Internet Protocol Transition: FCC Should Strengthen Its Data Collection Efforts to Assess the Transition's Effects
Published: 2015-12-16T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The communications sector is essential to the nation's economy and government operations and for the delivery of public safety services, especially during emergencies. As the sector transitions from legacy networks to IP-based networks, consumer and public safety groups and others have raised concerns about how the communications networks will function during times of crisis.
GAO was asked to examine the reliability of the nation's communications network in an IP environment during times of crisis. GAO examined (1) the potential challenges affecting IP networks in times of crisis and how the challenges may affect end users, and (2) the actions FCC, DHS, and other stakeholders have taken to ensure the reliability of IP communications. GAO reviewed FCC and DHS documents as well as FCC proceedings and comments filed with FCC on the IP transition and emergency communications. GAO assessed FCC's efforts to collect data on the effect of the IP transition. GAO interviewed officials from FCC and DHS, and representatives from the three largest telecommunications carriers, industry associations, and public interest and consumer advocacy groups.
section_title: What GAO Found
paragraphs: As the nation's telecommunications systems transition from legacy telephone networks to Internet Protocol (IP)-based networks, telecommunications carriers can face challenges during times of crisis that affect end users' ability to call 911 and receive emergency communications. These challenges include (1) preserving consumer service and (2) supporting existing emergency communications services and equipment. For example, during power outages, consumers with service provided over IP networks and without backup power can lose service. The Federal Communications Commission (FCC) is working to address this issue by adopting rules that will require carriers to provide information to consumers on backup power sources, among other things. Another challenge is that IP networks may not support existing telecommunications “priority” services, which allow key government and public-safety officials to communicate during times of crisis.
FCC, the Department of Homeland Security (DHS), and telecommunications carriers have taken various steps to ensure the reliability of IP communications, for example:
FCC proposed criteria—such as support for 911 services, network security, and access for people with disabilities—to evaluate carriers' replacement of legacy services when carriers seek to discontinue existing service.
DHS coordinated the development of the Communications Sector Specific Plan to help protect the nation's communications infrastructure.
Carriers told GAO they build resiliency and reliability into their IP networks as part of business operations and emergency planning.
FCC is also collecting data on the IP transition, but FCC could do more to ensure it has the information it needs to make data-driven decisions about the transition. FCC has emphasized that one of its statutory responsibilities is to ensure that its core values, including public safety capabilities and consumer protection, endure as the nation transitions to modernized networks. FCC stated that fulfilling this responsibility requires learning more about how the transition affects consumers. FCC plans on collecting data on the IP transition primarily through voluntary experiments proposed and run by telecommunications carriers. However, it is unclear if FCC will be able to make data-driven decisions about the IP transition because of the limited number and scale of the proposed experiments. In particular, there are only three proposed experiments that cover a very limited number of consumers; none of the experiments covers consumer services in high-density urban areas or includes critical national-security or public-safety locations. FCC also sought comment on how to supplement its data-gathering process; however, soliciting comments may not necessarily result in a change in FCC's existing policies. GAO found FCC lacks a detailed strategy that outlines how it will address its remaining information needs. Developing a strategy for collecting information about how the IP transition affects public safety and consumers would help FCC make data-driven decisions and address areas of uncertainty as it oversees the IP transition.
section_title: What GAO Recommends
paragraphs: FCC should strengthen its data collection efforts to assess the IP transition's effects. FCC did not agree or disagree with the recommendation and stated it has a strategy in place to oversee the IP transition. However, GAO continues to believe FCC should strengthen its data collection efforts.

section_title: Letter
paragraphs: The communications sector is essential to the nation’s economy, public  safety, and government operations. As part of the nation’s critical  infrastructure, communications networks are especially important due to  the enabling functions they provide across all critical infrastructure  sectors; the loss of communications facilities could have cascading  effects on other critical infrastructures due to interdependencies among  sectors. Furthermore, communications services play an essential role in  the delivery of public safety services, especially during emergencies. The  communications sector is transitioning from legacy networks to an all- Internet Protocol (IP) environment, leading consumer and public safety  groups, among others, to question how reliably the nation’s  communications networks will function during times of crisis, such as  natural and man-made disasters. While the private sector owns and  operates the nation’s communications networks and is primarily in charge  of managing and protecting these assets, federal law and policy establish  regulatory and support roles for the federal government related to  communications networks. In particular, the Federal Communications  Commission (FCC) and Department of Homeland Security (DHS) have  roles in enhancing the cyber and physical security of the communications  infrastructure that is essential to national security and public health and  safety.
The communications sector’s infrastructure is in the midst of a significant  change, which FCC refers to as a series of technology transitions from  legacy networks built for one specific purpose (e.g., telephone calls) to IP- based networks built for a variety of purposes (e.g., broadband, video,  data, voice, etc.). According to FCC, modernizing communications  networks through this and other means can dramatically reduce network  costs and broaden access to new technologies, allowing  telecommunications carriers to serve customers with increased  efficiencies that can lead to improved and innovative product offerings  and lower prices. The IP transition, however, is a gradual shift; thus, it will  take many years to complete and has no specific end date. In 2014, FCC  established a framework for telecommunications carriers to conduct  voluntary “service-based” experiments, whereby carriers could substitute  new communications technologies, such as fiber and cable for the  services that they currently provide to customers over legacy copper  lines. According to FCC, these voluntary service-based experiments will  examine the effects of replacing existing customer services with IP-based  alternatives.
You asked us to review issues related to the reliability of the nation’s  communications network in an IP environment during times of crisis,  which could include weather events (e.g., hurricanes or flooding); man- made disasters (e.g., vandalism or terrorist attacks); and unintentional  man-made outages (e.g., a backhoe cutting a communication line). This  report examines (1) the potential challenges affecting IP networks in  times of crisis and how the challenges affect end users, and (2) the  actions FCC, DHS, and other stakeholders have taken to ensure the  reliability of IP communications during times of crisis.
