Internet Infrastructure: DHS Faces Challenges in Developing a Joint Public/Private Recovery Plan
Released: 2006-07-28T00:00:00

Letter

Background

The Internet: An Overview

The Internet is a vast network of interconnected networks. It is used by governments, businesses, research institutions, and individuals around the world to communicate, engage in commerce, do research, educate, and entertain. While most Americans are familiar with Internet service providers—such as America Online and EarthLink—that provide consumers with a pathway, or “on-ramp,” to the Internet, many are less familiar with how the Internet was developed, the underlying structure of the Internet, and how it works.

In the late 1960s and the 1970s, the Department of Defense’s Advanced Research Projects Agency developed a network to allow multiple universities to communicate and share computing resources. In the ensuing decades, this project grew to become a large network of networks and was joined with an array of scientific and academic computers funded by the National Science Foundation. This expanded network provided the backbone infrastructure of today’s Internet. In 1995, the federal government began to turn the backbone of the Internet over to a consortium of commercial backbone providers. From that point on, the Internet infrastructure was owned and operated by private companies—including telecommunications companies, cable companies, and Internet service providers.

Today’s Internet connects millions of small, medium, and large networks. When an Internet user wants to access a Web site or to send an e-mail to someone who is connected to the Internet through a different Internet service provider, the data must be transferred between networks. Transit across the Internet is provided by either national backbone providers, regional network operators, or a combination of both. National backbone providers are companies that own and operate high-capacity, long-haul backbone networks. These providers transmit data traffic over long distances using high-speed, fiber-optic lines. Because national backbone operators do not service all locations worldwide, regional network providers supplement the long-haul traffic by providing regional service. Data cross between networks at Internet exchange points—which can be either hub points where multiple networks exchange data or private interconnection points arranged by transit providers. At these exchange points, computer systems called routers determine the optimal path for the data to reach their destination. The data then continue their path through the national and regional networks and exchange points, as necessary, to reach the recipient’s Internet service provider and the recipient (see fig. 1).

The networks that make up the Internet communicate via standardized rules called protocols. These rules can be considered voluntary because there is no formal institutional or governmental mechanism for enforcing them. However, if any computer deviates from accepted standards, it risks losing the ability to communicate with other computers that follow the standards. Thus, the rules are essentially self enforcing. One critical set of rules is the Transmission Control Protocol/Internet Protocol suite. These protocols define a detailed process that a sender and receiver agree upon for exchanging data. They describe the flow of data between the physical connection to the network and on to the end-user application. Specifically, these protocols control the addressing of a message by the sender, its division into packets, its transmission across networks, and its reassembly and verification by the receiver. This protocol suite has become the de facto communication standard of the Internet because many standard services (including mail transfer, news, and Web pages) are available on systems that support these protocols.

Another critical set of protocols, collectively known as the Domain Name System, ensures the uniqueness of each e-mail and Web site address. This system links names like www.senate.gov with the underlying numerical addresses that computers use to communicate with each other. It translates names into addresses and back again in a process invisible to the end user. This process relies on a system of servers, called domain name servers, which store data linking names with numbers. Each domain name server stores a limited set of names and numbers. They are linked by a series of 13 root servers, which coordinate the data and allow users to find the server that identifies the sites they want to reach. Domain name servers are organized into a hierarchy that parallels the organization of the domain names. For example, when someone wants to reach the Web site at www.senate.gov, his or her computer will ask one of the root servers for help. The root server will direct the query to a second server that knows the location of names ending in the .gov top-level domain. If the address includes a subdomain, the second server refers the query to a third server—in this case, one that knows the addresses for all names ending in senate.gov. The third server will then respond to the request with a numerical address, which the original requester uses to establish a direct connection with the www.senate.gov site. Figure 2 illustrates this example.

Another critical set of rules is called the Border Gateway Protocol—a protocol for routing packets between autonomous systems. This protocol is used by routers located at network nodes to direct traffic across the Internet. Typically, routers that use this protocol maintain a routing table that lists all feasible paths to a particular network. They also determine metrics associated with each path (such as cost, stability, and speed), so that the best available path can be chosen. This protocol is important because if a certain path becomes unavailable, the system will send data over the next best path (see fig. 3).

The Internet Is a Critical Information Infrastructure

From its origins in the 1960s as a research project sponsored by the U.S. government, the Internet has grown increasingly important to both American and foreign businesses and consumers, serving as the medium for hundreds of billions of dollars of commerce each year. According to the U.S. Census Bureau, retail e-commerce sales in the United States were an estimated $86 billion in 2005. The Internet has also become an extended information and communications infrastructure, supporting vital services such as power distribution, health care, law enforcement, and national defense.

Federal regulation recognizes the need to protect critical infrastructures. In December 2003, the President updated a national directive for federal departments and agencies to identify and prioritize critical infrastructure sectors and key resources and to protect them from terrorist attack. (See table 1 for a list of critical infrastructure sectors.) This directive recognized that since a large portion of these critical infrastructures is owned and operated by the private sector, a public/private partnership is crucial for the successful protection of these critical infrastructures.

In its plan for protecting these critical infrastructures, DHS recognizes that the Internet is a key resource composed of assets within both the information technology and the telecommunications sectors. It notes that the Internet is used by all sectors to varying degrees, and that it provides information and communications to meet the needs of businesses, government, and the other critical infrastructure sectors. Similarly, the national cyberspace strategy states that cyberspace is the nervous system supporting our nation’s critical infrastructures and recognizes the Internet as the core of our information infrastructure.

It is also important to note that there are critical interdependencies between sectors. For example, the telecommunications and information technology sectors, like many other sectors, depend heavily on the energy sector.

Attacks on the Information Infrastructure Are Increasing

In recent years, cyber attacks involving malicious software or hacking have been increasing in frequency and complexity. These attacks can come from a variety of actors. Table 2 lists sources of cyber threats that have been identified by the U.S. intelligence community.

An intelligence report on global trends forecast that terrorists may develop capabilities to conduct both cyber and physical attacks against nodes of the world’s information infrastructure—including the Internet and other systems that control critical industrial processes—such as electricity grids, refineries, and flood control mechanisms. The report stated that terrorists already have specified the U.S. information infrastructure as a target and currently are capable of physical attacks that would cause at least brief, isolated disruptions.

According to a Congressional Research Service report, the annual worldwide cost of major cyber attacks was, on average, $13.5 billion from 2000 to 2003. A more recently published report estimated that the worldwide financial impact of virus attacks was $17.5 billion in 2004 and $14.2 billion in 2005.

Multiple Organizations Could Help in Recovering the Internet from a Major Disruption

In the event of a major Internet disruption, multiple organizations could help recover Internet service. These organizations include private industry, collaborative groups, and government organizations. Private industry is central to Internet recovery because private companies own the vast majority of the Internet’s infrastructure and often have response plans. Collaborative groups—including working groups and industry councils—provide information-sharing mechanisms to allow private organizations to restore services. Additionally, government initiatives could facilitate responding to major Internet disruptions.

Private Industry

Private industry organizations are critical to recovering Internet services in the event of a major disruption because they own and operate the vast majority of the Internet’s infrastructure. This group of Internet infrastructure owners and operators includes telecommunications companies (such as AT&T and Verizon Communications), cable companies (such as Cox Communications and Time Warner Cable), Internet service providers (such as AOL and EarthLink), and root server operators (such as VeriSign and the University of Maryland). These entities own or operate cable lines; telephone lines; fiber-optic cables; or critical core systems, such as network routers and domain name servers.

These private companies currently deal with cyber attacks and physical disruptions on the Internet on a regular basis. According to representatives of Internet infrastructure owners and operators, these firms typically have disaster recovery plans in place. For example, a representative from a major telecommunications company stated that the company has emergency response plans for its primary and secondary emergency operations centers. Similarly, representatives of a cable trade association reported that most cable companies have standard disaster recovery plans and a network operations center from which they can monitor recovery operations.

Infrastructure representatives also noted that in the event of a network disruption, companies that are competitors work together to resolve the disruption. They said that although the companies are competitors, they have a business interest in cooperating because it is common to rely on each other’s networks. For example, a representative of a major telecommunications company noted that the company has “mutual-aid” agreements with its competitors to exchange technicians and hardware in the event of an emergency.

Collaborative Groups

Collaborative groups—working groups and industry councils that the private and public sectors have established to allow technical information sharing—help handle and recover from Internet disruptions. These collaborative groups are usually composed of individuals and experts from separate organizations. In the event of a major Internet disruption, these groups allow individuals from different companies to exchange information in order to assess the scope of the disruption and to restore services. Table 3 provides descriptions of selected collaborative groups.

Government Organizations—DHS

Federal policies and plans assign DHS lead responsibility for facilitating a public/private response to and recovery from major Internet disruptions. Within DHS, responsibilities reside in two divisions within the Preparedness Directorate: the National Cyber Security Division (NCSD) and the National Communications System (NCS). NCSD operates the U.S. Computer Emergency Readiness Team (US-CERT), which coordinates defense against and response to cyber attacks. The other division, NCS, provides programs and services that ensure the resilience of the telecommunications infrastructure in times of crisis.

