Defense Civil Support: DOD Needs to Identify National Guard's Cyber Capabilities and Address Challenges in Its Exercises
Released: 2016-09-06T00:00:00

Letter

Background

Defense Support of Civil Authorities

Under the Robert T. Stafford Disaster Relief and Emergency Assistance Act (Stafford Act), when state capabilities and resources are overwhelmed and the President of the United States declares an emergency or disaster, the governor of an affected state can request assistance from the federal government for major disasters or emergencies. Additionally, under the Economy Act, a federal agency may request the support of another federal agency, including DOD, without a presidential declaration of a major disaster or an emergency.

The federal government’s response to major disasters and emergencies in the United States is guided by the National Response Framework, a national-level guide on how local, state, and federal governments respond to major disasters and emergencies. The DHS interim National Cyber Incident Response Plan outlines domestic cyber-incident response coordination and execution among federal, state and territorial, and local governments, and the private sector. Overall coordination of federal incident-management activities is generally the responsibility of DHS. DOD supports the lead federal agency in the federal response to a major disaster or emergency. When the appropriate DOD official approves a lead federal agency’s request to provide support to civil authorities for domestic disasters or emergencies, DOD may provide capabilities and resources, including those drawn from the National Guard. Through DSCA, DOD provides these capabilities and resources, which the department defines as support provided by U.S. federal military forces, DOD civilians, DOD contract personnel, DOD component assets, and National Guard forces (when the Secretary of Defense, in coordination with the governors of the affected states, elects and requests to use those forces in Title 32 status) in response to requests for assistance from civil authorities for domestic emergencies, law enforcement support, and other domestic activities, or from qualifying entities for special events.

National Guard

The National Guard, which is comprised of Army and Air National Guard units, is located in the 50 states, three U.S. territories, and the District of Columbia. The National Guard has both federal and state-level missions, making it unique among U.S. military organizations. Its federal mission, which is executed under the control of the President of the United States and the Secretary of Defense, includes maintaining well- trained and well-equipped units that are ready to be mobilized and, when mobilized, to execute military missions in support of the full spectrum of DOD missions, including, but not limited to warfighting, contingency operations, defense security cooperation activities, and DSCA during national emergencies, major disasters, insurrections, and civil disturbances. Its state-level mission, which is executed under the control of state and territorial governors or by the President for the District of Columbia—is to protect life and property and preserve peace, order, and public safety. This mission involves providing emergency relief support during local or statewide emergencies, such as riots, earthquakes, floods, or terrorist attacks.

National Guard unit personnel may operate in a Title 10 status, a Title 32 status, or a state active-duty status. Personnel in a Title 10 status are federally funded and under the command and control of the President. Personnel in a Title 32 status are federally funded but under the command and control of the governor. National Guard personnel could support DOD’s DSCA mission while in a Title 10 or Title 32 status. The Secretary of Defense, in coordination with respective state governors, determines the most appropriate duty status for National Guard personnel when providing federal support during disasters and emergencies, including cyber support. Separately, National Guard personnel could also support the state’s civil authorities in a state active-duty status. Personnel in a state active-duty status are under the command and control of the governor and are state funded. Under state active duty status, the National Guard can be used for state purposes in accordance with the state constitution and statutes and the respective state is responsible for National Guard expenses.

The National Guard Bureau is a joint organization of DOD that, by law, is the channel of communications on all matters pertaining to the National Guard between (a) the Department of the Army and the Air Force, and (b) the states. In addition, according to DOD Directive 5105.77, National Guard Bureau (NGB), the bureau is the focal point at the strategic level for non-federalized National Guard matters that are not the responsibility in law or DOD policy of the Secretary of the Army, the Secretary of the Air Force, or the Chairman of the Joint Chiefs of Staff. The directive also states that the bureau supports force employment matters pertaining to homeland defense and DSCA missions by advising the Chairman of the Joint Chiefs of Staff on the activities of the National Guard as they relate to those missions. Specifically, according to the directive, the bureau prescribes training requirements; plans, programs, and administers the budget; and implements guidance on the structure of the Army National Guard of the United States and the Air National Guard of the United States.

In its 2014 cyber mission analysis report, DOD reported that the National Guard is well-positioned to offer its expertise and support to states in traditional missions like natural disasters as well as less traditional missions in cyberspace. Further, the Chief of the National Guard Bureau in his 2017 National Guard Bureau Posture Statement reported that the National Guard is uniquely postured to provide cyber capabilities and that its cyber capacity will play an integral role in coordinating with state and federal cyber professionals. In May 2016, DOD issued a Deputy Secretary of Defense policy memorandum that provides guidance on (a) coordinating, training, advising, and assisting cybersecurity support and services that DOD—including National Guard units—could provide to civil authorities incidental to military training, and (b) a state’s use of DOD networks, hardware, and software for state cybersecurity activities.

