured the effectiveness of sector mitigation efforts to GPS disruptions and that, as a result, DHS cannot ensure that the sectors could sustain essential operations during GPS disruptions. The lack of agreed-upon metrics to measure the effectiveness of sector mitigation efforts hinders DHS's ability to objectively assess improvements, track progress, establish accountability, provide feedback mechanisms, or inform decision makers about the appropriateness of the mitigation activities.
section_title: What GAO Recommends
paragraphs: DHS should ensure that its GPS risk assessment approach is consistent with DHS guidance; develop a plan to measure the effectiveness of mitigation efforts; and DOT and DHS should improve collaboration. DHS concurred with the latter two recommendations but did not concur with the first. GAO continues to believe that improving the risk assessment approach will capitalize on progress DHS has made and will improve future efforts.

section_title: Letter
paragraphs: The satellite-based Global Positioning System (GPS) provides  positioning, navigation, and timing (PNT) data to users worldwide. GPS is  used extensively in many infrastructure sectors, including most of the 16  sectors identified as critical to the nation’s economy, security, and  health—referred to as “critical infrastructure sectors.” Many of these  critical infrastructure sectors have grown dependent on GPS technology  as GPS-supported applications have become increasingly embedded in  their operations. GPS is also a key component in many of the modern  conveniences that people rely on or interact with daily. GPS receivers are  in everything from cell phones and wristwatches to bulldozers, shipping  containers, and automatic teller machines. However, interference from a  variety of sources—such as space weather events or devices that  intentionally block GPS signals—can disrupt GPS and affect its reliability.
The Department of Homeland Security (DHS) is responsible for  coordinating a national effort to protect our critical infrastructure and  published a report in 2012 on the infrastructure risks from GPS  disruptions. The Department of Transportation (DOT) serves as the lead  civilian agency on GPS-related issues and represents all civilian agencies  in issues related to GPS development, acquisition, management, and  operations. The President directed DOT, in coordination with DHS, to  develop, acquire, operate, and maintain backup PNT capabilities that can  support critical civilian and commercial infrastructure within the United  States during a GPS disruption. The inability to mitigate the negative  effects of a GPS disruption, especially a longer-term disruption, could  potentially lead to loss of life or billions in economic losses.
You asked us to provide information on the risks and potential effects of  GPS disruptions on the nation’s critical infrastructure. This report  examines (1) the extent to which DHS has assessed the risks of GPS  disruptions and their potential effects on the nation’s critical infrastructure,  (2) the extent to which DOT and DHS have planned or developed backup  capabilities or other strategies to mitigate the effects of GPS disruptions,  and (3) what strategies, if any, selected critical infrastructure sectors  employ to mitigate the effects of GPS disruptions, and any remaining  challenges they face.
To address our objectives, we focused on civilian, as opposed to military,  uses of GPS because the majority of GPS applications and users are  civilian. We also focused on four critical infrastructure sectors— communications, energy, financial services, and transportation systems— because of their high degree of dependence on GPS and  interdependence with other sectors, among other reasons. Similar to our  prior reviews of DHS’s risk assessments, we evaluated DHS’s 2012 GPS  risk assessment against established federal risk assessment criteria for  critical infrastructure protection. We examined agency documentation on  the efforts DOT and DHS have undertaken to plan or develop GPS  backup capabilities, reviewed relevant federal policies and presidential  directives, and compared the agencies’ efforts to the requirements in  these policies and directives. We compared DOT’s and DHS’s efforts  against our criteria on key elements of effective collaboration. We also  reviewed literature from academia and other GPS subject matter experts.  Additionally, we contacted federal government officials from agencies  involved in GPS governance—such as the Department of Defense  (DOD), DOT, and DHS—and agencies involved in critical infrastructure  protection for each of the four sectors we studied, such as the  Department of Energy (DOE) and the Department of the Treasury. We  also contacted state government officials through the U.S. States & Local  Government Subcommittee of the Civil GPS Service Interface Committee,  a forum established by DOT to exchange information about GPS with the  civilian user community. We contacted industry representatives for each  of the four sectors we studied and various GPS subject matter experts,  including members of the National Space-Based PNT Advisory Board  (Advisory Board), a federal advisory committee that provides independent  advice to the U.S. government on GPS matters. In selecting GPS  experts, we considered relevant published literature; their experience as  reflected in publications, testimonies, positions held, and their  biographies; and stakeholders’ recommendations.
We conducted this performance audit from November 2012 through  November 2013, in accordance with generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives. A more detailed  discussion of our objectives, scope, and methodology appears in  appendix I.
subsections: section_title: Background
paragraphs: The U.S. government has invested more than $5 billion since 2009 in  GPS and provides GPS service free of direct charge to users worldwide.  As shown in figure 1, GPS consists of the space segment, the ground- control segment, and the user segment. The U.S. Air Force develops,  maintains, and operates the space and ground-control segments.
The space segment consists of a constellation of satellites  transmitting radio signals to users. The Air Force manages the  constellation to ensure the availability of at least 24 GPS satellites 95  percent of the time.
The ground-control segment consists of a global network of ground  facilities that track the GPS satellites, monitor their transmissions,  perform analyses, and send commands and data to the constellation.
The user segment consists of GPS receiver equipment, which  receives the signals from the GPS satellites and uses the transmitted  information to calculate the user’s three-dimensional position and  time.
GPS is used extensively and in various ways in many critical  infrastructure sectors for PNT information. For example, among other  uses, the communications sector uses the GPS timing function to  synchronize call handoffs in wireless communications. The energy  sector’s bulk power system uses GPS timing in a component that  provides status measurements at frequent points in time. The financial  services sector uses GPS timing to time stamp financial transactions,  match trading orders, and synchronize financial computer systems. The  transportation systems sector uses GPS for safe and efficient operations.  For example, aircraft use GPS for en-route navigation and landings; the  maritime industry uses GPS for navigation and as a safety and situational  tool in high-traffic ports; commercial vehicles use GPS for positioning,  navigation, and fleet management; and rail systems use GPS for asset  management, tracking, and positive train control, which supports collision  avoidance.
Presidential directive assigns GPS governance roles, and there are other  policies and directives that apply to critical infrastructure protection that  are important for GPS governance. These policies and directives include:  (1) National Security Presidential Directive 39, (2) Homeland Security  Presidential Directive 7, (3) the National Infrastructure Protection Plan,  and (4) Presidential Policy Directive 21.
National Security Presidential Directive 39 (NSPD-39). NSPD-39  assigns governance roles to numerous federal agencies and other  entities. In particular, within DOD, the Air Force is responsible for the  overall development, acquisition, operation, security, and continued  modernization of GPS. DOT serves as the lead civilian agency on  GPS-related issues and has lead responsibility for developing  requirements for civilian applications. DHS, through the U.S. Coast  Guard’s Navigation Center, provides user support to the civilian, non- aviation GPS community. Additionally, NSPD-39 requires that DOT, in  coordination with DHS, develop, acquire, operate, and maintain  backup capabilities that can support critical civilian and commercial  infrastructure during a GPS disruption. NSPD-39 also assigns DHS  (in coordination with other agencies) the responsibility to identify,  locate, and attribute any interference within the United States that  adversely affects GPS use and to develop a central repository and  database for reports of domestic and international interference to GPS  civilian services. NSPD-39 also directed the federal government to  improve the performance of space-based PNT services, including by  developing more robust resistance to interference for national security  purposes, homeland security, and civilian, commercial, and scientific  users worldwide. Furthermore, NSPD-39 assigns the Department of  Commerce and the Federal Communications Commission (FCC)  responsibility for mitigating electronic interference with U.S. space- based PNT services within the United States. NSPD-39 also  established a National Executive Committee for Space-Based PNT  (National Executive Committee), chaired jointly by DOD and DOT, to  coordinate GPS-related matters across federal agencies. The  National Coordination Office for Space-Based PNT (NCO) houses the  permanent staff of the National Executive Committee and provides  day-to-day support for the committee’s activities. Among other things,  the National Executive Committee issued a 5-year plan for space- based PNT that recommends that DHS institute a risk management  approach to assess threats, vulnerabilities, and potential  consequences to interference to GPS signals and examine the best  opportunities to mitigate those risks. See figure 2 for the national  space-based PNT organization structure.
Homeland Security Presidential Directive 7 (HSPD-7). Issued in  2003, the purpose of HSPD-7 was to establish a national policy for  federal departments and agencies to identify, prioritize, and protect  critical infrastructure and key resources. HSPD-7 designated DHS as  the agency responsible for coordinating the nation’s efforts to protect  critical infrastructure. DHS was directed to coordinate protection  activities for each critical infrastructure sector through designated  Sector-Specific Agencies (SSA). In accordance with applicable laws  or regulations, DHS and the SSAs were directed to collaborate with  appropriate private sector entities and continue to encourage the  development of information sharing and analysis mechanisms to  identify, prioritize, and coordinate the protection of critical  infrastructure and key resources.