In June 2003, DHS created NCSD to serve as a national focal point for addressing cybersecurity issues and to coordinate the implementation of the National Strategy to Secure Cyberspace. Its mission is to secure cyberspace and America’s cyber assets in cooperation with public, private, and international entities.

NCSD is the government lead on a public/private partnership supporting the US-CERT, an operational organization responsible for analyzing and addressing cyber threats and vulnerabilities and disseminating cyber-threat warning information. In the event of an Internet disruption, US-CERT facilitates coordination of recovery activities with the network and security operations centers of owners and operators of the Internet and with government incident response teams.

NCSD also serves as the lead for the federal government’s cyber incident response through the National Cyber Response Coordination Group. This group is the principal federal interagency mechanism for coordinating the preparation for, and response to, significant cyber incidents—such as a major Internet disruption. In the event of a major disruption, the group convenes to facilitate intragovernmental and public/private preparedness and operations. The group brings together officials from national security, law enforcement, defense, intelligence, and other government agencies that maintain significant cybersecurity responsibilities and capabilities. Members use their established relationships with the private sector and with state and local governments to help coordinate and share situational awareness, manage a cyber crisis, develop courses of action, and devise response and recovery strategies.

NCSD also recently formed the Internet Disruption Working Group, which is a partnership between NCSD, NCS, the Department of the Treasury, the Department of Defense, and private-sector companies, to plan for ways to improve DHS’s ability to respond to and recover from major Internet disruptions. The goals of the working group are to identify and prioritize the short-term protective measures necessary to prevent major disruptions to the Internet or reduce their consequences and to identify reconstitution measures in the event of a major disruption.

NCS is responsible for ensuring a communications infrastructure for the federal government under all conditions—ranging from normal situations to national emergencies and international crises. NCS is composed of members from 23 federal departments and agencies. Although originally focused on traditional telephone service, due to the convergence of the Internet and telecommunications NCS has taken a larger role in Internet-related issues and has partnered with NCSD and private companies to address issues related to major Internet disruptions. For example, NCS now helps manage issues related to disruptions of the Internet backbone (e.g., high-capacity data routes).

The National Coordinating Center for Telecommunications (National Coordinating Center), which serves as the operational component of NCS, also has a role in Internet recovery. The center has eight resident industry members (representing companies that were originally telephone providers) as well as additional nonresident members, including representatives of newer, more Internet-oriented companies. During a major disruption to telecommunications services, the center communicates with both resident and nonresident members, with the goal of restoring service as soon as possible. In the event of a major Internet disruption, the National Coordinating Center plays a role in the recovery effort through its partnerships and collaboration with telecommunications and Internet-related companies.

Government Organizations—Federal Communications Commission

The Federal Communications Commission can support Internet recovery by coordinating resources for restoring the basic communications infrastructures over which Internet services run. For example, after Hurricane Katrina, the commission granted temporary authority for private companies to set up wireless Internet communications supporting various relief groups; federal, state, and local government agencies; businesses; and victims in the disaster areas.

The commission also sponsors the Network Reliability and Interoperability Council. A primary goal of the council is to prevent Internet disruptions from occurring in the first place. The council has developed a list of best practices for Internet disaster recovery that provides guidance on strategic issues (such as exercising disaster recovery plans) as well as operational issues (such as how to restore a corrupt domain name server).

Prior Evaluations of DHS’s Cybersecurity Responsibilities Have Highlighted Issues and Challenges Facing the Department

In May 2005, we issued a report on DHS’s efforts to fulfill its cybersecurity responsibilities. We noted that while DHS had initiated multiple efforts to fulfill its responsibilities, it had not fully addressed any of the 13 key cybersecurity responsibilities (see table 4) noted in federal law and policy. For example, we noted that the department established US-CERT as a public/private partnership to make cybersecurity a coordinated national effort, and it established forums to build greater trust and information sharing among federal officials with information security responsibilities and with law enforcement entities. However, DHS had not yet developed national cyber threat and vulnerability assessment or government/industry cybersecurity recovery plans—including a plan for recovering key Internet functions.

We also noted in our May 2005 report that DHS faced a number of challenges that have impeded its ability to fulfill its cyber responsibilities. These challenges included achieving organizational stability, gaining organizational authority, overcoming hiring and contracting issues, increasing awareness of cybersecurity roles and capabilities, establishing effective partnerships with stakeholders, achieving two-way information sharing with stakeholders, and demonstrating the value that DHS can provide. We made recommendations to the department to strengthen its ability to implement key responsibilities by completing critical activities and resolving underlying challenges. DHS agreed that strengthening cybersecurity is central to protecting the nation’s critical infrastructures and that much remained to be done, but it has not yet addressed our recommendations. We continue to evaluate DHS’s progress in implementing our recommendations.

Although Both Cyber and Physical Incidents Have Caused Disruptions, the Internet Has Not Yet Suffered a Catastrophic Failure

The Internet’s infrastructure is vulnerable to disruptions in service due to terrorist and other malicious attacks, natural disasters, accidents, technological problems, or a combination of the above. Disruptions to Internet service can be caused by cyber and physical incidents—both intentional and unintentional. Private network operators routinely deal with Internet disruptions of both types. Recent cyber and physical incidents have caused localized or regional disruptions, highlighting the importance of recovery planning. However, these incidents have also shown the Internet as a whole to be flexible and resilient. Even in severe circumstances, the Internet has not yet suffered a catastrophic failure.

Internet Disruptions Have Been Caused by Both Cyber and Physical Incidents

The Internet can be disrupted by either cyber or physical incidents, or by a combination of the two. These incidents can be intentional (such as a cyber attack or a terrorist attack on our nation’s physical infrastructure) or unintentional (such as a software malfunction or a natural disaster). Table 5 provides examples of intentional and unintentional cyber and physical incidents.

A cyber incident could cause a disruption if it affects a network protocol or an application that is integral to the working of the Internet. A cyber incident could be unintended (such as a software problem) or intended (such as an attack using malicious software or hacking that causes a disruption of service). Unintended incidents have caused significant disruptions in the past. For example, in 1998, a major Internet backbone provider had a massive outage due to a software flaw in the infrastructure that caused systems to crash; in 2002, a different provider had an outage due to a router with a faulty configuration.

Intentional incidents, or malicious attacks, have been increasing in frequency and complexity and recently have been linked to organized crime. Examples of malicious attacks include viruses and worms. Viruses and worms are often used to launch denial-of-service attacks, which flood targeted networks and systems with so much data that regular traffic is either slowed or stopped. Such attacks have been used ever since the groundbreaking Morris worm in November 1988, which brought 10 percent of the systems connected to the Internet to a halt. More recently, in 2001, the Code Red worm used a denial-of-service attack to affect millions of computer users by shutting down Web sites, slowing Internet service, and disrupting business and government operations.

Cyber attacks can also cause Internet disruptions by targeting specific protocols, such as the Border Gateway Protocol or the Domain Name System. If a vulnerability in the Border Gateway Protocol was exploited, the ability of Internet traffic to reach its destination could be limited or halted. Some experts believe that it could take weeks to recover from a major attack on the Border Gateway Protocol. The Domain Name System is also susceptible to various attacks, including the corruption of stored domain name information and the misdirection of addresses. Recently, hackers have used domain name servers to launch denial-of-service attacks—thereby amplifying the strength of the attacks. A network security expert stated that there have been numerous attacks of this type recently, and that some attacks have targeted top-level domains and Internet service providers. Attacks against top-level domain servers could disrupt users’ capability to connect to various Internet addresses. It could take several days to recover from a massive disruption of the domain name server system.

As the number of individuals with computer skills has increased, more intrusion, or hacking, tools have become readily available and relatively easy to use. Frequently, skilled hackers develop exploitation tools and post them on Internet hacking sites. These tools are then readily available for others to download, allowing even inexperienced programmers to create a computer virus or to literally point and click to launch an attack. According to the National Institute of Standards and Technology, 30 to 40 new attack tools are posted on the Internet every month. Experts also agree that there has been a steady advance in the sophistication and effectiveness of attack technology.

In the case of insider incidents, these tools may not even be necessary, because insiders often have unfettered access to their employers’ computer systems. In one incident, an insider installed unauthorized backdoor access to his employer’s systems. After his termination, the insider used these back doors to gain access to the systems and to delete accounts, change passwords, and delete security logs. While this is a case of an insider disrupting a single network, an insider could also use this knowledge to disrupt the operation of an Internet service provider. For example, an insider at a company that develops critical routing hardware might be able to use specific technical knowledge of the products to create an attack that could disrupt networks that use that particular equipment.

To date, cyber attacks have caused various degrees of damage. The following case studies provide examples of cyber attacks; the effects of these attacks; and the government’s role, if any, in recovery (see figs. 4 and 5).

