Telecommunications Networks: Addressing Potential Security Risks of Foreign-Manufactured Equipment
Published: 2013-05-21T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The United States is increasingly reliant on commercial communications networks for matters of national and economic security. These networks, which are primarily owned by the private sector, are highly dependent on equipment manufactured in foreign countries. Certain entities in the federal government view this dependence as an emerging threat that introduces risks to the networks. GAO was requested to review actions taken to respond to security risks from foreign-manufactured equipment.
This testimony addresses (1) how network providers and equipment manufacturers help ensure the security of foreign-manufactured equipment used in commercial communications networks, (2) how the federal government is addressing the risks of such equipment, and (3) other approaches for addressing these risks and issues related to these approaches.
This is a public version of a sensitive report that GAO issued in May 2013. Information deemed sensitive has been omitted. For the May 2013 report, GAO reviewed laws and regulations and interviewed officials from federal entities with a role in addressing cybersecurity or international trade, the five wireless and five wireline network providers with the highest revenue, and the eight manufacturers of routers and switches with the highest U.S. market shares. GAO obtained documentary and testimonial evidence from governmental entities in Australia, India, and the United Kingdom, because of their actions to protect their networks from supply chain attacks
section_title: What GAO Found
paragraphs: The network providers and equipment manufacturers GAO spoke with reported taking steps in their security plans and procurement processes to ensure the integrity of parts and equipment obtained from foreign sources. Although these companies do not consider foreign-manufactured equipment to be their most pressing security threat, their brand image and profitability depend on providing secure, reliable service. In the absence of industry or government standards on the use of this equipment, companies have adopted a range of voluntary risk-management practices. These practices span the life cycle of equipment and cover areas such as selecting vendors, establishing vendor security requirements, and testing and monitoring equipment. Equipment that is considered critical to the functioning of the network is likely to be subject to more stringent security requirements, according to these companies. In addition to these efforts, companies are collaborating on the development of industry security standards and best practices and participating in information-sharing efforts within industry and with the federal government.
The federal government has begun efforts to address the security of the supply chain for commercial networks. In 2013, the President issued an Executive Order to create a framework to reduce cyber risks to critical infrastructure. The National Institute of Standards and Technology (NIST)--a component within the Department of Commerce--is responsible for leading the development of the cybersecurity framework, which is to provide technology-neutral guidance to critical infrastructure owners and operators. NIST published a request for information in which NIST stated it is conducting a comprehensive review to obtain stakeholder input and develop the framework. NIST officials said the extent to which supply chain security of commercial communications networks will be incorporated into the framework is dependent in part on the input it receives from stakeholders. GAO identified other federal efforts that could impact communications supply chain security, but the results of those efforts were considered sensitive.
There are a variety of other approaches for addressing the potential risks posed by foreign-manufactured equipment in commercial communications networks, including those approaches taken by foreign governments. For example, the Australian government is considering a proposal to establish a risk-based regulatory framework that requires network providers to be able to demonstrate competent supervision and effective controls over their networks. The government would also have the authority to use enforcement measures to address noncompliance. In the United Kingdom, the government requires network and service providers to manage risks to network security and can impose financial penalties for serious security breaches. While these approaches are intended to improve supply chain security of communications networks, they may also create the potential for trade barriers, additional costs, and constraints on competition, which the federal government would have to take into account if it chose to pursue such approaches.

section_title: Letter
paragraphs: Thank you for the opportunity to testify at today’s hearing on federal and  industry efforts related to communications supply chain security. The  United States, like many other nations, is reliant on commercial  communications networks for business and personal communication as  well as for matters of national and economic security. Public and private  organizations rely on computer systems to transmit sensitive and  proprietary information, develop and maintain intellectual capital, conduct  operations, process business transactions, transfer funds, and deliver  services. In addition, the Internet has grown increasingly important to  American business and consumers, serving as a medium for hundreds of  billions of dollars of commerce each year. Many communications-based  applications and services, including local and long-distance telephone  calls, email, text messages, file transfers, and on-demand video  programming, depend on effectively operating communications networks.  Government, industry, and the public rely on communications networks to  such a great degree that federal policy has included them in a category of  national assets deemed critical infrastructure, making their protection a  national priority. Many other critical infrastructure sectors such as  banking and finance, energy, transportation systems, and water also rely  on communications networks to sustain their operation. In addition, we  have identified protecting systems that support our nation’s cyber critical  infrastructure as a government-wide high-risk area.
U.S. communications networks are, by and large, owned, operated, and  safeguarded by the private sector. Network providers are dependent on a  global supply chain to provide equipment—such as routers, switches,  and elements of evolved packet cores—that is used to transport a high  volume of aggregated voice and data traffic over their commercial  communications networks. According to several network providers, very  little of this equipment is manufactured in the United States. Equipment  manufacturers—including those headquartered in the United States—are  heavily dependent on facilities in foreign countries to design,  manufacture, and assemble their products. This dependence on foreign- manufactured equipment is viewed by some federal entities as an  emerging threat that introduces potential risks to the networks.  According to the Office of the National Counterintelligence Executive, “the  globalization of the economy has placed critical links in the manufacturing  supply chain under the direct control of U.S. adversaries.” A potential  enemy or criminal group has a number of ways to potentially exploit  vulnerabilities in the communications equipment supply chain, such as  placing malicious code in the components that could compromise the  security and resilience of the networks.
