Critical Infrastructure Protection: More Comprehensive Planning Would Enhance the Cybersecurity of Public Safety Entities' Emerging Technology
Released: 2014-01-28T00:00:00

Letter

Background

The 911 emergency call system is intended to give individuals a simple, easy-to-remember, routinely available number that can be used to reach an appropriate public safety provider during any life-threatening situation. Using a landline, wireless, mobile telephone, or voice over internet protocol (VoIP) system, a caller dials 911 and the call is routed to a communications provider facility that automatically forwards the call to a public safety entity such as a PSAP. Next, the call taker/dispatcher talks to the caller to determine the nature of the emergency and to determine the necessary first responders, while working to send (or dispatch) the appropriate first responders to the location. According to the National Emergency Number Association, there are more than 6,000 PSAPs nationwide, at a county or city level, that answer more than 240 million 911 calls each year. Figure 1 illustrates the public safety communications and dispatch system, including how an emergency call is typically placed, received, and processed.

As illustrated in figure 1, once a 911 caller places an emergency call, the communications provider receives and routes the call to the appropriate PSAP. The system used to route the call depends on the type of telephone used to make the 911 call. Specifically, for a call placed from a landline, a router in the provider’s central facility receives the 911 call and accesses the Automatic Number Identification database to associate the identifier with the phone number to determine the caller’s address. Then, based on the location information, the provider’s Master Street Address Guide database identifies the appropriate PSAP to receive the call. When a cell phone is used, the location information is typically provided to the PSAP through either cell tower triangulation technology or by Global Positioning System technology. When using VoIP, where calls are carried over digital subscriber lines, cable modems, or other Internet access methods, the caller needs to register the address of the VoIP device in advance. Current telecommunications and PSAP technology associate the voice and data transmission with the identifier and location databases and, based on the caller’s location, routes the call to the appropriate PSAP.

When the caller’s phone number, address, and voice are routed to the appropriate PSAP, the call is automatically delivered with the phone number and location. The trained 911 call taker/dispatcher assists the caller and inputs information into additional IT systems and infrastructure to begin the emergency response. For example, the call taker/dispatcher may enter information into a computer-aided dispatch system. These systems automate the call-taking process, provide questions and responses for various scenarios, and send the first responders. Based on the information put into the system by the call taker/dispatcher, the computer-aided dispatch system interfaces with other systems for identification and address, ascertains the nature of the assistance needed, and transmits the information to the appropriate first responder. To provide assistance to the first responder, the call taker/dispatcher may also be able to use geospatial tools and systems that provide information on utility placement, government facility types and locations, property plats, mapping data, and aerial photographs. In addition, call takers may use criminal justice information databases, Internet access, automated vehicle locators to select the closest first responder, and radio and telecommunications services to share and receive information as the situation warrants.

While a PSAP is to be available on a 24-hours, 365 day-a-year basis, an emergency operations center, as noted, is typically only activated during an environmental emergency or special event. It provides a single location for key decision makers from state, local, and federal agencies and multiple jurisdictions to gather and to react to events too complex or too large for regular offices or communications centers or single government agencies or jurisdictions to handle. From a single location, the officials can support on-scene incident commanders (such as fire, police, and emergency medical personnel), prioritize the allocation of resources, collaborate on strategy and tactics, and manage the fiscal and social consequences of an incident.

Emergency operations centers require the same variety of information and communications technology used by PSAPs to fulfill their mission: Internet access, telecommunications services, geospatial tools, and radio systems. In addition, these centers have access to and use public alerting and warning systems to disperse information to citizens, such as sending messages to registered devices (mobile telephones, pagers, electronic mail, etc.), sirens, public address systems, and, in some cases, reverse 911 or similar products that can send warnings to entire communities when the need arises.

Next Generation of Public Safety Communications Will Be Even More Reliant on IT

Public safety entities are undergoing the process of implementing the next generation of 911 services (known as NG 911) to, among other things, improve their capabilities to communicate with callers, increase resiliency of their 911 operations, and enhance information sharing among first responders. NG 911 is expected to use Internet protocol- based, broadband technology that is capable of carrying voice plus large amounts of varying types of data, such as instant messaging, wireline calls, VoIP calls, photographs, live video feeds from an emergency scene, and “telematics” (such as advanced automatic crash notification data collected from the vehicle’s computer system). Some states have implemented NG 911 functionality in selected PSAPs in order to ascertain technology requirements and cybersecurity implications with the intention of using multiple releases to eventually move to full NG 911 capability. For example, in 2011, California began conducting multiple pilots to evaluate different technology platforms for its NG 911 operations such as hosted or cloud-based technology. In 2012, Vermont completed a 6- month pilot accepting text messages in lieu of voice 911 calls from a wireless carrier. Vermont has also implemented a statewide 911 system that transmits 911 calls to PSAPs using VoIP for its emergency services network.