To address these objectives, we reviewed relevant FCC and DHS  documents including orders, notices of proposed rulemakings, reports,  and risk assessments, as well as relevant statutes and regulations. We  reviewed comments filed with FCC regarding the IP transition and  emergency communications. To ensure we reviewed a broad range of  comments, we selected comments by stakeholders that represented a  variety of interests, including public interest groups, industry and trade  associations, and state and local authorities. To identify information on  the proposed IP transition service-based experiments, we reviewed three  experiment proposals submitted by telecommunications carriers,  stakeholder comments to FCC on these proposals, and other documents  related to the service-based experiments. We assessed FCC’s efforts to  collect data on the effect of the IP transition against criteria established in  the federal Standards for Internal Control. We reviewed relevant DHS  documents including the 2013 National Infrastructure Protection Plan, the  2010 Communications Sector Specific Plan, and the 2012 Risk  Assessment Report for Communications. We interviewed state and local  officials and other stakeholders in six states—New York, New Jersey,  Arizona, California, Florida, and Alabama—to obtain additional  information on the challenges facing IP networks and how these  challenges affect end users, and to obtain information on state efforts to  ensure reliability. We selected these locations because they represent a  mix of communities that have experienced a major communications  outage since 2012 or that contain an area with a proposed IP transition  experiment. These communities also contain a mix of rural, suburban,  and urban communities, and demographics including economic  differences and average age of residents. We also interviewed officials  from FCC, DHS, and representatives from selected stakeholder groups  including public-interest and consumer-advocacy groups, industry  associations, the three largest telecommunications companies, and other  stakeholders. We identified stakeholders to interview based on our review  of comments filed in FCC’s Technology Transitions proceeding, as well  as based on recommendations from other organizations we interviewed.  More details about our scope and methodology can be found in appendix  I.
We conducted this performance audit from December 2014 to December  2015 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: The communications sector’s infrastructure is a complex system of  systems that incorporates multiple technologies and services. The  infrastructure includes wireline, wireless, satellite, cable, and  broadcasting capabilities, and includes the transport networks that  support the Internet and other key information systems. Historically,  networks based on time-division multiplexed (TDM) circuit-switches  running on copper loops provided voice service for consumers. In a 2015  report and order, FCC noted that for over 100 years customers could rely  upon telecommunications carriers for backup power for their residential  landline phones during power outages because power is provided over  traditional copper telephone lines. In other words, telephones served by  copper networks continue to work during commercial power outages as  long as the telephones do not need to be plugged into an electrical outlet  to function. On the other hand, the physical infrastructure for IP-based  networks, such as fiber and co-axial cable, does not carry power, which  means telephones connected to IP networks may not work during  commercial power outages (see fig.1).
According to FCC, networks other than copper and services not based on  TDM may not support data-based services such as credit card readers,  home alarms, and medical alert monitors. The Alarm Industry  Communications Committee noted in comments filed with FCC that the  traditional TDM-based telephone service meets the standards necessary  for fire protection and other life and safety applications, such as line  seizure, the detection of a loss in communications path, and the proper  encoding and decoding of tone messages sent by the alarm panel. The  committee stressed that as networks transition to IP-based networks,  these traits must be preserved.
FCC notes that there are a number of distinct but related kinds of  technology transitions, including: (1) changes in network facilities and in  particular retirement of copper facilities, and (2) changes that involve the  discontinuance, impairment, or reduction of legacy services, irrespective  of the network facility used to deliver those services. In the case of retiring  copper facilities, the Communications Act of 1934, as amended  (Communications Act), and FCC rules thereunder allow  telecommunications carriers to transition to new facilities without needing  FCC approval as long as the change of technology does not discontinue,  reduce, or impair the services provided. FCC rules do require incumbent  telecommunications carriers to give notice to interconnecting carriers of  planned copper retirements, and new FCC rules require incumbent  carriers to give notice to retail customers of such planned copper  retirements when such retirements remove copper to the customers’  premises without consumer consent, along with particular consumer  protection measures. Such consumer protections include explanations  of how consumers may seek more information from carriers about the  copper retirement process and its possible impact on consumers’ service,  and links for the FCC’s consumer complaint portal. With respect to  service discontinuance, under the Communications Act,  telecommunications carriers must obtain FCC approval before they  discontinue, reduce, or impair service to a community or part of a  community. FCC regulations include procedures for carriers to  discontinue, reduce, or impair service. The regulations state that to  discontinue telecommunications service, carriers must notify customers of  this intent and file an application with FCC. Once an application is  received, FCC issues a public notice and considers these applications on  a case-by-case basis and also accepts and reviews comments on  proposed discontinuations, reductions, or impairments of  telecommunications service. According to the order, FCC will normally  authorize the discontinuance, reduction, or impairment of service unless it  is shown that to do so would adversely affect the public convenience and  necessity, with regard to which FCC considers, among other things,  whether customers would be unable to receive service or a reasonable  substitute from another carrier.
FCC officials told us that there is no forcing action or requirement for  telecommunications carriers to transition to IP by a certain date and that  the technology transitions are organic processes without a single starting  or stopping point. In an August 2015 order, FCC noted that recent data  indicate 30 percent of all residential customers choose IP-based voice  services from cable, fiber, and other carriers as alternatives to legacy  voice services. Furthermore, an additional 44 percent of households were  “wireless-only” meaning these households only have wireless telephones.  The August 2015 order also states that overall, almost 75 percent of U.S.  residential customers (approximately 88-million households) no longer  receive telephone service over traditional copper facilities because they  rely on IP-based voice services or wireless phone service.
Both FCC and DHS play a role in regulating the transition to IP and  ensuring public safety communications are not at risk.
Pursuant to the Communications Act, FCC is charged with regulating  interstate and international communications by radio, television, wire,  satellite, and cable throughout the United States. FCC officials  stated that FCC is to promote the reliability, resiliency, and availability  of the nation’s communications networks at all times, including in  times of emergency or natural disaster. Further, FCC has the authority  to adopt, administer, and enforce rules related to communications  reliability and security, 911, and emergency alerting. FCC’s  regulations include requirements for certain telecommunications  carriers to report on the reliability and security of communications  infrastructures, specifically reporting on network outages. FCC also  asks carriers to report voluntarily on the status of the restoration of  communications in the event of a large scale disaster.