National Infrastructure Protection Plan (NIPP). In 2006, DHS  addressed the requirements of HSPD-7 by issuing the first NIPP,  which DHS updated in 2009. The NIPP provides an overarching  approach for integrating the nation’s many critical infrastructure  protection initiatives. The cornerstone of the NIPP is its risk  management framework, which defines roles and responsibilities for  DHS, the SSAs, and other federal, state, regional, local, and private  sector partners. Assessing risks is part of this framework, and the  NIPP specifies core criteria for risk assessments. The NIPP  specifically identifies GPS as a system that supports or enables  critical functions in critical infrastructure sectors.
Presidential Policy Directive 21 (PPD-21). Issued in February  2013, PPD-21 supersedes HSPD-7 and states that critical  infrastructure must be secure and able to withstand and rapidly  recover from all hazards. The directive refines and clarifies the  critical infrastructure-related functions, roles, and responsibilities  across the federal government, as well as aims to enhance overall  coordination and collaboration. PPD-21 directs DHS to conduct  comprehensive assessments of the vulnerabilities of the nation’s  critical infrastructure in coordination with the SSAs and in  collaboration with critical infrastructure owners and operators.  Executive Order 13636 was also issued in February 2013 to improve  critical infrastructure cybersecurity. According to DHS,  implementation of the executive order and PPD-21 includes updating  the NIPP by October 2013.
Disruption of the GPS signal can come from a variety of sources,  including radio emissions in nearby bands, jamming, spoofing, and  naturally occurring space weather.
Spectrum encroachment from radio emissions in nearby bands can  cause interference to the GPS signal when the stronger radio signals  overpower the relatively weak GPS signals from space. Additionally,  according to FCC, some GPS receivers are purposefully designed to  receive as much energy as possible from GPS satellites, which makes  the receivers vulnerable to interference from operations in nearby  bands. With this type of interference, GPS devices pick up the  stronger radio signals and become ineffective.
Jamming devices are radio frequency transmitters that intentionally  block, jam, or interfere with lawful communications, such as GPS  signals.
Spoofing involves the replacement of a true satellite signal with a  manipulated signal, whereby the user may not realize they are using  an incorrect GPS signal and may continue to rely on it. Articles and  lab experiments have illustrated potential for harm in the bulk power  system, maritime navigation, financial markets, and mobile  communications, among other areas.
Space weather can also cause interference to GPS signals. For  example, during solar flare eruptions, the sun produces radio waves  that can interfere with a broad frequency range, including those  frequencies used by GPS.
section_title: DHS Completed a Risk Assessment for GPS, but It Is Incomplete and Does Not Fully Conform to Guidance
subsections: section_title: DHS Issued a GPS National Risk Estimate
paragraphs: In September 2011, to fulfill the National Executive Committee’s request  for a comprehensive assessment of civilian GPS risks, DHS issued the  National Risk Estimate (NRE) to the NCO; DHS officials said the final  NRE was published in November 2012 with minor revisions. According  to DHS officials, the NRE is modeled after other risk estimates and efforts  in the intelligence community. In developing the NRE, DHS conducted a  scenario-based risk assessment for critical infrastructure using subject  matter experts from inside and outside government. The NRE focuses on  4 of the 16 critical infrastructure sectors: communications, emergency  services, energy, and transportation systems. According to DHS  officials, they chose these 4 sectors because they use GPS to support or  fulfill their core missions and because they provide an appropriate cross- section of risks and potential impacts that could apply broadly to other  sectors. The NRE considers three types of GPS disruption scenarios: (1)  naturally occurring disruptions, such as space weather events; (2)  unintentional disruptions, such as radio frequency signals interfering with  GPS signals; and (3) intentional disruptions, such as jamming or  spoofing. DHS solicited information from federal and private sector  stakeholders and held several workshops on various risk scenarios with  the subject matter experts, including one on the overall likelihood of  occurrence of the risk scenarios. DHS also held sector-specific  workshops on the consequences of GPS disruptions and alternative  futures for each sector based on varying degrees of community attention  to these security challenges. DHS used alternative futures to consider  the risk outlook over the next 20 years. According to DHS, the process of  developing the NRE helped clarify aspects of critical infrastructure  dependence on GPS and vulnerability to interference or an outage that  were previously uncertain. Specifically, DHS officials told us that the NRE  helped them understand the significance of the wide usage of GPS timing  in systems throughout the nation’s critical infrastructure. According to  DHS, through the NRE workshops and the exchange of ideas, sector  representatives also developed greater awareness of risks.
section_title: The NRE Did Not Fully Follow Risk Assessment Guidance or Fully Assess GPS Risks
paragraphs: Risk assessments, such as the NRE, involve complex analysis;  conducting a risk assessment across multiple sectors of systems with  many unknowns and little data is particularly challenging. The NIPP  specifies core criteria for risk assessments and provides a framework for  managing risk among the nation’s critical infrastructure sectors. Aspects  of DHS’s NRE are consistent with the NIPP, such as the use of scenarios  and subject matter experts and considering both the present and future  level of risk. However, the NRE lacks key characteristics of risk  assessments as outlined in the NIPP, and the NRE has not been widely  used to inform risk mitigation priorities. The lack of an overall DHS plan  and time frame to collect relevant threat, vulnerability, and consequence  data and to develop a risk assessment approach more consistent with the  NIPP could continue to hinder the ability of federal and private leaders to  manage the risks associated with GPS disruptions.
The NIPP states that risk assessment is at the core of critical  infrastructure protection and that it can be used to help address the  associated challenges through its framework for assessing risk. The NIPP  identifies the essential characteristics of a good risk assessment and calls  for risk assessments to be (1) complete, (2) reproducible, (3) defensible,  and (4) documented so that results can contribute to cross-sector risk  comparisons for supporting investment, planning, and resource  prioritization decisions. Our review of these NIPP characteristics with  respect to the NRE follows.
Complete. According to the NIPP, to be complete, the methodology  should assess threat, vulnerability, and consequence for every  defined risk scenario. We found the NRE examines these three key  elements of a risk assessment but does not fully conform to the NIPP  because, as described below, the NRE does not consider all relevant  threats or assess the vulnerabilities of each sector reviewed, and the  consequence assessment is incomplete because it fails to estimate  the potential losses. In addition, the NRE considers just four critical  infrastructure sectors. DHS officials acknowledged that their  assessment was in some respects limited because they chose not to  include all sectors due to resources and time constraints. For  example, DHS planning documents state that they had originally  planned to include the banking and finance sector, but DHS officials  told us that they dropped it when they could not identify the subject  matter experts necessary to complete a risk analysis. The NIPP  highlighted the importance of the banking and finance sector as a  high-risk critical infrastructure sector, noted that nearly all sectors  share relationships with banking and finance, and stated that banking  and finance relies on GPS as its primary timing source.
Reproducible. According to the NIPP, the methodology must produce  comparable, repeatable results, and minimize the use of subjective  judgments, leaving policy and value judgments to be applied by  decision makers. We found the NRE does not conform to the NIPP  because it is based entirely on subjective judgments of panelists and  is not reproducible. Three subject matter experts we interviewed told  us they were skeptical about the quality of the panel deliberations and  characterized the member judgments as “educated guesses.”  Moreover, if different panelists were chosen, the results might have  been different.
Defensible. According to the NIPP, the methodology should be  logical, make appropriate use of professional disciplines, and be free  of significant errors and omissions. Uncertainty of estimates and level  of confidence should be communicated. The NRE addresses some of  these standards, including identifying various uncertainties related to  its estimates. However, it is unclear that DHS made appropriate use  of professional disciplines. Given the lack of data, subject matter  experts were called upon to inform DHS’s statistical modeling. DHS  officials told us that they depended on the SSAs to suggest subject  matter experts and used a consultant to identify subject matter  experts beyond the SSAs’ suggestions. However, industry  representatives we interviewed questioned whether the panels had  sufficiently broad expertise to capture the full scope of GPS  vulnerabilities within sectors. For example, energy sector industry  representatives told us that the energy sector panel experts only  covered certain aspects of the electricity industry, not the entire  energy sector. DHS officials told us that that at times the SSAs had  difficulty suggesting subject matter experts. According to one official, it  was difficult to find people within the various sectors who understood  how GPS was embedded in their operations; he noted that sometimes  it took 20 to 30 telephone calls in a given sector to locate an individual  well-versed on the subject. However, decisions on expert selection  are not documented in the NRE, meaning others cannot reasonably  review and reproduce the NRE’s efforts. In addition, we found the  NRE’s calculations of risk are not sufficiently transparent to assess  whether the risk estimates are defensible and free of significant error.  For example, the NRE’s documentation is insufficiently transparent to  support its determination that unintentional interference is a high risk  for all four selected sectors where likelihood is high, but the  consequences are deemed to be fairly low for three of the four  sectors. Further, in the energy sector, a sophisticated, coordinated,  continuous pinpointed spoofing attack against multiple targets is rated  as having greater consequences than the other scenarios, yet due to  its low estimated likelihood, is rated as having the lowest risk for  energy scenarios. Without adequate explanation or presentation of  the underlying data, the NRE lacks the transparency to verify that the  estimate is defensible and free of significant error. Similarly, scenarios  with the greatest uncertainty are rated as having the highest risk  without sufficient data for an independent reviewer to verify. We  requested additional documentation of these estimates, but DHS did  not provide it.