In addition, the Middle Class Tax Relief and Job Creation Act of 2012 required the National Telecommunications and Information Administration (NTIA) and Transportation’s National Highway Traffic Safety Administration to create a program to improve emergency communications throughout the country by facilitating coordination and communication among federal, state, and local emergency communications systems, emergency personnel, public safety organizations, telecommunications providers, and telecommunications equipment manufacturers and vendors involved in the implementation of 911 services. The act established FirstNet as an independent authority within the NTIA to develop a single nationwide, interoperable public safety broadband network. The FirstNet network is intended to give users functionality beyond current radio communications such as access to video images of a crime in progress, downloaded floor plans of a burning building, and rapid connection with first responders from other communities. The network is expected to be IP-based and interface with commercial networks to transmit voice, text, photographic, video, and other digital data between PSAPs and first responders using interoperable mobile devices and leveraging NG 911 technology.

As of October 2013, the FirstNet network requirements had not been developed; however, the Middle Class Tax Relief and Job Creation Act of 2012 required functionality to include public Internet connectivity over commercial wireless networks or the public switched telephone network. The act also required that FirstNet’s network development ensure the safety, security, and resiliency of the network, including requirements for protecting and monitoring the network to defend against cyberattack. The act does not specify time frames for completing implementation of the network.

Threats to Public Safety Cyber Infrastructure

Like threats affecting other critical infrastructures, threats to the public safety IT infrastructure can come from a wide array of sources. For example, advanced persistent threats—where adversaries possess sophisticated levels of expertise and significant resources to pursue their objectives—pose increasing risk. Other sources include corrupt employees, criminal groups, hackers, and terrorists. These threat sources vary in terms of the capabilities of the actors, their willingness to act, and their motives, which can include monetary or political gain or mischief, among other things. Table 1 describes the sources of cyber-based threats in more detail.

These sources of cyber threats may make use of various cyber techniques, or exploits, to adversely affect communications networks, and could negatively impact Internet-protocol based NG 911 and FirstNet networks. Types of exploits include denial-of-service attacks, phishing, passive wiretapping, Trojan horses, viruses, worms, and attacks on the IT supply chains that support the communications networks. Table 2 describes the types of exploits in more detail.

In addition to cyber-based threats, the nation’s public safety entities also face threats from physical sources. Examples of these threats include natural events (e.g., hurricanes or flooding) and man-made disasters (e.g., terrorist attacks), as well as unintentional man-made outages (e.g., a backhoe cutting a communication line). For example, after a major storm in June 2012, several cities and counties in Virginia experienced a total outage of telephone service supporting 911 that continued for 5 days. The loss of commercial power and the subsequent failure of one of the two backup generators in the common carrier’s facilities were the predominant causes of the service outage. In addition, the lack of physical diversity in the telephone circuits supporting 911 and the failure to monitor the telephone circuits contributed to the disruption of PSAP operations during the outage.

While not related to public safety entities’ internal IT, these organizations, specifically PSAPs, have been the target of attacks and pranks. For example, in March 2013, the National Emergency Number Association reported that more than 200 telephony-based attacks had been identified. The attacks were part of an extortion scheme demanding payment for an outstanding debt to be paid to an individual or organization. When the request was not paid, the perpetrator launched an attack that inundated the PSAP’s administrative, nonemergency lines with a continuous stream of calls for a lengthy period of time.

In addition, PSAPs have received false emergency calls from pranksters who use Internet protocol-based telephone technology to camouflage the source of the call. In these cases, a caller reported a serious incident in progress, such as an armed robbery or a home invasion, and a false address or location information make it appear that the call is coming from a different address. For example, in April 2013, news media reported that multiple celebrities’ homes were swarmed by police after fake 911 calls were made reporting a crime in progress involving people armed with guns or bombs. The incidents occupied public safety resources that otherwise could have been available to receive and respond to actual emergency calls.

Identified Federal Agencies Are to Support and Coordinate with State and Local Governments Regarding Cybersecurity Efforts

Although state and local governments are responsible for the operation and cybersecurity of their public safety entities, federal law, policy, and plans specify roles and responsibilities for the Departments of Homeland Security, Commerce, Transportation, and Justice and the Federal Communications Commission to support state and local governments’ cybersecurity efforts. These agencies are responsible for performing one or more of the following cybersecurity-related coordination roles and responsibilities: (1) supporting critical infrastructure protection-related planning, (2) issuing grants, (3) sharing information, (4) providing technical assistance, and (5) regulating and overseeing essential functions.

Department of Homeland Security

DHS is responsible for leading, integrating, and coordinating the implementation of efforts to protect the nation’s cyber-reliant critical infrastructures. The Homeland Security Act of 2002 created DHS and, among other things, assigned it the following critical infrastructure protection responsibilities: (1) developing a comprehensive national plan for securing the critical infrastructures of the United States, (2) recommending measures to protect those critical infrastructures in coordination with other groups, and (3) disseminating, as appropriate, information to assist in the deterrence, prevention, and preemption of, or response to, terrorist attacks. In addition, under the act, DHS is required to provide to state and local government entities analysis and warnings related to threats and vulnerabilities to their critical information systems, crisis management support in response to threats or attacks, and technical assistance with emergency recovery plans for critical information systems.

