Critical Infrastructure: DHS Needs to Refocus Its Efforts to Lead the Government Facilities Sector
Released: 2012-09-12T00:00:00

Letter

Background

In 2003, HSPD-7 established a national policy for critical infrastructure and key resources. HSPD-7 designated DHS as the agency responsible for coordinating the nation’s efforts to protect critical infrastructure. The Office of Infrastructure Protection (IP) within DHS fulfills the functions associated with managing and coordinating the national protection efforts. In June 2006, DHS issued the first NIPP as required by HSPD-7. The NIPP provides a risk management framework and sector partnership model for developing, implementing, and maintaining a coordinated national effort to manage the risks to critical infrastructure.

FPS is the lead agency for the government facilities sector (the sector), and assumes multiple roles and responsibilities for the sector, which is comprised of a wide variety of facilities and assets owned or leased by federal, state, local, tribal, or territorial governments, located both domestically and overseas. Under the NIPP risk management framework, FPS is responsible for leading and coordinating six major elements sector-wide to identify, prioritize, and measure progress towards protecting critical infrastructure. See figure 1.

Additionally, the NIPP sector partnership model calls on FPS to form and chair a government coordinating council comprised of representatives from different levels of government to share activities, policy, and FPS also participates in or interacts with the following communications.cross-sector councils, which facilitate relationships within and among the 18 sectors:

The State, Local, Tribal, and Territorial Government Coordinating Council (SLTTGCC), which coordinates with non-federal government organizations across all 18 sectors; the Regional Consortium Coordinating Council, which represents a variety of distinct collaborative efforts between state, local, and private sector partners focused on critical infrastructure found in multistate regions or within a given city; the NIPP Federal Senior Leadership Council, which is a DHS-chaired council that consists of federal department and agency representatives from lead agencies named in HSPD-7; and the Critical Infrastructure Partnership Advisory Council, which is a partnership between government and private sector owners and operators of critical infrastructure to effectively coordinate federal protective programs.

The NIPP requires each lead agency to develop and revise a sector- specific plan that addresses critical infrastructure protection. FPS has responsibility for updating the plan to adequately represent the sector and involve Council members. Every 4 years, FPS must: identify gaps between the plan and guidance from IP, policy changes, and best practices; identify and develop a consolidated list of actions required to close gaps; obtain, and incorporate input from sector partners and the Council in obtain final approval from IP and release the plan to sector partners and the Council.

FPS and DHS issued the first sector-specific plan in 2007 and an update to the plan in 2010, in which they identified goals and objectives for the sector, shown in table 1.

As the lead agency, HSPD-7 also requires FPS to provide the Secretary of Homeland Security with annual reports to assess progress and effectively prioritize sector-specific activities and gaps, among other things. This process involves consulting the Council, similar to the 2010 update to the plan.

FPS’s role as the lead agency for the sector is an additional duty beyond its traditional role of protecting over 9,000 owned or leased facilities under the custody and control of GSA. As part of its mission, FPS conducts risk assessments, recommends countermeasures, and performs law enforcement activities, such as incident response. FPS’s activities are funded by security fees collected from tenant federal agencies. As such, FPS charges each tenant agency a basic security fee per square foot of space occupied in a GSA facility, among other fees.

The Interagency Security Committee (ISC), which was established in 1995, develops policies and standards and facilitates security-related information exchanges. While domestic non-military federal facilities— whether federally owned, leased, or managed—are required to adhere to the ISC standards, these standards do not apply to state, local, tribal, and territorial government facilities. ISC membership consists of over 100 senior executives from 51 federal agencies and departments, including FPS. DHS is responsible for chairing the ISC and is authorized to monitor federal agencies’ adherence to ISC standards.

FPS Is Not Effectively Leading the Sector

FPS’s leadership has not resulted in implementation of a risk management approach for the sector, as called for under the NIPP framework. Specifically, a lack of facilities data, risk assessments, and effective metrics and performance data undermine the implementation of a risk management approach. Under FPS’s leadership, effective partnerships have also not developed. FPS faces challenges in leading the sector linked to the sector’s size, diversity, and FPS’s fee-based revenue structure. These challenges are compounded by the lack of an action plan.