DHS is the principal federal agency to lead, integrate, and coordinate  the implementation of efforts to protect communications infrastructure.  DHS’s role in critical infrastructure protection is established by law  and policy. The Homeland Security Act of 2002, Homeland Security  Presidential Directive 7, and the National Infrastructure Protection  Plan establish an approach for protecting the nation’s critical  infrastructure sectors— including communications—that focuses on  the development of public private partnerships and establishment of a  risk management framework. These policies establish critical  infrastructure sectors, including the communications sector; assign  agencies to each sector (sector-specific agencies), including DHS as  the sector lead for the communications and information technology  sectors; and encourage private sector involvement. Pursuant to  Presidential Policy Directive 21, DHS is to coordinate the overall  federal effort to promote the security and resilience of the nation’s  critical infrastructure from all-hazards.
subsections: section_title: Carriers Face Challenges Preserving Services on IP Networks during Times of Crisis
paragraphs: As the nation’s telecommunications systems transition to IP networks,  carriers can face challenges during times of crisis that affect end users’  ability to call 911 and receive emergency communications. These  challenges include (1) preserving consumer service and (2) supporting  existing emergency communications services and equipment. FCC, DHS,  and other stakeholders have taken steps to help address these  challenges, but some persist.
subsections: section_title: Preserving Consumer Service
paragraphs: Providers face challenges in preserving service during times of crisis such  as natural disasters or outages caused by malicious acts and accidents.  For example, weather events, such as hurricanes and tornados, can  damage telecommunications infrastructure and the power sources  communications systems rely on to provide service. A 2012 DHS report  entitled 2012 Risk Assessment Report for Communications identified  risks to communication networks from violent weather that include fuel not  being available for generators during a commercial power outage; aerial  infrastructure unable to withstand high winds; utility poles unable to  withstand high winds; and underground infrastructure unable to withstand  flooding. Destruction of communications infrastructure by storms can  affect both legacy copper wire and IP networks. For example, in talking  with officials from New York and New Jersey about Hurricane Sandy, the  officials told us the storm damaged both copper lines and fiber optic  cable. However, as explained previously, in general, consumers with  basic telephones and service provided over copper lines can still operate  during a commercial power outage, as long as the carrier’s central office  maintains power and keeps supplying line power through an all-copper  network. In contrast, consumers with service provided over IP networks  require a backup power source, such as a battery, since IP network  infrastructure does not carry electrical power for the purpose of powering  end devices, such as telephones. Officials we contacted from four state  agencies, and representatives from four trade and industry organizations  and consumer groups emphasized the importance of backup power for  communications during emergencies.
To address backup power requirements during a commercial power  outage, FCC issued rules addressing 911 reliability and the reliability and  continuity of communications networks for both carriers’ central office  facilities and consumers’ homes. Specifically, in 2013, FCC issued new  rules on central office backup power certification requirements for certain  911 service providers. In an August 2015 order, FCC noted that many  consumers remained unaware they needed to take action to ensure their  landline telephone service remained available in the event of a  commercial power outage. FCC concluded that the transition to all-IP  networks had the potential to create a widespread public safety issue if  unaddressed. Therefore, FCC adopted rules to help ensure consumers  have the information and tools necessary to maintain landline home  telephone service during emergencies. When these rules become  effective, FCC will require that telecommunications carriers communicate  information to consumers regarding backup power, such as the  availability of backup power sources, service limitations with and without  backup power, and purchase options. FCC will also require  telecommunications carriers to give consumers the option to purchase a  backup power device with at least 8 hours of standby power during a  commercial power outage enabling calls, including those to 911.  Furthermore, FCC will require carriers to offer consumers the option to  purchase 24 hours of backup power within 3 years.
In addition to weather events, telecommunication network outages can  occur through malicious acts, such as vandalism and cyber attacks, and  by accidental cable cuts and software coding errors. For example, a fiber  optic cable north of Phoenix was vandalized in February 2015, causing  large-scale telephone and Internet outages across much of Northern  Arizona. According to local officials we contacted, the outage lasted about  a day and included Flagstaff, Sedona, Prescott, and surrounding areas  potentially affecting more than 300,000 people. Officials told us that the  Flagstaff police department’s 911 lines were down, so they sent staff to a  backup site at the Arizona Department of Public Safety to answer calls;  the police department also lost all Internet, a loss that prevented it from  checking for warrants and driver’s licenses. Additionally, officials told us  that some businesses closed because they could not process credit card  transactions, that ATMs did not work, and that Northern Arizona  University lost Internet service. According to a Flagstaff official, the  telecommunications carrier is now building, and expects to complete by  2016, an additional fiber optic cable that will improve resiliency and  redundancy.
Cyber attacks can also challenge both IP networks and traditional legacy  networks; however, DHS officials told us that IP networks are more prone  to cyber attacks than legacy networks, because legacy networks are  closed systems that are less vulnerable to cyber attacks. Under the terms  of a 2013 executive order and a related presidential policy directive, it is  the policy of the United States to strengthen the security and resilience of  its critical infrastructure against both physical and cyber threats. In a  2015 report, the Communications Security, Reliability and Interoperability  Council (CSRIC) identified cybersecurity threats to Voice over IP  (VoIP) and voice services that include disrupting network availability,  compromising confidentiality, and spoofing a caller’s identity. According  to FCC officials, CSRIC is developing recommendations to support the  real-time sharing of cyber threat information among private sector entities.  For our recent products related to cybersecurity and information security,  see related GAO products listed at the end of this report.
As with legacy copper networks, accidents also cause IP network outages  affecting communication capabilities. For example, a truck accident in  2014 took out 400 feet of aerial fiber optic cable along a rural road in  Mendocino County, California. According to a local incident report,  telephone, Internet, cellular, and 911 services went down for thousands of  residents, and Internet service was out almost completely along a 40-mile  corridor for approximately 45 hours. According to local officials we  contacted, 911 services were unavailable, and the county sheriff  estimated that 20 percent of county residents lost vital services. Alert  notifications through phone calls were unavailable for residents waiting to  receive evacuation notices just as a nearby wildfire was growing.  According to an incident report, health care providers could not be  reached; banks and supermarkets closed because they were unable to  function without Internet, telephone, and ATM services; and electronic  food stamp benefits were unavailable.