A physical incident could be caused by an intentional attack, a natural disaster, or an accident. For example, terrorist attacks, storms, earthquakes, and unintentional cutting of cables can all cause physical disruptions. Physical incidents causing Internet and telecommunications disruptions occur regularly—often as a result of the accidental cutting of cable lines. Physical incidents could affect various aspects of the Internet infrastructure, including underground or undersea cables and facilities that house telecommunications equipment, Internet exchange points, or Internet service providers. Such incidents could also disrupt the power infrastructure—leading to an extended power outage and thereby disrupting telecommunications and Internet service. The following case studies provide examples of physical incidents that caused Internet disruptions and the effect of these incidents (see figs. 6 to 8).

The Internet Has Not Yet Experienced a Catastrophic Disruption

Since its inception, the Internet has experienced disruptions of varying scale—from fast-spreading worms, to denial-of-service attacks, to physical destruction of key infrastructure components. However, the Internet has yet to experience a catastrophic disruption. Experts agree—and case studies show—that the Internet is resilient and flexible enough to handle and recover from many types of disruptions. While specific regions may experience Internet disruptions, backup servers and the ability to reroute traffic limit the effect of many targeted attacks. These efforts highlight the importance of recovery planning.

However, it is possible that a complex attack or set of attacks could cause the Internet to fail. It is also possible that a series of attacks against the Internet could undermine users’ trust—and thereby reduce the Internet’s utility.

Existing Laws and Regulations Apply to the Internet, but Numerous Uncertainties Exist in Using Them for Internet Recovery

Several federal laws and regulations provide broad guidance that applies to the Internet infrastructure, but it is not clear how useful these authorities would be in helping to recover from a major Internet disruption, because some do not specifically address Internet recovery and others have seldom been used. Pertinent laws and regulations address critical infrastructure protection, federal disaster response, and the telecommunications infrastructure (see app. II for additional details).

Specifically, the Homeland Security Act of 2002 and Homeland Security Presidential Directive 7 establish critical infrastructure protection as a national goal and describe a strategy for cooperative efforts by the government and the private-sector to protect the cyber- and physical-based systems that are essential to the operations of both the economy and the government. These authorities apply to the Internet because it is a core communications infrastructure supporting the information technology and telecommunications sectors. However, this law and regulation do not specifically address roles and responsibilities in the event of an Internet disruption.

Regarding federal disaster response, the Defense Production Act and the Stafford Act provide authority to federal agencies to plan for and respond to incidents of national significance—like disasters and terrorist attacks. Specifically, the Defense Production Act authorizes the President to ensure the timely availability of products, materials, and services needed to meet the requirements of a national emergency. The act is applicable to critical infrastructure protection and restoration, but it has never been used for Internet recovery. The Stafford Act authorizes federal assistance to states, local governments, nonprofit entities, and individuals in the event of a major disaster or emergency. However, the act does not authorize assistance to for-profit companies—such as those that own and operate core Internet components. Several representatives of private companies reported that they were unable to obtain needed resources to restore the communications infrastructure in the aftermath of Hurricane Katrina because the act does not extend to for-profit companies.

Other legislation and regulations, including the Communications Act of 1934 and the National Communications System (NCS) authorities, govern the telecommunications infrastructure and help ensure communications during national emergencies. The act governs the regulation of the telecommunications infrastructure upon which the Internet depends. However, coverage of the Internet is subsumed in provisions that govern interstate wire and radio communications, and there is no specific provision governing Internet recovery. NCS authorities establish guidance for operationally coordinating with industry to protect and restore key national security and emergency preparedness communications services. These authorities grant the President certain emergency powers regarding telecommunications, including the authority to require any carrier subject to the Communications Act of 1934 to grant preference or priority to essential communications. The President may also, in the event of war or national emergency, suspend regulations governing wire and radio transmissions and authorize the use or control of any such facility or station and its apparatus and equipment by any department of the government. Although these authorities remain in force and are implemented in the Code of Federal Regulations, they have been seldom used—and never for Internet recovery. Thus, it is not clear how effective they would be if used for this purpose. “The Internet infrastructure is owned and operated by the private sector. Although certain policies direct DHS to work with the private sector to ensure infrastructure protection, DHS does not have the authority to direct Internet owners and operators in their recovery efforts.”

DHS Initiatives Supporting Internet Recovery Planning Are under Way, but Much Remains to Be Done and the Relationships among Initiatives Are Not Evident

DHS has begun a variety of initiatives to fulfill its responsibility for developing an integrated public/private plan for Internet recovery, but these efforts are not complete or comprehensive. Specifically, DHS has developed high-level plans for infrastructure protection and national disaster response, but the components of these plans that address the Internet infrastructure are not complete. In addition, DHS has started a variety of initiatives to improve the nation’s ability to recover from Internet disruptions, including working groups to facilitate coordination and exercises in which government and private industry practice responding to cyber events. While these activities are promising, some initiatives are not complete, others lack time lines and priorities, and still others lack effective mechanisms for incorporating lessons learned. In addition, the relationships among these initiatives are not evident. As a result, the nation is not prepared to effectively coordinate public/private plans for recovering from a major Internet disruption.

DHS Has Developed High-level Protection and Response Plans, but Key Components Are Not Complete

Federal policy establishes DHS as the central coordinator for cyberspace security efforts and tasks the department with developing an integrated public/private plan for Internet recovery. DHS has two key documents that guide its infrastructure protection and recovery efforts, but components of these plans dealing with Internet recovery are not complete.

The National Response Plan is DHS’s overarching framework for responding to domestic incidents. The plan, which was released in December 2004, contains the following two components that address issues related to telecommunications and the Internet: The Emergency Support Function 2 of the plan identifies federal actions to provide temporary emergency telecommunications during a significant incident and to restore telecommunications after the incident. It assigns roles and responsibilities to different federal agencies; provides guidelines for incident response; and identifies actions to take before, during, and after the incident. Because the Internet is supported by the telecommunications infrastructure, this section of the plan could help with Internet recovery efforts.

The Cyber Incident Annex identifies policies and organizational responsibilities for preparing for, responding to, and recovering from cyber-related incidents impacting critical national processes and the national economy. The annex recognizes the National Cyber Response Coordination Group as the principal federal interagency mechanism to coordinate the government’s preparation for, response to, and recovery from a major Internet disruption or significant cyber incident.

These components, however, are not complete in that the Emergency Support Function 2 does not directly address Internet recovery, and the Cyber Incident Annex does not reflect the National Cyber Response Coordination Group’s current operating procedures. DHS officials acknowledged that both Emergency Support Function 2 and the Cyber Incident Annex need to be revised to reflect the maturing capabilities of the National Cyber Response Coordination Group, the planned organizational changes affecting NCS and NCSD, and the convergence of voice and Internet networks. However, DHS has not reached consensus on the best approach for revising these components, and it has not established a schedule for revising the overall plan.

The Draft National Infrastructure Protection Plan consists of both a base plan and sector-specific plans, but these have not been finalized. A January 2006 draft of the base plan identifies roles, responsibilities, and a high-level strategy for infrastructure protection across all sectors. It emphasizes the need to protect and recover the cyber infrastructure, including the Internet. Additionally, the sector plans are expected to apply the strategies identified in the base plan to the infrastructure sectors. For example, the information technology sector plan identifies relationships within the information technology sector and with other infrastructure sectors. It also identifies preliminary steps for infrastructure protection, such as identifying key assets and the consequences of the failure of those assets.

DHS is planning to finalize its base plan in 2006, but it has not yet set a date for doing so. Once this plan is released, it will lead to the development of the more detailed sector-specific plans. The next versions of the information technology and telecommunications sector plans are due to DHS within 180 days of the release of the final base plan.

While DHS’s intentions to revise these plans are necessary steps in the right direction, the plans do not fulfill the department’s responsibility to develop an integrated public/private plan for Internet recovery. Several representatives of private-sector firms supporting the Internet infrastructure expressed concerns about both plans, noting that the plans would be difficult to execute in times of crisis. Other representatives were uneasy about the government developing recovery plans, because they were not confident in the government’s ability to successfully execute the plans. DHS officials acknowledged that it will be important to obtain input from private-sector organizations as they refine these plans and initiate more detailed public/private planning.

Until both the National Response Plan and the National Infrastructure Protection Plan are updated and more detailed public/private planning begins, DHS lacks the integrated approach to Internet recovery called for in the cyberspace strategy and risks not being prepared to effectively coordinate such a recovery.

Other DHS Initiatives Related to Internet Recovery Planning Are under Way, but They Are Incomplete and the Relationships among the Initiatives Are Not Evident

While the National Response Plan outlines an overall framework for incident response, it is designed to be supplemented by more specific plans and activities. DHS has numerous initiatives under way to better define its ability to assist in responding to major Internet disruptions. These initiatives include task forces, working groups, and exercises. While these activities are promising, some initiatives are incomplete, others still lack time lines and priorities, and others lack an effective mechanism for incorporating lessons learned. In addition, the relationships and interdependencies among different initiatives are not evident.

As a result, tangible progress toward improving the government’s ability to help recover from a major Internet disruption has been limited.