No Overarching Risk Management Approach in Place

Lack of facilities data: Asset identification is a crucial element for risk management as outlined by both the NIPP framework and the 2010 plan. According to the 2010 plan, the sector’s assets and systems must be identified to determine which of these, if damaged, would result in significant consequences for national economic security, public health or safety, morale, or governance. The 2010 plan also states that identifying and obtaining appropriate data on government facilities located domestically and overseas is a sector objective. However, FPS officials said that they have not identified or obtained data on federal, state, local, tribal and territorial government facilities for the sector. According to FPS officials, developing sector-wide data may be untenable and unwarranted, because most federal, state, local, tribal, and territorial government facilities do not meet the threshold established by IP for the most critical infrastructure and government facilities generally remain the same year after year. Yet, the 2010 plan states that several circumstances may require frequent updates to data on government facilities, including changes in threat levels, large-scale facility renovations, or the identification of a facility as supporting a nationally critical function or critical asset. Moreover, the 2011 annual report states that functions carried out in one government facility often directly support the functions under way in many other government facilities. Thus, an incident at one facility could have cascading impact across a range of functions essential to governance. Without appropriate data on government facilities, FPS has limited awareness of the potentially evolving universe of government facilities as well as the interdependencies that may exist in the sector. As a result, FPS may be overlooking facilities whose failure or degradation could pose significant harm to the nation’s security, health, economy, or morale.

While FPS officials said that they have neither identified nor obtained data on the sector, FPS has contributed to the development of a database maintained by IP, the IP Gateway / Infrastructure Information Collection System. IP uses this database to identify critical infrastructure assets and systems. According to FPS officials, they periodically review and cross reference the information contained within the database against the dataset that FPS uses as part of its role of protecting federal facilities. However, FPS’s data do not encompass the full spectrum of sector facilities, in particular non-federal facilities. In addition, we have previously identified problems with FPS’s data, such as a lack of data on building jurisdictional authorities. Consequently, FPS’s efforts to corroborate the data contained within the IP Gateway / Infrastructure Information Collection System are undermined by the limited scope and quality of its data. To the extent that the IP Gateway / Infrastructure Information Collection System is used to prioritize critical infrastructure, this effort may also be detrimentally affected by weaknesses in FPS’s data.

No sector-wide risk assessments: FPS is not currently positioned to assess risk across the sector. Assessing risks and coordinating risk assessment programs are another key element of the NIPP framework and a sector objective. The plan and annual reports provide information about the principles of threat, vulnerability, and consequence as well as discuss different types of risks and threats faced by government facilities, but no standardized tool for performing risk assessments exists at the federal level, much less the state, local, tribal, and territorial levels. FPS promoted its Risk Assessment and Management Program (RAMP) as a risk assessment tool in the 2010 plan and sector annual reports, as well as in past Council meetings. However, the scope of RAMP was not originally intended to address non-federal facilities and has never become fully operational. Therefore, its usefulness as a sector-wide risk assessment tool is not clear. In fact, RAMP has been terminated according to a senior FPS official, and FPS is working on developing a replacement. According to this official, a new risk assessment tool and methodology will be released for use by sector partners at a future, unspecified date. FPS officials acknowledged the absence of a sector- wide risk assessment. Without this, FPS cannot prioritize facilities or implement protective programs, both activities predicated on effective risk assessment.

No effective metrics and performance data: FPS has not established effective metrics and performance data, which hampers its ability to monitor the sector’s progress toward the sector goal of implementing a long-term government facility risk management program as described in the 2010 plan. An effective metric is one that can adequately indicate progress toward a goal and that is objective, measureable, and quantifiable. Data to track metrics need to be sufficiently timely, complete, accurate, and consistent. Further, DHS has established guidance on metrics to assess improvements in the protection and resiliency of critical infrastructure, which lead agencies can use to guide these efforts in their respective sectors. We have reported that without effective performance data, decision makers may not have sufficient information to evaluate whether investments have improved security and reduced a facility’s vulnerability, or to determine funding priorities within and across agencies.