Exercises

Exercises are training events that, according to the 2008 National Response Framework, can play an instrumental role in preparing organizations to respond to an incident by providing opportunities to test response plans, evaluate response capabilities, assess the clarity of established roles and responsibilities, and improve proficiency in a simulated, risk-free environment. Short of performance in actual operations, exercises provide the best means to assess the effectiveness of organizations in achieving mission preparedness. Exercises provide an ideal opportunity to collect, develop, implement, and disseminate lessons learned and to verify corrective action taken to resolve previously identified issues. Sharing positive experiences reinforces positive behaviors, doctrine, tactics, techniques, and procedures, while disseminating negative experiences highlights potential challenges in unique situations or environments or identifies issues that need to be resolved. According to the 2008 National Response Framework, well- designed exercises improve interagency coordination and communications, highlight capability gaps, and identify opportunities for improvement. There are various types of exercises ranging from tabletop exercises that involve key personnel discussing simulated scenarios in informal settings to full-scale response exercises that include many agencies, jurisdictions, and disciplines. In addition to different types of exercises, there are different complexities or focus areas for exercises, such as tiers of exercises identified by numbers 1 through 4. For example, DOD units are to conduct tier 4 training to focus on unit policy and joint and service doctrine linked to unit mission-essential tasks. However, for more complex training situations, DOD is to conduct tier 1 exercises that are designed to prepare national-level organizations and combatant commanders and staffs at the strategic and operational level to integrate interagency, non-governmental, and multinational partners in highly complex environments. Also, the goal of tier 1 exercises is to integrate a diverse audience in a joint training environment and identify core competencies, procedural disconnects, and common ground to achieve U.S. unity of effort.

The National Guard Has Developed Cyber Capabilities That Could Support Civil Authorities, but DOD Does Not Have Full Visibility of National Guard Units’ Capabilities

The National Guard Has Cyber Capabilities That Could Support Civil Authorities

The National Guard in the 50 states, three territories, and the District of Columbia have capabilities that could be used—if requested and approved—to perform DOD or state missions to support civil authorities in a cyber incident. National Guard cyber capabilities, according to DOD officials, vary among states, territories, and the District of Columbia based on their differences in funding and prioritization. National Guard officials told us that National Guard units are in a unique position to recruit and retain individuals who have significant cyber expertise based on their full- time positions outside of the military and can coordinate with state authorities and critical infrastructure owners within their respective states. Based on our review of DOD reports, National Guard guidance documents, and our interviews with National Guard officials, we found three types of cyber capabilities that exist within the National Guard:

Communications directorates: The National Guard has a communications directorate within each state, territory, and the District of Columbia that operates and maintains that state’s part of the National Guard information network called GuardNet. In this capacity, the directorate conducts information assurance, information operations, and internal defensive activities. The size of each National Guard unit’s communications directorate varies between state, territory, and federal district. For example, Nevada National Guard officials told us that there were 26 full-time Army National Guard personnel staffed to their communications directorate in fiscal year 2016. Also, Maryland National Guard officials told us that there were 30 full-time personnel staffed to their Army National Guard communications directorate in fiscal year 2016. According to National Guard officials, personnel who work within a communications directorate, if requested and approved, could support a DSCA mission in a cyber incident. For example, Washington National Guard officials told us that their communications directorate’s cyber personnel can conduct vulnerability assessments, support cyber recovery efforts, provide cyber incident response support, and provide cyber and communication capabilities during cyber-related emergencies. Further, National Guard officials told us that the Georgia, Washington, and Maryland National Guard units have developed partnerships with state agencies and local governments to provide cybersecurity support.

Computer network defense teams: The National Guard has computer network defense teams in each state, three territories, and the District of Columbia with a mission to protect National Guard information systems against cyber threats within the respective state, territory, or federal district. According to the 2015 Concept of Operations Army National Guard Computer Network Defense Team (CND-T), the teams could serve as first responders for states for cyber emergencies and may provide surge capacity to national capabilities. For example, Colorado National Guard officials told us that their computer network defense team—if requested—could provide cyber capabilities to support civil authorities. In preparation for such a request, the team developed a planning document that identified specific cyber capabilities—such as cyber analysis, threat assessment, and incident response—that the team could provide to civil authorities for a cyber-related emergency or incident. Georgia National Guard officials also told us that their computer network defense team’s primary mission is to provide direct cybersecurity support to the network enterprise center and the team also conducts cybersecurity assessments, incident response, network analysis, and forensic support. As of October 2015, 50 states, three territories, and the District of Columbia had computer network defense teams that ranged from 1 to 23 personnel.