DHS Plans to Revise the Role and Mission of the National Communications System, but This Effort Is Not Yet Complete

DHS plans to revise the role and mission of the National Communications System (NCS) to reflect the convergence of voice and data communications, but this effort is not yet complete. NCS is responsible for ensuring the availability of a viable national security and emergency preparedness communications infrastructure. Originally focused on traditional telephone service, NCS has recently taken on a larger role in Internet-related issues due to the convergence of the infrastructures that serve traditional telephone traffic and those that serve data (such as Internet traffic). A presidential advisory committee on telecommunications has established two task forces to recommend changes to NCS’s role, mission, and functions to reflect this convergence. One task force focused on changes due to next-generation network technologies, while the other focused on revising the role and mission of NCS’s National Communications Center. Appendix III provides additional details on the two task forces.

Both task forces have made recommendations to improve NCS’s operations, but DHS has not yet developed plans to address these recommendations. Until NCS completes efforts to revise its role and mission, the group is at risk of not being prepared to address the unique issues that could be caused by future Internet disruptions.

National Cyber Response Coordination Group Is Defining Its Roles and Responsibilities, but Much Remains to Be Done

As a primary entity responsible for coordinating governmentwide responses to cyber incidents—such as major Internet disruptions—DHS’s National Cyber Response Coordination Group is working to define its roles and responsibilities, but much remains to be done. The group reported that it has begun efforts to define its roles, responsibilities, capabilities, and activities. For example, the group has developed a concept of operations—which includes a high-level recovery function—but is waiting for the results of additional analyses before revising and enhancing the concept of operations. The group also drafted operating procedures that it used during a national cyber exercise in February 2006, and it plans to incorporate lessons learned from the exercise into the operating procedures and to issue revised procedures by June 2006. The group also reported that it has made progress on initiatives to (1) map the current capabilities of government agencies to detect, respond to, and recover from cyber incidents; (2) identify secure communications capabilities within the government that can be used to respond to cyber incidents; (3) perform a gap analysis of different agencies’ capabilities for responding to cyber incidents; and (4) establish formal resource-sharing agreements with other federal agencies as well as state and local governments. However, much remains to be done to complete these initiatives.

One challenge facing the National Cyber Response Coordination Group is the “trigger” for government involvement. Currently, the group can be activated by a cyber incident that may relate to or constitute a terrorist attack, a terrorist threat, a threat to national security, a disaster, or any other cyber emergency requiring federal government response; a confirmed, significant cyber incident directed at one or more national a cyber incident that impacts or potentially impacts national security, national economic security, public health or safety, or public confidence and morale; discovery of an exploitable vulnerability in a widely used protocol; other complex or unusual circumstances related to a cyber incident that requires interagency coordination; or any cyber incident briefed to the President.

DHS officials acknowledged that the trigger to activate this group is imprecise and will need to be clarified. Because key activities to define roles, responsibilities, capabilities, and the appropriate trigger for government involvement are still under way, the group is at risk of not being able to act quickly and definitively during a major Internet disruption.

The Internet Disruption Working Group Was Established to Work with the Private Sector to Establish Plans to Respond to Major Internet Disruptions, but It Lacks Time Lines and Priorities for Its Initiatives

Since most of the Internet is owned and operated by the private sector, NCSD and NCS established the Internet Disruption Working Group to work with the private sector to establish priorities and develop action plans to prevent major disruptions of the Internet and to identify recovery measures in the event of a major disruption. The group includes representatives of both domestic and international government agencies and private Internet-related companies. According to DHS officials who organized the group, the group held its first forum in November 2005 to begin to identify real versus perceived threats to the Internet, refine the definition of an Internet disruption, determine the scope of a planned analysis of disruptions, and identify near-term protective measures.

DHS officials stated that they had identified a number of potential future plans, including meeting with industry representatives to better understand what constitutes normal network activity and what further refine the definition of an Internet disruption; determine which public/private organizations would be contacted in an emergency and what contingency plans the government could establish; encourage implementation of best practices for protecting key Internet infrastructure, including the Domain Name System; and consider requiring improved security technologies for the Domain Name System and the Border Gateway Protocol in government contracts.

Efforts such as those previously mentioned appear to be worthwhile; however, agency officials have not yet finalized plans, resources, or milestones for these efforts. Until they do, the benefits of these efforts will not be fully realized.

The North American Incident Response Group Is an Additional Mechanism for Outreach to the Private Sector, but Its Efforts Are Early

In addition to the Internet Disruption Working Group, US-CERT officials formed the North American Incident Response Group. The group, modeled on similar groups in Asia and Europe, includes both public and private-sector network operators who would be the first to recognize and respond to cyber disruptions. In September 2005, US-CERT officials conducted regional workshops with group members to share information on structure and programs and incident response, and to seek ways for the government and industry to work together operationally. The attendees included 32 organizations, such as computer security incident response teams; information sharing and analysis centers; members of private firms that provide security services; information technology vendors; and other organizations that participate in cyber watch, warning, and response functions. US-CERT officials stated that these events were highly successful, and that they hope to continue to hold such events quarterly beginning in 2006.

As a result of the first meetings, US-CERT officials developed a list of action items and assigned milestones to some of these items. For example, US-CERT has established a secure instant messaging capability to communicate with group members. In addition, it plans to conduct a survey of the group members to determine what they need from US-CERT and what types of information they can provide.

While the outreach efforts of the North American Incident Response Group are promising, DHS has only just begun developing plans and activities to address the concerns of private-sector stakeholders.

DHS Has Conducted Initial Exercises That Address Cyber Disruption, but Efforts to Incorporate Lessons Learned into DHS Operations Are Lacking

Over the last few years, DHS has conducted several broad intergovernmental exercises to test regional responses to significant incidents that could affect the critical infrastructure. These regional exercises included incidents that could cause localized Internet disruptions, and they resulted in numerous findings and recommendations regarding the government’s ability to respond to and recover from a major Internet disruption. For example, selected exercises found that both the government and private-sector organizations were poorly prepared to effectively respond to cyber events. They cited the lack of clarity on roles and responsibilities, the lack of coordination and communication, and a limited understanding of cybersecurity concerns as serious obstacles to effective response and recovery from cyber attacks and disruptions. Furthermore, regional participants reported being unclear regarding who was in charge of incident management at the local, state, and national levels.

More recently, in February 2006, DHS conducted an exercise called Cyber Storm, which was focused primarily on testing responses to a cyber-related incident of national significance. The exercise involved a simulated large-scale attack affecting the energy and transportation infrastructures, using the telecommunications infrastructure as a medium for the attack. The results of this exercise have not yet been published. (Details on these exercises are provided in app. IV.)

Exercises that include Internet disruptions can help to identify issues and interdependencies that need to be addressed. However, DHS has not yet identified planned activities and milestones or identified which group should be responsible for incorporating into its plans and initiatives lessons learned from the regional and Cyber Storm exercises. Without a coordination process, plans, and milestones, there is less chance that the lessons learned from the exercises will be successfully transferred to operational improvements.

The Relationships and Interdependencies among Various DHS Initiatives Are Not Evident

While DHS has various initiatives under way—including efforts to update the National Response Plan, task forces assessing changes to NCS, working groups on responding to cyber incidents, and exercises to practice recovery efforts—the relationships and interdependencies among these various efforts are not evident. For example, plans to update the National Response Plan to better reflect the Internet infrastructure are related to task force efforts to suggest changes to NCS to deal with the convergence of voice and data technologies. However, it is not clear how these initiatives are being coordinated. Furthermore, the National Cyber Response Coordination Group, the Internet Disruption Working Group, and the North American Incident Response Group are all meeting to discuss ways to address Internet recovery, but the interdependencies among the groups have not been clearly established. Additionally, it is not evident that lessons learned from the various cyber-related exercises are being incorporated in the planned revision of the National Response Plan or the ongoing efforts of the various working groups. Without a thorough understanding of the interrelationships among its various initiatives, DHS risks pursuing redundant efforts and missing opportunities to build on related efforts.

DHS officials acknowledged that they have not yet fully coordinated the various initiatives aimed at enhancing the department’s ability to help respond to and recover from a major Internet disruption, but they noted that the complexity of this undertaking and the number of entities involved in Internet recovery make this effort challenging.

Multiple Challenges Exist to Planning for Recovery from Internet Disruptions

Although DHS has various initiatives under way to improve Internet recovery planning, it faces key challenges in developing a public/private plan for Internet recovery, including (1) innate characteristics of the Internet that make planning for and responding to a disruption difficult, (2) a lack of consensus on DHS’s role and on when the department should get involved in responding to a disruption, (3) legal issues affecting DHS’s ability to provide assistance to restore Internet service, (4) reluctance of the private-sector to share information on Internet disruptions with DHS, and (5) leadership and organizational uncertainties within DHS. Until it addresses these challenges, DHS will have difficulty achieving results in its role as the focal point for recovering the Internet from a major disruption.