IP network outages caused by human error, such as software coding  errors, can affect large numbers of people over wide geographic areas.  Such outages are sometimes referred to as “sunny day” outages. For  example, in April 2014, a 911 call-routing facility in Colorado stopped  directing emergency calls to 911 call centers in 7 states. The outage  was caused by a coding error and resulted in a loss of 911 services for  more than 11-million people for up to 6 hours. Unlike legacy copper  networks, IP networks permit call control to be distributed among just a  few large servers nationwide, meaning each server can serve millions, or  even tens of millions, of customers, according to FCC. State officials from  New York and California told us that IP networks allow for increased  consolidation of equipment and facilities, which means that when an  outage does occur, it can potentially last longer and affect more people  across a wider area than legacy networks. An FCC investigation into a  multistate 911 outage in 2014 found that this geographical consolidation  of critical 911 capabilities may increase the risk of a large “sunny day”  outage caused by software failures rather than disasters or weather  conditions. According to this investigation, large-scale outages may  result when IP networks do not include appropriate safeguards. In 2013,  FCC adopted rules requiring 911 service providers to certify annually that  they comply with industry-backed best practices or implement alternative  measures that are reasonably sufficient to assure reliable 911 service.
section_title: Supporting Existing Emergency Communication Services and Equipment
paragraphs: IP networks may not support existing communication services that key  government officials and others rely on during times of crisis.  Communications networks can become congested during emergencies,  preventing government officials and other national security and  emergency preparedness personnel from communicating with one  another. To overcome this congestion, DHS maintains priority  telecommunications services, such as the Government Emergency  Telecommunications Service (GETS) that provide priority calling  capabilities to authorized users. GETS was initially designed in the 1990s  to operate with legacy networks during times of congestion. DHS officials  told us that over the past 5 years similar priority features have been  implemented in the core IP networks of select U.S. nationwide long- distance service providers. DHS officials told us congestion, caused by  high-call volume and potentially as a result of cyber attack, will continue  to be a challenge in an IP environment. FCC officials told us that although  congestion may not be as likely in IP networks as it was in legacy  networks, it will still occur. As shown in figure 2, numerous government  officials and non-government organizations in critical positions rely on  GETS when networks become congested during times of crisis.
The value of priority telecommunications service when compared to  regular network performance becomes apparent during times of crisis.  For example, according to DHS, during Hurricane Sandy and the  immediate aftermath, networks were congested due to damage and high  call volume into and out of the storm-damaged area. Likewise, according  to DHS officials and a DHS report on the Boston Marathon bombing, as  news of the bombs spread, cell phone networks became congested with  users and were largely unavailable for about 90 minutes. As shown in  table 1, GETS had high call-completion rates during recent times of crisis.
DHS officials told us that the current GETS will likely lose some  functionality during the transition to an all-IP environment. The officials  said they are planning a project that will provide priority for IP wireline  access, but the project has not yet received approval for acquisition. In  2015, a multi-agency executive committee reported that the national  security and emergency preparedness community must be able to rely on  these priority services to complete their mission-essential  communications in the IP environment. DHS is working on a program  that is aimed at enabling users to have priority voice, data, and video  communications as networks evolve, but according to DHS officials, data  and video capabilities will not be available for several years. In the  meantime, as telecommunications carriers transition from legacy  networks to IP networks, key national security and emergency  preparedness personnel might not be able to complete important GETS  calls during times of crisis. CSRIC is currently assessing how priority  services programs can take advantage of IP technologies and intends to  recommend protocols that can be used to ensure priority communications  upon the retirement of legacy services. As CSRIC noted, this is important  since the federal government is losing priority capabilities that rely on  networks that will eventually be replaced by IP-based infrastructure.  According to FCC officials, CSRIC estimates that the recommendations  on protocols and standards that can support the delivery of priority  communications for first responders and national security personnel over  IP networks will be complete in March 2017.
New IP networks may no longer support other government and consumer  public safety services and equipment that work in the existing legacy  network. Examples of such items include alarm systems and 911 call  center systems. According to the Alarm Industry Communications  Committee, telecommunications carriers installing new IP services may  prevent alarm signals from being transmitted, and some IP services may  improperly encode alarm signals. In comments submitted to FCC, the  Association of Public Safety Communications Officials International  (APCO) noted that alarm systems and medical alert monitors need to be  provided for under new IP networks. APCO commented that alarms and  alerts are a critical part of the input into 911 call centers and any identified  shortfalls or anomalies should be identified to ensure that any effect to the  public or public safety is known well ahead of time. APCO also  commented that copper replacements in the foreseeable future must  accommodate existing 911 call centers in the relevant service area,  including those that have not yet transitioned to IP-based systems. As  discussed, that transition will not be immediate and continuity of  operations with existing 911 systems is vital for public safety.
section_title: Agencies and Stakeholders Have Taken Steps to Ensure IP Networks Are Reliable, but FCC Has Little Information to Assess the Effect of the IP Transition
subsections: section_title: Efforts to Ensure the Reliability of IP Networks
subsections: section_title: FCC Efforts
paragraphs: In addition to addressing the specific challenges affecting IP networks  during times of crisis described above, FCC has taken a variety of other  actions to help ensure the overall reliability of IP networks, including the  following:
Proposed criteria in August 2015 to evaluate and compare the  replacement of legacy services. FCC had not previously codified any  specific criteria by which it evaluated the adequacy of substitute  services, but proposed changes to the process in a further notice of  proposed rulemaking. Specifically, FCC proposed that to be eligible  for automatic grant of authority under FCC’s rules, a  telecommunications carrier seeking to discontinue an existing retail  service must demonstrate that any substitute service meet criteria  related to (1) interoperability with devices and services, such as alarm  services and medical monitoring; (2) support for 911 services and call  centers; (3) network capacity and reliability; (4) quality of both voice  service and Internet access; (5) access for people with disabilities,  including compatibility with assistive technologies; (6) network security  in an IP-supported network; (7) service functionality; and (8) coverage  throughout the service area. In addition, FCC proposed to require that  part of the evaluation to discontinue a legacy retail service should  include whether the carrier has an adequate consumer education and  outreach plan. FCC noted it believes establishing these criteria will  benefit industry and consumers alike and will minimize complications  when carriers seek approval for large scale discontinuances. It also  noted that having clear criteria in place will better allow carriers to  know how they can obtain approval for discontinuing legacy service  once they are ready to do so. According to representatives from  Public Knowledge, this organization had urged FCC to establish  metrics to compare the services that carriers are discontinuing with  replacement services. The organization’s representatives noted that  without ensuring new services are actually substitutes for the services  being phased out, there is a risk that entire communities could lose  critical functionality in their communications networks. In the further  notice of proposed rulemaking, FCC tentatively concluded that several  of the criteria proposed by Public Knowledge are the appropriate  criteria.