National Guard cyber units: The Army and Air Force are in the process of setting up National Guard units with cyber capabilities to support U.S. Cyber Command’s missions. For example, the Army and the Air Force are planning to establish National Guard cyber protection teams to conduct defensive cyberspace operations. National Guard officials stated that while the Army National Guard and Air National Guard are approaching the organization of the teams differently, both sets of teams will have capabilities that could support civil authorities in a domestic cyber incident. Specifically, within the Army National Guard, the Army has 1 full-time cyber protection team in place and is developing 10 part- time cyber protection teams that would conduct defensive cyberspace operations, and could support DSCA missions if called upon. Also, within the Air National Guard, the Air Force plans to develop 2 full-time cyber protection teams that will be filled by 12 Air National Guard units on a rotational basis that would support U.S. Cyber Command to defend DOD networks and would be available as surge capacity in a cyber incident. According to the 2017 National Guard Bureau Posture Statement, the National Guard will activate the cyber teams by the end of fiscal year 2019. According to National Guard officials, the cyber protection teams are authorized to have 39 personnel each and Georgia National Guard officials told us that in fiscal year 2016 their cyber protection team had 34 assigned personnel. In addition to the cyber protection teams, the Air National Guard has 3 additional cyber units whose mission—as members of U.S. Cyber Command’s national mission teams—is to stop cyber attacks and malicious cyber activity of significant consequence against the United States. The Air National Guard also has 7 cyber intelligence, surveillance, and reconnaissance units whose mission is to produce tailored all-source intelligence products that enable cyberspace operations. In addition, according to DOD’s cyber mission analysis report, the Virginia National Guard Data Processing Unit, when activated, conducts cyberspace operations in support of U.S. Cyber Command and other organizations.

DOD Does Not Have Full Visibility of All National Guard Cyber Capabilities

DOD has not identified and does not have full visibility into National Guard cyber capabilities that could support civil authorities during a cyber incident. As noted in DOD’s 2013 Strategy for Homeland Defense and Defense Support of Civil Authorities, DOD is often expected to play a prominent supporting role in responding to a disaster and to rapidly and effectively harness resources to respond to civil-support requests in the homeland. According to the strategy, an effective response will require, among other things, better linking of established federal and state capabilities. DOD does not have visibility into all National Guard units’ cyber capabilities because the department has not maintained a database that identifies National Guard cyber capabilities that could support civil authorities during a cyber incident. Section 1406 of the John Warner National Defense Authorization Act for Fiscal Year 2007 requires that DOD identify National Guard emergency response capabilities. Specifically, the section requires that the Secretary of Defense maintain a database of emergency response capabilities that includes the following: (1) the types of emergency response capabilities that each state’s National Guard, as reported by the states, may be able to provide in response to a domestic natural or manmade disaster, both to their home states and under state-to-state mutual assistance agreements; and (2) the types of emergency response capabilities that DOD may be able to provide in support of the National Response Plan’s emergency support functions, and identification of the units that provide these capabilities.

Initially during our review, National Guard Bureau officials identified two systems that the bureau traditionally uses to identify some National Guard capabilities—the Defense Readiness Reporting System and the Joint Information Exchange Environment. However, National Guard officials acknowledged that neither of these systems fully or quickly identified National Guard cyber capabilities that could be used to support civil authorities in a cyber incident. For example, according to National Guard Bureau officials, the Defense Readiness Reporting System was designed to identify the capabilities associated with National Guard units’ federal missions; however, since some National Guard capabilities, such as computer network defense teams, were established to support state and local governments and do not have a federal mission, the Defense Readiness Reporting System will not report or identify these capabilities. Additionally, National Guard Bureau officials told us that they have used the Joint Information Exchange Environment system to query National Guard units for specific capabilities; however, the officials acknowledged that the query approach takes time that might not be available during a cyber incident. National Guard Bureau officials also told us that these systems were not designed to identify National Guard unit cyber capabilities and that neither of the systems were established or designed for the purposes described in section 1406. DOD officials, including National Guard Bureau officials and two state National Guard units we interviewed, acknowledged that DOD has not maintained a database that would allow the department to fully and quickly identify existing cyber capabilities of all National Guard cyber units. Without such a database, DOD may not have timely access to these capabilities when requested by civil authorities during a cyber incident.

DOD Has Conducted and Participated in Exercises to Support Civil Authorities in a Cyber Incident, but Has Not Addressed Challenges with the Exercises

DOD Has Conducted and Participated in Exercises to Prepare to Support Civil Authorities During or After a Cyber Incident

From fiscal years 2013 through 2015, DOD conducted or participated in 9 exercises that were designed to explore the application of policies for supporting civil authorities or to test the response to simulated attacks on cyber infrastructure owned by civil authorities. Of these 9 exercises, DOD conducted 7 exercises and participated in 2 non-DOD hosted exercises. Table 1 shows the 7 exercises that DOD components conducted during the time period of our review—fiscal years 2013 through 2015.