In 2003, Homeland Security Presidential Directive 7 (HSPD-7) established DHS as the principal federal agency to lead, integrate, and coordinate the implementation of efforts to protect cyber-critical infrastructures and key resources. In addition, HSPD-7 identified lead federal agencies, referred to as sector-specific agencies, that are responsible for coordinating critical infrastructure protection efforts with the public and private stakeholders in their respective sectors.

In 2009, in accordance with the Homeland Security Act, DHS issued the National Infrastructure Protection Plan (NIPP). The plan sets forth a risk management framework and details the roles and responsibilities of DHS in protecting the nation’s critical infrastructures; identifies agencies with lead responsibility for coordinating with the sectors (or sector-specific agencies); and specifies how other federal, state, regional, local, tribal, territorial, and private-sector stakeholders should use risk management principles to prioritize protection activities within and across sectors. As the sector-specific agency for the emergency services sector, DHS is to coordinate protective programs and resilience strategies for the sector. The emergency services sector is comprised of assets, systems, and networks supporting law enforcement, fire and emergency services, emergency management, emergency medical services, and public works functions at the state, local, tribal, and territorial levels of government.

Based on NIPP, DHS is tasked with, among other things, updating the sector-specific plans, coordinating sector training, and maintaining information-sharing mechanisms. DHS is to collaborate with public- and private-sector stakeholders through government and sector coordinating councils to develop and implement the sector-specific plan in order to identify and protect critical infrastructure assets. In addition, DHS is responsible for the state, local, tribal, and territorial cybersecurity engagement program, which was established to build partnerships with non-federal public stakeholders including governors, mayors, state homeland security advisors, chief information officers, and chief information security officers, in order to advance the department’s mission in protecting critical network systems and ensuring the use of the Internet as a resource to connect with citizens.

In February 2013, Presidential Policy Directive 21 directed the Secretary of Homeland Security to update NIPP by October 2013. However, it states that all plans remain in effect until specifically revoked or superseded. It also revoked HSPD-7 but continued to identify DHS as the sector-specific agency for the emergency services sector. The directive also identified sector-specific agency roles and responsibilities for their respective sectors to include (1) coordinating with federal agencies and collaborating with state, local, territorial, and tribal entities; (2) serving as a day-to-day federal interface for the prioritization and coordination of activities; (3) carrying out, consistent with law and policy, incident management; and (4) supporting sector identification of vulnerabilities. DHS released an updated NIPP in December 2013.

Department of Commerce

Federal law and policy also establish a role for Commerce in protecting the nation’s communications networks. For example, the Telecommunications Authorization Act of 1992 established Commerce’s National Telecommunications and Information Administration (NTIA) as the principal presidential adviser on telecommunications and information policies. NTIA activities include administering grant programs that further the deployment and use of broadband and other technologies, and developing policy on issues related to the Internet economy, including cybersecurity.

In addition, as discussed previously, the Middle Class Tax Relief and Job Creation Act of 2012 required NTIA and Transportation’s National Highway Traffic Safety Administration to create a program to improve emergency communications throughout the country. The act established FirstNet as an independent authority within the NTIA to develop a single nationwide, interoperable public safety broadband network. FirstNet’s responsibilities include leading the development actions including obtaining grants and funds from and making contracts with, among others, private companies and federal, state, regional, and local agencies. In addition, FirstNet is also to ensure the safety, security, and resiliency of the FirstNet network, including requirements for protecting and monitoring the network to protect against cyber attack.

Department of Transportation

Based on provisions in the ENHANCE 911 Act of 2004 and Middle Class Tax Relief and Job Creation Act of 2012, Transportation, through the National Highway Traffic Safety Administration, coordinates 911 services at the federal, state, and local levels. Specifically, Transportation operates a program to facilitate coordination and communication between federal, state, and local emergency communications systems, emergency personnel, public safety organizations, telecommunications carriers, and telecommunications equipment manufacturers and vendors involved in the implementation of 911 services. Coordination activities include resources and technical assistance provided to state and local 911 authorities, such as grants supporting upgrades to PSAP equipment and operations and education about implementing new 911 technologies.

Department of Justice

The Federal Bureau of Investigation (FBI), under Justice, leads the nation’s efforts in investigating cyber-based crimes including computer intrusions and major cyber fraud. The FBI shares cyber-related information with state and local governments that could be law enforcement sensitive or classified. In particular, the FBI’s National White Collar Crime Center in partnership with the Internet Crime Complaint Center is to receive Internet-related criminal complaints; research, develop, and refer the criminal complaints to federal, state, local, and international law enforcement; and issue alerts to affected entities.