Updated copper retirement rules and definitions to help ensure the  public has the information needed to adapt to an evolving  communications environment. FCC issued new rules in an August  2015 report and order that, among other things, require incumbent  carriers to directly notify consumers of plans to retire copper networks  to the customer’s premises without customer consent. In this report  and order, FCC also updated its definition of copper retirement due to  the frequency and scope of copper network retirement. Included in  this definition is de facto retirement, i.e., the failure to maintain these  copper lines that is the functional equivalent of removal or disabling.  FCC noted that it made these changes in rules and definitions since  the record developed in that proceeding reflects numerous instances  in which notice of copper retirement has been lacking, leading to  consumer confusion, and therefore consumers need direct notice for  these important network changes that may directly affect them.
Collected and analyzed network outage data, looking for trends, and  communicated with telecommunications carriers. FCC developed and  maintains the Network Outage Reporting System (NORS) for  collecting confidential outage information from telecommunications  carriers. These carriers are required to report information about  disruptions or outages to their communications systems that meet  specified thresholds. According to FCC, engineers on its staff  monitor and analyze the outage reports in real time looking for trends  in outages, communicate with carriers about outages, and produce a  high-level network outage report. FCC officials told us that even  though the outage information is not publicly reported, they believe  the act of reporting helps network providers correct problems and that  by combining multiple reports, FCC gains insight on network reliability  and working with carriers cooperatively leads to better outcomes with  fewer, less severe outages. FCC shares NORS reports with DHS’s  Office of Emergency Communications, which may provide information  from those reports to such other governmental authorities as it may  deem to be appropriate. Otherwise, reports filed in NORS are  presumed confidential and are thus withheld from routine public  inspection. However, in March 2015, FCC proposed, among other  things, granting states read-only access to those portions of the  NORS database that pertain to communications outages in their  respective states to advance compelling state interests in protecting  public health and safety. Representatives from two state agencies  and two consumer organizations we contacted told us that granting  states access to outage reports would improve the overall reliability of  communications networks by giving them additional information.
Tracked the status of the restoration of communications in the event  of a large scale disaster. FCC developed and maintains the Disaster  Information Reporting System (DIRS), a voluntary system used by  members of the communications sector intended to provide  information on the status of restoration efforts to FCC and DHS. DIRS  reports include information on major equipment failures and the  service and geographic area affected. According to FCC officials,  DIRS is only activated during major disasters, and since these  incidents are unique, the system is not designed to track trends. For  example, the officials said that DIRS is often activated during  hurricanes, but because of differences in wind speed, direction, and  other challenges, outages from one hurricane do not necessarily  indicate infrastructure will be affected the same way in another  hurricane.
Chartered CSRIC to provide FCC with recommendations on ways to  improve security, reliability, and interoperability of communications  systems. FCC officials told us CSRIC has not specifically looked at  ways to improve reliability of IP networks; however, there have been a  number of working groups that aim to improve the overall reliability of  telecommunications networks. Specifically, in September 2014,  CSRIC issued a report and series of best practices for providing  backup power to customers relying on IP networks and on consumer  notification.
section_title: DHS Efforts
paragraphs: DHS has also taken the following actions to help ensure the reliability of  IP networks during times of crisis:
Coordinated with other federal government agencies, owners and  operators of communications networks, and state, local, tribal, and  territorial governments. As the Sector Specific Agency for the  communications sector, DHS manages the industry-government  relationship, encourages private sector involvement through the  involvement of the sector-coordinating councils, and maintains the  Communications Sector Specific Plan. According to representatives of  the Communications Sector Coordinating Council, the Council works  closely with DHS, and they noted DHS is helpful in providing  assistance for educational and outreach programs, including ensuring  training opportunities occur when needed. DHS also coordinates with  stakeholders by participating in CSRIC and by coordinating and  serving as the Executive Secretariat support to the President’s  National Security Telecommunications Advisory Committee—a  presidential advisory group comprised of chief executives from major  telecommunications companies, network service providers, and the  information technology, and aerospace industries. Additionally,  DHS’s Office of Emergency Communications provides coordination  support by offering training, coordination, and tools to stakeholders.
Coordinated the development and implementation of the 2010  Communications Sector Specific Plan and is currently working on an  updated plan. The sector specific plan was developed by DHS, the  Communications Sector Coordinating Council, and the Government  Communications Coordinating Council and is intended to ensure the  sector effectively coordinates with sector partners, other sectors, and  DHS. According to representatives of the Communications Sector  Coordinating Council, they met regularly with DHS to update the  sector specific plan. The plan provides a framework for industry and  government partners to establish a coordinated strategy to protect the  nation’s critical communications infrastructure. Part of this framework  includes conducting national risk assessments. With respect to  communications, DHS issued a report entitled 2012 Risk Assessment  Report for Communications, which according to the report, represents  the culmination of a 2-year period during which 29 government and 32  industry sector partners assessed physical, cyber, and human risks of  concern that could potentially affect local, regional, and national  communications. According to DHS officials, the Communications  Sector Coordinating Council and Government Communications  Coordinating Council determined an updated risk assessment was not  needed because details of the changing risk environment will be  discussed and updated in other sector documents, such as the sector  specific plan. DHS officials also told us the new plan should be  completed in 2015 and will be updated to include the communications  sector’s transition to IP networks and will include more focus on  cybersecurity-related content. We did not evaluate the 2010 plan  because it was being updated and did not evaluate the 2015 plan  because it was not issued at the time of our review.
