Internet Infrastructure: Challenges in Developing a Public/Private Recovery Plan
Published: 2006-09-13T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Since the early 1990s, growth in the use of the Internet has revolutionized the way that our nation communicates and conducts business. While the Internet originated as a U.S. government-sponsored research project, the vast majority of its infrastructure is currently owned and operated by the private sector. Federal policy recognizes the need to prepare for debilitating Internet disruptions and tasks the Department of Homeland Security (DHS) with developing an integrated public/private plan for Internet recovery. GAO was asked to summarize its report--Internet Infrastructure: DHS Faces Challenges in Developing a Joint Public/Private Recovery Plan, GAO-06-672 (Washington, D.C.: June 16, 2006). This report (1) identifies examples of major disruptions to the Internet, (2) identifies the primary laws and regulations governing recovery of the Internet in the event of a major disruption, (3) evaluates DHS plans for facilitating recovery from Internet disruptions, and (4) assesses challenges to such efforts.
section_title: What GAO Found
paragraphs: A major disruption to the Internet could be caused by a physical incident (such as a natural disaster or an attack that affects key facilities), a cyber incident (such as a software malfunction or a malicious virus), or a combination of both physical and cyber incidents. Recent physical and cyber incidents, such as Hurricane Katrina, have caused localized or regional disruptions but have not caused a catastrophic Internet failure. Federal laws and regulations that address critical infrastructure protection, disaster recovery, and the telecommunications infrastructure provide broad guidance that applies to the Internet, but it is not clear how useful these authorities would be in helping to recover from a major Internet disruption. Specifically, key legislation on critical infrastructure protection does not address roles and responsibilities in the event of an Internet disruption. Other laws and regulations governing disaster response and emergency communications have never been used for Internet recovery. DHS has begun a variety of initiatives to fulfill its responsibility for developing an integrated public/private plan for Internet recovery, but these efforts are not complete or comprehensive. Specifically, DHS has developed high-level plans for infrastructure protection and incident response, but the components of these plans that address the Internet infrastructure are not complete. In addition, the department has started a variety of initiatives to improve the nation's ability to recover from Internet disruptions, including working groups to facilitate coordination and exercises in which government and private industry practice responding to cyber events. However, progress to date on these initiatives has been limited, and other initiatives lack time frames for completion. Also, the relationships among these initiatives are not evident. As a result, the government is not yet adequately prepared to effectively coordinate public/private plans for recovering from a major Internet disruption. Key challenges to establishing a plan for recovering from Internet disruptions include (1) innate characteristics of the Internet that make planning for and responding to disruptions difficult, (2) lack of consensus on DHS's role and when the department should get involved in responding to a disruption, (3) legal issues affecting DHS's ability to provide assistance to restore Internet service, (4) reluctance of many in the private sector to share information on Internet disruptions with DHS, and (5) leadership and organizational uncertainties within DHS. Until these challenges are addressed, DHS will have difficulty achieving results in its role as a focal point for helping the Internet to recover from a major disruption.

section_title: Letter
paragraphs: Thank you for the opportunity to summarize our previously issued  report on public/private recovery plans for Internet infrastructure.  Since the early 1990s, increasing computer interconnectivity—most  notably growth in the use of the Internet—has revolutionized the  way that our government, our nation, and much of the world  communicate and conduct business. Our country has come to rely  on the Internet as a critical infrastructure supporting commerce,  education, and communication. While the benefits of this  technology have been enormous, this widespread interconnectivity  poses significant risks to the government’s and our nation’s  computer systems and, more importantly, to the critical operations  and infrastructures they support.
Federal regulation establishes the Department of Homeland Security  (DHS) as the focal point for the security of cyberspace—including  recovery efforts for public and private critical infrastructure  systems. Additionally, federal policy recognizes the need to be  prepared for the possibility of debilitating Internet disruptions and  tasks DHS with developing an integrated public/private plan for  Internet recovery. Last year, we testified before the Senate on  DHS’s responsibilities for cybersecurity-related critical  infrastructure protection. In that testimony, we discussed the status  of DHS’s efforts and challenges faced by DHS in fulfilling its  responsibilities. We reported that DHS had much work ahead of it.  In a related report, we recommended that DHS prioritize  cybersecurity-related responsibilities—including establishing  recovery plans for key Internet functions.