Federal Communications Commission

The Federal Communications Commission (FCC) regulates interstate and international communications by radio, television, wire, satellite, and cable throughout the United States. Agency officials stated that FCC is to promote the reliability, resiliency, and availability of the nation’s communications networks at all times, including in times of emergency or natural disaster. Further, it has the authority to adopt, administer, and enforce rules related to cybersecurity, communications reliability, and 911 and emergency alerting. Its regulations include requirements for certain communications providers to report on the reliability and security of communications infrastructures. These include requirements for reporting service disruptions and outages. For example, communications providers are required to report service outages and related issues that meet specific thresholds that affect public safety communications and emergency response.

Also, the FCC engages in public-private partnerships through federal advisory committees such as its Communications, Security, Reliability, and Interoperability Council. The Council develops and provides recommendations to the FCC regarding best practices and actions that can be taken to ensure optimal security, reliability, and interoperability of commercial and public safety communications systems. Among other efforts, the Council’s working group is responsible for assessing and making recommendations concerning technical standards, related technical gaps, and overall readiness of the legacy 911 system for accepting information generated by NG 911 applications. Working group members include representatives from federal, state, and local governments, the telecommunications industry, and industry associations.

In addition, the FCC is required by the Middle Class Tax Relief and Job Creation Act of 2012 to reallocate spectrum for use by public safety entities and to grant a license for that spectrum to FirstNet. Under the act, the FCC is required to establish an advisory board to develop recommended technical requirements to ensure a nationwide level of interoperability for the network. The board is to be known as the “Technical Advisory Board for First Responder Interoperability.” FCC is also required, in coordination with DHS and the National Highway Transportation Safety Administration, to make recommendations to Congress regarding the legal and statutory framework for NG 911 services to include security standards.

Presidential Policy Directive 21 requires that the FCC is to exercise its authority and expertise to partner with DHS, as well as other federal departments and agencies, to: (1) identify and prioritize communications infrastructure; (2) identify communications sector vulnerabilities and work with industry and other stakeholders to address those vulnerabilities; and (3) work with stakeholders, including industry, and engage foreign governments and international organizations to increase the security and resilience of critical infrastructure within the communications sector and facilitate the development and implementation of best practices promoting the security and resilience of critical communications infrastructure.

Identified Federal Agencies Have Had Limited Coordination with State and Local Governments Regarding Cybersecurity at Public Safety Entities

The five identified federal agencies have, to varying degrees, coordinated cybersecurity-related activities with state and local governments. Agencies’ activities include (1) supporting critical infrastructure protection- related planning, (2) issuing grants, (3) sharing information, (4) providing technical assistance, and (5) regulating and overseeing essential functions. However, except for supporting critical infrastructure planning, federal activities were generally not targeted towards or focused on public safety entities. For example, DHS collaborated with state and local governments through the Sector Coordinating Council to complete critical infrastructure planning efforts. Regarding grants to enhance emergency services, sharing cybersecurity-related information, providing technical assistance, and regulating and overseeing essential functions, federal agencies’ coordination activities with state and local governments were generally not targeted to public safety entities’ cybersecurity. However, federal agencies performed some coordination-related activities directed to public safety entities, including issuing alerts about cyber-based attacks to public safety entities, performing risk assessments, providing technical assistance through education and awareness efforts, and administering grants that allowed for expenditures for IT equipment and cybersecurity tools.

DHS’s Critical Infrastructure Protection Planning Activities Address Cyber Risks in the Current Environment but Do Not Consider Planned Technology Initiatives

In accordance with NIPP, DHS coordinated with state and local governments through the Emergency Service Sector Coordinating Council to develop a draft plan to address the protection of emergency services sector critical infrastructure and key resources. During the process, DHS solicited and obtained input from federal and nonfederal stakeholders through the established government and sector coordinating councils. For example, FCC officials from the Public Safety and Homeland Security Bureau stated that they had coordinated with DHS and other federal entities in the development of the plan. In 2010, DHS issued the Emergency Services Sector-Specific Plan, which addresses, among other things, the cybersecurity of public safety entities such as PSAPs, emergency operations centers, and first responder agencies. The Emergency Services Sector Coordinating Council acknowledged within the plan that they had provided input during the development process and would work with the various partners to support implementation of the plan.

The Emergency Services Sector-Specific Plan identifies activities that the sector can take to mitigate the overall risk to key assets, systems, networks, or functions, and mitigate vulnerabilities or minimize the consequences associated with a terrorist attack or other incident. The Emergency Services Sector-Specific Plan lists protective programs and resilience strategies for the human, physical, and cyber-critical infrastructure supporting the sector that are available to members of the emergency services sector to assist them in protecting their critical assets. The cyber-related protective programs include homeland security grants, the cross-sector cybersecurity working group, and cyber exercises. The plan is intended to serve as a guide for the sector, including the public safety entities, to set protective program goals and objectives, identify assets, assess risks, prioritize infrastructure components and programs to enhance risk mitigation, implement protective programs, measure program effectiveness, and incorporate research and development of technology initiatives into sector planning efforts. For example, it states that the sector must be able to determine the hardware and software components critical to supporting the sector’s mission, including the computers, databases, and other IT assets. Further, DHS, through the plan, recognized the risk of cyber attack on PSAP systems, such as attacks on computer-aided dispatch systems and how such attacks would seriously impede the sector’s ability to react and respond swiftly to incidents.