Recent government efforts in the United States and other countries  highlight concerns about the potential impact of supply chain threats on  government, industry, and personal communications and transactions.  Legislative proposals in the United States have sought to improve the  protection of critical infrastructure, such as commercial communications  networks, from cyber attacks., Likewise, the White House released an  Executive Order and a presidential policy directive in February 2013 that  seek to improve the protection of critical infrastructure, including  communications networks, from cyber attacks. In 2012, the House  Committee on Energy and Commerce, Subcommittees on Oversight and  Investigations, and Communications and Technology held a series of  hearings that addressed, among other things, cybersecurity threats to  communication networks. The House Permanent Select Committee on  Intelligence released a report in October 2012 in which it recommended  the United States view with suspicion the continued penetration of the  U.S. telecommunications market by Chinese telecommunications  companies. To help protect against the potential national security risks,  the committee further recommended that U.S.-based network providers  consider the long-term security risks associated with purchasing products  or services from specific foreign-based equipment manufacturers. Other  countries—such as Australia, India, and the United Kingdom—are  similarly concerned about the emerging threats to their commercial  communication networks posed by the global supply chain and have  taken actions to improve their ability to address this security challenge.
You asked us to examine private-sector and government actions to  respond to the potential security risks posed by the use of foreign- manufactured equipment. This testimony is a public version of a sensitive  report that we issued in May 2013 in response to your request. This  testimony communicates the publicly releasable aspects of our findings  while omitting information considered sensitive regarding federal actions  taken to address potential security risks from foreign-manufactured  equipment. This testimony discusses the objectives of our report, which  were to examine:  1) How communications network providers and equipment  manufacturers help ensure the security of foreign-manufactured  equipment used in commercial communications networks.  2) How the federal government is addressing the potential risks of  the use of foreign-manufactured equipment in commercial  communications networks.  3) Other approaches for addressing the potential risks of the use  of foreign-manufactured equipment in commercial  communications networks and issues related to these  approaches.
In preparing this statement, we relied on the work supporting our May  2013 report. For that report, we interviewed and collected documentation  from federal agencies, including the Department of Commerce  (Commerce), the Department of Homeland Security (DHS), the  Department of Defense (DOD), the General Services Administration  (GSA), and the Federal Communications Commission (FCC), among  others, that have a role in addressing cybersecurity to identify federal  efforts to address the risks of using foreign-manufactured equipment in  commercial communications networks. We also asked federal agencies  to identify statutes and regulations related to the federal government’s  legal and regulatory authority over how communications network  providers ensure the security of their U.S. commercial networks. We  interviewed commercial communications network providers and  equipment manufacturers that supply providers with routers, switches,  and evolved packet cores to discuss their approaches for ensuring the  security of the equipment used in commercial communications networks.  We focused this work on the five wireless and five wireline network  providers with the highest revenue and the eight manufacturers of routers  and switches with the largest market share in the United States. We did  not test the effectiveness of the practices identified by the federal  government, communication network providers, or equipment  manufacturers.
Additionally, through a review of government and academic studies and  interviews with stakeholders, we identified and described other  approaches from governmental entities in Australia, India, and the United  Kingdom that address supply chain risks for commercial communications  networks. We chose these countries to show the variation in how foreign  governments are approaching supply chain risk management and  because of the availability of public information in English describing their  approaches. While the results of the data collected from these three  countries may not encompass all possible approaches, they provided  important insights into the approaches that some countries are using to  address supply chain risks for commercial communications networks. We  also assessed the potential for using the Committee on Foreign  Investment in the United States (CFIUS) review process for purchases  of foreign-manufactured equipment. A voluntary notification process  similar to CFIUS is being discussed by government and industry  stakeholders. We reviewed the Foreign Investment and National Security  Act of 2007, related regulations, and CFIUS annual reports to Congress  to describe the CFIUS process and its applicability to purchases of  foreign equipment for commercial networks. Finally, we conducted our  own analysis regarding several potential issues that could arise from the  use of these approaches. We identified these issues based on interviews  with foreign government officials and U.S. industry stakeholders, and our  review of foreign proposals and other documentation. The issues  identified do not present an exhaustive list of all issues that could arise,  but rather provide a range of considerations involved in other approaches  to addressing supply chain risks.
We conducted this work from December 2011 to May 2013 in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives. See appendix I for more information about our scope  and methodology.
subsections: section_title: Background
subsections: section_title: Cybersecurity and Critical Infrastructure Protection Responsibilities
paragraphs: Federal policy calls for critical infrastructure protection activities that are  intended to enhance the cyber and physical security of private  infrastructures, such as telecommunication networks, that are essential to  national and economic security. DHS, Commerce, and FCC have critical  infrastructure protection responsibilities over issues related to the security  of communications networks. Appendix IV provides additional  information on these agencies’ legal authority related to supply chain  security for commercial communication networks. In addition, some  executive actions have focused on supply chain risk management issues  related to cybersecurity, which are described below.
The Homeland Security Act of 2002 established DHS and assigned it  the following critical infrastructure protection responsibilities: develop a comprehensive national plan for securing the key resources  and critical infrastructure of the United States and disseminate, as appropriate, information to assist in the deterrence,  prevention, and pre-emption of or response to terrorist attacks.
Commerce is responsible under Presidential Policy Directive 21 (PPD- 21), in coordination with other federal and nonfederal entities, for  improving security for technology and tools related to cyber-based  systems, and promoting the development of other efforts related to critical  infrastructure to enable the timely availability of industrial products,  materials, and services to meet homeland security requirements. Within  Commerce, the National Institute of Standards and Technology (NIST)  has responsibility for, among other things, cooperating with other federal  agencies, industry, and other private organizations in establishing  standard practices, codes, specifications, and voluntary consensus  standards.
Under PPD-21, FCC is responsible for exercising its authority and  expertise to partner with other federal agencies on:  identifying and prioritizing communications infrastructure;  identifying communications sector vulnerabilities and working with  industry and other stakeholders to address those vulnerabilities; and working with stakeholders, including industry, and engaging foreign  governments and international organizations to increase the security  and resilience of critical infrastructure within the communications  sector and facilitating the development and implementation of best  practices promoting the security and resilience of the nation’s critical  communications infrastructure.