In 2000, FPS transitioned all alarm-monitoring and dispatching capabilities from several regional control centers to four MegaCenters. Currently, each MegaCenter monitors multiple types of alarm systems, closed circuit television, and wireless dispatch communications within federal facilities throughout the nation. These centers—located in Michigan, Colorado, Pennsylvania, and Maryland—are equipped with state-of-the-art communication systems and operate continuously. terms of timeliness, completeness, accuracy, or consistency. Until it establishes quantifiable metrics and performance data, FPS will be unable to gauge progress toward implementing a risk management approach, specifically, and the protection or resiliency of critical government facilities, overall.

FPS Has Not Built Effective Partnerships across Different Levels of Government

To effectively implement the NIPP and achieve the goals of the sector, partnerships are essential. As previously discussed, the NIPP sector partnership model integrates partners into the planning and operational activities for a collaborative approach to the protection of critical infrastructure. Likewise, the 2010 plan places a significant emphasis on the role of partnerships. However, of the 16 Council members we contacted, 13 indicated that they had little or no involvement in developing the sector plan and annual reports, and for at least 8 agencies these documents were of negligible value. To offset low Council member response, FPS officials reported relying on open source information (e.g., annual federal budget) to develop the annual report. Relying primarily on open source information does not fully or effectively leverage the knowledge and experience of Council members, potentially undermining the value of the plan as a means to promote collaboration in critical infrastructure protection. Consequently, this key coordination goal of the 2010 plan has not been met, and as a result, FPS is limited in its ability, as lead agency for the sector, to productively contribute to the larger DHS effort to prioritize and safeguard the nation’s most critical infrastructure. FPS’s role as lead agency for the government facilities sector is particularly critical because according to the 2011 annual report, government facilities have been the most frequently attacked sector since 1968 and the sector involves a very dynamic threat environment. FPS’s compilation of reports that hold little value for sector partners, leaves FPS and its sector partners less able to engage in a comprehensive risk management framework that addresses this threat environment.

Furthermore, while FPS chairs the Council, the principle mechanism for engaging partners, FPS has not involved the full spectrum of sector partners. FPS officials said that they use an informal process to manage the Council membership and have repeatedly reported that they actively seek to add members to expand state and local representation. Of the Council members identified by FPS, 21 of the 26 are federal agencies, 3 are state or local agencies, and 2 are non-governmental organizations. Officials from all 5 state and local government and non-governmental organizations told us that they were either unaware or did not consider themselves to be members of the Council. Furthermore, the Council currently has no representation from tribal and territorial governments. Having active representation from state, local, tribal, and territorial governments on the Council would be particularly helpful, given that FPS’s interaction with the cross-sector councils that represent these perspectives has been limited or non-existent. As previously discussed, the SLTTGCC provides all 18 sectors a mechanism to coordinate with non-federal government organizations. According to the 2010 plan, the SLTTGCC had liaisons who were fully integrated into the Council. However, both SLTTGCC officials and FPS officials indicated that there has been limited interaction. During our review, FPS reached out to the SLTTGCC to discuss opportunities to increase partnering activities. FPS officials reported having never worked with the Regional Consortium Coordinating Council, which includes state and local government representatives. With limited representation on the Council and little or no interaction with certain cross-sector councils, the sector is missing opportunities to engage and integrate the experience, knowledge, and priorities of state, local, tribal and territorial partners into the plan to help ensure buy-in for protecting critical infrastructure across all levels of government.

Moreover, the Council has become progressively less active over the years. According to the 2011 annual report, the lead agency convenes Council meetings quarterly and communicates information about threats, incidents, and effective protection-related practices to sector partners. However, Council members indicated that the frequency of meetings has steadily declined over the years. In 2011, FPS held only one meeting in January; its next meeting was held in May 2012. No working groups or other activities occurred in the interim. At the 2011 meeting, there was a total of four non–DHS Council members who attended. FPS’s May 2012 Council meeting may have reflected increased interest, with 14 agencies other than DHS in attendance. However, only one attendee represented state, local, tribal or territorial governments; all other attendees were from federal agencies. FPS officials acknowledged that participation of Council members has been decreasing every year. Most Council members representing federal agencies said that interaction with the sector had not been helpful since their agencies actively participate in the ISC, which provides the guidance their agencies need to meet federal physical security standards. Nevertheless, some Council members said that the sector was valuable as a resource for coordinating security activities and potentially developing a uniform risk assessment tool. Since the sector covers a larger and broader set of government facilities than the ISC— such as military, state, local, tribal and territorial facilities—the potential benefits of collaboration, as discussed earlier, could lead to a more comprehensive approach to protecting critical government facilities.