Documented. According to the NIPP, the assumptions and  methodology used to generate the risk assessment must be clearly  documented. The NRE did include elements that were consistent with  the NIPP, such as describing the NRE’s underlying analytic  assumptions, its various workshops on likelihood and consequences,  and its use of subject matter experts and a statistical simulation model  to overcome limited data. Nonetheless, we found that overall, the  NRE does not conform to this guideline because, as previously noted,  it does not document how the subject matter experts, who were  identified as inside and outside government, were selected. Absent  reliable data, the NRE depends on the reliability of the expert panels.  This and other documentation issues, such as not fully reporting the  underlying data supporting the risk calculations, also affect the NRE’s  reproducibility and defensibility.
Furthermore, the NIPP states that risk is a function of three  components—threat, vulnerability, and consequence—and a risk  assessment approach must assess each component for every defined  risk scenario. We found that there are factors in the NRE’s analysis that  specifically undermined the validity of the three components of a risk  assessment, as follows.
Threat. According to the NIPP, risk assessments should estimate an  intentional threat as the likelihood that an adversary would attempt a  given attack method against a target, and for other hazards, threat is  generally estimated as the likelihood that a hazard will manifest itself.  To complete the NRE, DHS issued data calls and held a workshop on  the overall likelihood of GPS disruptions. Nonetheless, the NRE  overall does not conform to the NIPP because the NRE neither uses  its threat assessment to inform its threat-likelihood rankings, nor  considers all relevant threats. In a separate classified annex, the NRE  considers the threat likelihood of a range of GPS disruptions, which  follows NIPP guidance to consider terrorist capability and intent.  However, DHS officials told us that this threat information was not  used for the NRE. DHS officials stated that the DHS Office of  Intelligence and Analysis had not provided a draft of the threat annex  in time for the May 6, 2011, scenario likelihood workshop, so the  annex could not inform the ranking of the scenario likelihoods. The  NIPP also requires an all-hazards approach for risk assessment. DHS  officials told us that their selection of GPS disruption scenarios was  based on discussions with subject matter experts. However, it is  unclear how the threats for the risk scenarios were selected. For  instance, while the NRE cites the threat of spectrum encroachment,  which involves the potential for interference from new communication  services near GPS frequencies, and considers alternative futures  scenarios based in part on how potential spectrum encroachment is  managed, it is not clear why the risk scenarios did not include the risk  of interference to GPS receivers from operations in other frequency  bands. DHS officials told us that while the spectrum encroachment  issue was relevant and a topic of discussion with subject matter  experts during the NRE’s development, it was outside the scope of  what the NRE sought to assess because it stems from policy making  rather than a threat from potential adversaries.
Vulnerability. The vulnerability assessment in the NRE does not  meet the criteria in the NIPP because it does not identify  vulnerabilities specific to the sector nor the GPS dependencies of the  sectors’ key systems. Instead, the NRE assessed general  vulnerabilities that did not consider specific sectors or the key systems  used by those sectors. Without such a sector-specific assessment,  the NRE does not adequately identify critical infrastructure systems’  vulnerabilities and critical dependencies, nor develop estimates of the  likelihood that an attack or hazard could cause harm. The NRE states  that DHS was constrained in conducting unique vulnerability  assessments for each of the four sectors because of limited data and  key uncertainties. The NRE acknowledges that this constraint is a  limitation of the report and that a likelihood workshop was used to  estimate a combined threat and vulnerability assessment.
Consequence. The NIPP states that at a minimum, consequences  should focus on the two most fundamental components—human  consequences and the most relevant direct economic consequences.  For the NRE, DHS held sector-specific workshops on the  consequences of GPS disruptions and projected a risk outlook over  the next 20 years. However, the NRE focuses on assessing the  potential impacts on sector functions, but does not assess how  disruptions in those sector functions could affect the economy or  safety of life. Without more specific analysis of the consequences, the  overall risks from GPS disruptions cannot be calculated or compared  across all sectors. DHS officials acknowledged that this was an area  for improvement. The NRE also discusses sector interdependencies  at a high level, but DHS did not survey the potential economic or  safety-of-life consequences of these interdependencies.
The NIPP and other DHS guidance states that risk assessments are to be  used to inform planning and priorities; however, we found the NRE has  not been widely used. In particular, in addition to the NIPP guidance, the  DHS strategic plan and risk management framework state that risk  assessments should be used to inform and prioritize risk mitigation. The  NRE states that it is to be used to inform executive-level decisions. The  NCO told us that the NRE’s intended use was to help inform senior  government officials about the risks posed to the nation’s critical  infrastructure sectors by relying upon the GPS signal. NCO officials  stated that they and the National Executive Committee, which requested  the study, were satisfied with the NRE. The NRE has also been  distributed to other federal agencies. One DHS component, the Office of  Cybersecurity and Communications, told us that the NRE had been  helpful in understanding some of the threats, especially to timing, but  officials from another component, the Transportation Security  Administration (TSA), told us that they are not using the NRE. For  example, TSA officials said they found the NRE to be very general and  did not see the relevance to TSA. Officials from two other agencies, the  Departments of Defense and Energy, told us that the NRE was not  helpful. Subject matter experts we contacted, some of whom participated  in the NRE, expressed their concerns about the validity of the NRE, and  one noted that industry does not have access to the final NRE because it  is designated “For Official Use Only” (FOUO). DHS officials told us that in  2013, DHS began using the NRE to inform the planning and prioritization  of initial steps to raise awareness of GPS disruptions. For example,  among other things, they uploaded the NRE to a homeland security  information-sharing portal to share with sector partners, and they told us  that they have recently begun using the NRE for outreach to raise sector  awareness but, as to specific guidance, they could only provide an  example of brief correspondence encouraging sectors to identify their  specific sources for PNT data. It has been 2 years since the NRE was  issued and these preliminary steps do not rise to the level of a plan and a  time frame to address how the considerable data gaps across 16 critical  infrastructure sectors are to be closed.
In response to the National Executive Committee’s request for a risk and  mitigation assessment, DHS commissioned a separate study that was  performed concurrently with the NRE. According to the NIPP, mitigation  approaches should use the risk assessment’s results to establish  priorities and determine those actions that could provide the greatest risk  mitigation benefits and inform planning and resource decisions. The  mitigation report does not use the risk assessment’s results of the NRE  and instead, focused on generic mitigation issues and technologies.  As  a result, it is unclear whether the pursuit of the mitigation report’s  recommendations would address the highest risks of GPS disruption to  critical infrastructure.
DHS officials acknowledged the data and methodological limitations of  the NRE, but stated that they have no plans to conduct another NRE on  GPS because of resource constraints. The lack of an overall DHS plan  and time frame to collect relevant data, periodically review the readiness  of data to conduct a more robust risk assessment, and develop a risk  assessment approach more consistent with the NIPP could continue to  hinder the ability of federal and private leaders to manage the risks  associated with GPS disruptions. Based on our review, opportunities exist  for DHS to develop an enhanced risk assessment. For example, recent  assessments performed by the private sector continue to report that the  risk associated with GPS disruptions are a growing concern and that  there are potential economic consequences. By considering this  additional threat, vulnerability, and consequence information, DHS would  be better positioned to employ a GPS risk assessment approach  consistent with the NIPP. Furthermore, as previously mentioned, the  National Executive Committee’s 5-year plan for 2009-2013 also  recommends that DHS institute a risk management approach to  assessing threats, vulnerabilities, and potential consequences to  interference to GPS signals and examine the best opportunities to  mitigate those risks. Because of the shortcomings we found in the NRE,  we do not believe that DHS has instituted an adequate risk management  approach to address the risks associated with GPS interference.
section_title: DOT and DHS Have Initiated Mitigation Efforts, but Have Not Met All Requirements
subsections: section_title: DOT and DHS Are Required to Develop Backup Capabilities to Mitigate GPS Disruptions but Have Made Limited Progress
paragraphs: According to a presidential directive, DOT, in coordination with DHS, is  required to develop, acquire, operate, and maintain backup capabilities  that can support critical civilian and commercial infrastructure in the event  of a GPS disruption. NSPD-39 also assigns DHS (in coordination with  other agencies) the responsibility to identify, locate, and attribute any  interference that adversely affects GPS use and to develop a central  repository and database for reports of domestic and international  interference. DOT and DHS have initiated a variety of ongoing mitigation  efforts that contribute to fulfilling their presidential directive, such as (1)  developing plans and strategies for the nation’s PNT architecture, (2)  researching GPS alternatives for aviation, (3) developing plans and  strategies for GPS interference detection, (4) researching possibilities for  a nationwide timing backup, and (5) conducting other studies.