Supply chain risk management has been the focus of executive actions;  for example, in January 2008, the President directed the development of  a multi-pronged approach for addressing global supply chain risk  management as part of the Comprehensive National Cybersecurity  Initiative (CNCI), an ongoing effort. More recently, at the direction of the  President, a report on the federal government’s cybersecurity-related  activities was released, which discussed, among other things, the  importance of prevention and response against threats to the supply  chains used to build and maintain the nation’s infrastructure.  Additionally, in response to one of the report’s recommendations, the  President appointed a national cybersecurity coordinator in December  2009.
section_title: Description of Core Networks and Access Networks
paragraphs: The United States has several nationwide voice and data networks that  along with comparable communications networks in other countries,  enable people around the world to connect to each other, access  information instantly, and communicate from remote areas. These  networks consist of core networks, which transport a high volume of  aggregated voice and data traffic over significant distances, and access  networks, which are more localized and connect end users to the core  network or directly to each other. Multiple network providers in the United  States operate distinct core and access networks that interconnect to  form a national communications infrastructure (see fig. 1).
Routers and switches send traffic, in the form of data packets, through  core and access networks. These pieces of equipment read the address  information located in the data packet, determine its destination, and  direct it through the network. Routers connect users between networks,  while switches connect users within a network. The evolved packet core  is the mobile core network used for long-term evolution (LTE) systems, a  standard for commercial wireless technologies. LTE is widely accepted as  the foundation for future mobile communications. Several major network  equipment manufacturers are competing to provide equipment to wireless  network providers that are upgrading their networks to deploy LTE.
section_title: Global Supply Chain
paragraphs: Communications infrastructure is increasingly composed of components  that are designed, developed, and manufactured by foreign companies or  by U.S. companies that rely on suppliers that integrate foreign  components into their products. Furthermore, we have previously  reported that according to NIST, today’s complex global economy and  manufacturing practices make corporate ownership and control more  ambiguous when assessing supply chain vulnerabilities, as companies  may conduct business under different names in multiple countries. For  example, foreign-based companies sometimes manufacture and  assemble products and components in the United States, and U.S.-based  companies sometimes manufacture products and components overseas  or employ foreign workers domestically. Figure 2 depicts some of the  locations that major network equipment manufacturers we spoke with use  for different steps in the production process.
From 2007 through 2011, communications network equipment imported  for the U.S. market came from over 100 foreign countries. While the  import data do not distinguish whether the imports are from U.S. or  foreign-based companies, according to International Trade Commission  staff, many of the imports are from U.S. companies manufacturing  abroad. Imports of network equipment to the United States grew about  $10 billion (about 76 percent) over a 5-year period, from $13.5 billion in  2007 to $23.8 billion in 2011, as shown in figure 3. During this same  period, imports from China, which was the leading source country, grew  by $4.9 billion (112 percent). In 2011, the top five sources of U.S. imports  of networking equipment were China ($9.3 billion), Mexico ($5.2 billion),  Malaysia ($2.6 billion), Thailand ($1.9 billion), and Canada ($713 million).
While there is no comprehensive unclassified compilation of attacks to  core networks that originated in the supply chain, reliance on a global  supply chain introduces some degree of risk. Risks include threats posed  by actors such as foreign intelligence services or counterfeiters that may  exploit vulnerabilities in the supply chain, thus compromising the  availability, security, and resilience of the networks. Multiple points in  the supply chain may present vulnerabilities that threat actors could  exploit. For example, a lack of adequate testing for software patches and  updates could leave a communications network vulnerable to the  insertion of code intended to allow unauthorized access to information on  the network. Routers and switches can present points of vulnerability  because they connect to the core network and are used to aggregate  data, according to an FCC official with whom we spoke. For example if a  threat actor gained control of a router, that actor could disrupt data traffic  to and inside core networks. Supply chain threats and vulnerabilities are  discussed in more depth in appendixes II and III, respectively.
section_title: Industry Is Addressing the Risks of Using Foreign- Manufactured Equipment
subsections: section_title: Companies Address Supply Chain Risk through Procurement and Testing Practices
paragraphs: The network providers and equipment manufacturers we met with told us  they address the potential security risks of using foreign-manufactured  equipment through voluntary risk management practices. Officials from  the companies and industry groups that we spoke with said that they  consider the level of risk to be affected not by where equipment and  components are made, but how they are made, particularly the security  procedures implemented by manufacturers. Many of these officials also  said they were not aware of any intentional attacks originating in the  supply chain, and some said that they consider the risk of this type of  attack to be low. Officials from four industry groups and one research  institution we spoke with told us that supply chain attacks are harder to  carry out and require more resources than other modes of attacks, such  as malicious software uploaded to equipment through the Internet, and,  therefore, are the less likely vehicle to be used by potential attackers.  Three network providers told us the most common anomalies found in  equipment are caused by erroneous coding in the software, anomalies  that are unintentional. Such anomalies could, however, lead to exploitable  vulnerabilities, according to officials from a third-party testing firm.  Nonetheless, the companies we spoke with told us that security is a high  priority because their brand image and profitability depends, in part, on  avoiding any type of breach of security or disruption of service.
Network providers and equipment manufacturers told us that their  voluntary risk management practices are in the areas of vendor selection,  vendor security requirements, and equipment testing and monitoring, as  described below and in figure 4. They said these practices are often a  part of their company’s overall security plans and procurement processes  and are applied throughout the entire life cycle of their equipment.
The network providers and equipment manufacturers we spoke with said  that ensuring the security and reliability of their equipment requires them  to carefully select their vendors. In addition to the typical considerations  when selecting vendors—prices and product performance, the vendor’s  financial stability, and maintenance and service options offered—the  providers and manufacturers told us that they consider security-related  factors, such as the vendor’s security practices, the industry standards  related to security the vendors follow, and past security performance or  reputation. Another consideration for some network providers when  selecting vendors is how critical the equipment being procured is to  network operations. Components that will be used in the core network, for  example, are typically purchased from vendors that network providers  consider most trustworthy. Some network providers told us they also  value having long-term relationships with equipment manufacturers,  because they are able to develop trust over time that the manufacturer  will provide them with reliable and secure equipment and services.