The exercises explored how the department would provide assistance to civil authorities during or after a cyber incident. For example,

U.S. Cyber Command’s Cyber Guard—The command conducted exercises in fiscal years 2013, 2014, and 2015 to explore the ability of DOD, other federal agencies, and the private sector to respond in cyberspace to a destructive or disruptive attack of significant consequence on U.S. critical infrastructure. In the 2015 Cyber Guard exercise, DOD participants supported DHS network defense as part of a simulated DSCA response. National Guard teams also conducted activities to coordinate, train, advise, and assist civil authorities in a state active duty status. The exercises also included legal and policy tabletop review sessions to explore legal and policy issues related to a national response to significant domestic cyberspace incidents.

Army National Guard’s Cyber Shield—The Army National Guard conducted Cyber Shield exercises in fiscal years 2013, 2014, and 2015 to train computer network defense teams on the detection, analysis, identification, reporting, and mitigation of cyber threats. The Army National Guard focused the fiscal year 2013 and 2014 exercises on defense of the GuardNet, and in the fiscal year 2015 exercise, changed the focus to support for civil authorities. Specifically, the Cyber Shield 2015 exercise included a scenario where industrial-control systems for electric grid infrastructure and hydroelectric dams were under cyber threat. According to Army National Guard officials, this change to focus on civil support was in response to requests from states for an exercise that would involve National Guard support for information technology infrastructure in the states.

Vista Host II—In this May 2015 tabletop exercise, North American Aerospace Defense Command and U.S. Northern Command focused on examining planning assumptions, potential resource requirements, and the roles and responsibilities for cyber-related defense support of civil authorities. Specifically, the exercise scenario involved civil support to an electric power generator in responding to a disaster caused by a cyber attack on the generator’s industrial-control systems that controlled hydroelectric and nuclear power generation systems. According to U.S. Northern Command officials, the exercise showed that there was a lack of clarity on roles and responsibilities for supporting civil authorities during a cyber incident.

In addition to conducting the 7 exercises, from fiscal year 2013 through 2015, DOD components participated in 2 exercises conducted by non- DOD organizations.

DHS’s Cyber Storm IV—The department’s Cyber Storm IV exercises, which consisted of a series of 15 exercises focused on cybersecurity preparedness and response capabilities, ran from fiscal year 2011 through fiscal year 2014. The exercise series was designed to, among other things, improve the processes, procedures, interactions, and information-sharing mechanisms that exist or should exist under the interim National Cyber Incident Response Plan. According to DHS officials involved in planning the exercise series, DOD officials assisted in designing the exercise scenarios and DOD officials also participated in multiple exercises that included a tabletop exercise component designed to examine policy issues. U.S. Cyber Command officials also noted that Cyber Storm IV helped participants better understand federal cyber capabilities.

North American Electric Reliability Corporation’s GridEx II—The not-for- profit international organization conducted the GridEx II exercise in fiscal year 2014 on responding to cyber attacks on electric grid components. The exercise included both executive decision making in a tabletop exercise and a response to simulated cyber attacks on electric grid networks. According to a North American Electric Reliability Corporation official, DOD components such as U.S. Northern Command, U.S. Cyber Command, and two state National Guard units participated in GridEx II.

DOD Has Experienced Challenges in Its Civil- Support Exercises and Has Not Conducted a Tier 1 Exercise That Could Address Challenges

We identified three types of challenges with DOD’s exercises that could limit the extent to which DOD is prepared to support civil authorities in a cyber incident; DOD has not addressed the challenges. The DOD Cyber Strategy states that DOD will exercise its DSCA capabilities in support of DHS and other agencies and with state and local authorities to help defend the federal government and the private sector, if directed, in an emergency. Similarly, the Strategy for Homeland Defense and Defense Support of Civil Authorities states that DOD will deepen and facilitate rigorous federal, regional, and state-level planning, training, and exercises through coordination and liaison arrangements that support civil authorities at all levels. Although DOD has developed the two guidance documents, we found challenges that could limit the effectiveness of DOD’s exercises. Specifically,

Limited access because of classified exercise environments: According to documents we reviewed and officials we interviewed, DOD’s tendency to exercise in a classified environment limited the ability of other federal agencies and critical infrastructure owners to participate in DSCA exercises. In one example, Washington National Guard officials told us that utility personnel who had flown across the country to participate in a civil support exercise that the National Guard unit had invited them to participate in were not admitted into the classified exercise environment. According to DHS’s Cyber Guard 15 after-action report, DOD’s requirement for the exercise environment to be closed and classified prohibited a more active participation by industry partners and DHS components, including the National Cybersecurity and Communications Integration Center. According to the DHS Cyber Guard 15 exercise after-action report, the exercise has experienced this challenge since 2013. Similarly, according to U.S. Cyber Command’s after-action report for its February 2016 Cyber Guard 16 tabletop exercise, the exercise experienced issues because officials of state and local governments and the private sector did not have security clearances, which hindered information sharing.