In June 2006, we issued a report that (1) identifies examples of  major disruptions to the Internet, (2) identifies the primary laws and  regulations governing recovery of the Internet in the event of a  major disruption, (3) evaluates DHS’s plans for facilitating recovery  from Internet disruptions, and (4) assesses challenges to such  efforts. The report includes matters for congressional consideration  and recommendations to DHS for improving Internet recovery  efforts.
As requested, this testimony summarizes our June 2006 report. That  report contains a detailed overview of our scope and methodology.  As we stated in our report, all supporting work was performed in  accordance with generally accepted government auditing standards.
subsections: section_title: Background
paragraphs: The Internet is a vast network of interconnected networks that is  used by governments, businesses, research institutions, and  individuals around the world to communicate, engage in commerce,  do research, educate, and entertain. From its origins in the 1960s as  a research project sponsored by the U.S. government, the Internet  has grown increasingly important to both American and foreign  businesses and consumers, serving as the medium for hundreds of  billions of dollars of commerce each year. The Internet has also  become an extended information and communications  infrastructure, supporting vital services such as power distribution,  health care, law enforcement, and national defense. Today, private  industry—including telecommunications companies, cable  companies, and Internet service providers—owns and operates the  vast majority of the Internet’s infrastructure. In recent years, cyber  attacks involving malicious software or hacking have been  increasing in frequency and complexity. These attacks can come  from a variety of actors, including criminal groups, hackers, and  terrorists.
Federal regulation recognizes the need to protect critical  infrastructures such as the Internet. It directs federal departments  and agencies to identify and prioritize critical infrastructure sectors  and key resources and to protect them from terrorist attack.  Furthermore, it recognizes that since a large portion of these critical  infrastructures is owned and operated by the private sector, a  public/private partnership is crucial for the successful protection of  these critical infrastructures. Federal policy also recognizes the  need to be prepared for the possibility of debilitating disruptions in  cyberspace and, because the vast majority of the Internet  infrastructure is owned and operated by the private sector, tasks  DHS with developing an integrated public/private plan for Internet  recovery. In its plan for protecting critical infrastructures, DHS  recognizes that the Internet is a key resource composed of assets  within both the information technology and the telecommunications  sectors. It notes that the Internet is used by all critical  infrastructure sectors to varying degrees and provides information  and communications to meet the needs of businesses and  government.
In the event of a major Internet disruption, multiple organizations  could help recover Internet service. These organizations include  private industry, collaborative groups, and government  organizations. Private industry is central to Internet recovery  because private companies own the vast majority of the Internet’s  infrastructure and often have response plans. Collaborative  groups—including working groups and industry councils—provide  information-sharing mechanisms to allow private organizations to  restore services. In addition, government initiatives could facilitate  response to major Internet disruptions.
Federal policies and plans assign DHS lead responsibility for  facilitating a public/private response to and recovery from major  Internet disruptions. Within DHS, responsibilities reside in two  divisions within the Preparedness Directorate: the National Cyber  Security Division (NCSD) and the National Communications System  (NCS). NCSD operates the U.S. Computer Emergency Readiness  Team (US-CERT), which coordinates defense against and response  to cyber attacks. The other division, NCS, provides programs and  services that assure the resilience of the telecommunications  infrastructure in times of crisis. Additionally, the Federal  Communications Commission can support Internet recovery by  coordinating resources for restoring the basic communications  infrastructures over which Internet services run. For example, after  Hurricane Katrina, the commission granted temporary authority for  private companies to set up wireless Internet communications  supporting various relief groups; federal, state, and local  government agencies; businesses; and victims in the disaster areas.