Key Internet Characteristics Make Recovery More Difficult

The Internet’s diffuse structure, vulnerabilities in its basic protocols, and lack of agreed-upon performance measures make planning for and responding to a disruption more difficult.

Control of the Internet Is Diffuse

The diffuse control of the Internet makes planning for recovering from a disruption more challenging. The components of the Internet are not all governed by the same organization. Some components of the Internet are controlled by government organizations, while others are controlled by academic or research institutions. However, the vast majority of the Internet is owned and operated by the private sector. Each organization makes decisions to implement or not implement various standards based on issues such as security, cost, and ease of use. Therefore, any plan for responding to a disruption requires the agreement and cooperation of these private-sector organizations.

In addition, the Internet is international. According to private-sector estimates, only about 20 percent of Internet users are in the United States. Cyber actors in one country have the potential to impact systems connected to the Internet in another country. This geographical diversity makes planning for Internet recovery more difficult.

Vulnerabilities in Internet-Related Protocols Make Responding to Disruptions Difficult

The Internet’s protocols have vulnerabilities that can be exploited. Examples of these vulnerabilities include the following: The version of Internet Protocol (IPv4) that is widely used today has certain security limitations that have been addressed but are not fully integrated into the protocol. The newest version of the protocol (IPv6) addresses some of these limitations, but it has not yet been fully adopted.

The Domain Name System, which directs users to the correct Web site based on the name they typed in, was not originally built with the intent of being resistant to attacks. Domain name servers or caches storing Domain Name System information can be corrupted. Although some protective measures have been implemented, a method to encrypt and protect Domain Name System information has not yet been widely deployed.

Border Gateway Protocol, the protocol that transmits routing information among separate networks, has vulnerabilities that, if not mitigated, could subject those networks to attack. For example, a malicious actor could advertise incorrect routing information. Because this protocol provides the basis for all Internet connectivity, a successful attack could have wide-ranging effects.

Lack of Standards for Measuring Internet Performance Hinders the Ability to Recognize Disruptions and Recover Accordingly

There are no well-accepted standards for measuring and monitoring the Internet infrastructure’s availability and performance. Instead, individuals and organizations rate the Internet’s performance according to their own priorities.

The commonly used version of Internet Protocol (IPv4) does not guarantee a priority or speed for delivery, but rather provides “best effort” service. The next version (IPv6) has features that may help the delivery of future Internet traffic, but it is not yet widely used. The topic of guaranteeing a particular level of service, called “quality of service,” is currently the subject of much research. For example, NCS requested information from private companies on the potential for prioritizing certain types of Internet service over others if network capacity was limited; NCS found that there is currently no offering of a priority service, nor is there any consensus by industry on a standard approach to prioritization. Obstacles to offering the service include both technical and financial challenges. Since there are no clear standards for quality of service, prioritizing service if capacity is limited or setting thresholds that indicate a disrupted network can be difficult.

Private-sector representatives identified additional challenges to network measurement and performance standards, including a reluctance to share proprietary performance data that other companies could use for competitive advantage, flaws in measurement techniques, and the ability to “spoof” performance data.

The lack of agreement on standards for measurement and performance limits the ability of the government and private sector to readily identify poor performance and identify when recovery efforts should begin.

There Is No Consensus on DHS’s Role in Responding to Internet Disruption or the Appropriate Trigger for Its Involvement

There is a lack of consensus about the role DHS should play in responding to a major Internet disruption and about the appropriate trigger for its involvement. As we previously noted in this report, the lack of clear legislative authority for Internet recovery efforts complicates the definition of this role.

DHS’s Role Lacks Consensus

DHS is currently providing information to private industry through existing US-CERT and National Coordinating Center relationships and conducting exercises such as Cyber Storm. US-CERT and National Coordinating Center officials are also working to improve their relationships with the private sector. However, DHS officials acknowledged that their role in recovering from an Internet disruption needs additional clarification, because private industry owns and operates the vast majority of the Internet.

Private-sector officials representing telecommunication backbone providers and Internet service providers were also unclear about the types of assistance DHS could provide in responding to an incident and about the value of such assistance. While many officials stated that the government did not have a direct recovery role, others identified a variety of roles ranging from providing information on specific threats (which DHS currently does through US-CERT), providing security and disaster relief support during a crisis, funding backup communication infrastructures, and driving improved Internet security through requirements for its own procurement. Clearly, there was no consensus among the officials on this issue. Table 6 summarizes potential roles suggested by private-sector representatives and DHS officials’ assessments of each area.

The difference between a minor and a major Internet disruption can be a combination of factors. The severity of a disruption can be influenced by the length of time that the disruption lasts; the impact of the disruption on the operation of the Internet, both in quality of operation (e.g., if the speed of the Internet is affected), and the number of users that cannot access the Internet; the impact that the disruption has on society, such as the impact on national security or economic security; and the simultaneity of events (e.g., a disruption coinciding with a national disaster or terrorist attack could be more severe than a disruption occurring on an uneventful day).

However, it is not clear when the government should get involved in a disruption. For example, the lessons learned from the DHS-sponsored regional exercises show that organizations do not know how and to whom they should report a cyber attack and what information to convey; local and state emergency operations centers often lack procedures to determine when they should activate for a cyber event; private-sector participants often do not inform government authorities about what they see as routine events because of company policy, legal constraints, or liability concerns; and it is unclear when a cybersecurity incident becomes a source of concern and what types of incidents should be communicated to local and federal law enforcement.

The trigger for the National Response Plan, which is DHS’s overall framework for incident response, is poorly defined and has been found by both GAO and the White House to need revision. DHS officials acknowledged that the definition for activation of its National Cyber Response Coordination Group is very broad and needs clarification. In addition, other DHS officials stated that, in their meetings with private-sector firms and other government agencies, they have determined that they need to further refine the definition of when government should be involved during an Internet disruption.

DHS officials have stated that a successful public/private partnership is critical to the success of efforts to plan for responding to Internet disruptions. Since private-sector participation in DHS planning activities for Internet disruption is voluntary, agreement on the appropriate trigger for government involvement and on the role of government in resolving an Internet disruption are essential to any plan’s success. Without a consensus on the appropriate role of government in responding to the disruption, or on the trigger for government involvement, planning for response to the disruption is difficult.

Legal Issues Affect DHS’s Ability to Provide Assistance during Recovery Efforts

There are key legal issues affecting DHS’s ability to provide assistance to help restore Internet service. As previously noted, key legislation and regulations guiding critical infrastructure protection, disaster recovery, and the telecommunications infrastructure do not provide specific authorities for Internet recovery. As a result, there is no clear legislative guidance on what government entity would be responsible in the case of a major Internet disruption.

In addition, while the Stafford Act authorizes the government to provide federal assistance to states, local governments, nonprofit entities, and individuals in the event of a major disaster or emergency, it does not authorize assistance to for-profit corporations. Several representatives of telecommunications companies reported that they had requested federal assistance from DHS during Hurricane Katrina. Specifically, they requested food, water, and security for the teams they were sending in to restore the communications infrastructure, and fuel to power their generators. DHS responded that it could not fulfill these requests, noting that the Stafford Act did not extend to for-profit companies.

Many in the Private Sector Are Reluctant to Share Internet Information with the Government

Because a large percentage of the nation’s critical infrastructure—including the Internet—is owned and operated by the private sector, public/private partnerships are crucial for successful critical infrastructure protection. Although certain policies direct DHS to work with the private sector to ensure infrastructure protection, DHS does not have the authority to direct Internet owners and operators in their recovery efforts. Instead, it must rely on the private sector to share information on incidents, disruptions, and recovery efforts.

We have previously reported that many in the private sector are reluctant to share information with the federal government. Many private-sector representatives questioned the value of providing information to DHS regarding planning for and recovery from Internet disruption. Concerns included the potential for disclosure of the information and the perceived lack of benefit in providing the information. In addition, DHS identified provisions of the Federal Advisory Committee Act as having a “chilling effect” on cooperation with the private sector. The act governs the structure of certain federal advisory groups and requires that membership in and information about the groups’ activities be public record. However, both the act itself and other federal legislation provide the ability to limit disclosure of sensitive information provided to the government. While DHS officials stated that the agency was working on a solution to problems posed by the act, they did not provide us with information on potential solutions or milestones for completing these activities. The uncertainties regarding the value and risks of cooperation with the government limit incentives for the private sector to cooperate in Internet recovery planning efforts.

DHS’s Leadership and Organizational Issues Impact Its Ability to Address Internet Disruption

In 2003 and again in 2005, we identified the transformation of DHS from 22 agencies into one department as a high-risk area. As part of this body of work, we noted that organizational and management practices are critical to successfully transforming an organization. Additionally, we reported on the importance of top leadership driving any transformation and the need for a stable and authoritative organizational structure. However, DHS has lacked permanent leadership while developing its plans for Internet recovery and reconstitution. In addition, the organizations with roles in Internet recovery have overlapping responsibilities and may be reorganized once DHS selects permanent leadership. As a result, it is difficult for DHS to develop a clear set of organizational priorities and to coordinate among the various activities responsible for Internet recovery planning.