Limited inclusion of other federal agencies and critical infrastructure owners: Some of the exercises DOD conducted included key federal agencies such as DHS and critical infrastructure owners such as power providers. However, the exercises DOD conducted did not include other key federal agencies (e.g., State and Treasury departments), or other critical infrastructure owners (e.g., bank owners). According to an official from ODASD for Cyber Policy, DOD recognizes that such organizations potentially would be involved in a cyber incident. Similarly, according to the DOD Cyber Strategy, the private sector owns and operates over 90 percent of all of the networks and infrastructure of cyberspace and is thus the first line of defense. In Vista Host II, DOD officials reportedly learned that the critical infrastructure owner would contact its security vendors first because of their familiarity with the critical infrastructure’s industrial-control systems; however, none of the DOD exercises we reviewed included such vendors.

Inadequate incorporation of joint physical-cyber scenarios: The 7 DOD-conducted exercises we reviewed did not fully explore a scenario in which multiple DOD components and commanders would be responding to a cyber incident that causes an emergency or disaster with physical effects or occurs during such an emergency. The Joint Action Plan for State-Federal Unity of Effort on Cybersecurity, which was approved by DOD, recognizes the possibility of a cyber incident with physical effects as well as a physical incident with cyber implications. DOD recognizes that a cyber incident could cause physical effects, including cascading failures of multiple, interdependent, critical, life-sustaining infrastructure sectors. Similarly, Washington National Guard officials told us that bad actors may take advantage of a disaster or emergency to conduct cyber attacks on information and communications systems in that geographic area. In its planning, DOD has recognized that this is an area that needs to be addressed. Specifically, a planning document that the ODASD for Cyber Policy, the National Guard Bureau, U.S. Northern Command, and U.S. Cyber Command developed to implement the DOD Cyber Strategy states that the department should conduct an exercise that will incorporate cybersecurity as part of broader exercise scenarios. DOD officials acknowledged that DOD exercises to date, such as the Cyber Guard exercises, have not been ideal for a nationwide exercise that addresses multiple complexities of cyber incidents and physical consequences.

In addition to these challenges, we also observed that DOD has not addressed its goals by conducting a tier 1 exercise involving various partners in highly complex environments. Specifically, while DOD conducted 7 exercises that evaluated in some part civil support for a cyber incident, these exercises varied from tabletop exercises to other exercises that do not meet Joint Staff’s’ tier 1 exercise criteria. DOD’s Cyber Strategy exercise planning document states that DOD needs to conduct a tier 1 exercise to achieve the DOD Cyber Strategy goal of exercising its DSCA capabilities in support of DHS and other agencies, including state and local authorities, to help defend the federal government and the private sector, if directed, in an emergency. Similarly, U.S. Northern Command and ODASD for Cyber Policy officials told us that the department needs to conduct a tier 1 exercise to explore a disaster with physical and cyber effects. DOD’s Cyber Strategy planning document states and officials agree that the department needs to conduct such an exercise to prepare its forces to support civil authorities during or after a cyber incident. However, DOD has not conducted a tier 1 exercise that would prepare DOD forces and enable the department to achieve one of the goals in the DOD Cyber Strategy because the department has not identified an exercise to do so. According to U.S. Northern Command officials, the command wanted to incorporate a cyber civil-support scenario in its 2016 Ardent Sentry exercise, which is a tier 1 exercise. However, the command cancelled its plans after U.S. Cyber Command— a DOD component that would potentially provide critical capabilities in supporting civil authorities—stated that the command had to focus its exercise resources on the Cyber Guard exercise to certify DOD’s cyber protection teams. Until DOD identifies and conducts a tier 1 exercise, DOD will miss an opportunity to fully test response plans, evaluate response capabilities, assess the clarity of established roles and responsibilities, and improve proficiency in supporting DHS, other federal agencies, and state and local authorities, if directed, in an emergency. In addition, identifying and conducting a tier 1 exercise would provide DOD an opportunity to address the challenges the department has experienced in previous exercises. For example, the tier 1 exercise could be conducted in part on an open network, include additional federal agencies and other critical infrastructure owners that would be involved in a response, and incorporate scenarios where both cyber threats and physical effects were involved.