Prior evaluations of DHS’s cybersecurity responsibilities have  highlighted issues and challenges facing the department. In May  2005, we issued a report on DHS’s efforts to fulfill its cybersecurity  responsibilities. We noted that while DHS had initiated multiple  efforts to fulfill its responsibilities, it had not fully addressed any of  the 13 key cybersecurity responsibilities noted in federal law and  policy. We also reported that DHS faced a number of challenges that  have impeded its ability to fulfill its cyber responsibilities. These  challenges included achieving organizational stability, gaining  organizational authority, overcoming hiring and contracting issues,  increasing awareness of cybersecurity roles and capabilities,  establishing effective partnerships with stakeholders, achieving two- way information sharing with stakeholders, and demonstrating the  value that DHS can provide. In this report, we also made  recommendations to improve DHS’s ability to fulfill its mission as an  effective focal point for cybersecurity, including recovery plans for  key Internet functions. DHS agreed that strengthening cybersecurity  is central to protecting the nation’s critical infrastructures and that  much remained to be done, but it has not yet addressed our  recommendations.
section_title: Although Cyber and Physical Incidents Have Caused Disruptions, the Internet Has Not Yet Suffered a Catastrophic Failure
paragraphs: The Internet’s infrastructure is vulnerable to disruptions in service  due to terrorist and other malicious attacks, natural disasters,  accidents, technological problems, or a combination of the above.  Disruptions to Internet service can be caused by cyber and physical  incidents—both intentional and unintentional. Recent physical and  cyber incidents have caused localized or regional disruptions,  highlighting the importance of recovery planning. However, these  incidents have also shown the Internet as a whole to be flexible and  resilient. Even in severe circumstances, the Internet has not yet  suffered a catastrophic failure.
To date, cyber attacks have caused various degrees of damage. For  example, in 2001, the Code Red worm used a denial-of-service  attack to affect millions of computer users by shutting down Web  sites, slowing Internet service, and disrupting business and  government operations. In 2003, the Slammer worm caused network  outages, canceled airline flights, and automated teller machine  failures. Slammer resulted in temporary loss of Internet access to  some users, and cost estimates on the impact of the worm range  from $1.05 billion to $1.25 billion. The federal government  coordinated with security companies and Internet service providers  and released an advisory recommending that federal departments  and agencies patch and block access to the affected channel.  However, because the worm had propagated so quickly, most of  these activities occurred after it had stopped spreading.
In 2002, a coordinated denial-of-service attack was launched against  all of the root servers in the Domain Name System. At least nine of  the thirteen root servers experienced degradation of service.  However, average end users hardly noticed the attack. The attack  became visible only as a result of various Internet health-monitoring  projects. The response to the attacks was handled by the server  operators and their service providers. The attack pointed to a need  for increased capacity for servers at Internet exchange points to  enable them to manage the high volumes of data traffic during an  attack. If a massive disruptive attack on the domain name server  system were successful, it could take several days to recover from.  According to experts familiar with the attack, the government did  not have a role in recovering from it.
Like cyber incidents, physical incidents could affect various aspects  of the Internet infrastructure, including underground or undersea  cables and facilities that house telecommunications equipment,  Internet exchange points, or Internet service providers. For  example, on July 18, 2001, a 60-car freight train derailed in a  Baltimore tunnel, causing a fire that interrupted Internet and data  services between Washington and New York. The tunnel housed  fiber-optic cables serving seven of the biggest U.S. Internet service  providers. The fire burned and severed fiber optic cables, causing  backbone slowdowns for at least three major Internet service  providers. Efforts to recover Internet service were handled by the  affected Internet service providers; however, local and federal  officials responded to the immediate physical issues of  extinguishing the fire and maintaining safety in the surrounding  area, and they worked with telecommunications companies to  reroute affected cables.
In addition, Hurricane Katrina caused substantial destruction of the  communications infrastructure in Louisiana, Mississippi, and  Alabama, but it had minimal affect on the overall functioning of the  Internet outside of the immediate area. According to an Internet  monitoring service provider, while there was a loss of routing  around the affected area, there was no significant impact on global  Internet routing. According to the Federal Communications  Commission, the storm caused outages for over 3 million telephone  customers, 38 emergency 9-1-1 call centers, hundreds of thousands  of cable customers, and over 1,000 cellular sites. However, a  substantial number of the networks that experienced service  disruptions recovered relatively quickly.