While network providers said that they are aware of security concerns  about vendors from certain countries, they do not exclude vendors from  consideration that have manufacturing locations in those countries, in  part, because the global nature of the supply chain would make excluding  all vendors located in a particular country difficult. Some network  providers told us they may exclude or avoid vendors based on factors  such as the ownership of the company or concerns about the security of  the vendor’s product, and two told us that federal government officials  had advised against using specific vendors for national security reasons,  as discussed in the following section of this testimony.
Network providers and equipment manufacturers told us that once vendor  selections are made, they might require vendors to follow certain security  practices, often as part of their contracts. Network providers told us that  the security practices they require are typically based on the criticality or  perceived risk of the project and the role of the vendor. For example, one  network provider we spoke with generates a vendor risk profile for  purchases that it considers critical or high risk or if it does not have an  established relationship with the vendor. The company uses the profile to  collect information on the product or service being provided, the vendor’s  access to proprietary information, such as the company’s financial  information or customer sensitive information, and available information  on a vendor’s subcontractors. This information enables the network  provider to identify areas of concern to investigate and to customize the  security requirements placed on the vendor. The security practices that  both network providers and equipment manufacturers may require of their  vendors include the following: physical security measures, such as procedures for securing  manufacturing sites, transporting equipment and parts, and packaging  equipment and parts; access controls, such as limiting in-house and vendor employees’  access to equipment, maintaining records of who accesses  equipment, and restricting who performs patches and updates; and employee security measures, such as requiring employees to have  background checks and use passwords and user verification to  access systems.
Additionally, network providers and equipment manufacturers told us they  might require vendors to allow inspections of their manufacturing sites to  check for compliance with the agreed-upon security practices.  Representatives from the companies we met with told us that they  conduct inspections at varying frequencies and for a number of reasons,  including if the vendor is providing a critical piece of equipment or part or  is identified as high risk, or if the equipment is performing poorly.
Network providers and equipment manufacturers told us that equipment  is tested to detect vulnerabilities. This is done throughout the life cycle of  equipment, including during product development, before and after  implementation, and when any patches or updates are applied. After  equipment is installed into the network, network providers also monitor  the equipment constantly to detect abnormal traffic or problems with the  equipment that might indicate a potential cyber attack and disrupt network  service. According to officials from a third-party testing firm, there are  several tools available to test the security of equipment, including:  vulnerability scans—searching software and hardware for known  vulnerabilities; penetration testing—executing deliberate attempts to attack a network  through the equipment, sometimes targeting specific vulnerabilities of  concern; and  source code analysis—evaluating in depth the underlying software  code that can uncover unknown vulnerabilities that would not be  detected during a vulnerability scan.
Testing can be performed by the network provider, the equipment  manufacturer, or independent third-party testing firms. Most network  providers and several equipment manufacturers told us they use third- party testing firms on an ad-hoc basis, such as when requested by a  customer or when they do not have the expertise or resources to conduct  appropriate tests. Network providers and equipment manufacturers also  use these firms when they want to analyze software or firmware source  code because equipment manufacturers are reluctant to provide network  providers with source code, which they consider intellectual property.  Two network providers and one equipment manufacturer told us they use  a trusted delivery model that employs a third-party testing firm to ensure  that the equipment purchased and received is secure. Under this model,  the third-party testing firm tests equipment over the full life-cycle of  equipment, including when there are software patches or hardware  updates, and uses a number of different techniques, such as source code  analysis. Additionally, the testing firm verifies that the equipment  delivered and implemented by the network provider matches the  equipment tested and that the equipment manufacturer followed certain  security procedures.
However, a recent congressional report identified the following potential  limitations of third-party testing and available testing techniques.
These firms typically test equipment that is configured in a specific  and restrictive way that may differ from the configuration that is  actually deployed in the network.
The behavior of equipment can vary widely depending on how and  where it is configured, installed, and maintained.
The pace of technology is changing more rapidly than third-party  evaluation processes.
Vendors that finance their own security evaluations create a conflict of  interest that can lead to skepticism about the independence and rigor  of the result.
Officials from a third-party testing firm told us that there are evaluation  processes, such as the trusted delivery model, that test the equipment  delivered to network providers and deployed into the network against the  equipment tested. Although they said it is impossible to test every piece  of equipment, the firm tests a statistically significant random selection of  equipment that represents all manufacturing lots and geographic  locations. They also told us that independence is critical to their business.  The officials said the vendor has no visibility into the evaluation process,  and, typically, the vendor is obligated to report testing results.
The congressional report further stated that regardless of the testing  technique employed, fully preventing a determined and clever insider  from intentionally inserting flaws into equipment means finding and  eliminating every significant vulnerability from a complex product, a  monumental, or even—in the words of one congressional report— ”virtually impossible” task. Similarly, officials from one third-party testing  firm whom we spoke with told us that they have concerns about the  effectiveness of network monitoring as a way of detecting vulnerabilities.  They said that security monitoring, in most cases, can only detect  attempts to exploit known vulnerabilities, or in more complex approaches,  identify potentially dangerous anomalous network activity. And as  systems evolve and are updated, new vulnerabilities that have long  existed in the underlying equipment may be inadvertently exposed in a  manner that makes exploitation possible.
section_title: Companies Collaborate on Supply-Chain Security Standards, Best Practices, and Information Sharing
paragraphs: There are currently no industry standards that address all aspects of  supply chain risk management, including supply chain security, and few  best practices that provide industry with guidance on determining what  practices to use. However, according to officials from companies and  industry groups and the experts we spoke with, there are several  industry-led efforts to establish standards and best practices and share  information related to supply chain security. Some network providers  and equipment manufacturers told us that they developed their own  practices based on national and international standards that address  information systems’ security, such as those practices described within  the certification program called the Common Criteria, and those  developed by the International Organization for Standardization (ISO), the  International Electrotechnical Commission (IEC), NIST, and the Internet  Engineering Task Force. However, these standards are not specific to  supply chain security. Additionally, federal agencies that we have  identified as having jurisdiction over issues related to the security of  communications networks have not established supply chain security  requirements for the communications industry, as discussed further in the  next section of this testimony. The companies we spoke with also told  us they have been participating in information sharing about cybersecurity  issues, including supply chain security, in venues including informal  conversations, industry group meetings, and discussions with the federal  government. Below are the two industry-led efforts most frequently  discussed during our interviews.