Conclusions

DOD has a key role to prepare to defend the homeland and support civil authorities in all domains—including cyberspace—and plays a crucial role in supporting a national effort to confront cyber threats to critical infrastructure. The National Guard has cyber capabilities that could be used—if requested and approved—to support civil authorities in a cyber incident. During an emergency, it is necessary for decision makers to have visibility into the full capabilities that National Guard units possess to support civil authorities. Unless DOD develops or specifies a database to provide full and quick identification of all National Guard units’ cyber capabilities, DOD may not have timely visibility and access for needed capabilities when requested by civil authorities during a cyber incident. Similarly, DOD has conducted and participated in exercises to prepare the department to support civil authorities in a cyber incident. Unless DOD conducts a tier 1 exercise that involves various partners in highly complex environments, DOD risks having unprepared forces to call upon to support civil authorities during or after a disaster with physical and cyber effects, and will miss a key opportunity to address the challenges we have identified with its previous exercises.

Recommendations for Executive Action

To ensure that decision makers have immediate visibility into all capabilities of the National Guard that could support civil authorities in a cyber incident, we recommend that the Secretary of Defense maintain a database that can fully and quickly identify the cyber capabilities that the National Guard in the 50 states, three territories, and the District of Columbia have and could be used—if requested and approved—to support civil authorities in a cyber incident.

To better prepare DOD to support civil authorities in a cyber incident, we recommend that the Secretary of Defense direct the Deputy Assistant Secretary of Defense for Cyber Policy, the Chief of the National Guard Bureau, the Commander of U.S. Northern Command, and the Commander of U.S. Cyber Command to conduct a tier 1 exercise that will improve DOD’s planning efforts to support civil authorities in a cyber incident. Such an exercise should also address challenges from prior exercises, such as limited participant access to exercise environment, inclusion of other federal agencies and private-sector cybersecurity vendors, and incorporation of emergency or disaster scenarios concurrent to cyber incidents.

Agency Comments and Our Evaluation

We provided a draft of this report to DOD and DHS for their review and comment. In its written comments, DOD partially concurred with our two recommendations. DOD’s comments are summarized below and are reprinted in entirety in appendix II. DOD also provided technical comments, which we incorporated into the report as appropriate. DHS provided technical comments which we incorporated as appropriate.

DOD partially concurred with our recommendation that the Secretary of Defense maintain a database that can fully and quickly identify the cyber capabilities that the National Guard in the 50 states, three territories, and the District of Columbia have and could be used—if requested and approved—to support civil authorities in a cyber incident. In its response, DOD stated that it already tracks capability and readiness across the entire force. Specifically, DOD stated that National Guard units assigned to and performing Title 10, U.S. Code, missions report readiness through the Defense Readiness Reporting System, and that units assigned to perform Title 32, U.S. Code, missions report to their state’s adjutant general. However, as we reported—and DOD’s comments reflect—the Defense Readiness Reporting System does not identify National Guard capabilities that could provide cyber support in a cyber incident. While this system could track some National Guard capabilities, such as cyber protection teams assigned to U.S. Cyber Command, this system alone will not provide DOD leaders complete information about capabilities they could employ to assist civil authorities. For example, while National Guard computer network defense teams could serve as first responders for states for cyber emergencies and may provide surge capacity to national capabilities, the readiness system will not include these teams.

In its comments, DOD also made reference to an annual report that state adjutants general are to provide to the Chief of the National Guard Bureau regarding the readiness of their respective state National Guards. During our engagement, we reviewed the National Guard Bureau’s submission to the July-September 2015 Quarterly Readiness Report to the Congress, which the bureau uses to meet its requirement to provide DOD leaders a status on the readiness of the National Guard to conduct DSCA activities. We found that the report identifies the readiness of state National Guard units to conduct certain DSCA missions—such as hurricane response. However, the National Guard has not incorporated other DSCA missions—including cyber civil support—in the Quarterly Readiness Report to the Congress. Consequently, as prepared now, this report does not help DOD leaders identify assets that could be used in a cyber crisis scenario. However, if the National Guard Bureau modifies the report to include the readiness level of National Guard units to provide civil support in a cyber incident, DOD leaders will potentially have more visibility into cyber capabilities that exist within the National Guard across each state. Because the Defense Readiness Reporting System and the National Guard report do not currently enable DOD leaders to identify National Guard cyber capabilities that could facilitate a quick response in a cyber incident, we continue to believe that DOD should maintain a database—as required by law—that can fully and quickly identify the cyber capabilities that the National Guard possesses.

In response to DOD’s comments, we clarified the recommendation that was initially in the report. Specifically, we modified the recommendation from stating that the database should include cyber capabilities that “all National Guard units possess” to cyber capabilities that “the National Guard in the 50 states, three territories, and the District of Columbia have and could be used.” This modification is consistent with the requirement identified in Section 1406 of the John Warner National Defense Authorization Act for Fiscal Year 2007, which states that the database should include emergency response capabilities that each state’s National Guard may be able to provide in response to a natural or manmade domestic disaster. We discussed this modification with DOD officials and they agreed that the modified recommendation provided them the necessary flexibility to address the report’s finding and recommendation.