Federal officials stated that the government took steps to respond to  the hurricane, such as increasing analysis and watch services in the  affected area, coordinating with communications companies to  move personnel to safety, working with fuel and equipment  providers, and rerouting communications traffic away from affected  areas. However, private-sector representatives stated that requests  for assistance, such as food, water, fuel, and secure access to  facilities were denied for legal reasons; the government made time- consuming and duplicative requests for information; and certain  government actions impeded recovery efforts.
Since its inception, the Internet has experienced disruptions of  varying scale—including fast-spreading worms, denial-of-service  attacks, and physical destruction of key infrastructure  components—but the Internet has yet to experience a catastrophic  failure. However, it is possible that a complex attack or set of  attacks could cause the Internet to fail. It is also possible that a  series of attacks against the Internet could undermine users’ trust  and thereby reduce the Internet’s utility.
section_title: Existing Laws and Regulations Apply to the Internet, but Numerous Uncertainties Exist in Using Them for Internet Recovery
paragraphs: Several federal laws and regulations provide broad guidance that  applies to the Internet infrastructure, but it is not clear how useful  these authorities would be in helping to recover from a major  Internet disruption because some do not specifically address  Internet recovery and others have seldom been used. Pertinent laws  and regulations address critical infrastructure protection, federal  disaster response, and the telecommunications infrastructure.
Specifically, the Homeland Security Act of 2002 and Homeland  Security Presidential Directive 7 establish critical infrastructure  protection as a national goal and describe a strategy for cooperative  efforts by the government and the private sector to protect the  physical and cyber-based systems that are essential to the  operations of the economy and the government. These authorities  apply to the Internet because it is a core communications  infrastructure supporting the information technology and  telecommunications sectors. However, this law and regulation do  not specifically address roles and responsibilities in the event of an  Internet disruption.
Regarding federal disaster response, the Defense Production Act  and the Stafford Act provide authority to federal agencies to plan  for and respond to incidents of national significance like disasters  and terrorist attacks. Specifically, the Defense Production Act  authorizes the President to ensure the timely availability of  products, materials, and services needed to meet the requirements  of a national emergency. It is applicable to critical infrastructure  protection and restoration but has never been used for Internet  recovery. The Stafford Act authorizes federal assistance to states,  local governments, nonprofit entities, and individuals in the event of  a major disaster or emergency. However, the act does not authorize  assistance to for-profit companies—such as those that own and  operate core Internet components.
Other legislation and regulations, including the Communications Act  of 1934 and the NCS authorities, govern the telecommunications  infrastructure and help to ensure communications during national  emergencies. For example, the NCS authorities establish guidance  for operationally coordinating with industry to protect and restore  key national security and emergency preparedness communications  services. These authorities grant the President certain emergency  powers regarding telecommunications, including the authority to  require any carrier subject to the Communications Act of 1934 to  grant preference or priority to essential communications. The  President may also, in the event of war or national emergency,  suspend regulations governing wire and radio transmissions and  authorize the use or control of any such facility or station and its  apparatus and equipment by any department of the government.  Although these authorities remain in force in the Code of Federal  Regulations, they have been seldom used—and never for Internet  recovery. Thus it is not clear how effective they would be if used for  this purpose.
In commenting on the statutory authority for Internet reconstitution  following a disruption, DHS agreed that this authority is lacking and  noted that the government’s roles and authorities related to assisting  in Internet reconstitution following a disruption are not fully  defined.
section_title: DHS Initiatives Supporting Internet Recovery Planning Are under Way, but Much Remains to Be Done and the Relationship Between Initiatives Is Not Evident
paragraphs: DHS has begun a variety of initiatives to fulfill its responsibility to  develop an integrated public/private plan for Internet recovery, but  these efforts are not complete or comprehensive. Specifically, DHS  has developed high-level plans for infrastructure protection and  national disaster response, but the components of these plans that  address the Internet infrastructure are not complete. In addition,  DHS has started a variety of initiatives to improve the nation’s  ability to recover from Internet disruptions, including working  groups to facilitate coordination and exercises in which government  and private industry practice responding to cyber events. While  these activities are promising, some initiatives are not complete,  others lack time lines and priorities, and still others lack effective  mechanisms for incorporating lessons learned. In addition, the  relationship between these initiatives is not evident. As a result, the  nation is not prepared to effectively coordinate public/private plans  for recovering from a major Internet disruption.