The Open Group Trusted  Technology Forum (OTTF)
The OTTF is a forum within The Open Group, which is a global  consortium that represents all sectors of the IT community including  academics, equipment manufacturers, federal agencies, and software  developers. The Open Group establishes certification programs and  voluntary consensus standards, such as standards for security, enterprise  architecture, interoperability, and systems management. The OTTF’s  objective is to create and adopt standards to improve the security and  integrity of commercial off-the-shelf information and communication  products, including hardware and software, as they are being developed  and moved through the global supply chain. In April 2013, the OTTF  published a voluntary standard that is intended to enhance the security  of global supply chains by mitigating the risks of tainted and counterfeit  products. The OTTF intends to provide an accreditation program that  will allow information and communication providers, equipment  manufacturers, and those vendors that supply software or hardware  components to the providers and manufacturers, to become accredited if  they meet the standard’s requirements and conformance criteria. Officials  from DOD said that although it is unknown whether industry will adopt this  standard and what the associated costs will be to maintain and use it,  developing such process-based certifications along with product  certifications, such as the Common Criteria, may prove beneficial in  covering more of the global IT supply chain.
Communications Sector  Coordinating Council (CSCC)
In accordance with Homeland Security Presidential Directive 7, the CSCC  is an industry-led group that represents the viewpoints from the U.S.  communications sector and facilitates coordination between industry and  the federal government on improving physical and cyber security of the  communications critical infrastructure., Representatives from the  CSCC told us that the CSCC began meeting with the federal government  in March 2011 to discuss supply chain security, which led to the creation  of a CSCC working group to facilitate dialogue, planning, and  coordination among the government and industry on supply chain risk  management. This group’s objectives include enhancing the  government’s understanding of industry’s current risk management  practices, the government’s sharing of supply chain threat information,  and identifying and sharing best practices for supply chain risk  management. The working group is scheduled to conclude its work in  December 2013.
section_title: Federal Government Has Begun Efforts to Address the Risks of Using Foreign- Manufactured Equipment
paragraphs: The White House released an Executive Order in February 2013 that is  likely to have an impact on communications supply chain security. We  identified other federal efforts, such as the Interim Telecommunications  Sector Risk Management Task Force, that could impact communications  supply chain security, but the results of those efforts are considered  sensitive, so we do not include them here.
subsections: section_title: Executive Order on Cybersecurity for Critical Infrastructure
paragraphs: An Executive Order released in February 2013 calls for NIST to develop a  framework to reduce cyber risks to critical infrastructure and for DHS and  others to spearhead increased information sharing between the federal  government and owners and operators of critical infrastructure including  communications networks. As discussed below, federal officials told us  that supply chain security may be included in these efforts, but the extent  has yet to be determined.
The Executive Order instructs NIST to develop a cybersecurity framework  (framework) to reduce cyber risks to critical infrastructure using an open  public review and comment process. This framework would provide  technology-neutral guidance to critical infrastructure’s owners and  operators. In February 2013, NIST published a request for information  (RFI) in which NIST stated it is conducting a comprehensive review to  develop the framework and is seeking stakeholder input. According to  NIST officials, the extent to which supply chain security of commercial  communications networks will be incorporated into the framework is  largely dependent on the input it receives from stakeholders. The officials  added that while it is reasonable to assume that they may receive  comments about supply chain security, which crosses critical  infrastructure sectors, it is possible they may not receive comments  specific to the use of foreign-manufactured equipment in commercial  communication networks.
In adopting the preliminary framework, the Executive Order requires  agencies with responsibility for regulating the security of critical  infrastructure to provide a report—in consultation with national security  staff, DHS, and the Office of Management and Budget—which states  whether the agencies have clear authority to establish requirements  based on the framework and whether any additional authorities are  necessary. DHS officials stated that without seeing the context of the  report, they could not say whether it would identify authorities specifically  related to the supply chain security of commercial communications  networks and the conditions under which those authorities could be used.
The Executive Order also calls for the federal government to increase  information sharing with owners and operators of critical infrastructure,  including communications networks, information sharing that could  include sharing of supply chain-related threats. The order directs DHS to  share unclassified cyber threat information and expand a voluntary  information-sharing program that provides classified cyber threat  information to critical infrastructure owners and operators with  government security clearances. DHS officials told us that they foresee  that this information sharing could encompass threats originating in the  supply chain.
section_title: Other Approaches to Supply Chain Risk Management
subsections: section_title: Risk Management Approaches from Selected Countries
subsections: section_title: Australian Reform Proposal
paragraphs: The Australian government is considering a reform proposal to establish a  risk-based regulatory framework to better manage national security  challenges to Australia’s telecommunications infrastructure. The  Attorney-General, in consultation with industry, has created a proposal  that addresses supply chain risks by introducing a universal obligation on  carriers and carriage service providers to protect their networks and  facilities from unauthorized access or interference. Specifically, the  proposal requires carriers and carriage service providers to be able to  demonstrate competent supervision and effective controls over their  networks. The government would also have the authority to use  enforcement measures to address noncompliance, as described in   table 1.