Coordinated the development of the 2014 National Emergency  Communications Plan. This plan aims to enhance emergency  communications capabilities at all levels of government in  coordination with the private sector, nongovernmental organizations,  and communities. DHS developed recommendations to help meet the  plan’s five broad goals related to (1) governance and leadership, (2)  planning and procedures, (3) training and exercises, (4) operational  coordination, and (5) research and development. According to the  plan, DHS’s Office of Emergency Communications intends to  coordinate with public safety agencies and emergency responders  and will identify strategies and timelines to accomplish the plan’s  goals, objectives, and recommendations and measure progress  nationwide.
section_title: Telecommunications Carrier’s Efforts
paragraphs: In the private sector, telecommunications carriers have also worked to  ensure their IP networks are functional during times of crisis in the  following ways:
Built resiliency and reliability into IP networks as part of business  operations and planning for emergencies. According to DHS, as the  owners and operators of the majority of the nation’s communications  networks, private sector entities are responsible for protecting key  commercial communications assets, as well as ensuring the resiliency  and reliability of communications during day-to-day operations and  emergency response and recovery efforts. In addition, commercial  communications carriers have a primary role in network restoration  during outages and service failures and support reconstitution for  emergency response and recovery operations. Representatives of the  three largest telecommunication carriers told us they are taking action  at the company level to improve reliability because building reliability  and resilience into networks are part of normal business operations.  For example, these carriers have developed emergency  preparedness plans for events such as hurricanes, to help ensure  network reliability. These plans included pole replacement, decreased  dependency on aerial facilities, and adding additional generators.  Officials from one major carrier told us that customers expect the  phone to work when they pick it up to make a call and that the  company risks losing customers if it cannot provide reliable service.
Participate in a variety of groups intended to provide information and  improve the overall reliability of communications networks. For  example, in addition to groups like CSRIC and the Communications  Sector Coordinating Council described above, telecommunications  carriers participate in other organizations such as the Alliance for  Telecommunications Industry Solutions (ATIS). ATIS’s Network  Reliability Steering Committee advises the communications industry  through developing and issuing standards, technical requirements and  reports, best practices, and annual reports. ATIS also launched a task  force looking at how the IP transition affects public safety  communications infrastructure.
section_title: Selected State Agency Efforts
paragraphs: State authorities from three public utility agencies told us that they have  taken action to ensure the reliability of IP networks. These actions include  collecting consumer complaints, levying fines, reviewing outage data, and  making recommendations for improvement. For example, officials at one  state agency told us that they receive and investigate complaints and if an  issue is identified levy fines or open a rulemaking proceeding. Officials at  another state agency told us they review outage data and make  recommendations for improvements based on lessons learned. According  to the DHS’s 2010 Sector Specific Plan, the state Public Utility  Commission is the primary authority for implementing regulations, and  individual telecommunications carriers work directly with state authorities  regularly to address regulatory issues. However, according to the  National Regulatory Research Institute, more than half the states have  made changes to their regulatory authority that reduced or eliminated  retail telecommunications regulation. For example, one state agency  told us that although the commission previously had a role in ensuring the  reliability and robustness of the communications network, it no longer has  that authority.
section_title: Although FCC Has Data Collection Efforts Under Way, It Has Limited Information about the Effect of the IP Transition
paragraphs: FCC is collecting data on the IP transition and sought comment on  collecting additional data on the transition’s effect on consumers, but  could do more to ensure it has the information it needs to make data- driven decisions about the IP transition. The primary way FCC intends  to gather information about the IP transition is through service-based  experiments. In particular, FCC established a framework in January 2014  within which carriers can conduct voluntary service-based experiments.  These voluntary experiments would allow telecommunications carriers to  substitute new communications technologies for the legacy services over  copper lines that they are currently providing to customers and to test a  variety of approaches to resolving operational challenges that result from  transitioning to new technology and that may affect users. According to  FCC, these experiments are not intended to test technologies or resolve  legal or policy debates.
FCC established technical parameters for each experiment, including  requiring each proposal to provide sufficiently detailed information about  how the experiments will be designed to allow meaningful public  comment and thorough evaluation of the proposed experiment.  Specifically, each experiment proposal must include other information  such as: the purpose and proposed metrics for measuring success; the  scope of the experiment (geography, product, or service offering); the  technical parameters including a description of any physical or network  changes and how the experiment will affect customers and other  providers and product or service offerings; and timelines. FCC noted it  would find useful experiments that collect and provide data on key  attributes of IP-based services, such as network capacity, 911 services  and call centers, and cybersecurity. According to FCC officials, the  voluntary experiments can begin without FCC approval; however, carriers  planning to discontinue service have to seek permission from FCC prior  to doing so. At the time of our review, the experiments were still in the  early stages, and FCC had not approved the discontinuation of any  existing services.
As shown in figure 3, at the time of our review, AT&T proposed  experiments in two locations and CenturyLink proposed one location.
According to AT&T documents, initially AT&T plans to encourage  voluntary migration to IP-based services for existing customers through  outreach and education. Subsequently, AT&T plans to seek FCC  approval to “grandfather” existing customers and offer only wireless and  wireline IP-based services for new orders. The documents also note that  eventually, those existing customers will also have to transition to such  alternatives, but not until FCC has evaluated the results and approved  AT&T to discontinue legacy service and move forward to the full IP  transition. As part of the trials, AT&T plans on collecting and reporting to  FCC information including data on the progress of the experiment,  customer complaints, network performance, call quality, and issues  relating to access by persons with disabilities. According to FCC officials,  FCC intends to contract with a major research organization to collect and  analyze data from the AT&T experiment locations. At the time of our  review, FCC officials told us this data collection is expected to begin in  several months.
Unlike the AT&T experiments, CenturyLink submitted a proposal that  does not directly affect consumers. Instead this experiment focuses on  business end users and service providers, and according to CenturyLink’s  own proposal, the experiment would be very narrow in scope.  CenturyLink also noted that it was not seeking to discontinue any services  or requesting a waiver of any FCC rules, even for the purposes of the  experiment.