DHS Has Lacked Permanent Leadership in Key Roles

In recent years, DHS has experienced a high level of turnover in its cybersecurity division and has lacked permanent leadership in key roles. In May 2005, we reported that multiple senior DHS cybersecurity officials had recently left the department. These officials included the NCSD Director, the Deputy Director responsible for Outreach and Awareness, the Director of the US-CERT Control Systems Security Center, the Under Secretary for the Information Analysis and Infrastructure Protection Directorate, and the Assistant Secretary responsible for the Information Protection Office.

Subsequently, in July 2005, the DHS Secretary announced a major reorganization of the department. Under this reorganization, the Information Analysis and Infrastructure Protection Directorate, which contained NCS and NCSD, was renamed the Directorate for Preparedness, which would be managed by an appointed under secretary. The responsibilities of NCS and NCSD were placed under a new Assistant Secretary for Cyber Security and Telecommunications. DHS stated that the creation of a position for Assistant Secretary for Cyber Security and Telecommunications within the department would elevate the position of cybersecurity in the department and by doing so raise visibility for the issue. However, as of May 2006, no candidate for the assistant secretary position had yet been publicly announced. In addition, the current head of NCSD is in an acting position and has been since October 2004.

While DHS stated that the lack of a permanent assistant secretary has not hampered its efforts in protecting critical infrastructure, several private-sector representatives stated that DHS’s lack of leadership in this area has limited progress. Specifically, these representatives stated that filling key leadership positions would enhance DHS’s visibility to the Internet industry and potentially improve its reputation.

DHS Organizations Have Overlapping Responsibilities

DHS officials acknowledged that the current organizational structure has overlapping responsibilities in planning for and recovering from a major Internet disruption. NCSD is responsible for planning and response activities governing information technology, while NCS has the lead for telecommunications. However, because of the convergence of voice and data networks, NCS has become more involved in Internet issues.

There is currently no written division of responsibilities between NCS and NCSD related to Internet recovery. NCS officials stated that a revision of the Emergency Support Function 2 would help address the apparent overlap, but DHS has not established a date for finalizing this document. Furthermore, DHS officials stated that the new assistant secretary would have discretion to reorganize NCS and NCSD. For example, NCS and NCSD could be combined, or one or more program areas could be modified. As a result, it is difficult for DHS to develop a clear set of organizational priorities and to coordinate among the various activities responsible for Internet recovery planning.

Conclusions

As a critical information infrastructure supporting our nation’s commerce and communications, the Internet is subject to disruption—from both intentional and unintentional incidents. While major incidents to date have had regional or local impacts, the Internet has not yet suffered a catastrophic failure. Should such a failure occur, however, existing legislation and regulations supporting critical infrastructure protection, disaster response, and the telecommunications infrastructure do not specifically address roles and responsibilities for Internet recovery.

A national policy, the National Strategy to Secure Cyberspace, establishes DHS as the focal point for ensuring the security of cyberspace—a role that includes developing joint public/private plans for facilitating a recovery from a major Internet disruption. While DHS has initiated efforts to refine high-level disaster recovery plans, the components of these plans that pertain to the Internet are not complete. Additionally, while DHS has undertaken several initiatives to improve Internet recovery planning, much remains to be done. Specifically, some initiatives lack clear time lines, lessons learned are not consistently being incorporated in recovery plans, and the relationships between the various initiatives are not clear.

DHS faces numerous challenges to developing integrated public/private recovery plans—not the least of which is the fact that the government does not own or operate much of the Internet. In addition, there is no consensus among public and private stakeholders about the appropriate role of DHS and when it should get involved; legal issues limit the actions the government can take; the private sector is reluctant to share information on Internet performance with the government; and DHS is undergoing important organizational and leadership changes. As a result, the exact role of the government in helping to recover the Internet infrastructure following a major disruption remains unclear.

Matters for Congressional Consideration

Given the importance of the Internet as a critical infrastructure supporting our nation’s communications and commerce, Congress should consider clarifying the legal framework that guides roles and responsibilities for Internet recovery in the event of a major disruption. This effort could include providing specific authorities for Internet recovery as well as examining potential roles for the federal government, such as providing access to disaster areas, prioritizing selected entities for service recovery, and using federal contracting mechanisms to encourage more secure technologies. This effort also could include examining the Stafford Act to determine if there would be benefits in establishing specific authority for the government to provide for-profit companies—such as those that own or operate critical communications infrastructures—with limited assistance during a crisis.

Recommendations for Executive Action

To improve DHS’s ability to facilitate public/private efforts to recover the Internet in case of a major disruption, we recommend that the Secretary of the Department of Homeland Security implement the following nine actions: Establish dates for revising the National Response Plan and finalizing the National Infrastructure Protection Plan—including efforts to update key components relevant to the Internet.

Use the planned revisions to the National Response Plan and the National Infrastructure Protection Plan as a basis, draft public/private plans for Internet recovery, and obtain input from key Internet infrastructure companies.

Review the NCS and NCSD organizational structures and roles in light of the convergence of voice and data communications.

Identify the relationships and interdependencies among the various Internet recovery-related activities currently under way in NCS and NCSD, including initiatives by US-CERT, the National Cyber Response Coordination Group, the Internet Disruption Working Group, the North American Incident Response Group, and the groups responsible for developing and implementing cyber recovery exercises.

Establish time lines and priorities for key efforts identified by the Internet Disruption Working Group.

Identify ways to incorporate lessons learned from actual incidents and during cyber exercises into recovery plans and procedures.

Work with private-sector stakeholders representing the Internet infrastructure to address challenges to effective Internet recovery by further defining needed government functions in responding to a major Internet disruption (this effort should include a careful consideration of the potential government functions identified by the private sector in table 6 of this report), defining a trigger for government involvement in responding to such documenting assumptions and developing approaches to deal with key challenges that are not within the government’s control.

Agency Comments

We received written comments from DHS on a draft of this report (see app. V). In DHS’s response, the Director of the Departmental GAO/Office of Inspector General Liaison Office concurred with our recommendations. DHS stated that it recognizes that the Internet is an important component of the information infrastructure in which both the information technology and telecommunications sectors share an interest. It also stated that because of the increasing reliance of various critical infrastructure sectors on interconnected information systems, the Internet represents a significant source of interdependencies for many sectors. DHS agreed that strengthened collaboration between the public and private sectors is critical to protecting the Internet. DHS also provided information on initial actions it is taking to implement our recommendations.

DHS officials, as well as others who were quoted in our report, also provided technical corrections, which we have incorporated in this report as appropriate.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution of it until 30 days from the report date. At that time, we will send copies of this report to interested congressional committees, the Secretary of the Department of Homeland Security, and other interested parties. In addition, this report will be available at no charge on GAO’s Web site at www.gao.gov.

If you have any questions on matters discussed in this report, please contact us at (202) 512-9286 and at (202) 512-6412, or by e-mail at pownerd@gao.gov and rhodesk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix VI.

Objectives, Scope, and Methodology

Our objectives were to (1) identify examples of major disruptions to the Internet, (2) identify the primary laws and regulations governing recovery of the Internet in the event of a major disruption, (3) evaluate the Department of Homeland Security’s (DHS) plans for facilitating recovery from Internet disruptions, and (4) assess challenges to such efforts.

To determine the types of major disruptions to the Internet, we analyzed our prior work on cybersecurity issues as well as reports by private organizations, research experts, and government agencies. We identified incidents that were representative of types of disruptions that have actually occurred. We compiled case studies by reviewing and summarizing research reports and interviewing private-industry experts and government officials. We also conducted interviews with individuals in the private/public sectors, including representatives of private companies that operate portions of Internet infrastructure.

To determine the primary laws and regulations for recovering the Internet in the event of a major disruption, we analyzed relevant laws and regulations related to infrastructure protection, disaster response, and the telecommunications infrastructure. These laws and regulations included the Homeland Security Act of 2002, Homeland Security Presidential Directive 7, the Defense Production Act, the Stafford Act, the Communications Act of 1934, and the National Communications System (NCS) authorities. We also obtained the perspectives of DHS and the Federal Communications Commission on the laws and regulations that govern Internet recovery. Additionally, we conducted interviews with DHS and other government officials as well as representatives of the telecommunications and information technology sectors.

To assess plans for recovery of Internet service in the event of a major disruption, we analyzed key documents, such as the interim National Infrastructure Protection Plan, the National Response Plan, a report from the National Coordinating Center Task Force, and reports from regional tabletop security exercises. We observed a portion of DHS’s Cyber Storm exercise, which focused on facilitating government and private industry organizations to address an array of cybersecurity issues. We also spoke with the Deputy Manager of NCS and the Deputy Director of the NCSD to identify DHS’s initiatives in the area of Internet protection and recovery. Additionally, we interviewed representatives from private companies that operate portions of Internet infrastructure. These included representatives of major telecommunications and cable companies, Internet service providers, and root server operators. We also interviewed representatives from three information sharing and analysis centers to obtain their perspectives on DHS’s capabilities in the area of Internet recovery.