Developing plans and strategies for the nation’s PNT  architecture. As a precursor to providing GPS backup capabilities per  NSPD-39, DOT, in conjunction with DOD and with participation from  31 government agencies, including DHS, developed a national PNT  architecture report and implementation plan to help guide the federal  government’s PNT investment decisions. Issued in 2008, the National  PNT Architecture report documented the nation’s current mix of “ad  hoc” PNT sources and identified a number of capability gaps. To  address these gaps, the report recommended that the nation  transition to a “greater common denominator” strategy, where the  PNT needs of many users are efficiently met through commonly  available solutions, rather than numerous, individual systems.  Additionally, the report acknowledged that GPS is the cornerstone of  the nation’s PNT capabilities and made a number of  recommendations that would ensure continued availability of PNT  service during GPS disruptions through, for example, the ability to  provide PNT from alternative sources when a primary source is not  available. The National PNT Architecture implementation plan,  released in 2010, identified the tasks federal agencies would need to  take to implement the report’s recommendations.
Researching GPS alternatives for aviation. Through the Federal  Aviation Administration’s (FAA) Alternative PNT initiative, DOT is  researching potential GPS backup solutions for the Next Generation  Air Transportation System (NextGen). To meet NextGen’s  navigation and performance requirements, GPS will be the primary  navigation aid for aircraft. According to FAA officials, the legacy  navigation systems currently used by aircraft during GPS disruptions  are not capable of supporting new NextGen capabilities. As a result,  FAA is conducting feasibility studies and analysis on three potential  systems that can be used as a GPS backup for NextGen and,  according to FAA officials, expects to make a decision by 2016.
Developing plans and strategies for GPS interference detection.
In 2007, DHS began efforts on GPS interference detection and  mitigation (IDM) to improve the federal government’s ability to detect,  locate, and mitigate sources of GPS interference. Among DHS’s  planned activities were developing a central repository for GPS  interference reports, and identifying GPS backup-system  requirements and determining suitability of backup capabilities.
Researching possibilities for a nationwide timing backup.
According to DHS officials, in 2012 the Coast Guard entered into a  research agreement with a technology company to test alternative,  non-space-based sources of precise time. Additionally, according to  DHS officials, in late 2012 the National Institute of Standards and  Technology began researching the possibility of using the nation’s  fiber networks as an alternative, non-space-based source of precise  time. Both research efforts are ongoing.
Conducting other studies. DHS has conducted or commissioned  other studies related to GPS mitigation. For example, in 2009, DHS  surveyed federal agencies to better understand their GPS capabilities,  requirements, and backup systems. However, not all SSAs responded  to DHS’s requests for information. As previously mentioned, DHS also  commissioned a study of GPS risk mitigation techniques, which was  conducted concurrently with the NRE and issued in 2011. Among  other things, the study described actions that GPS users can take to  improve the resiliency of their GPS receivers against jamming and  spoofing and recommended that federal regulators of critical  infrastructure ensure that the infrastructure they regulate possesses  sufficient resiliency to operate without GPS timing. According to  DHS officials, DHS continues to examine the study’s findings and  recommendations, although specific actions remain unbudgeted. In  commenting on a draft of this report, DHS noted that it also awarded  funding in May 2013 to develop technologies to detect and localize  sources of GPS disruptions, among other things, and in July 2013,  commissioned a study to assess potential sector-specific and cross- sector threat mitigation technologies, among other things, for the  communications sector and electricity subsector of the energy sector.
Although DOT and DHS have taken the above initiatives, they have made  limited progress implementing their plans to develop, acquire, operate,  and maintain backup capabilities and, overall, the requirements of NSPD- 39 remain unfulfilled. For example, with respect to DOT efforts, little  progress has been made on the tasks outlined in the National PNT  Architecture implementation plan since its issuance 3 years ago. DOT  officials cited a variety of reasons why additional progress has not been  made, including resource constraints, uncertainty, and competing  priorities. In particular, DOT assigned lead responsibility for PNT to the  Research and Innovative Technology Administration (RITA), yet RITA’s  Office of PNT and Spectrum Management has three full-time staff  members, one of whom works on the National PNT Architecture  implementation plan in addition to other responsibilities. One senior DOT  official involved in GPS management also stated that, organizationally,  another key issue was uncertainty surrounding which federal agencies  would take responsibility for ensuring the plan was implemented and for  funding the various tasks and programs. According to this official, the  implementation plan did not get optimal support from federal agencies  that were assigned tasks because these agencies did not have resources  to devote to completing those tasks. In addition, DOT officials said little  progress was made on the implementation plan because immediately  after its issuance in 2010, DOT staff with GPS expertise shifted their  focus to proceedings surrounding a wireless broadband network proposal  by a company called Lightsquared—a proposal which government  officials, industry representatives, and GPS experts demonstrated could  cause significant GPS interference. However, DOT officials stated that  information supporting the implementation plan has been incorporated  into the most recent Federal Radionavigation Plan.
Similarly, DHS has completed few IDM activities, though the agency has  taken some steps. For example, DHS established an incident portal to  serve as a central repository for all agencies reporting incidents of GPS  interference and developed draft interagency procedures and a common  format for reporting incidents. The incident portal is hosted by FAA, but  due to its security policy, other agencies are not able to access the  portal. Other activities remain incomplete, including those related to  identifying GPS backup-system requirements and determining suitability  of backup capabilities. DHS officials cited a variety of reasons why they  have not made additional progress, such as insufficient staffing and  budget constraints. With respect to insufficient staffing, DHS’s PNT  Program Management Office, which leads the agency’s IDM efforts, has  three full-time staff members, one of whom is currently working in another  component of DHS. With respect to budget constraints, DHS officials in  the PNT Program Management Office stated that it is difficult to obtain  financial resources in the current constrained budget environment. While  DHS is in the process of formally implementing and standardizing  procedures for information sharing among agency PNT operations  centers when GPS disruptions occur, it does not have plans intended to  address some other IDM activities, such as those related to development  of GPS backup requirements and analysis of alternatives for backup  capabilities.
Additionally, stakeholders expressed concern that DHS’s IDM efforts are  separated from other critical infrastructure protection efforts within DHS,  but DHS has indicated that a new interagency task force will increase  coordination between these efforts. Specifically, DHS’s National  Protection and Programs Directorate (NPPD) leads and manages efforts  to protect the nation’s 16 critical infrastructure sectors, but the PNT  Program Management Office, within the Office of the Chief Information  Officer, leads DHS’s IDM efforts, as shown in figure 3. Members of the  Advisory Board and the GPS experts from academic and other research  institutions we spoke with expressed concern that this organizational  structure means that GPS management does not receive the same level  of attention and resources as the agency’s other efforts to protect key  national assets. DHS previously acknowledged that the agency’s GPS  efforts were event-driven, that resources were provided on an ad-hoc  basis, and that NPPD was uniquely structured to fulfill many of NSPD- 39’s objectives, given its role of developing risk-mitigation strategies for  critical infrastructure protection efforts. However, regarding this  organization, DHS officials said that GPS expertise has been within the  Office of the Chief Information Officer since DHS’s creation and that the  positions were originally hired to fulfill other DHS missions. As PNT  issues became more prevalent, these positions evolved into the PNT  Program Management Office. The officials noted that through a new  interagency task force formed in April 2013, NPPD will have increased  involvement in the agency’s IDM efforts.
Figure 4 provides a timeline of DOT’s and DHS’s efforts to provide GPS  backup capabilities since the issuance of NSPD-39 in 2004.
In addition to the challenges described above, DOT and DHS’s ability to  provide for backup capabilities as specified in the presidential directive  has been hampered by a lack of effective collaboration. In prior work, we  have identified key elements of effective collaboration that can help  enhance and sustain collaboration among federal agencies, thereby  maximizing performance and results. Specifically, we have previously  found that key elements of effective collaboration include clearly defining  (1) roles, responsibilities, and authorities; (2) outcomes and monitoring  progress toward outcomes; and (3) written agreements regarding how  agencies will collaborate. DOT and DHS have not followed these  practices; for example:
Roles and responsibilities. DOT and DHS have not clearly defined  what each agency’s respective roles, responsibilities, and authorities  are in terms of satisfying the presidential directive to provide GPS  backup capabilities. Defining roles and responsibilities ensures that  agencies have clearly articulated and agreed on which entity will do  what and what is expected of each party. Various discussions we had  with DOT and DHS officials indicated there is considerable confusion  and lack of clarity between the agencies about what their roles,  responsibilities, and authorities are, despite the guidance in NSPD-39.  For example, DOT officials told us that they handle backup  capabilities for aviation, but they depend on DHS and industry to  provide backup capabilities for the other critical infrastructure sectors.  DOT officials questioned why DOT would provide backup capabilities  for non-transportation sectors and whether doing so would make  sense. The DOT officials highlighted that sectors look to DHS for  cross-sector capabilities to protect key national assets, such as GPS,  and that DHS is better positioned to lead this effort given its mission  and experience with managing and mitigating risks to critical  infrastructure sectors. However, DHS officials we contacted told us  that NSPD-39 places lead responsibility with DOT, not DHS. They  stated that DHS has no legal basis or other authority to require that  GPS users take measures to mitigate GPS disruptions by having  backup capabilities in place. DHS officials also said that it may be  industries’ and individual sectors’ responsibilities to ensure their  systems have GPS backup capabilities, in coordination with their  SSA. A DOD official and the GPS experts from academic and other  research institutions we contacted also noted that it is not clear what  entity or agency oversees GPS risk management for the different  sectors and whether DHS has authority to require sectors to  demonstrate that they have backup capabilities.