FCC is taking and plans to take additional steps to collect information on  how consumers are experiencing the IP transition. FCC officials said they  have begun taking action to improve consumer complaint data and make  them more transparent, including launching a new consumer help center  intended to collect additional consumer complaint data and working with  various groups to share this and other data. FCC also plans to work with  state, local, and tribal governments to leverage existing data-collection  efforts and develop common definitions, categories, and a metric that will  allow for comparison of consumer experiences in different parts of the  country and help create a more comprehensive picture of the consumer  experience as networks transition. FCC sought comment on how it could  supplement its data-gathering process on the effects of technology  transitions beyond consumer complaints and inquiries.
In light of the scale of the IP transition and the potential for disruptions to  consumers and public safety, FCC recognizes it will need information on  the effects of the transition to ensure IP communications networks are  reliable. Federal standards for internal control, which provide the overall  framework for identifying and addressing major performance and  management challenges, stress the importance of obtaining information  from external sources that may have a significant impact on an agency  achieving its goals. Furthermore, in its January 2014 order, FCC noted  that one of its statutory responsibilities is to ensure that its core values,  including public safety and consumer protection, endure as the nation  transitions to modernized communications networks. In the order, FCC  noted that fulfilling this responsibility requires that FCC learn more about  how the modernization of communications networks affects consumers.  The order also states that FCC intends to collect data through the  service-based experiments that would permit the making of data-driven  decisions about the IP transition. However, it is unclear if FCC will be able  to make data-driven decisions about the IP transition because of the  limited number and scale of the proposed experiments. For example, one  major carrier did not propose any experiments. Furthermore, as some  organizations have commented, AT&T’s experiments have limitations  including the small number of experiments; a lack of geographic  dispersion; and a lack of diverse population densities, demographics, and  climates. These experiments, as planned, will affect less than 55,000  living units combined, which according to Public Knowledge, likely  represent approximately 0.07 percent of AT&T’s wireline customers.  Additionally, the proposed experiments do not include high-density urban  areas; areas with colder climates or mountainous terrains; or areas that  encompass diverse populations. Finally, none of the proposed  experimental areas includes critical national security or public safety  locations, such as those serving Department of Defense or Federal  Aviation Administration facilities.
FCC’s other efforts related to data collection on the IP transition include  enhancing consumer complaint data, leveraging existing data collection  efforts at the state and local level, and seeking comments on how FCC  could supplement its data-gathering process. However, it remains unclear  if FCC can meet its information needs through these efforts. For example,  as noted above, DHS officials expressed concerns about the priority  services that national security and emergency preparedness personnel  rely on during times of crisis, such as GETS, losing functionality in an IP  environment. FCC may need additional information to help ensure that  such personnel can continue to make important calls during times of  crisis. Another area of uncertainty with the IP transition is the availability  of 911 services and compatibility with medical devices and other  equipment. In particular, according to AT&T, in its proposed experimental  areas, approximately a third of customers who chose not to migrate to  wireless service expressed concerns regarding 911 calls and  compatibility with medical devices and other equipment. Furthermore,  FCC’s solicitation of comments about the data-gathering process may not  necessarily result in a change in FCC’s existing policies. Although FCC’s  efforts to collect data represent a good start, we found FCC lacks a  detailed strategy that outlines how it will address its remaining information  needs, including determining what information from states and localities is  available to be leveraged, a methodology for obtaining that information,  and the resources required. As a result, FCC cannot ensure that it has  the information necessary to make data-driven decisions about the IP  transition.
section_title: Conclusions
paragraphs: FCC has recognized the importance of collecting data that would enable it  to make data-driven decisions about the IP transition and has sought  comment on how it could supplement its data-gathering process.  Nevertheless, at the time of our review, FCC had little information on the  effect of the transition, namely because the service-based experiments— FCC’s primary method for collecting data on the transition—were very  limited in number and scale, did not cover consumer services in urban  areas, and did not include critical national security or public safety  locations. Although FCC has other data collection efforts under way, it is  unclear whether FCC’s efforts will address its remaining information  needs, especially those related to the functionality of priority services and  911 availability. Developing a strategy for collecting information about  how the IP transition affects public safety and consumers would help FCC  address these areas of uncertainty as it oversees the IP transition and  enable FCC to make data-driven decisions.
section_title: Recommendation for Agency Action
paragraphs: To strengthen FCC’s data collection efforts, the Chairman of FCC should  develop a strategy to gather additional information on the IP transition to  assess the transition’s potential effects on public safety and consumers.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to FCC and DHS for their review and  comment. FCC provided written comments, reproduced in appendix II  and technical comments, which we incorporated as appropriate. DHS  provided technical comments, which we incorporated as appropriate.
In written comments, FCC did not state whether it agreed or disagreed  with our recommendation that it develop a strategy to gather additional  information on the IP transition to assess the transition’s potential effects  on public safety and consumers. FCC stated that it agreed with us about  the importance of ensuring an informed, data-driven process for  determining which services can be seamlessly supported during the IP  transition, which services will need to be transformed, and which services  will no longer be supported in an IP world, while preserving FCC’s core  functions of public safety, universal service, competition, and consumer  protection. FCC noted that it is essential that it have sufficient information  to make informed decisions and further stated that it has a  comprehensive data strategy in place to oversee the IP transition.  According to FCC, its strategy for overseeing the transition combines  traditional regulatory approaches with innovative methods that match the  dynamism of the communications environment. FCC stated that the  service-based experiments are by no means the sole means by which  FCC is overseeing the IP transition and provided examples of actions it  has taken to oversee the transition. For example, FCC stated that it took  the following actions, which we had already highlighted in our report: enhanced its notification process for retirement of copper facilities; provided clear direction to industry concerning the circumstances  in which approval  must be sought before removing a service from  the marketplace; collected NORS disruption data; and engaged with the private sector and other relevant stakeholders  through FCC’s federal advisory committees, including CSRIC.
In the letter, FCC also stated that it had taken action on some issues that  were outside the scope of our review, including revising information it  obtains from states on the states’ collection and use of 911 fees and  maintaining a “Text-to-911 Registry.”