In addition, the NIPP and the Emergency Services Sector-Specific Plan identified the need to assess risks to the sector. In 2012, DHS, based on a collaborative effort with state and local entities and the private sector, issued the Emergency Services Sector Cyber Risk Assessment, which documents DHS and sector subject matter experts’ evaluation of the threats, vulnerabilities, and consequences to the sector’s cyber infrastructure. The assessment identified intentional and unintentional threats including cyber-related threats that could disrupt or degrade a PSAP’s 911 service capabilities. For example, a cyber-related threat could target a computer-aided dispatch system or geospatial database, thus compromising the availability of geographical information and other technical support and reducing the effectiveness of the emergency response. The risk assessment also stated that vulnerabilities to the common carriers’ address and location databases are the responsibility of the common carriers and are not within the control of a PSAP. It further stated that the next step is to determine how identified risks should be addressed and will require continued public- and private-sector collaboration. Also, according to the risk assessment, the sector is to develop a strategy for mitigating risks throughout the sector. According to DHS officials responsible for emergency services sector activities, the strategy is scheduled for completion and approval by the end of the second quarter of fiscal year 2014.

While DHS and the Emergency Services Sector Coordinating Council addressed in the 2010 Emergency Services Sector-Specific Plan aspects of cybersecurity of the current environment, they did not address the development and implementation of NG 911 and the FirstNet network in public safety entities. According to the NIPP, sector-specific plans are to identify activities to mitigate overall risk to the key assets, systems, networks, or functions, and mitigate vulnerabilities or minimize the consequences associated with a terrorist attack or other incident. As the sector-specific agency, DHS is tasked with developing and updating the sector-specific plans in coordination with public and private sector stakeholders through government and sector coordinating councils.

However, DHS and the coordinating councils had not yet incorporated cybersecurity protections for NG 911 and the FirstNet network into the sector plan in part because the revision cycle had not occurred and FirstNet was not established until 2012. According to DHS officials, the process for updating the sector-specific plans will begin after the revised NIPP has been released. A revised NIPP was released in December 2013, and, according to DHS, a new sector-specific plan is estimated to be completed in December 2014. Until DHS, in collaboration with stakeholders, develops the next iteration of the sector-specific plan, it is unclear if the cybersecurity implications of implementing these technologies will be considered. Comprehensive planning based on effective coordination between federal and non-federal emergency services sector stakeholders could better position the sector to identify and mitigate the increased cyber-based risks of the NG 911 and FirstNet network technologies. Without such planning, information systems are at an increased risk of failure or being unavailable at critical moments.

Although Identified Federal Agencies Provided Grants to State and Local Governments, These Grants Did Not Specifically Target Cybersecurity of Public Safety Entities

Federal grant programs have been used to fund technology enhancements so that public safety entities could address the evolution in communications technology and for technology enhancements at state and local public safety entities to include allocations for cybersecurity enhancements at the grantee’s option. The National Highway Traffic Safety Administration and the NTIA allocated $43.5 million in grants to states over a 3-year period, starting in September 2009, to help implement enhancements to 911 system functionality to address the increase in 911 calls from cell phones and the future plans for PSAPs to handle text and other message formats. Eligible expenses under the grant requirements fell into four categories: administrative expenses, training, consulting, and hardware and software. The grant period concluded at the end of fiscal year 2012. In all, the National Highway Traffic Safety Administration and NTIA awarded grants ranging from $200,000 to $5.4 million to 30 states and territories to help implement 911 system enhancements. While cybersecurity was not specified as a requirement in a grant program’s eligible use of funds, it was not precluded from the allowed use of the funds. In March 2013, the National Highway Traffic Safety Administration and NTIA reported that state governments used the majority of the funds to procure hardware and software to develop the IP-based infrastructure in preparation for their eventual migration to the NG 911 environment.

DHS’s Federal Emergency Management Agency (FEMA) offered preparedness program funds to state and local governments in order to enhance their emergency response capabilities. Although FEMA does not have a specific grant program for cyber-related purchases, cybersecurity and IT equipment (i.e., personal and network firewalls, authentication devices, and intrusion detection systems) are among the allowable equipment listed under these grants. The grants also allow for purchases of PSAP-related IT, such as computer-aided dispatch systems, global positioning systems, and automatic vehicle locating systems. According to FEMA officials, the grant money is typically distributed to state governments that, in turn, allocate the funds to local governments for their public safety entities and for other local government operations.