Further, stakeholders highlighted that it is unclear how the NSPD-39  backup-capabilities requirement fits in with the NIPP risk management  framework DHS uses for critical infrastructure protection. Specifically,  DOT and DHS officials noted that NSPD-39 predates the issuance of  the first NIPP in 2006, which, as previously described, established the  critical infrastructure protection risk management framework. As such,  DOT and DHS officials, a DOD official, members of the Advisory  Board, and the GPS experts from academic and other research  institutions we contacted said that the NSPD-39 backup-capabilities  requirement may be outdated and could require updating to better  reflect current risk management guidance that, DOT officials added,  would include operational mitigations in addition to backup systems.  For example, DHS officials noted that the NIPP risk management  framework indicates that SSAs are responsible for working with DHS  to coordinate infrastructure protection for their sector, including  backup capabilities. One DHS official said that his goal would be to  have each critical infrastructure sector’s Sector-Specific Plan address  GPS disruptions.
Outcomes and monitoring progress. DOT and DHS have not  established clear, agreed-upon outcomes that clarify what would  satisfy the NSPD-39 backup-capabilities requirement, and neither  agency has been consistently monitoring its progress. Establishing  clear outcomes for efforts that require collaboration ensures that  agencies have agreed on how they will satisfy mutual responsibilities  and what specifically they are working toward. DOT’s and DHS’s  confusion about roles described above indicates that the agencies  have not done so. Additional statements made by the agencies also  indicate that there may still be uncertainty about the desired outcome.  For example, while DHS officials said that it might be each individual  sector’s responsibility to provide its own GPS backup solutions, DOT  officials stated that individual solutions for every sector would be  redundant and inefficient and that DOT does not desire a sector- based architecture for GPS backup capabilities. Additionally, DHS  officials told us that a single, domestic backup to GPS is not needed,  and DOT officials told us that a single backup solution fulfilling all  users’ needs would not be practical. Nevertheless, DOT officials  stated that the Coast Guard’s decommissioning of LORAN-C was a  loss for the robustness of GPS backup capabilities, especially given  that both DOT and DHS had supported the upgrading of LORAN-C to  eLORAN as a national GPS backup.
Written agreements regarding collaboration. DOT and DHS have  not documented their agreements regarding how they will collaborate  to satisfy their NSPD-39 backup-capabilities requirement. In prior  work, we have found that the action of two agencies articulating roles  and responsibilities and a common outcome into a written document  is a powerful collaboration tool. Accordingly, we have recommended  many times that collaborations benefit from formal written  agreements, such as a memorandum of understanding or agreement.  While the agencies have individual mitigation efforts that contribute to  fulfilling the NSPD-39 backup-capabilities requirement, as described  above, they do not have a written agreement that considers all of  these efforts and provides a unified, holistic strategy for how the  agencies are addressing their shared responsibility. According to DOT  and DHS officials, the agencies are in the process of finalizing a  written agreement on interagency procedures for information sharing  among agency PNT operations centers when GPS disruptions occur  (to which DOD will also be a signatory), but are not developing any  type of written agreement memorializing how they will collaborate to  satisfy the NSPD-39 backup-capabilities requirement.
Without clearly defining both roles and desired outcomes for efforts that  require collaboration, DOT and DHS cannot ensure that they will satisfy  mutual responsibilities. DOT stated that the rationale behind developing a  national PNT architecture was the absence of coordinated interagency  efforts on PNT, which could lead to uncoordinated research efforts, lack  of clear developmental paths, potentially wasteful procurements, and  inefficient deployment of resources. Additionally, DHS has reported that  the well-established presence of effective backup capabilities could  discourage threats to GPS in the first place. In light of the recent issuance  of PPD-21 in February 2013, DOT, DHS, DOD, and the National  Aeronautics and Space Administration formed a Critical Infrastructure  Security and Resiliency scoping group to address the needed resiliency  of critical infrastructure relying on GPS, and subsequently, the National  Space-Based PNT Executive Steering Group established an Interagency  IDM/Alternative PNT task force in April 2013. According to DHS officials,  the task force plans to review and update planned IDM activities, and as  previously noted, through the task force, NPPD will have increased  involvement in the agency’s IDM efforts. Such activities could provide an  opportunity for DOT and DHS to address their challenges and  uncertainties and document their agreements. However, as of July 2013,  there was still confusion between the agencies on these future activities.  For example, DOT officials stated that according to their current  understanding based on guidance from the NCO, the task force would  mostly monitor activities while DHS highlighted a broader scope of activity  for the task force, including elevating awareness of critical sectors’  dependencies on GPS.
section_title: Select Critical Infrastructure Sectors Employ Various Mitigation Strategies, but DHS Has Not Measured the Effectiveness of These Efforts
subsections: section_title: Sector-Specific Strategies to Mitigate GPS Disruptions Vary
paragraphs: Agency officials and industry representatives from the four critical  infrastructure sectors we contacted said their sectors would generally be  able to withstand short-term GPS disruptions and provided examples of  strategies to mitigate GPS disruptions for aspects of sector operations, as  follows.
Communications. The communications sector, which uses GPS to  synchronize timing of communications and for location-based  services, employs a range of strategies to mitigate GPS disruptions.  For example, at large critical communication nodes (e.g., mobile  wireless and wireline-switching centers, satellite control centers),  atomic clocks are often deployed to backup GPS. However, some of  the most precise timing mechanisms may not be deployed widely  across communications networks, and the type and level of  redundancies vary across the network and across industry providers.  Communications sector industry representatives believe GPS  disruptions lasting over 24 hours would likely cause interruption of  mobile communication services because call handoffs between cell  sites would begin to fail.
Energy. For one aspect of the energy sector—the bulk power  system—DOE officials and energy sector industry representatives told  us that the sector uses GPS to get frequent time measurements on  the state of the system, but that the industry does not rely on GPS to  operate the system at this time. The representatives noted that the  bulk power system has built-in redundancies and, in the event of a  GPS disruption, could rely on other systems that provide less frequent  time measurements.
Financial services. According to Department of the Treasury  officials, the financial services sector primarily relies on atomic clocks  to time-stamp financial transactions; GPS is used as a secondary  timing source in the communications protocols of these transactions.  In the event of a GPS disruption, Treasury officials noted that the  financial services sector has a risk management process in place,  which includes hardware, software, and operational procedures to  detect and mitigate any disruptions in communications.
Transportation systems. Within the transportation systems sector,  for aviation, FAA officials said that multiple legacy navigation systems  that are not reliant on GPS signals can enable aircraft to fly and land  in the event of a GPS disruption. DHS officials noted that alternate  means of navigation, such as radar and visual references to  landmarks, are available for maritime users. An industry  representative and a TSA official from the rail and commercial vehicle  segments of the transportation systems sector, respectively, said that  they do not currently need extensive GPS mitigation efforts since  other means, such as maps and cell phone communication, can be  used for navigation.
According to critical infrastructure sector agency officials and industry  representatives we contacted, three of the four sectors have initiated  efforts to study GPS vulnerability and potential mitigations, but have not  yet implemented sector-wide mitigation efforts for various reasons. Some  stakeholders told us they focus mitigation efforts on higher-priority  threats. For example, energy sector industry representatives and financial  services sector agency officials said that they are less concerned about  GPS disruptions than other threats, like cybersecurity. The 2012 and  2013 annual summit agendas of a financial industry group dedicated to  industry collaboration on critical security threats addressed cybersecurity  threats and excluded threats from GPS disruptions. Sectors may be  reluctant to bear significant costs for mitigation efforts because GPS  disruptions are often perceived as low risk since the number of reported  incidents is relatively low. For example, in 2012, only 44 incidents were  reported to the Coast Guard, which fields reports of GPS disruptions.  However, it is unclear the extent to which incidents have been properly  reported. According to Coast Guard officials, GPS users are frequently  unaware that the Coast Guard serves as the civilian focal point for  reporting GPS disruptions, and oftentimes users do not report incidents  because they assume a software glitch is the source of the problem.  Furthermore, incidents caused by jammers (i.e., personal privacy  devices) are often perceived as low impact events, generally due to their  localized impact and popular use to avoid tracking of individuals. High- impact events, such as extreme solar storms, spoofing, and high-power  jammers—which can impact a larger geographic area, or can have larger  consequences in terms of safety, loss of life, and economic loss—are  perceived as low probability.