While these actions are useful for FCC to oversee the IP transition, we  continue to believe that FCC needs to develop a strategy to gather  additional information on the potential effects of the IP transition.  Especially with respect to the priority services that national security and  emergency preparedness personnel rely on during times of crisis, by  having a strategy to collect additional information on the IP transition,  FCC could help ensure that such personnel can continue to make  important calls during times of crisis. Furthermore, as AT&T noted, some  residential customers have expressed concerns regarding 911 availability  and compatibility with medical devices and other equipment in an IP  environment. Developing a strategy to collect additional information on  the transition’s effects could help FCC address these areas of  uncertainty.
We are sending copies of this report to the Chairman of FCC, the  Secretary of Homeland Security, and appropriate congressional  committees. In addition, the report is available at no charge on GAO’s  website at http://www.gao.gov.
If you or members of your staff have any questions about this report,  please contact me at (202) 512-2834 or goldsteinm@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. Major contributors to this report  are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: This report examines the reliability of the nation’s communications  networks in an Internet Protocol (IP) environment. Specifically, we  reviewed (1) the potential challenges affecting IP networks during times of  crisis and how the challenges affect end users, and (2) the actions FCC,  DHS, and other stakeholders have taken to ensure the reliability of IP  communications during times of crisis.
To identify challenges affecting IP networks and how the challenges  affect end users, we reviewed relevant documents from the Federal  Communications Commission (FCC) and Department of Homeland  Security (DHS) including orders, notices and proposed rulemakings,  reports, and risk assessments, as well as relevant statutes and  regulations. We reviewed comments filed with FCC regarding the IP  transition and emergency communications. To ensure we reviewed a  broad range of comments, we selected comments by stakeholders that  represented a variety of interests, including public interest groups,  industry and trade associations, and state and local authorities. We  reviewed reports and best practices from federal advisory committees,  trade associations, and consumer groups. We reviewed our prior  recommendations, as well as those made by DHS, the Communications  Security, Reliability, and Interoperability Council, and the National  Security Telecommunications Advisory Committee related to priority  telecommunications services. We also searched various Web-based  databases to identify existing articles, peer-reviewed journals, trade and  industry articles, government reports, and conference papers. We  identified articles from 2010 to 2015. We examined summary-level  information about the literature identified in our search that we believed to  be germane to our report. It is possible that we may not have identified all  of the reports with findings relevant to our objective, and there may be  other challenges affecting IP networks during times of crisis that we did  not present.
To determine the actions taken by FCC, DHS, and other stakeholders to  ensure the reliability of IP communications during times of crisis, we  reviewed relevant FCC proceedings, reports, and documents.  Specifically, we reviewed FCC proceedings related to technology  transitions and ensuring consumer backup power for continuity of  communications, reports on disruptions to communications reports on  major disruptions to 911-related communications, and documents related  to outage-reporting information. To identify information on the proposed  IP transition experiments, we reviewed AT&T and CenturyLink’s  proposals, stakeholder comments submitted to FCC on these proposals,  and other documents related to the experiments. We assessed FCC’s  efforts to collect data on the effect of the IP transition against criteria  established in the federal Standards for Internal Control. We reviewed  relevant DHS documents including the 2013 National Infrastructure  Protection Plan, the 2010 Communications Sector Specific Plan, and  the 2012 Risk Assessment Report for Communications. We also  reviewed reports and best practices from the Communications Security,  Reliability, and Interoperability Council and the Alliance for  Telecommunications Industry Solutions.
To obtain additional information on the challenges affecting IP networks  and how these challenges affect end users, and to obtain information on  state efforts to ensure reliability we selected locations in six states—New  York, New Jersey, Arizona, California, Florida, and Alabama—to provide  additional details. We selected these locations because they represent a  mix of communities that experienced a major communications outage  since 2012 or contain an area with a proposed IP transition experiment.  These regions also contain a mix of rural, suburban, and urban  communities, and demographics including economic differences and  average age of residents. We reviewed documents such as reports,  comments to FCC, and comments to state agencies. We interviewed  officials from state Public Utility Commissions or similar agencies  including the New York Department of Public Service, New Jersey Board  of Public Utilities, California Public Utilities Commission, and Florida  Public Service Commission. We interviewed representatives from other  organizations that had experienced the effects of outages or were  involved with the proposed IP transition experiments including the City of  Flagstaff, the Arizona Telecommunications and Information Council, the  Broadband Alliance of Mendocino County, and the Communications  Workers of America. We interviewed officials from FCC and DHS and  representatives from AT&T, Verizon, and CenturyLink. We also  interviewed representatives from selected stakeholder groups including  trade and industry associations and consumer and public interest groups,  as shown in table 2. We identified stakeholders to interview based on our  review of comments filed in FCC’s Technology Transitions proceeding, as  well as based on recommendations from other organizations we  interviewed.
section_title: Appendix II: Comments from the Federal Communications Commission
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Sally Moino (Assistant  Director), Richard Calhoon, David Hooper, Michael Kaeser, Aaron  Kaminsky, Malika Rice, Amy Rosewarne, and Andrew Stavisky made key  contributions to this report.
section_title: Related GAO Products
paragraphs: Federal Information Security: Agencies Need to Correct Weaknesses and  Fully Implement Security Programs. GAO-15-714. September 29, 2015.
Cybersecurity: Recent Data Breaches Illustrate Need for Strong Controls  across Federal Agencies. GAO-15-725T. June 24, 2015.
Cybersecurity: Actions Needed to Address Challenges Facing Federal  Systems. GAO-15-573T. April 22, 2015.
Information Security: IRS Needs to Continue Improving Controls over  Financial and Taxpayer Data. GAO-15-337. March 19, 2015.
Information Security: FAA Needs to Address Weaknesses in Air Traffic  Control Systems. GAO-15-221. January 29, 2015.
Information Security: Additional Actions Needed to Address  Vulnerabilities That Put VA Data at Risk. GAO-15-220T. November 18,  2014.
Information Security: VA Needs to Address Identified Vulnerabilities.  GAO-15-117. November 13, 2014.
Federal Facility Cybersecurity: DHS and GSA Should Address Cyber Risk  to Building and Access Control Systems. GAO-15-6. December 12, 2014.