FPS’s Capacity to Lead the Sector Hindered by Its Fee Structure and Lack of Action Plan

FPS has identified its limited resources as a significant challenge to leading a sector as large and diverse as the government facilities sector. The 2010 plan states that the sector includes more than 900,000 federal assets, as well as assets from 56 states and territories; more than 3,000 counties; 17,000 local governments; and 564 federally recognized tribal nations. In addition, these facilities represent a wide variety of uses, both domestically and overseas, ranging from office buildings and courthouses to storage facilities and correctional facilities. FPS officials indicated that they have very limited staffing and no dedicated line of funding for activities related to leading the sector, and it was unclear if FPS’s security fees could be used to cover the costs of serving as the lead agency for the sector. Because of limited resources, FPS officials said that they could only meet the NIPP’s minimum reporting requirements and did not engage in other activities that could address the issues discussed earlier. For example, FPS officials said that they abandoned efforts related to strategic communications and marketing as described in the 2010 annual report, aimed at increasing awareness and participation across the sector because of resource constraints. FPS reported in 2010 that it did not have the capability to plan for any sector-specific agency investments. In 2011, FPS had less than one full-time equivalent employee engaged in sector- specific agency activities, which represents a decline from prior years when FPS had a full-time equivalent employee and several contract employees assisting with its sector responsibilities.

As discussed above, FPS is funded using a fee-based structure in which it collects funds from federal tenant agencies for security and protective services. We have previously reported that FPS’s involvement in homeland security activities not directly related to facility protection is inconsistent with a requirement in the Homeland Security Act of 2002 that FPS use funding from the fees it collects solely for the protection of federal government buildings and grounds. We recommended to DHS that if FPS continues its involvement in activities not directly related to the protection of federal buildings and grounds, a funding process would be needed that is consistent with the requirement regarding the use of funds from agency rents and fees.

Notwithstanding issues related to how its fees may be used, FPS has not fully assessed the resource requirements for serving as the lead sector agency, because it has not completed an action plan or cost estimate for carrying out the 2010 plan. The 2010 plan states that determining the sector’s priorities, program requirements, and funding needs for government facility protection is a sector objective. FPS previously reported it was developing an action plan to guide its implementation of the 2010 plan, but according to FPS officials, they are no longer pursuing this, because identifying steps FPS can and will take is difficult without knowing what funding or resources are available. FPS officials also told us that they originally estimated the cost of serving as the lead agency to be around $1 million, but did not provide us with the analysis to support this estimate.

According to DHS officials, HSPD-7 is in the process of being updated to reassess how the NIPP and the sectors are overseeing the protection of critical infrastructure, which may result in the sector being restructured. For example, according to DHS, GSA, and Department of the Interior officials, GSA will become a co-lead agency, the monuments and icons sector will be subsumed within the government facilities sector, and an executive committee that includes the ISC may be formed to help advise the sector. Such changes may affect FPS’s workload and resources as the lead agency.

An action plan could help FPS and DHS refocus efforts in the sector. We have recommended that agencies leading intergovernmental efforts use an action plan to establish priorities, provide rationale for resources, and to propose strategies for addressing challenges.enable FPS and DHS to manage change by prioritizing the activities required of the sector’s lead agency and identifying those activities that can be feasibly carried out by FPS given its current resource constraints. An action plan may also be useful to FPS for justifying additional resources, which may help address the challenge posed by its fee-based revenue structure.