To identify the challenges that may affect current recovery plans, we analyzed DHS plans, congressional testimony, and other evaluations of challenges to Internet recovery. We also interviewed officials at DHS, including NCSD’s Deputy Director of Strategic Initiatives and Deputy Director of Operations and NCS’s Chief of the Critical Infrastructure Protection Division. In addition, we interviewed other agencies that are involved with the government’s efforts in the area of Internet recovery and experts in the private sector and academia. We performed our work from August 2005 to May 2006 in accordance with generally accepted government auditing standards.

Legislation and Regulations Govern Critical Infrastructure Protection, Disaster Response, and the Telecommunications Infrastructure

Multiple Laws and Regulations Govern Protection of Critical Infrastructure

Federal laws and policies establish critical infrastructure protection as a national goal and describe a strategy for cooperative efforts by government and the private sector to protect the cyber- and physical-based systems that are essential to the minimum operations of the economy and the government. The primary authorities governing protection of critical infrastructure include the Homeland Security Act of 2002 and Homeland Security Presidential Directive 7.

The Homeland Security Act of 2002

The Homeland Security Act of 2002 established DHS and gave it lead responsibility for preventing terrorist attacks in the United States, reducing the vulnerability of the United States to terrorist attacks, and minimizing the damage and assisting in the recovery from attacks that do occur.

The act also assigns DHS a number of responsibilities for critical infrastructure protection, including (1) developing a comprehensive national plan for securing the key resources and critical infrastructure of the United States; (2) recommending measures to protect the key resources and critical infrastructure of the United States in coordination with other federal agencies and in cooperation with state and local government agencies and authorities, the private sector, and other entities; and (3) disseminating, as appropriate, information analyzed by the department—both within the department and to other federal, state, and local government agencies and private-sector entities—to assist in the deterrence, prevention, or preemption of or response to terrorist attacks.

Additionally, the act specifically charged DHS with providing state and local government entities and, upon request, private entities that own or operate critical infrastructure, with analyses and warnings concerning vulnerabilities and threats to critical crisis management support in response to threats or attacks on critical technical assistance with respect to recovery plans to respond to major failures of critical information systems.

Homeland Security Presidential Directive 7

Homeland Security Presidential Directive 7, dated December 17, 2003, superseded Presidential Decision Directive 63 and established a national policy for federal departments and agencies to identify and prioritize critical infrastructures and key resources and to protect them from terrorist attack. The directive defines responsibilities for (1) DHS, (2) sector-specific federal agencies that are responsible for addressing specific critical infrastructure sectors, and (3) other departments and agencies.

The directive also makes DHS responsible for coordinating the national effort to enhance the protection of the critical infrastructure and key resources of the United States. Under the directive, the Secretary of DHS is to serve as the principal federal official to lead, integrate, and coordinate implementation of efforts among federal departments and agencies, state and local governments, and the private sector to protect critical infrastructure and key resources. The Secretary also is to work closely with other federal departments and agencies, state and local governments, and the private sector in accomplishing the objectives of the directive. The Secretary is given responsibility to coordinate protection activities for several key infrastructure sectors, including the information technology and telecommunications sectors.

Homeland Security Presidential Directive 7 provides that DHS is to collaborate with the appropriate private-sector entities and to encourage the development of information-sharing and analysis mechanisms. Additionally, the department and sector-specific agencies are to collaborate with the private sector and continue to support sector-coordinating mechanisms to identify, prioritize, and coordinate the protection of critical infrastructure and key resources and facilitate sharing of information about cyber and physical threats, vulnerabilities, incidents, potential protective measures, and best practices.

Multiple Laws Govern Federal Response to Disasters and Incidents of National Significance

Federal planning for disaster recovery is governed by legislation including the Defense Production Act and the Stafford Act.

Defense Production Act

The Defense Production Act was enacted at the outset of the Korean War to ensure the availability of industrial resources to meet the needs of the Department of Defense. The act is intended to facilitate the supply and timely delivery of products, materials, and services to military and civilian agencies, in times of peace as well as in times of war. Presently, only titles I, III, and VII of the Defense Production Act remain in effect. DHS identified the act as a primary authority that supports telecommunications emergency planning and response functions.

Title I of the act authorizes the President to ensure the timely availability of products, materials, and services needed to meet current defense preparedness and military readiness requirements as well as the requirements of a national emergency. Under section 101 of the act, the President may require preferential performance on contracts and orders to meet approved national defense requirements and may allocate materials, services, and facilities as necessary to promote the national defense in a national emergency. Homeland Security Presidential Directive 7, previously discussed, specifically acknowledges the authority of the Department of Commerce to use the act to ensure the timely availability of industrial products, materials, and services to meet homeland security requirements.

Title III of the act authorizes the use of financial incentives to expand productive capacity and supply. It authorizes loan guarantees, loans, purchases, purchase guarantees, and installation of equipment in contractor facilities for those goods necessary for national defense. It is used only in cases where domestic sources are required and domestic firms cannot, or will not, act on their own to meet a national defense production need.

Title VII of the Defense Production Act defines national defense to include domestic emergency preparedness and critical infrastructure protection and restoration activities. The act’s authorities, therefore, are available to meet requirements in a civil disaster, such as a major Internet disruption.

The act also authorizes the President to provide antitrust defenses to private firms participating in voluntary agreements aimed at solving production and distribution problems.

The Year 2000 computer transition and the September 11, 2001, attacks prompted new interest in the act and its application to information technology and cybersecurity. Some commentators indicated that the act would be a useful tool in managing a critical infrastructure emergency. In January 2001, President Clinton directed the Secretary of Energy to exercise authority under the act, among other statutes, to ensure the availability of natural gas for high-priority uses in California. President Clinton found that ensuring natural gas supplies to California was necessary and appropriate to maximize domestic supplies and to promote the national defense. President Bush subsequently extended this executive order.

In recent years, Congress has expanded the Defense Production Act’s coverage to include crises resulting from natural disasters or “man-caused events” not amounting to an armed attack on the United States. The definition of national defense in the act was expanded in 1994 to include emergency preparedness activities authorized by the Stafford Act. In 2003, the act was reauthorized through September 30, 2008. It was also amended to add explicit authority to use the act for critical infrastructure protection and restoration. In addition, the 2003 Act (section 5) added a definition of critical infrastructure to the act.

The Stafford Act

“Major disaster means any natural catastrophe (including any hurricane, tornado, storm, high water, winddriven water, tidal wave, tsunami, earthquake, volcanic eruption, landslide, mudslide, snowstorm, or drought), or, regardless of cause, any fire, flood, or explosion, in any part of the United States, which in the determination of the President causes damage of sufficient severity and magnitude to warrant major disaster assistance under this Act to supplement the efforts and available resources of States, local governments, and disaster relief organizations in alleviating the damage, loss, hardship, or suffering caused thereby.”

A presidential declaration that a major disaster has occurred activates the federal response plan for the delivery of federal disaster assistance. The Federal Emergency Management Agency is responsible for coordinating the federal and private response effort. A presidential declaration of a major disaster triggers several Stafford Act authorities, including, for example, federal activities to support state and local governments to facilitate the distribution of help distribute aid to victims through state and local governments and voluntary organizations, perform life- and property-saving assistance, clear debris, and use the resources of the Department of Defense; repair and reconstruct federal facilities; repair, restore, and replace damaged facilities owned by state and local governments, as well as private nonprofit facilities that provide essential services or contributions for other facilities or hazard mitigation measures in lieu of repairing or restoring damaged facilities; and establish—during or in anticipation of an emergency—temporary communications systems, and make such communications available to state and local government officials.

Specific Laws and Regulations Govern the Telecommunications Infrastructure That Supports the Internet

The Internet is enabled by the telecommunications infrastructure that supports transmission of data. Key laws and regulations include the Communications Act of 1934, as amended, and the National Communications System (NCS) authorities.

Communications Act of 1934, as Amended

The primary federal telecommunications law is the Communications Act of 1934. Its original purpose was to regulate interstate and foreign commerce in communications by wire and radio by licensing radio stations and regulating the telecommunications monopolies of the time. The 1934 Act also created the Federal Communications Commission to implement the act. The 1934 act, as amended, has remained for more than 60 years as the basis of federal regulation of telecommunications services. The Telecommunications Act of 1996 amended the 1934 Act to enhance competition in the telecommunications market. These laws govern regulation of forms of transmission upon which the Internet depends. There is, however, no general regulatory provision for the Internet in the act and no specific provision providing authorities and responsibilities for Internet recovery.

NCS Authorities

NCS was established by a memorandum signed by President Kennedy in 1963, following the Cuban Missile Crisis. The memorandum called for establishing a national communications system by linking together and improving the communication facilities and components of various federal agencies. This original memorandum has since been amended and superseded over time.