DOD partially concurred with our recommendation that the Secretary of Defense direct the Deputy Assistant Secretary of Defense for Cyber Policy, the Chief of the National Guard Bureau, the Commander of U.S. Northern Command, and the Commander of U.S. Cyber Command to conduct a tier 1 exercise that will improve DOD’s planning efforts to support civil authorities in a cyber incident. DOD concurred in the need to exercise a whole range of challenges associated with responding to a cyber incident but stated that it believes that the Cyber Guard exercise meets the intent of the recommendation. DOD stated that Cyber Guard is designed to address a whole-of-government, whole-of-nation response to a significant cyber attack and included participants from across DOD, the National Guard, DHS, the Federal Bureau of Investigation, the intelligence community, and the private sector. Based on our review of after-action reports and discussions with DOD officials, we believe that the Cyber Guard exercise provides DOD components with an opportunity to evaluate aspects of the department’s DSCA mission—such as Cyber Guard 15’s test of DOD participation in a response to a cyber attack of significant consequence against U.S. critical infrastructure. However, these after-action reports and DOD officials at various levels also identified a number of issues that keep Cyber Guard in its current form from being a tier 1 exercise that would enable the department to achieve its DOD Cyber Strategy goal of exercising its DSCA capabilities in support of DHS and other agencies, including state and local authorities. Specifically, officials from the ODASD for Cyber Policy, U.S. Northern Command, U.S. Cyber Command, and National Guard units told us that Cyber Guard, in its current form, does not meet the intentions of a tier 1 exercise. For example, according to DOD officials, one of the primary purposes of Cyber Guard is to use the exercise as a forum to certify cyber protection teams as being operationally ready. Consequently, according to DOD officials, this does not provide DOD flexibility to address training requirements that are not part of the certification requirements. DOD has also conducted the exercise in a classified forum, which consistently limits public and private sector participation. DOD stated that it strives for greater inclusion of public and private entities in its exercises to increase realism and enhance its understanding of domestic response requirements; however, the exercises are typically classified because they can reveal capabilities, readiness, or plans for military forces that must be protected.

DOD’s approach does not recognize that while some DOD components may support civil authorities using classified means, other DOD components—including the National Guard—may be coordinating, training, advising, or assisting civil authorities on unclassified networks. Other cyber civil support exercises, such as the Army National Guard’s Cyber Shield exercise and the North American Electric Reliability Corporation’s GridEx exercise, demonstrate that training in unclassified forums is both possible and beneficial. If DOD modifies Cyber Guard to address the challenges we have highlighted—such as limited participant access to exercise environment, inclusion of other federal agencies and private-sector cybersecurity vendors, and incorporation of emergency or disaster scenarios concurrent to cyber incidents—it could improve DOD’s planning efforts to support civil authorities in a cyber incident. Otherwise, we still believe that DOD should conduct a tier 1 exercise such as a modified Ardent Sentry that includes a DOD response to civil authorities for a cyber incident.

We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, and the Secretary of Homeland Security. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-9971 or KirschbaumJ@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III.

Appendix I: Scope and Methodology

To examine the extent to which the National Guard has developed cyber capabilities that could support civil authorities in response to a cyber incident and the Department of Defense (DOD) has visibility over those capabilities, we reviewed DOD policies and guidance to identify the National Guard’s role in providing Defense Support of Civil Authorities, National Guard cyber capabilities, and the mechanisms used to identify National Guard capabilities. Specifically, we reviewed Joint Publication 3- 28, Defense Support of Civil Authorities; DOD Directive 3025.18, Defense Support of Civil Authorities (DSCA); DOD Instruction 3025.22, The Use of the National Guard for Defense Support of Civil Authorities; and DOD Directive 7730.65 Department of Defense Readiness Reporting System (DRRS). To identify National Guard cyber capabilities, we reviewed DOD’s and the National Guard’s cyber mission analysis reports. Additionally, we discussed National Guard unit cyber capabilities and capability identification mechanisms with officials from DOD involved in DSCA from the National Guard Bureau, the Army National Guard, the Air National Guard, and the Office of the Deputy Assistant Secretary of Defense (ODASD) for Cyber Policy. We also spoke with Timothy Lowenberg, a recognized expert on the National Guard’s role in cyber incidents who is a retired U.S. Air Force Major General; he also has served as an advisor to the Council of Governors and the National Governors Association. We compared the DOD guidance documents listed above and the information we received in our interviews to the requirement for identifying National Guard emergency response capabilities listed in the United States Code. Based on these discussions and relevant DOD documentation, we categorized National Guard units with cyber capabilities. After pre-testing our interview questions with officials from the Maryland National Guard and meeting with the Colorado National Guard, we conducted structured interviews with a non- generalizable sample of officials from state National Guard cyber units from Georgia, Nevada, and Washington to discuss their cyber civil- support roles and responsibilities, cyber capabilities, and capability tracking mechanisms. We judgmentally selected these states based on the type and number of cybersecurity teams in the state, participation of teams in cyber civil-support exercises, and the relative level of information sector employment in the state based on 2014 Bureau of Labor Statistics sector-level data. We found the Bureau of Labor Statistics information- sector activity data sufficiently reliable for the purpose of this selection. Our findings regarding the capabilities identified during our three sets of interviews with these National Guard units are not generalizable to all state National Guard cyber units and do not reflect an exhaustive list of National Guard cyber capabilities. While some of the National Guard capabilities could be used to support their respective state missions, our focus was on National Guard capabilities that could be used in DOD’s DSCA mission.