DHS has two key documents that guide its infrastructure protection  and recovery efforts, but components of these plans dealing with  Internet recovery are not complete. The National Response Plan is  DHS’s overarching framework for responding to domestic incidents.  It contains two components that address issues related to  telecommunications and the Internet, Emergency Support  Function 2 and the Cyber Incident Annex. These components,  however, are not complete; Emergency Support Function 2 does not  directly address Internet recovery, and the annex does not reflect  the National Cyber Response Coordination Group’s current  operating procedures. The other key document, the National  Infrastructure Protection Plan, consists of both a base plan and  sector-specific plans. The base plan, which was recently released,  describes the importance of cybersecurity and networks such as the  Internet to critical infrastructure protection and includes an  appendix that provides information on cybersecurity  responsibilities. The appendix restates DHS’s responsibility to  develop plans to recover Internet functions. However, the base plan  is at a high level and the sector-specific plans that would address the  Internet in more detail are not scheduled for release until December  2006.
Several representatives of private-sector firms supporting the  Internet infrastructure expressed concerns about both plans, noting  that they would be difficult to execute in times of crisis. Other  representatives were uneasy about the government developing  recovery plans, because they were not confident of the  government’s ability to successfully execute the plans. DHS officials  acknowledged that it will be important to obtain input from private- sector organizations as they refine these plans and initiate more  detailed public/private planning.
Both the National Response Plan and National Infrastructure  Protection Plan are designed to be supplemented by more specific  plans and activities. DHS has numerous initiatives under way to  better define its ability to assist in responding to major Internet  disruptions. While these activities are promising, some initiatives  are incomplete, others lack time lines and priorities, and still others  lack an effective mechanism for incorporating lessons learned.
DHS plans to revise the role and mission of the National  Communications System (NCS) to reflect the convergence of voice  and data communications, but this effort is not yet complete. A  presidential advisory committee on telecommunications  established two task forces that recommended changes to NCS’s  role, mission, and functions to reflect this convergence, but DHS has  not yet developed plans to address these recommendations.
As a primary entity responsible for coordinating governmentwide  responses to cyber incidents—such as major Internet disruptions— DHS’s National Cyber Response Coordination Group is working to  define its roles and responsibilities, but much remains to be done.  DHS officials acknowledge that the trigger to activate this group is  imprecise and will need to be clarified. Because key activities to  define roles, responsibilities, capabilities, and the appropriate  triggers for government involvement are still under way, the group is  at risk of not being able to act quickly and definitively during a  major Internet disruption.
Since most of the Internet is owned and operated by the private  sector, NCSD and NCS established the Internet Disruption Working  Group to work with the private sector to establish priorities and  develop action plans to prevent major disruptions of the Internet  and to identify recovery measures in the event of a major disruption.  According to DHS officials who organized the group, it held its first  forum, in November 2005, to begin to identify real versus perceived  threats to the Internet, refine the definition of an Internet disruption,  determine the scope of a planned analysis of disruptions, and  identify near-term protective measures. DHS officials stated that  they had identified a number of potential future plans; however,  agency officials have not yet finalized plans, resources, or  milestones for these efforts.
US-CERT officials formed the North American Incident Response  Group, which includes both public and private-sector network  operators that would be the first to recognize and respond to cyber  disruptions. In September 2005, US-CERT officials conducted  regional workshops with group members to share information on  structure, programs, and incident response and to seek ways for the  government and industry to work together operationally. While the  outreach efforts of the North American Incident Response Group  are promising, DHS has only just begun developing plans and  activities to address the concerns of private-sector stakeholders.
Over the last few years, DHS has conducted several broad inter- governmental exercises to test regional responses to significant  incidents that could affect the critical infrastructure. More recently,  in February 2006, DHS conducted an exercise called Cyber Storm,  which was focused primarily on testing responses to a cyber-related  incident of national significance. Exercises that include Internet  disruptions can help to identify issues and interdependencies that  need to be addressed. However, DHS has not yet identified planned  activities, milestones, or which group should be responsible for  incorporating lessons learned from the regional and Cyber Storm  exercises into its plans and initiatives.