Justice, through its Office of Justice Programs, provided grants to local governments to support cyber forensics, cyber crime investigations, and related training. Justice reported that fiscal year 2012 grants funded computer equipment purchases, training for law enforcement personnel, and cyber crime awareness and prevention programs. However, based on our analysis of cyber-related grant information provided by Justice officials, the grants were not used for cybersecurity within the local public safety organizations. Local governments used the grants to enhance their capabilities to perform cyber forensics and cyber crime investigations.

At the time of our review, NTIA officials involved in the FirstNet network’s implementation stated that NTIA had distributed grants totaling $122 million to state and local governments for planning and conducting studies to determine the infrastructure, equipment, and architecture requirements for FirstNet’s network development.

FCC officials did not identify grant programs that directly or indirectly target improving the security of the networks and computer systems at state and local public safety entities.

DHS and FBI Shared Cybersecurity Information that Could be Relevant to Public Safety Entities’ Cybersecurity

DHS shared cybersecurity-related information such as threats and hazards with state and local governments through various entities. While the information was not uniquely targeted to public safety entities, it may be of benefit to them. Specifically,

DHS collected, analyzed, and disseminated cyber threat and cybersecurity-related information to state and local governments through its National Cybersecurity and Communications Integration Center and through its relationship with the Multi-State Information Sharing and Analysis Center.

DHS’s State, Local, Tribal, and Territorial Engagement Office’s Security Clearance Initiative facilitates the granting of security clearances to state chief information officers and chief information security officers. The clearances allow these personnel to receive information about current and recent cyber attacks and threats. For example, according to DHS officials, they have issued secret clearances to 48 percent of state chief information officers and 84 percent of state chief information security officers.

DHS provides intelligence information to fusion centers, which then share the information on possible terrorism and other threats and issue alerts to state and local governments. For example, in March 2013, a fusion center issued a situational awareness bulletin specific to public safety entities. The alert was about possible telephony denial-of-service attacks targeting PSAPs’ administrative (non-911) telephone lines.

The FBI’s Internet Crime Complaint Center has also provided alerts to PSAPs. For example, in April 2013, the FBI’s Internet Crime Complaint Center warned PSAPs about telephony denial-of-service attacks targeting them and advised victims to report incidents to law enforcement. The advisory noted that dozens of such attacks had targeted the administrative PSAP lines and that the attacks were part of an extortion scheme demanding payment for an outstanding debt to be paid to an individual or organization. The perpetrator launched an attack that inundated the PSAP with a continuous stream of calls for a lengthy period of time.

Identified Agencies Have Coordinated Cybersecurity Technical Assistance with State and Local Governments, but Efforts Are Not Generally Targeted to Public Safety Entities

DHS, Transportation, Commerce, and the FCC had coordinated with state and local governments to provide technical assistance including cybersecurity awareness training on cybersecurity threats and available resources, guidance to strengthen their cybersecurity posture, and cyber exercises and cybersecurity assessments to help them identify cyber vulnerabilities. The technical assistance was provided to public safety entities in a few instances, but was generally not targeted to them.

DHS’s state and local government-focused activities included:

Performing outreach to state governors, chief information officers, and chief information security officers to build awareness of cybersecurity threats and DHS technical resources available to them.

Since 2010, conducting 114 cyber resilience reviews, including at least 1 that was focused on a local government’s 911 and emergency management cyber operations, in order to enhance the cybersecurity posture of state and local government partners. These reviews were free, voluntary, and covered the entities’ cybersecurity practices regarding the management of assets, controls, incidents, service continuity, and risk.

Leading 33 cyber-related exercises since 2006 with state, local, and territorial government partners to test and evaluate plans and policies to handle cyber incidents.

Providing financial support to the Multi-State Information Sharing and Analysis Center (e.g., $6.7 million in 2012), whose members represent the 50 states, 4 U.S. territories, 4 tribal nations, and hundreds of municipalities. Its security operations center provides intrusion prevention support services for state and local government systems by actively monitoring their networks. Currently the monitoring covers 22 states, 7 local governments, and 1 territory.

Developing and administering, in coordination with the Multi-State Information Sharing and Analysis Center and the National Association of State Chief Information Officers, a national cybersecurity questionnaire. It was distributed to state and local governments to identify weaknesses and strengths in state and local governments’ cybersecurity processes. In March 2012, DHS and the Multi-State Information Sharing and Analysis Center jointly issued the survey report that identified key challenges faced by state and local governments, including a low overall awareness of risks to their systems, a lack of information security and disaster recovery plans, and a less mature cybersecurity capability among local governments. According to DHS officials, DHS has partnered with the Multi-State Information Sharing and Analysis Center to complete a second iteration of the survey and plans to report the results in March 2014.

Performing outreach activities, including presentations at professional conferences on cybersecurity and related available federal resources, with organizations such as the National Emergency Management Association and the International Association of Chiefs of Police that represent public safety professionals.