To assess the extent to which DOD has conducted and participated in exercises to support civil authorities in cyber incidents and any challenges it faced in doing so, we reviewed the DOD Cyber Strategy, Strategy for Homeland Defense and Defense Support of Civil Authorities, and Joint Publication 3-28 for DSCA. We also reviewed these documents to determine the types of exercises in which DOD should be conducting or participating. We identified a non-generalizable sample of relevant exercises by reviewing exercise planning documentation and through interviews with knowledgeable officials. Specifically, we reviewed an exercise planning document that DOD developed in response to the DOD Cyber Strategy and interviewed DOD and DHS officials to identify exercises that DOD components conducted or participated in from fiscal years 2013 through 2015. We chose this timeframe because it allowed us to identify a range of exercises for review and to identify any trends over time. We selected exercises—to include tabletop or simulated network defense exercises—that addressed computer network defense and involved support to civil authorities. We excluded exercises that focused solely on defense of DOD networks. We confirmed these exercises met our selection criteria through reviewing exercise after-action reports. To examine DOD planning for conducting future exercises related to civil support for cyber incidents, we reviewed the DOD Cyber Strategy exercise planning document. We also reviewed DOD guidance for such exercises, such as the DOD Cyber Strategy; Joint Publication 3-28; DOD Directive 3025.18, and Chairman of the Joint Chiefs of Staff Instruction 3500.01H Joint Training Policy for the Armed Forces of the United States. We compared DOD plans for exercises for supporting civil authorities in cyber incidents to these documents. We observed the Cyber Guard 2016 Legal/Policy Tabletop Exercise held in February 2016 in Laurel, Maryland. To learn about DOD challenges in conducting exercises and planning for exercises of civil support in cyber incidents over the next few years, we interviewed officials from ODASD for Cyber Policy, National Guard Bureau, U.S. Northern Command, and U.S. Cyber Command.

We conducted this performance audit from June 2015 to September 2016 in accordance with generally accepted government auditing standards.

Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Defense

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact above, key contributors to this report included Tommy Baril (Assistant Director), Tracy Barnes, David Beardwood, Kevin Copping, Patricia Farrell Donahue, Jamilah Moon, and Richard Powelson.

Related GAO Products

Civil Support: DOD Needs to Clarify Its Roles and Responsibilities for Defense Support of Civil Authorities during Cyber Incidents. GAO-16-332. Washington, D.C.: April 4, 2016.

Civil Support: DOD is Taking Action to Strengthen Support of Civil Authorities. GAO-15-686T. Washington, D.C.: June 10, 2015.

Cybersecurity: Actions Needed to Address Challenges Facing Federal Systems. GAO-15-573T. Washington, D.C.: April 22, 2015.

Information Security: Agencies Need to Improve Cyber Incident Response Practices. GAO-14-354. Washington, D.C.: April 30, 2014.

Information Security: Federal Agencies Need to Enhance Responses to Data Breaches. GAO-14-487T. Washington, D.C.: April 2, 2014.

Civil Support: Actions Are Needed to Improve DOD’s Planning for a Complex Catastrophe, GAO-13-763. Washington, D.C.: September 30, 2013.

Homeland Defense: DOD Needs to Address Gaps in Homeland Defense and Civil Support Guidance. GAO-13-128. Washington, D.C.: October 24, 2012.

Defense Cyber Efforts: Management Improvements Needed to Enhance Programs Protecting the Defense Industrial Base from Cyber Threats. GAO-12-762SU. Washington, D.C.: August 3, 2012.

Information Security: Cyber Threats Facilitate Ability to Commit Economic Espionage. GAO-12-876T. Washington, D.C.: June 28, 2012.

Cybersecurity: Threats Impacting the Nation. GAO-12-666T. Washington, D.C.: April 24, 2012.