The executive order currently in force is Executive Order 12472, April 3, 1984, which was amended slightly by Executive Order 13286 on February 28, 2003. Executive Order 12472, as amended by Executive Order 13286, established NCS and provided that its mission was to assist the President, the National Security Council, the Homeland Security Council, the Director of the Office of Science and Technology Policy, and the Director of the Office of Management and Budget in, among other responsibilities, “the coordination of the planning for and provision of national security and emergency preparedness communications for the Federal government under all circumstances, including crisis or emergency, attack, recovery and reconstitution.”

The administrative structure includes a National Communications System Committee of Principals, an executive agent, and a manager. The Homeland Security Act of 2002 transferred NCS to DHS. To reflect this change, Executive Order 13286 made the Secretary of DHS the Executive Agent.

NCS’s mission with regard to critical infrastructure protection is to ensure the reliability and availability of telecommunications for national security and emergency preparedness. Its mission includes, but it is not necessarily limited to, responsibility for (1) ensuring the government’s ability to receive priority services for national security and emergency preparedness purposes in current and future telecommunications networks by conducting research and development and participating in national and international standards bodies and (2) operationally coordinating with industry for protecting and restoring national security and emergency preparedness services in an all-hazards environment.

Section 706 of the Communications Act of 1934 grants the President certain emergency powers regarding telecommunications, including the authority to grant essential communications “preference or priority with any carrier” subject to this act. The President may also, in the event of war or national emergency, suspend regulations governing wire and radio transmissions and “authorize the use or control of any such facility or station and its apparatus and equipment by any department of the Government.” Section 706 is implemented in Executive Order 12472, which provides that the Director of the Office of Science and Technology Policy shall direct the exercise of the war power functions of the President under section 706(a), (c)-(e) of the Communications Act of 1934, as amended (47 U.S.C. 606). Section 706 is implemented in the Code of Federal Regulations at title 47, chapter II.

Two Task Forces Have Assessed NCS Roles and Mission

The National Security Telecommunications Advisory Committee advises the President on issues and problems related to implementing national security and emergency preparedness telecommunications policy. The committee recently formed two task forces to provide recommendations on changes to DHS’s NCS division and operations.

Next Generation Network Task Force

In May 2004, the Next Generation Network Task Force was formed to develop recommendations on changes that needed to be made to NCS as a result of issues such as the convergence of voice and data communications. The task force was to (1) define the expected structure for next-generation networks, such as those using Internet-based protocols; (2) identify national security and emergency preparedness user requirements for next- generation networks and outline how these requirements will be met; and (3) examine relevant user scenarios and expected cyber threats and recommend optimal actions to address these threats.

The task force agreed to present its findings and recommendations in two separate reports to the President—a near-term recommendations report and a final comprehensive report.

In March 2005, the task force issued near-term recommendations for the federal government. While the recommendations did not address NCS’s role in recovering from an Internet disruption, they included exploring the use of government networks as alternatives for critical emergency communications during times of national crisis; using and testing existing and leading-edge technologies and commercial capabilities to support critical emergency user requirements for security and availability; studying and supporting industry efforts in areas that present the greatest emergency communications risks during the period of convergence, including gateways, control systems, and first responder communications systems; and reviewing the value of satellite systems as a broad alternative transmission channel for critical emergency communications.

The final report, issued in March 2006, contained recommendations that the federal government require federal agencies to plan for and invest in resilient and alternate communications mechanisms to be used in a crisis, develop identity management tools to support priority emergency communication on next-generation networks, develop supporting policies for emergency communications on next- improve DHS incident management capabilities.

DHS has not yet developed specific plans to address the recommendations from either report.

National Coordinating Center Task Force

In October 2004, a task force was established to examine the future mission and role of the National Coordinating Center, which is part of NCS. This task force was to study the direction of the center over the next year, 3 years, and 5 years, including how industry members of the center should continue to partner with the government and how the center should be structured.

The task force researched the center’s functions and mapped the center’s authorities to its missions. It studied the center’s organizational structure, information sharing and analysis, incident management and leadership, and international mutual-aid abilities.

In its report issued in May 2006, the task force found that since the September 11 attacks the number of companies participating in the National Coordinating Center has more than doubled, but the influx of new members has hindered information sharing because of the time it takes to develop trusted relationships between members. The report also found that members wanted government to increase its sharing of threat information with the communications industry through the National Coordinating Center. The report recommended that the National Coordinating Center broaden center membership by including additional firms, such as cable operators, satellite operators, and Internet service providers; NCS examine the possible combination of the National Coordinating Center and the Information Technology Information Sharing and Analysis Center; DHS clarify responsibilities and authorities in emergency situations to facilitate response to telecommunications disruptions; DHS revise the Cyber Incident Annex to the National Response Plan to clarify the trigger for the annex and the appropriate role of the government in responding to such an incident; the National Coordinating Center develop a concept of operations for responding to cyber events; and DHS resolve confusion over legal or jurisdictional issues in responding to cyber or communications crises.

DHS has not yet developed a plan to address these findings and recommendations.

DHS Has Conducted Disaster Response Exercises That Include Cyber Incidents

DHS Has Conducted Regional Exercises Involving Cyber Attacks

Over the last few years, DHS has conducted several exercises to test the federal and regional response to incidents affecting critical infrastructures. Among other events, these exercises included incidents that could cause localized Internet disruptions. Specifically, DHS sponsored two cyber tabletop exercises with Connecticut and New Jersey, as well as a series of exercises in the Pacific Northwest and Gulf Coast regions of the United States.

The series of exercises in the Pacific Northwest was named Blue Cascades. Blue Cascades II, conducted in September 2004, addressed a scenario involving cyber attacks and attacks that disrupted infrastructure, including telecommunications and electric power. The scenario explored regional capabilities to deal with threats, interdependences, cascading impacts, and incident response. Blue Cascades III, conducted in March 2006, focused on the impact of a major earthquake in the area and the resulting efforts to recover and restore services. Both exercises were sponsored by NCSD and organized by the Pacific Northwest Economic Region.

Purple Crescent II, held in New Orleans, Louisiana, in October 2004, was also designed to raise awareness of infrastructure interdependencies and to identify how to improve regional preparedness. The scenario involved a cell of terrorists that used an approaching major hurricane to test their ability to disrupt regional infrastructures, government and private organizations, and particularly disaster preparedness operations using cyber attacks. The exercise was sponsored by the Gulf Coast Regional Partnership for Infrastructure Security and funded by NCSD.

The objectives of these exercises included raising awareness of infrastructure-related cybersecurity issues and identifying response and recovery challenges; bringing together physical security, emergency management, and other disciplines involved in homeland security and disaster response; identifying roles and responsibilities in addressing cyber attacks and disruptions; determining ways to foster public/private cooperation and information identifying preparedness gaps associated with cybersecurity and related producing an action plan of activities.

The exercises resulted in many findings regarding the overall preparedness for cyber incidents (see table 7). Overall, the exercises found that both the government and private-sector organizations were poorly prepared to effectively respond to cyber events. The lack of clarity on roles and responsibilities coupled with both the lack of coordination and communication and limited understanding of cybersecurity concerns pose serious obstacles to effective response and recovery from cyber attacks and disruptions. Furthermore, it was unclear who was in charge of incident management at the local, state, or national levels.

The after-action reports from the exercises recommended areas for additional study and planning, including additional study of the vulnerabilities of critical infrastructures to cyber improved information on training, assessments, and resources to be used against cyber attacks; improved federal, state, local, and private-sector planning and defined thresholds for what constitutes a major cyber attack.

Cyber Storm Was DHS’s First National Exercise Focused on Cyber Attacks

Cyber Storm, held in February 2006 in Washington, D.C., was the first DHS- sponsored national exercise to test response to a cyber-related incident of national significance. The exercise involved a simulated, large-scale attack affecting the energy, information technology, telecommunications, and transportation infrastructures. DHS officials stated that they plan to hold a similar exercise every other year.

According to information provided by agency officials, the exercise involved eight federal departments and three agencies, three states, and four foreign countries. The exercise also involved representatives from the private sector, including nine information technology companies, six electric companies, and two airlines. The exercise objectives included testing interagency, intergovernmental, and public/private coordination of incident response.

Representatives of private-sector companies provided mixed responses on the value of exercises such as Cyber Storm. Selected representatives expressed concerns about the overly broad scope and the difficulty in justifying dedicating resources for the exercises due to the lack of clear goals and outcomes. Another representative stated that government exercises help the government but exercises involving private-sector coordination with multiple agencies would also be helpful. Another representative stated that exercises were only of value if there was a process for integrating lessons learned from the exercises into policies and procedures. Two representatives, from a private-sector company that participated in Cyber Storm, stated that, while useful, the exercise was not designed for network operators, who would benefit from more comprehensive training in incident response.

Comments from the Department of Homeland Security

GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to those named above, Don R. Adams, Naba Barkakati, Scott Borre, Neil Doherty, Vijay D’Souza, Joshua A. Hammerstein, Bert Japikse, Joanne Landesman, Frank Maguire, Teresa M. Neven, and Colleen M. Phillips made key contributions to this report.