Providing, through FEMA, technical assistance to 12 state-level emergency operations centers in 2010 through 2012 that was not cybersecurity specific but could benefit public safety entities’ IT infrastructure. For example, FEMA assisted states with their information sharing and coordination capability and with emergency operations center design and management functions.

FCC, Transportation, and Commerce have also provided technical assistance to state and local governments that was not targeted to the cybersecurity of public safety entities, but could benefit their operations.

FCC provided technical assistance via its website to state and local governments by issuing guidelines for planning for the continuity of their PSAP operations and managing the security and operability of the PSAP communications systems and networks during emergencies. PSAPs may choose to implement the FCC guidelines, which are voluntary, to further develop, enhance, and expand their current emergency and disaster preparedness, response and recovery plans, and strategic approach to their overall emergency communications plans. According to FCC officials responsible for making the guidance available, FCC does not track the use of the guidance by PSAPs. In addition, according to local county public safety officials from one county, FCC provided technical assistance to resolve communications problems that arose due to issues with radio frequencies and signals.

FCC worked with state and local governments to incorporate federal access control standards into FirstNet development efforts.

Transportation and Commerce also provided technical assistance activities that, while not cybersecurity related, were intended to help enhance the technology infrastructure for PSAPs and to improve coordination and communications among federal, state, and local emergency communications systems, and others involved in the implementation of enhancements to 911 services. Specifically, the National Highway Traffic Safety Administration and NTIA jointly offer educational services and technical and operational information to state and local governments on implementing new technology such as IP-enabled 911 services.

FCC’s Regulatory Oversight of Telecommunications Providers Could Benefit Public Safety Entities

FCC’s regulatory oversight of the reliability and availability of telecommunications services does not directly impact state and local public safety entities. Public safety entities may benefit from FCC actions because the telecommunication providers’ services are essential to the public safety entities’ ability to receive emergency calls and dispatch first responders to the correct location. For example, the FCC requires reporting on telecommunications service outages, and its outage reporting guidelines include requirements to report extended service interruptions (exceeding 30 minutes) potentially affecting 911 call centers.

In addition, in June 2013, FCC established an e-mail address for PSAPs to voluntarily report communications provider outages they experience directly to the FCC. Further, in December 2013, FCC released an order adopting new rules requiring providers to take reasonable measures to provide reliable 911 service with respect to circuit diversity, central office backup power, and diverse network monitoring.

Conclusions

Identified federal agencies coordinate to varying degrees with state and local governments about the cybersecurity of IT relied on to receive and respond to 911 communications by PSAPs, first responder agencies, and emergency operations centers. Federal cybersecurity efforts may indirectly benefit public safety entities, but their efforts are generally not targeted to them. While DHS collaborated with state and local governments for critical infrastructure planning for the emergency services sector, the current plan does not incorporate cybersecurity protections for NG 911 and the FirstNet network. Until DHS, in collaboration with stakeholders, develops the next iteration of the sector- specific plan, it is unclear if the cybersecurity implications of implementing NG 911 and the FirstNet network will be considered. As these new technologies are adopted to enhance the capabilities of public safety entities, cyber risks will increase. Thus, effective federal cybersecurity coordination including critical infrastructure protection planning with state and local governments concerning their public safety entities could better position the sector to identify and mitigate these risks.

Recommendation

We recommend that the Secretary of Homeland Security, in collaboration with emergency service sector stakeholders, address the cybersecurity implications of implementing NG 911 and the FirstNet network in the next iteration of sector plans.

Agency Comments and Our Evaluation

We provided a draft of this report to the Departments of Homeland Security, Commerce, Justice, and Transportation, and the Federal Communications Commission for their review and comment. DHS provided written comments on our report (see app. II), signed by DHS’s Director of Departmental GAO-OIG Liaison Office. In its comments, DHS concurred with our recommendation. In addition, DHS stated that the revised NIPP was released in December 2013, and it will work with sector partners to develop an updated Emergency Services Sector-Specific Plan that will include consideration of both NG 911 and the FirstNet network. DHS estimated completing the updated sector plan by December 31, 2014.

FCC also provided written comments on a draft of our report (see app. III), signed by the Chief, Public Safety and Homeland Security Bureau. FCC stated that without coordination on public safety cybersecurity matters among federal, state, and local governments, the problems outlined in this report will not be properly addressed. Further, FCC agreed that the current Emergency Service Sector Specific Plan does not provide the detail necessary to address the threat.

Audit liaisons from DHS, FCC, and Justice also provided technical comments via e-mail. We incorporated these comments where appropriate. . We are sending copies of this report to interested congressional committees; the Secretaries of the Departments of Commerce, Homeland Security, and Transportation; the Attorney General of the United States; the Chairman of the Federal Communications Commission; the Director of the Office of Management and Budget; and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions regarding this report, please contact me at (202) 512-6244 or at wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report.

Appendix I: Objective, Scope, and Methodology

Our objective was to determine the extent to which federal agencies coordinated with state and local governments regarding cybersecurity efforts at emergency operations centers, public safety answering points, and first responder agencies involved in handling emergency calls.