Under this framework, the government would provide guidance to inform  carriers and carriage service providers how they can maintain competent  supervision and effective control over their networks and educate carriers  and carriage service providers on national security risks. The approach  would require amendments to telecommunications statutes, such as the  Telecommunications Act and other relevant laws.
India enacted a new approach in 2011 through its operating licenses for  telecommunications service providers. India’s Department of  Telecommunications (DoT) is responsible for granting operating licenses  to India’s telecommunications service providers. In May 2011, DoT issued  amendments to its operating licenses that included new or revised  requirements for providers and equipment vendors to improve the  security of India’s telecommunications network infrastructure. Under the  amendments, telecommunications service providers are to be completely  responsible for security of their networks, including the supply chain of  their hardware and software. Key security requirements are described in  table 2.
The United Kingdom (UK) enacted new security and resilience  requirements for network and service providers in 2011 through revisions  to its Communications Act of 2003. The UK’s Office of Communications  (Ofcom), the independent regulator and competition authority for the UK  communications industries, is responsible for enforcing the requirements.  According to Ofcom officials, these requirements address supply chain  risks by focusing on the ability of the network and service providers to  manage the overall security of their infrastructure and maintain network  availability. Ofcom officials told us they are still developing their overall  approach to enforcing the requirements, which are described in table 3.
A Chinese network equipment manufacturer voluntarily partnered with the  UK government to establish a Cybersecurity Evaluation Centre to test its  equipment for use in UK networks. According to officials from Ofcom and  the Chinese manufacturer, the facility was created in part to address  national security concerns related to using equipment from a vendor that  did not have an established relationship with the UK government or UK  network providers. The Chinese manufacturer provides the facility with  the design and source code for all equipment, which is then tested for  vulnerabilities by staff with UK security clearances. According to officials  from Ofcom and representatives from the Chinese manufacturer, network  providers cannot use the equipment until it has been approved through  the testing process. In addition, the UK government requires all software  patches be tested using the same process before they are installed on  the equipment by the network providers. According to officials from the  Chinese manufacturer, this voluntary approach helped increase trust with  its customers. However, in November 2012, the chairman of the UK  parliament’s intelligence and security committee confirmed to us that the  committee is reviewing the commercial relationship between the Chinese  manufacturer and a British telecommunications provider and the Chinese  manufacturer’s overall presence in the UK’s critical national  infrastructure.
section_title: Expanding Use of the U.S. Process for Reviewing Foreign Acquisitions
paragraphs: The U.S. government’s Committee on Foreign Investment in the United  States (CFIUS) conducts reviews to determine whether certain  transactions that could result in foreign control of U.S. businesses pose  risks to U.S. national security. Industry representatives from the U.S.  Communications Sector Coordinating Council told us the council and  participating federal entities are discussing whether a voluntary  notification process similar to CFIUS should be used for network provider  purchases of foreign-manufactured equipment. In addition, the House  Intelligence Permanent Select Committee report recommended that  legislative proposals seeking to expand CFIUS to include purchasing  agreements should receive thorough consideration by relevant  congressional committees.
CFIUS follows a process established by statutes and regulations for  examining certain transactions that could result in foreign control of U.S.  businesses. Parties generally submit voluntary notices of transactions to  CFIUS, but CFIUS also has the authority to initiate reviews unilaterally.  Pursuant to the Foreign Investment and National Security Act of 2007,  CFIUS must complete a review of a covered transaction within 30  days. In certain circumstances, following the review, CFIUS may initiate  an investigation that may last up to 45 additional days., If CFIUS finds  that the covered transaction presents national security risks and that  other provisions of law do not provide adequate authority to address the  risks, then CFIUS may enter into an agreement with, or impose conditions  on, the parties to mitigate such risks. If the national security risks cannot  be resolved and the parties do not choose to abandon the transaction,  CFIUS may refer the case to the President, who can choose whether to  suspend or prohibit the transaction., As shown in table 4, presidential  decisions are rare. Table 4 also shows the number of CFIUS covered  transactions, withdrawals, and other outcomes from calendar years 2009  to 2011.
Discussions between the Communications Sector Coordinating Council  and participating federal entities on adapting a CFIUS-type voluntary  notification process for use on equipment purchases are ongoing, and it is  not clear how the proposal will develop, if at all. The council is trying to  understand the threats the government is concerned about and whether  these could be best addressed by a CFIUS- type process or some other  means. According to some members of the council, options range from a  simple notification process, wherein network providers notify the federal  government of proposed equipment purchases, to a complete review and  approval process of the proposed transactions, including the  aforementioned 30-day review and 45-day investigation periods.
section_title: Potential Issues Related to Use of These Approaches
paragraphs: While these approaches are intended to improve supply chain security of  communications networks, they may also create the potential for trade  barriers, additional costs, and constraints on competition. Additionally,  there are other issues specific to the approach of expanding the CFIUS  process to include foreign equipment purchases. We identified these  issues based on interviews with foreign government officials and U.S.  industry stakeholders, and our review of foreign proposals and other  documentation. While the issues we identified provide a range of  considerations that U.S. federal agencies would need to take into account  if they chose to implement these approaches, they do not represent an  exhaustive list.
Some of the approaches may create a trade barrier or cause trade  disputes. The Office of the United States Trade Representative (USTR)  has reported that standards-related measures that are non-transparent,  discriminatory, or otherwise unwarranted can act as significant barriers to  U.S. trade. USTR has reported concerns regarding some of India’s  licensing requirements for telecommunications service providers including  the following:  the requirement for telecommunications equipment vendors to test all  equipment in labs in India;  the requirement to allow the service provider and government  agencies to inspect a vendor’s manufacturing facilities and supply  chain and perform security checks for the duration of the contract to  supply the equipment; and  the imposition of strict liability and possible blacklisting of a vendor for  taking inadequate precautionary security measures, without the right  to appeal and other due process guarantees.