While DHS has various initiatives under way, the relationships and  interdependencies between these various efforts are not evident.  For example, the National Cyber Response Coordination Group, the  Internet Disruption Working Group, and the North American  Incident Response Group are all meeting to discuss ways to address  Internet recovery, but the interdependencies between the groups  have not been clearly established. Without a thorough  understanding of the interrelationships between its various  initiatives, DHS risks pursuing redundant efforts and missing  opportunities to build on related efforts.
After our report was issued, a private-sector organization released a  report that examined the nation’s preparedness for a major Internet  disruption. The report stated that our nation is unprepared to  reconstitute the Internet after a massive disruption. The report  supported our findings that significant gaps exist in government  response plans and that the responsibilities of the multiple  organizations that would play a role in recovery are unclear. The  report also made recommendations to complete and revise response  plans such as the Cyber Incident Annex of the National Response  Plan; better define recovery roles and responsibilities; and establish  more effective oversight and strategic direction for Internet  reconstitution.
section_title: Multiple Challenges Exist to Planning for Recovery from Internet Disruptions
paragraphs: Although DHS has various initiatives under way to improve Internet  recovery planning, it faces key challenges in developing a  public/private plan for Internet recovery, including (1) innate  characteristics of the Internet that make planning for and  responding to a disruption difficult, (2) lack of consensus on DHS’s  role and on when the department should get involved in responding  to a disruption, (3) legal issues affecting DHS’s ability to provide  assistance to restore Internet service, (4) reluctance of the private  sector to share information on Internet disruptions with DHS, and  (5) leadership and organizational uncertainties within DHS. Until it  addresses these challenges, DHS will have difficulty achieving  results in its role as focal point for recovering the Internet from a  major disruption.
First, the Internet’s diffuse structure, vulnerabilities in its basic  protocols, and the lack of agreed-upon performance measures make  planning for and responding to a disruption more difficult. The  components of the Internet are not all governed by the same  organization. In addition, the Internet is international. According to  private-sector estimates, only about 20 percent of Internet users are  in the United States. Also, there are no well-accepted standards for  measuring and monitoring the Internet infrastructure’s availability  and performance. Instead, individuals and organizations rate the  Internet’s performance according to their own priorities.
Second, there is no consensus about the role DHS should play in  responding to a major Internet disruption or about the appropriate  trigger for its involvement. The lack of clear legislative authority for  Internet recovery efforts complicates the definition of this role. DHS  officials acknowledged that their role in recovering from an Internet  disruption needs further clarification because private industry owns  and operates the vast majority of the Internet.
The trigger for the National Response Plan, which is DHS’s overall  framework for incident response, is poorly defined and has been  found by both us and the White House to need revision. Since  private-sector participation in DHS planning activities for Internet  disruption is voluntary, agreement on the appropriate trigger for  government involvement and the role of government in resolving an  Internet disruption is essential to any plan’s success.
Private-sector officials representing telecommunication backbone  providers and Internet service providers were also unclear about the  types of assistance DHS could provide in responding to an incident  and about the value of such assistance. There was no consensus on  this issue. Many private-sector officials stated that the government  did not have a direct recovery role, while others identified a variety  of potential roles, including  ●  providing information on specific threats;  ●  providing security and disaster relief support during a crisis;  ●  funding backup communication infrastructures;   ●  driving improved Internet security through requirements for the  government’s own procurement;  ●  serving as a focal point with state and local governments to  establish standard credentials to allow Internet and  telecommunications companies access to areas that have been  restricted or closed in a crisis;  ●  providing logistical assistance, such as fuel, power, and security,  to Internet infrastructure operators;  ●  focusing on smaller-scale exercises targeted at specific Internet  limiting the initial focus for Internet recovery planning to key  national security and emergency preparedness functions, such as  public health and safety; and  ●  establishing a system for prioritizing the recovery of Internet  service, similar to the existing Telecommunications Service  Priority Program.