Conclusions

FPS is responsible for leading efforts to identify, prioritize, and protect critical government facilities across all levels of government under the NIPP. The loss of critical government facilities and the people who work in them because of terrorism, natural hazards, or other causes could lead to catastrophic consequences. The lack of facility information, the absence of sector-wide risk assessments, and ineffective metrics and data undermine the implementation of a risk management approach as outlined by the NIPP risk management framework and envisioned in the 2010 plan. In addition, FPS has not effectively employed the NIPP sector partnership model to engage the Council and represent the depth, breadth, and interests of the sector, particularly non-federal partners. Consequently, key goals of the 2010 plan have not been met, and FPS is limited in its ability to productively contribute to the larger DHS effort to prioritize and safeguard the nation’s most critical infrastructure. According to DHS officials, structural changes to the sector may already be under way. Yet, FPS and DHS do not have an informed understanding of the priorities and resources needed to fulfill the lead agency responsibilities, and structural changes may affect these priorities and available resources. An action plan could serve as a valuable tool for FPS and DHS to identify, in tandem with any structural changes, priorities that can be feasibly achieved and the associated resource requirements given FPS’s fee-based revenue structure. This may, in turn, help address the overall limited progress made to date in the sector with implementing a risk management approach and developing effective partnerships.

Recommendation for Executive Action

To enhance the effectiveness of the government facilities sector, we recommend that the Secretary of DHS direct FPS, in partnership with IP and Council members, to develop and publish an action plan that identifies sector priorities and the resources required to carry out these priorities. With consideration of FPS’s resource constraints, this plan should address FPS’s limited progress with implementing a risk management approach and developing effective partnerships within the sector. The plan should address, at a minimum, steps needed to: 1. develop appropriate data on critical government facilities; 2. develop or coordinate a sector-wide risk assessment; 3. identify effective metrics and performance data to track progress toward the sector’s strategic goals; and 4. increase the participation of and define the roles of non-federal Council members.

Agency Comments

We provided a draft report to DHS, GSA, Department of Education, Department of Health and Human Services, Department of State, National Archives and Records Administration, National Aeronautics and Space Administration, National Institute of Standards and Technology, Department of the Interior, Environmental Protection Agency, and Department of Justice. DHS concurred with our recommendation to develop and publish an action plan for the sector. DHS’s full comments are reprinted in appendix II. The National Archives and Records Administration also agreed with our findings. DHS, GSA, and the National Institute of Standards and Technology provided technical comments, which we considered and incorporated, where appropriate. The other agencies did not provide comments on our draft report.

As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after its issue date. At that time, we will send copies of this report to the Secretary of Homeland Security, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov.

If you or your staffs have any questions on this report, please contact me at (202) 512-2834 or GoldsteinM@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Contact information and key contributors to the report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

To assess the Federal Protective Service’s (FPS) leadership of the government facilities sector, we reviewed Homeland Security Presidential Directive 7, Department of Homeland Security’s (DHS) National Infrastructure Protection Plan (NIPP), and the 2010 Government Facilities Sector-Specific Plan (the 2010 plan). Based on these documents, we identified the implementation of a risk management approach and development of effective partnerships as two key activities of the NIPP and the 2010 plan that lead agencies are responsible for. These activities form the foundation for identifying, prioritizing, and protecting critical infrastructure. We reviewed the outcomes reported in the 2010 and 2011 sector annual reports to determine FPS’s actions, and identified gaps between these actions and the goals and activities in the 2010 plan. We reviewed prior GAO reports and DHS Office of Inspector General reports on critical infrastructure to identify any challenges that FPS faces in leading the implementation of the 2010 plan and key practices on establishing performance metrics and interagency collaboration.

In addition, we interviewed FPS officials in Washington, D.C., about the 2010 plan, its sector-related activities as the lead agency, and any challenges to implementing the plan. We interviewed DHS officials from the Office of Infrastructure Protection and Interagency Security Committee about their role as sector partners and their interaction with FPS as the lead agency. We also interviewed members from the sector’s Council about their role and participation in the Council and their interaction with FPS. We selected 16 of the 26 members of the Council based on several criteria, including their level of activity as determined by contributions to the 2010 plan and sector annual reports, or participation in the 2011 Council meeting, and all 5 of the state and local government members, and non-governmental organization members. Among federal members of the Council, we also selected federal agencies that served as the lead agencies for the monuments and icons sector, water sector, commercial facilities sector, and education subsector, and federal executive branch agencies with expertise in law enforcement or physical security applicable to the protection of government facilities.

We conducted this performance audit from December 2011 to August 2012 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Homeland Security

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the individual named above, David Sausville, Assistant Director; Friendly Vang-Johnson; Jennifer DuBord; Delwen Jones; Steven Putansu; and Kathleen Gilhooly made key contributions to this report.