These requirements may result in trade-distorting conditions by making it  more expensive and burdensome for foreign equipment manufacturers to  do business in India. According to USTR, it is too early to evaluate  whether the proposed reforms in Australia, new requirements and  voluntary Cybersecurity Evaluation Centre in the UK, and an extension of  CFIUS to equipment purchases would create trade barriers or cause  trade disputes. Three U.S.-based equipment manufacturers told us that  extending CFIUS to equipment purchases could cause other countries to  implement similar policies, which may result in barriers to entry in other  countries and trade disputes.
All of the approaches may increase costs to industry and the federal  government. The Australian and UK governments recognize that changes  to the regulatory framework would include a cost to industry, which may  increase prices for consumers. Representatives from the Chinese  equipment manufacturer stated that although voluntarily setting up the  Cybersecurity Evaluation Centre was expensive, it was the cost of doing  business in the UK. Similarly, one telecommunications industry group  reported that India’s 2011 License Amendments would increase  compliance costs for Indian telecommunications services providers. The  majority (6 of 8) of equipment manufacturers we spoke with told us that  any proposal to extend CFIUS to equipment purchases would increase  costs for network providers, equipment manufacturers, and ultimately  consumers. In addition, it is likely that the responsible federal agencies  will also incur additional administrative costs in implementing any supply  chain risk management requirements.
All of the approaches may have an impact on the business decisions of  network providers and equipment manufacturers and competition within  the industry. The Australian government is aware that its proposed  framework could have effects on the industry, and it is trying to anticipate  these effects and explore how they might be mitigated. It is also seeking  input from industry and government stakeholders on any potentially  broader effects on competition in the telecommunications market and on  consumers. Similarly, a telecommunications industry group reported the  Indian requirements complicate the relationship between  telecommunications service providers and their equipment vendors,  creating concerns about access to intellectual property and giving each  an incentive to shift the risk of enforcement onto the other (though the  current requirements still place the principal obligations on the  licensees). Representatives from a U.S.-based equipment manufacturer  told us that extending the CFIUS process to equipment purchases could  potentially lead to vendors being excluded from the U.S. market without  appeal rights; this would result in limited competition and therefore  potentially higher prices for consumers. Similarly, four network providers  and one think tank also told us that extending CFIUS to equipment  purchases would limit competition and raise costs.
The appropriate universe of equipment supply contracts that would be  subject to review would need to be defined if the CFIUS process were  extended to cover these transactions. There were 269 notices of  transactions covered by the CFIUS process from 2009 through 2011. By  comparison, four network providers and two equipment manufacturers we  spoke with noted that network providers conduct thousands of  transactions a year and expressed concerns about their being subject to  a CFIUS-type process. Specifically, the two manufacturers said it would  be difficult for CFIUS members to oversee all of these transactions in a  timely fashion, adding expense to the procurement process for network  providers and equipment manufacturers that could be passed on to  consumers. In addition, CFIUS member agencies may incur significant  administrative costs if asked to review thousands of procurement  transactions per year.
Chairman Walden, Ranking Member Eshoo, and Members of the  Subcommittee, this completes my prepared statement. I would be  pleased to respond to any questions that you may have at this time.
section_title: Contact and Acknowledgments
paragraphs: If you or your staff members have any questions about this testimony,  please contact me at (202) 512-2834 or goldsteinm@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this statement. GAO staff who made key  contributions to this testimony are listed in appendix V.
section_title: Appendix I: Scope and Methodology
paragraphs: We focused our review on the core networks that constitute the backbone  of the nation’s communications system and the equipment—such as  routers, switches and evolved packet cores—that transport traffic over  these networks. We also focused on the wireline, wireless, and cable  access networks used to connect end users to the core wireline networks.  We did not address broadcast or satellite networks because they are  responsible for a smaller volume of traffic than other networks.
To obtain information on all of our objectives we conducted a literature  review and semi-structured interviews with or obtained written comments  from academics, industry analysts, and research institutions; federal  entities; domestic and foreign equipment manufacturers; industry and  trade groups; network providers; and security and software audit firms as  shown in table 5.
We selected the stakeholders based on relevant published literature, our  previous work, stakeholders’ recognition and affiliation with a segment of  the communications industry (domestic and foreign equipment  manufacturers, industry and trade groups, network providers and so  forth), and recommendations from the stakeholders interviewed. We also  spoke with federal entities that have a role in addressing cybersecurity,  international trade, and the Committee on Foreign Investment in the U.S.  (CFIUS).
To describe how communications network providers and equipment  manufacturers help ensure the security of foreign-manufactured  equipment that is used in commercial communications networks, we  interviewed network providers; domestic and foreign equipment  manufacturers (routers, switches, and evolved packet cores); and  industry and trade groups. Information we collected included specific  industry practices, such as the use of security provisions in contracts; the  extent to which domestic and international standards help guide their  practices; and any industry-wide efforts addressing supply chain security.  We focused this work on the five wireless and five wireline network  providers with the highest revenue, the eight manufacturers of routers  and switches with the highest market shares in the U.S. market, and two  cable network providers. To identify the top five U.S. wireless providers  by subscribers, we used data from the Department of Defense and  verified the subscribership data against investor relations reports from the  providers. To identify the top five U.S. wireline providers by subscribers,  we used publicly available rankings and verified the subscriber data  against investor relations reports from the providers. We selected the top  eight manufacturers of routers and switches based on 2010 U.S. market  share. We selected two of the top three U.S. cable companies based on  2011 subscriber data.
To identify how the federal government is addressing the potential risks of  foreign-manufactured equipment that is used in commercial  communications networks, we asked federal agencies to identify statutes  and regulations to identify potential sources of the federal government’s  legal and regulatory authority over how communications network  providers ensure the security of their U.S. commercial networks.  Additionally, we interviewed and collected documentation from 13 federal  entities to identify related federal efforts, such as interagency information  sharing initiatives and those with the private sector.