section_title: DHS Has Not Measured the Effectiveness of the Sectors’ Efforts to Mitigate GPS Disruptions
paragraphs: Although the sectors have taken steps to prepare for GPS disruptions,  DHS has not measured the effectiveness of sectors’ mitigation efforts to  ensure sector resiliency against GPS disruptions. DHS officials told us  that during 2013, DHS has been focused on increasing awareness of  GPS embeddedness and potential disruptions within three sectors—the  communications, information technology, and transportation systems  sectors. According to DHS and NCO officials, no plan or timeline has  been developed or approved for identifying and assessing measures of  effectiveness. DHS officials indicated it is not necessary to measure  effectiveness of individual programs and that the absence of resilience  measures for an individual program does not mean that DHS is not  measuring overall resilience at the sector level.  Furthermore, DHS  officials stated that the absence of a single measure at the program level  may be for several reasons, including that the cost of data collection and  analysis would be too great. However, the NIPP cites the importance of  measuring program effectiveness and the use of performance metrics to  track the effectiveness of protection programs. Specifically, the NIPP  requires DHS to work with SSAs and sector partners to measure the  effectiveness of critical infrastructure protection programs by establishing  performance metrics that enable DHS to objectively assess  improvements, track progress, establish accountability, document actual  performance, provide feedback mechanisms, and inform decision- making.  More recently, PPD-21 emphasizes efforts to strengthen and  maintain resilient critical infrastructure and requires DHS to use a metrics  and analysis process to measure the nation’s ability to manage and  reduce risks to critical infrastructure. Additionally, PPD-21 emphasizes  addressing resiliency in an environment of critical infrastructure’s  interconnectedness and interdependencies. As previously discussed,  GPS supports interconnected systems both within and across sectors and  GPS disruptions represent potential risks to critical infrastructure.
With regard to measuring effectiveness, we have previously  recommended that DHS develop performance measures to assess the  extent to which sector partners are taking actions to resolve resiliency  gaps identified during various vulnerability assessments. We have also  previously recommended that outcome-based measures would assist  DHS in assessing effectiveness of sector protection efforts. GPS  experts we contacted from academic and other research institutions  noted that focusing on measuring outcomes—and not just on testing the  GPS devices—in critical systems and sectors is important because  several factors can affect mitigation effectiveness in the event of a GPS  disruption: the GPS devices, the systems and equipment dependent on  those devices, and the personnel and operational procedures that rely on  GPS. While DHS requested SSA input for the NRE and stated they held  tabletop exercises with other government agencies to test agency  coordination processes in the event of a GPS disruption incident, DHS  has not measured the effectiveness of mitigation efforts in terms of sector  resiliency to GPS disruptions in the sectors we reviewed. Furthermore,  the four Sector-Specific Plans submitted to DHS that we reviewed did not  include any reference to GPS mitigation efforts. As a result of not having  measurements, or a plan to assess the impact of GPS disruptions on  critical infrastructure sectors, DHS cannot provide assurance that the  critical infrastructure sectors would be able to maintain operations in the  event of a GPS disruption without significant economic loss, or loss of life.
Measuring effectiveness of mitigation efforts on potential GPS disruptions  as part of measuring sector resiliency is important because agency  officials, industry representatives, and GPS experts have raised a number  of concerns about the sectors’ ability to sustain operations during GPS  disruptions. For example, they raised the following concerns:
Low awareness. Sector awareness of the extent to which GPS is  embedded in their systems is frequently unknown and understated,  thereby affecting their ability to plan appropriate mitigations. For  example, DHS officials and the GPS experts from academic and other  research institutions we contacted cited a GPS incident in San Diego  that impaired normal operations in the communications, maritime, and  aviation sectors, even though it was a short-term disruption, which  according to communications sector industry representatives, should  not have impaired operations because of the sector’s backup and  mitigation measures. Separately, in the maritime industry, we heard  from Coast Guard officials that multiple shipboard systems are  dependent on GPS and mariners may not be aware of the  dependencies. In a United Kingdom maritime GPS disruption test,  numerous alarms sounded on the ship’s bridge due to the failure of  different systems, and the test raised concerns that GPS signal loss  could lead to hazardous conditions for mariners.
Sustainability. The degree to which backup systems can sustain  current levels of operations and users are able to operate legacy  backup systems is unknown. Coast Guard officials indicated that  mariners who are accustomed to relying on GPS may no longer have  the skills or staff to adequately use legacy backup systems, and that  the legacy systems may be less efficient, causing economic losses.  For example, according to Coast Guard officials, if GPS were  disrupted for a day or more in a major port, it could result in millions of  dollars of losses due to inefficiencies in managing ship and cargo  traffic.
Increasing dependency. Use of GPS is growing and it is unclear  what mitigations would be effective with increased GPS use. For  example, in the energy sector, as GPS is increasingly used to monitor  the bulk power system, reliance on GPS in the long term may become  more critical in grid operations. According to a DOE official, DOE  validated the lab tests of an academic expert who demonstrated the  vulnerability of GPS-based bulk power system monitoring equipment  to a spoofing attack and has efforts under way to determine the long- term implications of increasing GPS dependency. The aviation  segment of the transportation systems sector will also be more  dependent on GPS. As previously described, GPS will be the primary  navigation aid under NextGen and FAA plans to eventually  decommission much of the current legacy navigation systems and  replace them with potentially new, alternative PNT systems currently  being researched. In the rail segment of the transportation systems  sector, the use of GPS to provide safety benefits through positive train  control is increasing, and DOT has indicated that degradation or loss  of GPS could, in the future, result in rail network congestion or  gridlock.
Sector interdependencies. Interdependencies among sectors may  not be well understood. For example, FAA reported that while its air  traffic control systems have backup systems for GPS, its  communication systems rely on the communications sector, which  might experience some problems in the event of GPS disruptions.  Therefore, one sector’s lack of appropriate mitigation may affect other  sectors.
Likelihood of disruptions. According to the stakeholders, the  likelihood of GPS disruptions could be growing and may be  underestimated by sectors and DHS. DHS officials and the GPS  experts from academic and other research institutions we contacted  cited that an Internet search for “GPS jammer” yielded approximately  500,000 results. They noted that over time, as the technology  advances, these jammers are likely to become smaller, more  powerful, and less expensive, increasing the likelihood of disruptions.
Additionally, in the last few years, a growing number of papers and  industry presentations are available on the Internet that discuss or  show the ability to spoof GPS receivers in multiple sectors, which  agency officials said could increase the likelihood of spoofing.  Furthermore, GPS experts indicated that the unintended interference  produced by the introduction of new communication services near the  GPS frequencies has the potential to greatly disrupt reception of the  relatively weak GPS signal, and indicated the difficulty of estimating  these disruptions in advance and isolating them.
section_title: Conclusions
paragraphs: GPS is essential to U.S. national security and is a key component in  economic growth, safety, and national critical infrastructure sectors. As  GPS becomes increasingly integrated into sectors’ operations, it has  become an invisible utility that users do not realize underpins their  applications, leaving sectors potentially vulnerable to GPS disruptions.  We recognize that risk assessments, such as the NRE, involve complex  analysis and that conducting a risk assessment across multiple sectors of  systems with many unknowns and little data is particularly challenging.  Although DHS attempted to overcome these challenges, the NRE also  lacks some of the key characteristics of risk assessments outlined in the  NIPP and, as a result, is incomplete. As such, the NRE is limited in its  usefulness to inform mitigation planning, priorities, and resource  allocation. Furthermore, the lack of an overall DHS plan designed to  address the NRE’s shortcomings, such as lack of data, and enhance its  risk assessment approach, such as by using available threat  assessments, could hinder future public and private risk management of  GPS. A plan and a time frame for developing a more complete data- driven risk assessment that also addresses the deficiencies in the NRE’s  assessment methodology would help DHS capitalize on progress it has  made in conducting risk assessments and contribute to the more effective  management of the increasing risks to the nation’s critical infrastructure.  Such steps also would provide DHS planners and other decision makers  with insights into DHS’s overall progress and a basis for determining  what, if any, additional actions need to be taken.
Federal agencies and experts have reported that the inability to mitigate  GPS disruptions could result in billions of dollars of economic loss. Critical  infrastructure sectors have employed various strategies to mitigate GPS  disruptions, but both the NRE and stakeholders we interviewed raised  concerns that since sector risks are underestimated, growing, and  interdependent, it is unclear whether such efforts are sufficient. Federal  risk management policy requires DHS to work with SSAs and sector  partners to measure the nation’s ability to manage and reduce risks to  critical infrastructure by using a metrics and analysis process. However,  we found DHS has not measured the effectiveness of sector mitigation  efforts to GPS disruptions. As a result, DHS cannot ensure that critical  infrastructure sectors could sustain essential operations during GPS  disruptions. The lack of agreed-upon metrics to measure the actual  effectiveness of sector mitigation efforts hinders DHS’s ability to  objectively assess improvements, track progress, establish accountability,  provide feedback mechanisms, or inform decision makers about the  appropriateness of—or need for additional—mitigation activities. We  previously recommended that DHS develop performance measures to  assess the extent to which sector partners are taking actions to resolve  resiliency gaps identified during the various vulnerability assessments.  Measuring effectiveness of mitigation efforts on potential GPS disruptions  as part of measuring sector resiliency is important because agency  officials, industry representatives, and GPS experts have raised a number  of concerns about the sectors’ ability to sustain operations during GPS  disruptions.