Related GAO Products

Federal Protective Service: Better Data on Facility Jurisdictions Needed to Enhance Collaboration with State and Local Law Enforcement. GAO-12-434. Washington, D.C.: March 27, 2012.

Federal Protective Service: Actions Needed to Resolve Delays and Inadequate Oversight Issues with FPS’s Risk Assessment and Management Program. GAO-11-705R. Washington, D.C.: July 15, 2011.

Homeland Security: Protecting Federal Facilities Remains a Challenge for the Department of Homeland Security’s Federal Protective Service. GAO-11-813T. Washington, D.C.: July 13, 2011.

Budget Issues: Better Fee Design Would Improve Federal Protective Service’s and Federal Agencies’ Planning and Budgeting for Security. GAO-11-492. Washington, D.C.: May 20, 2011.

Homeland Security: Ongoing Challenges Impact the Federal Protective Service’s Ability to Protect Federal Facilities. GAO-10-506T. Washington, D.C.: March 16, 2010.

Homeland Security: Greater Attention to Key Practices Would Improve the Federal Protective Service’s Approach to Facility Protection. GAO-10-142. Washington, D.C.: October 23, 2009.

Homeland Security: Federal Protective Service Has Taken Some Initial Steps to Address Its Challenges, but Vulnerabilities Still Exist. GAO-09-1047T. Washington, D.C.: September 23, 2009.

Homeland Security: The Federal Protective Service Faces Several Challenges That Hamper Its Ability to Protect Federal Facilities. GAO-08-683. Washington, D.C.: June 11, 2008.

Homeland Security: Preliminary Observations on the Federal Protective Service’s Efforts to Protect Federal Property. GAO-08-476T. Washington, D.C.: February 8, 2008.

Homeland Security: Guidance and Standards Are Needed for Measuring the Effectiveness of Agencies’ Facility Protection Efforts. GAO-06-612. Washington, D.C.: May 31, 2006.

Homeland Security: Further Actions Needed to Coordinate Federal Agencies’ Facility Protection Efforts and Promote Key Practices. GAO-05-49. Washington, D.C.: November 30, 2004.

Homeland Security: Transformation Strategy Needed to Address Challenges Facing the Federal Protective Service. GAO-04-537. Washington, D.C.: July 14, 2004.

Critical Infrastructure Protection

Critical Infrastructure Protection: DHS Has Taken Action Designed to Identify and Address Overlaps and Gaps in Critical Infrastructure Security Activities. GAO-11-537R. Washington, D.C.: May 19, 2011.

Critical Infrastructure Protection: DHS Efforts to Assess and Promote Resiliency Are Evolving but Program Management Could Be Strengthened. GAO-10-772. Washington, D.C.: September 23, 2010.

Critical Infrastructure Protection: Update to National Infrastructure Protection Plan Includes Increased Emphasis on Risk Management and Resilience. GAO-10-296. Washington, D.C.: March 5, 2010.

The Department of Homeland Security’s (DHS) Critical Infrastructure Protection Cost-Benefit Report. GAO-09-654R. Washington, D.C.: June 26, 2009.

Influenza Pandemic: Opportunities Exist to Address Critical Infrastructure Protection Challenges That Require Federal and Private Sector Coordination. GAO-08-36. Washington, D.C.: October 31, 2007.

Critical Infrastructure: Sector Plans Complete and Sector Councils Evolving. GAO-07-1075T. Washington, D.C.: July 12, 2007.

Critical Infrastructure Protection: Sector Plans and Sector Councils Continue to Evolve. GAO-07-706R. Washington, D.C.: July 10, 2007.

Critical Infrastructure: Challenges Remain in Protecting Key Sectors. GAO-07-626T. Washington, D.C.: March 20, 2007.

Critical Infrastructure Protection: Progress Coordinating Government and Private Sector Efforts Varies by Sectors’ Characteristics. GAO-07-39. Washington, D.C.: October 16, 2006.

Information Sharing: DHS Should Take Steps to Encourage More Widespread Use of Its Program to Protect and Share Critical Infrastructure Information. GAO-06-383. Washington, D.C.: April 17, 2006.