To determine other approaches, including those of foreign countries, for  addressing the potential risks of using foreign-manufactured equipment in  commercial communications networks, we conducted a literature review  and interviewed stakeholders. We identified other approaches from  governmental entities in Australia, India, and the United Kingdom (UK)  that address supply chain risks for commercial communications  networks. These countries were chosen to show the variation in how  foreign governments are approaching supply chain risk management. We  also considered criteria such as the availability of public information on  the approach to allow for a detailed review and language considerations.  While the results of the data collected from these three countries may not  encompass all possible approaches, it provided important insights into the  approaches that some countries are using to address supply chain risks  for commercial communications networks.
We reviewed documents and interviewed officials from governmental  entities in Australia, India, and the UK to describe the approaches and  issues that could arise from using these approaches. We identified these  issues based on interviews with foreign government officials and U.S.  industry stakeholders, and our review of foreign proposals and other  documentation. The issues identified provide a range of considerations,  but is not an exhaustive list of all issues that could be considered.
We also assessed the potential for using the  CFIUS review process for  purchases of foreign-manufactured equipment because a voluntary  notification process similar to CFIUS is being discussed by government  and industry stakeholders. We reviewed the Foreign Investment and  National Security Act of 2007, related regulations, and CFIUS’s annual  reports to Congress to describe the CFIUS process. We reviewed  CFIUS’s transaction data to describe the number of covered transactions,  investigations, and Presidential decisions made from calendar years 2009  to 2011 to provide context. Additionally, we interviewed officials from  federal agencies and industry stakeholders on how the commercial  communications market in the United States may be affected if any of the  identified approaches are used when U.S. communications companies  purchase equipment manufactured in foreign countries. We conducted  data reliability testing to determine that any data used are suitable for our  purposes.
We conducted this performance audit from December 2011 to May 2013  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Examples of Threats to the Information Technology Supply Chain
paragraphs: Supply chain threats are present at various phases of the life cycle of  communications network equipment. Each of the key threats presented in  table 6 could create an unacceptable risk to a communications network.
section_title: Appendix III: Examples of Supply Chain Vulnerabilities
paragraphs: Threat actors can introduce the threats described in appendix II by  exploiting vulnerabilities at multiple points in the global supply chain.  Table 7 describes examples of the types of vulnerabilities that could be  exploited.
section_title: Appendix IV: Potential Sources of Authority for Taking Action to Ensure Supply Chain Security
paragraphs: In examining potential sources of authority related to supply chain  security, we focused on DHS, FCC, and Commerce because of their roles  in critical infrastructure protection. Homeland Security Presidential  Directive 7 (2003) designated DHS as the sector-specific federal agency  for the telecommunications critical infrastructure sector. It required DHS  to set up appropriate systems, mechanisms, and procedures to share  cyber information with other federal agencies and the private sector,  among others. The Communications Sector-Specific Plan of the National  Infrastructure Protection Plan characterizes FCC and Commerce as  partners that have relevant authority and support DHS’s communications  critical-infrastructure protection efforts.
DHS has not identified specific authorities that would permit it to take  action to ensure the security of the supply chain of commercial networks.  Officials from DHS’s Office of General Counsel stated that the Homeland  Security Act might have applicable authority, although this authority is  not specific to the security of the supply chain of commercial networks.  DHS further stated that it cannot say what specific authority it might use if  it needed to take action because it has not faced a set of circumstances  related to a commercial network’s supply chain security requiring action.
Officials from FCC’s Office of General Counsel stated that FCC could  regulate network providers’ supply chain practices to assure that the  public interest, convenience, or necessity are served if circumstances  warranted. Specifically, FCC could impose supply chain requirements on  providers of common carrier wireline and wireless voice services and, in  specific circumstances, information services providers, using FCC’s  authority under the Communications Act. Officials stated that FCC has  not yet attempted to use these sources of authority to impose regulations  specifically designed to address cybersecurity threats.
FCC officials stated that because the agency has not adopted regulations  or policies related to supply chain security in commercial communications  networks, reliance on these sources of authority has not been tested by  legal challenges in court. According to FCC officials, legislative changes  to the Communications Act to provide express recognition of the agency’s  authority to address such threats would reduce the risk of such  challenges and may facilitate adoption of supply chain security regulation.
FCC officials added that although its current legal authority could allow  FCC to act to impose supply chain requirements on network providers, it  has not determined the extent to which it has authority to regulate  companies that manufacture network equipment. In the past, the agency  regulation of equipment manufacturers has focused on interference  management. FCC officials told us that they are actively participating in  discussions within the executive branch regarding supply side issues,  though which agencies should take the lead on this issue has not been  determined.
Commerce officials stated that Section 232 of the Trade Expansion Act of  1962, as amended, could potentially provide authority for Commerce to  use when communications equipment purchases pose a potential risk to  national security. According to Commerce documents, Section 232 gives  Commerce statutory authority to conduct investigations to determine the  effect of imports on national security. If an investigation finds that an  import may threaten to impair national security, then the President may  use his statutory authority to “adjust imports,” by taking measures  recommended by the Secretary of Commerce, including barring imports  of a product. Commerce has not used, or attempted to use, this authority  for any cases involving the communications sector. Commerce officials  stated that they reviewed this authority in 2010 in part because a major  network provider was considering purchasing foreign-manufactured  communications equipment from a company that the federal government  believed might pose a national security threat. Since the network provider  decided not to purchase equipment from that company, Commerce did  not review the potential applicability of Section 232 to that transaction.
section_title: Appendix V: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Contact and Acknowledgments
paragraphs: In addition to the contact named above, Heather Halliwell, Assistant  Director; Derrick Collins; Swati Deo; Anne Doré; Bert Japikse; Sara Ann  Moessbauer; Josh Ormond; Amy Rosewarne; and Hai Tran made key  contributions to this testimony.