Although the President directed DOT, in coordination with DHS, to  develop backup capabilities to mitigate GPS disruptions, the agencies  have made limited progress amid continued uncertainty. Both agencies  cited resource constraints—such as budget and staffing—as a reason  why they have not made additional progress. Nevertheless, DOT and  DHS have not defined their respective roles, responsibilities, and  authorities or what agreed-upon outcome would satisfy the presidential  directive. As a result, DOT and DHS cannot ensure that they will satisfy  mutual responsibilities. Clearly delineating roles and responsibilities and  agreed-upon outcomes and documenting these agreements would allow  the agencies to address many of the uncertainties regarding fulfillment of  their NSPD-39 backup-capabilities requirement, such as which agency is  responsible for various key tasks, what role SSAs and industry should  have, how NSPD-39 fits into the NIPP risk management framework,  whether NSPD-39 is outdated, and others.
section_title: Recommendations for Executive Action
paragraphs: To ensure that the increasing risks of GPS disruptions to the nation’s  critical infrastructure are effectively managed, we recommend that the  Secretary of Homeland Security take the following two actions:  Increase the reliability and usefulness of the GPS risk assessment by  developing a plan and time frame to collect relevant threat,  vulnerability, and consequence data for the various critical  infrastructure sectors, and periodically review the readiness of data to  conduct a more data-driven risk assessment while ensuring that  DHS’s assessment approach is more consistent with the NIPP.
As part of current critical infrastructure protection planning with SSAs  and sector partners, develop and issue a plan and metrics to measure  the effectiveness of GPS risk mitigation efforts on critical infrastructure  resiliency.
To improve collaboration and address uncertainties in fulfilling the NSPD- 39 backup-capabilities requirement, we recommend that the Secretaries  of Transportation and Homeland Security take the following action:
Establish a formal, written agreement that details how the agencies  plan to address their shared responsibility. This agreement should  address uncertainties, including clarifying and defining DOT’s and  DHS’s respective roles, responsibilities, and authorities; establishing  clear, agreed-upon outcomes; establishing how the agencies will  monitor and report on progress toward those outcomes; and setting  forth the agencies’ plans for examining relevant issues, such as the  roles of SSAs and industry, how NSPD-39 fits into the NIPP risk  management framework, whether an update to the NSPD-39 is  needed, or other issues as deemed necessary by the agencies.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to the Departments of Homeland  Security, Transportation, and Commerce for their review and comment.  DHS provided written comments (reprinted in app. II) and technical  comments, which we incorporated as appropriate. DOT provided informal  comments summarized below, and technical comments, which we  incorporated as appropriate. Commerce had no comments.
In written comments, DHS concurred with two of our recommendations  and noted activities that it will undertake to address those  recommendations. In particular, DHS concurred with our recommendation  to develop and issue a plan and metrics to measure the effectiveness of  GPS risk mitigation efforts, and our recommendation that DHS and DOT  establish a formal written agreement that details how the agencies plan to  address their shared responsibility.
However, DHS did not concur with our recommendation related to  increasing the reliability and usefulness of the GPS risk assessment and  expressed concern about our evaluation of the NRE. DHS stated that it  did not agree with this recommendation because DHS officials and  subject matter experts believe the existing NRE analysis has sufficiently  characterized the risk environment, and that our characterization of the  NRE’s incorporation of best practices is inaccurate. Specifically, DHS  disagreed with our analysis about the extent to which the NRE met NIPP  criteria that risk assessments be complete, reproducible, defensible, and  documented and provided reasons for its disagreement. For example,  regarding our analysis of the NRE’s incompleteness, DHS stated that the  NIPP does not require that a risk assessment consider all, or even a  minimum number of, critical infrastructure sectors to be complete. Rather,  DHS noted, the NIPP states that the risk assessment methodology must  assess consequence, vulnerability, and threat for every defined risk  scenario. Regarding our analysis that the NRE was not being widely  used, DHS noted that we do not reference a second, concurrent report  directed at mitigation of GPS risks. DHS stated that the NRE was, by  design, meant to primarily support the National Executive Committee for  Space-Based PNT’s high-level, interagency policy role, and that the  committee and its staff had provided positive feedback. Based on its  reasons for non-concurrence, DHS requested that we consider this  recommendation resolved and closed.
We disagree with DHS’s assertion that our characterization of the NRE is  inaccurate. We have added additional text to clarify that based on the  NIPP criteria we determined, overall, that the NRE was incomplete  because each aspect of the NRE’s risk assessment—threat, vulnerability,  and consequence—was incomplete. Regarding our analysis that the NRE  was not reproducible, we found that the NRE does not conform to the  NIPP because it is based entirely on subjective judgments of panelists. If  different panelists were chosen, the results might have been different.  Subject matter experts we interviewed told us they were skeptical about  the quality of the panel deliberations, and characterized the members’  judgments as “educated guesses.” Regarding if the results were  defensible, we continue to believe that potentially useful statistical  techniques are only as valid as the underlying data, and that a core  problem of the NRE methodology was that it did not document how the  panel experts were chosen; the opinions of those experts were the basis  for virtually all the data in the NRE. For example, at a minimum the quality  of DHS’s panel selection would have been more transparent to the  independent reviewer (as well as the participants) if DHS detailed exactly  what sector and GPS expertise were required for each panel and how  well the participating panelists covered these areas of expertise. After  DHS officials told us that they had little documentary support for the NRE,  we narrowed our request and asked DHS officials to defend and provide  support for some of their key conclusions, but they did not provide it.
Several industry and federal representatives we interviewed questioned  whether the panels had sufficiently broad expertise to capture the full  scope of GPS vulnerabilities within sectors. Regarding documentation, as  we reported, the NRE did include some elements of documentation that  were consistent with the NIPP. However, DHS stated that with limited  data, its methodology depended on the expert judgment of the NRE  panels. Thus, as previously noted, documenting the rigor of the panel  selection process was crucial to the validity of the NRE. Nevertheless,  DHS did not provide documentation, either in the NRE or in subsequent  information requests, on how the subject matter experts were selected.  This and other documentation issues, such as not fully reporting the  underlying data supporting the risk calculations, also affect the NRE’s  reproducibility and defensibility.
Regarding our point that the NRE has not been widely used to inform risk  mitigation priorities, DHS commented that we fail to mention that the  National Executive Committee also requested a mitigation assessment.  The mitigation study was discussed in our risk mitigation section of the  report, and we have included additional information on the study.  However, since the studies were done concurrently, the mitigation study  was not informed by the NRE. Among other things, the report identifies  best practices to mitigate risk to GPS receivers rather than using the NRE  to develop a mitigation plan to reduce the risks the NRE identified and  guide resource allocation, as required by the NIPP. Regarding the  intended use of the NRE, the NCO told us that the study was intended to  help inform senior government officials about risk associated with GPS  use, not just the National Executive Committee or NCO. We have added  language to clarify that NCO officials stated that they and the National  Executive Committee were generally satisfied with the NRE. However, as  we noted in the report, the NRE was distributed to other agencies and  TSA officials told us that they are not using the NRE and did not see the  relevance to TSA, and officials from the Departments of Defense and  Energy told us that the NRE was not helpful in managing GPS risks.
DHS commented that data on GPS risk factors have not improved and in  its technical comments DHS noted that it has commissioned a study to  obtain better data. However, while we recognize that obtaining better data  is a challenge, we continue to believe that DHS should increase the  reliability and usefulness of the GPS risk assessment by developing a  plan and time frame to collect relevant threat, vulnerability, and  consequence data for the various critical infrastructure sectors, and  periodically review the readiness of data to conduct a more data-driven  risk assessment while ensuring that DHS’s assessment approach is more  consistent with the NIPP. For example, DHS could use the classified  threat assessment that was completed too late to be included in the NRE,  and it could proactively acquire and use private sector threat  assessments. We believe such actions will help DHS develop a more  rigorous, reliable assessment to inform risk mitigation planning and  resource allocation. Consistent with our recommendation, DHS has  initiated an effort to survey and better understand the vulnerabilities of  critical infrastructure sectors. In May 2013, DHS awarded funding to four  companies to conduct a detailed survey report of existing civilian GPS  receiver use within two critical infrastructure sectors, among other things.  A later phase of this effort, according to DHS documentation, is to explore  other sectors. This is a good first step toward gathering the kind of  information DHS needs to conduct more data-driven risk assessments in  the future. The National Executive Committee’s 5-year plan recommends  that DHS institute a risk management approach to assess threats,  vulnerabilities, and potential consequences to interference to GPS signals  and examine the best opportunities to mitigate those risks. Because of  the shortcomings we found in the NRE, we do not believe that DHS has  instituted an adequate risk management approach to address the risks  associated with GPS interference. Although DHS requested that we  consider this recommendation resolved and closed, we disagree and  believe that our recommendation is still needed to ensure that DHS  develops a plan to gather the data required for risk assessment and risk  management.