A third challenge to planning for recovery is that there are key legal  issues affecting DHS’s ability to provide assistance to help restore  Internet service. As noted earlier, key legislation and regulations  guiding critical infrastructure protection, disaster recovery, and the  telecommunications infrastructure do not provide specific  authorities for Internet recovery. As a result, there is no clear  legislative guidance on which organization would be responsible in  the case of a major Internet disruption. In addition, the Stafford Act,  which authorizes the government to provide federal assistance to  states, local governments, nonprofit entities, and individuals in the  event of a major disaster or emergency, does not authorize  assistance to for-profit corporations. Several representatives of  telecommunications companies reported that they had requested  federal assistance from DHS during Hurricane Katrina. Specifically,  they requested food, water, and security for the teams they were  sending in to restore the communications infrastructure and fuel to  power their generators. DHS responded that it could not fulfill these  requests, noting that the Stafford Act did not extend to for-profit  companies.
A fourth challenge is that a large percentage of the nation’s critical  infrastructure—including the Internet—is owned and operated by  the private sector, meaning that public/private partnerships are  crucial for successful critical infrastructure protection. Although  certain policies direct DHS to work with the private sector to ensure  infrastructure protection, DHS does not have the authority to direct  Internet owners and operators in their recovery efforts. Instead, it  must rely on the private sector to share information on incidents,  disruptions, and recovery efforts. Many private-sector  representatives questioned the value of providing information to  DHS regarding planning for and recovery from Internet disruption.  In addition, DHS has identified provisions of the Federal Advisory  Committee Act as having a “chilling effect” on cooperation with the  private sector. The uncertainties regarding the value and risks of  cooperation with the government limit incentives for the private  sector to cooperate in Internet recovery-planning efforts.
Finally, DHS has lacked permanent leadership while developing its  preliminary plans for Internet recovery and reconstitution. In  addition, the organizations with roles in Internet recovery (NCS and  NCSD) have overlapping responsibilities and may be reorganized  once DHS selects permanent leadership. As a result, it is difficult for  DHS to develop a clear set of organizational priorities and to  coordinate between the various activities necessary for Internet  recovery planning. In May 2005, we reported that multiple senior  DHS cybersecurity officials had recently left the department. These  officials included the NCSD Director, the Deputy Director  responsible for Outreach and Awareness, the Director of the US- CERT Control Systems Security Center, the Under Secretary for the  Information Analysis and Infrastructure Protection Directorate and  the Assistant Secretary responsible for the Information Protection  Office. Additionally, DHS officials acknowledge that the current  organizational structure has overlapping responsibilities for  planning for and recovering from a major Internet disruption.
In a July 2005 departmental reorganization, NCS and NCSD were  placed in the Preparedness Directorate. NCS’s and NCSD’s  responsibilities were to be placed under a new Assistant Secretary  of Cyber Security and Telecommunications—in part to raise the  visibility of cybersecurity issues in the department. However, almost  a year later, this position remains vacant. While DHS stated that the  lack of a permanent assistant secretary has not hampered its efforts  in protecting critical infrastructure, several private-sector  representatives stated that DHS’s lack of leadership in this area has  limited progress. Specifically, these representatives stated that  filling key leadership positions would enhance DHS’s visibility to the  Internet industry and potentially improve its reputation.
section_title: Implementation of GAO Recommendations Should Improve DHS Internet Recovery Planning Efforts
paragraphs: Given the importance of the Internet infrastructure to our nation’s  communication and commerce, in our accompanying report we  suggested matters for congressional consideration and made  recommendations to DHS regarding improving efforts in planning  for Internet recovery. Specifically, we suggested that Congress  consider clarifying the legal framework that guides roles and  responsibilities for Internet recovery in the event of a major  disruption. This effort could include providing specific authorities  for Internet recovery as well as examining potential roles for the  federal government, such as providing access to disaster areas,  prioritizing selected entities for service recovery, and using federal  contracting mechanisms to encourage more secure technologies.  This effort also could include examining the Stafford Act to  determine whether there would be benefits in establishing specific  authority for the government to provide for-profit companies—such  as those that own or operate critical communications  infrastructures—with limited assistance during a crisis.