In providing comments on the draft report, DOT declined to take a  position on the recommendations but agreed to consider our  recommendation to improve collaboration and address uncertainties in  fulfilling the NSPD-39 backup-capabilities requirement. DOT stated that  the agency has worked closely with DHS on PNT-related activities but it  welcomed the opportunity to have agency roles clarified in a formal,  written agreement. DOT also reiterated that the agency’s views are  consistent with the National PNT Architecture report’s “greater common  denominator” strategy described in this report. DOT noted that GPS  dependency and the ability to handle a GPS disruption are not well  understood and will not be well understood until there is a “real-world”  incident or test scenario to evaluate. DOT also noted that the recently  formed Interagency IDM/Alternative PNT task force needs to expand its  scope beyond monitoring activities.
We are sending copies of this report to the Secretary of Homeland  Security, the Secretary of Transportation, the Secretary of Commerce and  interested congressional committees. In addition, the report is available at  no charge on our website at http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact Mark Goldstein at (202) 512-2834 or goldsteinm@gao.gov, or  Joseph Kirschbaum at (202) 512-9971 or kirschbaumj@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. Key contributors to this report are  listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: We reviewed (1) the extent to which the Department of Homeland  Security (DHS) has assessed the risks of Global Positioning System  (GPS) disruptions and their potential effects on the nation’s critical  infrastructure, (2) the extent to which the Department of Transportation  (DOT) and DHS have planned or developed backup capabilities or other  strategies to mitigate the effects of GPS disruptions, and (3) what  strategies, if any, selected critical infrastructure sectors employ to mitigate  the effects of GPS disruptions, and any remaining challenges they face.  We focused on civilian uses of GPS and on the following four critical  infrastructure sectors: communications, energy, financial services, and  transportation systems. We focused on civilian, as opposed to military,  uses of GPS because the majority of GPS applications and users are  civilian. We selected these sectors because of their dependence on GPS,  interdependence with other sectors, inclusion in DHS’s GPS National  Risk Estimate (NRE), and designation as critical sectors.
To address these issues, we interviewed or obtained written comments  from federal and state government officials, industry representatives, and  GPS subject matter experts. Specifically, we contacted government  officials from agencies involved in GPS governance, such as the  Department of Defense (DOD), DOT, and DHS. To obtain views from  state government officials, we contacted members of the U.S. States &  Local Government Subcommittee of the Civil GPS Service Interface  Committee, which is a forum established by DOT to exchange information  about GPS with the civilian user community. In selecting these members,  we asked the chair of the Subcommittee to identify a list of potential state  government officials, and we ensured the officials represented a variety of  states, geographical locations, and GPS uses. We also contacted the  Sector-Specific Agency (SSA) for each of the sectors we studied, as  follows: DHS’s Office of Cybersecurity and Communications (CS&C) for  the communications sector, the Department of Energy (DOE) for the  energy sector, the Department of the Treasury for the financial services  sector, and DOT, the Transportation Security Administration (TSA), and  the U.S. Coast Guard for the transportation systems sector. To obtain  views from industry representatives, we contacted the Sector  Coordinating Council (SCC) for each of the sectors we studied and  selected industry participants to interview based on input from a  designated spokesperson for each SCC. For the energy and  transportation systems sectors, we contacted each sub-sector, although  not all sub-sectors participated or provided us with written responses, as  shown in table 1. Industry representatives from the financial services  sector declined to respond to our requests for information. Additionally,  we contacted various GPS subject matter experts, including members of  the National Space-Based Positioning, Navigation, and Timing (PNT)  Advisory Board (Advisory Board), which is a federal advisory committee  that provides independent advice to the U.S. government on GPS  matters. We requested that our Advisory Board liaison invite all members  to participate, and members participated based on their availability. Views  expressed by members of the Advisory Board do not necessarily  represent the official position of the Board as a whole. We also attended a  formal meeting of the Advisory Board in May 2013. In selecting experts to  contact, we considered relevant published literature; their experience as  reflected in publications, testimonies, positions held, and their  biographies; recommendations from the Institute of Navigation (a non- profit professional society dedicated to PNT); and other stakeholders’  recommendations. See table 1 for a list of the stakeholders we contacted.
To review the extent to which DHS has assessed the risks of GPS  disruptions and their potential effects on the nation’s critical infrastructure,  we compared DHS’s efforts to established risk assessment criteria and  contacted GPS stakeholders. Specifically, as the centerpiece of DHS’s  GPS risk assessment efforts, we reviewed DHS’s 2012 GPS NRE and  compared it to the risk assessment criteria established in the National  Infrastructure Protection Plan (NIPP), originally issued by DHS in 2006  and updated in 2009. To learn more about the NRE’s scope,  methodology, and conduct, we interviewed the DHS officials responsible  for authoring the NRE and reviewed related documentation. We also  reviewed the DHS commissioned study that was requested in conjunction  with the NRE. Additionally, we reviewed other assessments that consider  GPS risks—including threat, vulnerability, and consequence—from DHS  and others. For example, documentation we reviewed included DOT’s  2001 Vulnerability Assessment of the Transportation Infrastructure  Relying on the GPS, the Homeland Security Institute’s 2005 GPS  Vulnerability Assessment, MITRE’s 2010 Coast Guard C4IT GPS  Vulnerabilities Assessment, and the North American Electric Reliability  Corporation’s 2012 Extended Loss of GPS Impact on Reliability  whitepaper, among others. Additionally, we interviewed or obtained  written responses from the government officials, industry representatives,  and GPS subject matter experts identified in table 2 to obtain their views  on the NRE and to assess whether the NRE is being used to inform  sector risk management efforts.
To review the extent to which DOT and DHS have planned or developed  backup capabilities or other strategies to mitigate the effects of GPS  disruptions, we contacted GPS stakeholders, examined agency  documentation, and reviewed relevant federal policies and directives.  Specifically, we interviewed DOT and DHS officials as identified in table  2. We also reviewed documentation from these agencies on the efforts  they have undertaken. For example, DHS documentation we reviewed  included materials related to IDM efforts and the draft 2013 Interagency  Memorandum of Agreement with Respect to Support to Users of the  Navstar GPS, among others. DOT documentation we reviewed included  the 2006 National PNT Architecture Terms of Reference, the 2010  National PNT Architecture Implementation Plan and the 2008 DOD  National PNT Architecture Study Final Report, the 2008 Memorandum of  Agreement between DOD and DOT on Civil Use of the GPS, and  documentation related to FAA’s Alternative PNT initiative, among others.  We also reviewed other key documentation related to GPS, such as the  2012 Federal Radionavigation Plan. We compared this information to  NSPD-39 and also reviewed other relevant policies, such as the  President’s 2010 National Space Policy of the U.S.A. We also interviewed  or obtained written responses from the government officials, industry  representatives, and GPS subject matter experts identified in table 2 to  obtain their views on DOT and DHS’s efforts or for context sophistication.  For example, we interviewed the NCO and reviewed meeting minutes  from the National Executive Committee for Space-Based PNT and its  Executive Steering Group and reviewed its National Five-Year Plan for  Space-Based PNT for Fiscal Years 2009-2013. Additionally, we  compared DOT and DHS’s efforts against our criteria on key elements of  effective collaboration.
To review what strategies, if any, selected critical infrastructure sectors  employ to mitigate the effects of GPS disruption, and any remaining  challenges they face, we contacted GPS stakeholders identified in table 2  and reviewed relevant reports and whitepapers from these entities. We  also interviewed the SSAs for each sector, as described above and  identified in table 2, and reviewed the Sector-Specific Plans for each  sector to assess if GPS is addressed. We reviewed the NIPP risk  management framework for guidance on measuring the effectiveness of  sector risk mitigation efforts. Additionally, we reviewed literature and  presentations from academia, the Space Weather Prediction Center  within NOAA’s National Weather Service, and other government  agencies, GPS subject matter experts and research institutions. We  received Coast Guard data on the number of GPS incidents reported to  NAVCEN. We did not assess the reliability of these data because they did  not materially affect our findings, conclusions, or recommendations. We  also interviewed or obtained written responses from the government  officials, industry representatives, and GPS subject matter experts  identified in table 2 to obtain their views on sector mitigation efforts and  factors that affect sector mitigation efforts.
We conducted this review from November 2012 to November 2013 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient and appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of Homeland Security
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to the individuals named above, Sally Moino and Glenn Davis,  Assistant Directors; Eli Albagli; Melissa Bodeau; Katherine Davis; Richard  Hung; Bert Japikse; SaraAnn Moessbauer; Josh Ormond; Nalylee Padilla;  and Daniel Rodriguez made key contributions to this report.