Additionally, to improve DHS’s ability to facilitate public/private  efforts to recover the Internet in case of a major disruption, we  recommended that the Secretary of the Department of Homeland  Security implement the following nine actions:  ●  Establish dates for revising the National Response Plan—including  efforts to update key components that are relevant to the Internet.  ●  Use the planned revisions to the National Response Plan and the  National Infrastructure Protection Plan as a basis to draft  public/private plans for Internet recovery and obtain input from key  Internet infrastructure companies.  ●  Review the NCS and NCSD organizational structures and roles in  light of the convergence of voice and data communications.  ●  Identify the relationships and interdependencies among the various  Internet recovery-related activities currently under way in NCS and  NCSD, including initiatives by US-CERT, the National Cyber  Response Coordination Group, the Internet Disruption Working  Group, the North American Incident Response Group, and the  groups responsible for developing and implementing cyber recovery  exercises.  ●  Establish time lines and priorities for key efforts identified by the  Internet Disruption Working Group.  ●  Identify ways to incorporate lessons learned from actual incidents  and during cyber exercises into recovery plans and procedures.   ●  Work with private-sector stakeholders representing the Internet  infrastructure to address challenges to effective Internet recovery  by  ●  further defining needed government functions in responding to a  major Internet disruption (this effort should include a careful  consideration of the potential government functions identified by  the private sector earlier in this testimony),  ●  defining a trigger for government involvement in responding to  such a disruption, and  ●  documenting assumptions and developing approaches to deal  with key challenges that are not within the government’s control.
In written comments, DHS agreed with our recommendations and  stated that it recognizes the importance of the Internet for  information infrastructures. DHS also provided information about  initial actions it is taking to implement our recommendations.
In summary, as a critical information infrastructure supporting our  nation’s commerce and communications, the Internet is subject to  disruption—from both intentional and unintentional incidents.  While major incidents to date have had regional or local impacts, the  Internet has not yet suffered a catastrophic failure. Should such a  failure occur, however, existing legislation and regulations do not  specifically address roles and responsibilities for Internet recovery.
As the focal point for ensuring the security of cyberspace, DHS has  initiated efforts to refine high-level disaster recovery plans;  however, pertinent Internet components of these plans are not  complete. While DHS has also undertaken several initiatives to  improve Internet recovery planning, much remains to be done.  Specifically, some initiatives lack clear timelines, lessons learned  are not consistently being incorporated in recovery plans, and the  relationships between the various initiatives are not clear.
DHS faces numerous challenges in developing integrated  public/private recovery plans—not the least of which is the fact that  the government does not own or operate much of the Internet. In  addition, there is no consensus among public and private  stakeholders about the appropriate role of DHS and when it should  get involved; legal issues limit the actions the government can take;  the private sector is reluctant to share information on Internet  performance with the government; and DHS is undergoing  important organizational and leadership changes. As a result, the  exact role of the government in helping to recover the Internet  infrastructure following a major disruption remains unclear.
To improve DHS’s ability to facilitate public/private efforts to  recover the Internet in case of a major disruption, our report  suggested that Congress consider clarifying the legal framework  guiding Internet recovery. We also made recommendations to DHS  to establish clear milestones for completing key plans, coordinate  various Internet recovery-related activities, and address key  challenges to Internet recovery planning. Effectively implementing  these recommendations could greatly enhance our nation’s ability to  recover from a major Internet disruption.
Mr. Chairman, this concludes my statement.  I would be happy to  answer any questions that you or members of the subcommittee  may have at this time.
If you have any questions on matters discussed in this testimony,  please contact us at (202) 512-9286 and at (202) 512-6412 or by e- mail at pownerd@gao.gov and rhodesk@gao.gov. Other key  contributors to this testimony include Don R. Adams, Naba  Barkakati, Scott Borre, Neil Doherty, Vijay D’Souza, Joshua A.  Hammerstein, Bert Japikse, Joanne Landesman, Frank Maguire,  Teresa M. Neven, and Colleen M. Phillips. (310829)
This  is  a  work  of  the  U.S.  government  and  is  not  subject  to  copyright  protection  in  the  United  States.  It  may  be  reproduced  and  distributed  in  its  entirety  without  further  permission  from  GAO.  However,  because  this  work  may  contain  copyrighted  images  or  other  material,  permission  from  the  copyright  holder  may  be  necessary  if  you  wish  to  reproduce this material separately.