The scope of our audit focused on identified federal agencies that have a role and responsibilities for coordinating cybersecurity efforts with state and local governments. We also included state and local governments and related public safety entities and key industry associations that are involved in handling emergency calls or work closely with or represent those in the emergency communications industry.

To identify the roles of federal agencies and select the organizations responsible for coordinating cybersecurity efforts with state and local government for public safety entities, we reviewed relevant federal law, policy, regulation, and critical infrastructure protection-related strategies, including the following:

Homeland Security Act of 2002;

Middle Class Tax Relief and Job Creation Act of 2012;

Implementing Recommendations of the 9/11 Commission Act of 2007;

2009 National Infrastructure Protection Plan;

2010 Emergency Services Sector-Specific Plan;

2012 Emergency Services Sector Cyber Risk Assessment;

2003 National Strategy to Secure Cyberspace;

Department of Homeland Security’s Information Sharing Strategy,

Presidential Policy Directive 21—Critical Infrastructure Security and Resilience, February 12, 2013;

Executive Order 13618—Assignment of National Security and Emergency Preparedness Communications Functions, July 6, 2012;

Executive Order 13636—Improving Critical Infrastructure Cybersecurity, February 19, 2013; and

Title 47, Code of Federal Regulations sections 4.5, 4.9, 12.3, and Part 400.

We analyzed these documents to identify federal agencies responsible for coordinating with state and local governments regarding cybersecurity- related activities, including partnering with state and local government emergency services organizations to fulfill planning and assessment efforts, providing technical assistance, and sharing relevant information about threat, vulnerabilities, and mitigation techniques. In addition, we analyzed these documents to determine other methods that could support the cybersecurity of emergency services to include administering grants related to improving 911 services or regulating essential functions such as communications. Based on our analysis, we determined that the Departments of Homeland Security, Commerce, Justice, and Transportation and the Federal Communications Commission were key federal entities relevant to our objective and identified five key activities related to cybersecurity coordination, to evaluate the federal entities against: (1) supporting critical infrastructure protection-related planning, (2) issuing grants, (3) sharing information, (4) providing technical assistance, and (5) regulating and overseeing essential functions.

To determine the identified federal entities’ cybersecurity coordination activities related to these activities, we collected and analyzed relevant plans and reports dated from 2009 to 2013. For example, we analyzed DHS’s State, Local, Tribal and Territorial Cybersecurity Engagement Program efforts to build partnerships with their non-federal partners to advance DHS’s mission in protecting critical network systems. To get a better understanding of grants and how they are issued, we analyzed the Federal Emergency Management Agency’s guidance on public safety grant funds, Transportation’s administration of the E911 grant program, and the Justice’s reports on Office of Justice Program grantees. To determine the responsibilities of various agencies in regulating and overseeing functions, we analyzed various laws to determine DHS responsibilities to state and local entities and Federal Communications Commission’s outage reporting requirements. In addition, we interviewed officials from Department of Homeland Security’s Office of Cybersecurity and Communications, Office of Infrastructure Protection, and the Federal Emergency Management Agency; Commerce’s National Telecommunications and Information Administration, and First Responder Network Authority; Justice’s Federal Bureau of Investigation, Justice Management Division, and Community Oriented Policing Services; Transportation’s National Highway Traffic Safety Administration; and the Federal Communications Commission’s Public Safety and Homeland Security Bureau.

To confirm federal efforts and gain an understanding regarding how public safety entities operate, we analyzed relevant policies, plans, and reports such as the National Emergency Number Association’s Primer on the 911 Call Process, Recommended Best Practices Checklist Against TDoS Attacks, and Emergency Number Professional’s Reference Manual; the California 911 Emergency Communications Office’s explanation of E911 Call Flow; the Metropolitan Washington Councils of Governments Final Report on 911 Service Gaps During and Following the Derecho Storm on June 29, 2012; the Federal Communications Commission’s report on Impact of the June 2012 Derecho on Communications Networks and Services, and How 911 Works by Julia Layton. In addition, we interviewed officials familiar with emergency operations and/or cybersecurity aspects of state and local governments from the National Association of State Chief Information Officers; National Emergency Number Association; National Emergency Managers Association; National Association of State 911 Administrators; Multi-State Information Sharing and Analysis Center; International Association of Fire Chiefs; and the National Governors Association.

We also interviewed state and local government officials familiar with emergency communication operations based on proximity of location, leadership in national associations, and/or involvement in ongoing technology enhancements. For example, we interviewed public safety officials from the Alabama 911 Board; Arlington County, Virginia; California Public Safety Communications Office; Fairfax County, Virginia; Orange County, California; Overland Park, Kansas; and Wake County, North Carolina. In addition, to get a better understanding of cybersecurity and the activities performed at public safety answering points and emergency operations centers and their interaction with first responders, we reviewed and analyzed the operations and responsibilities of the California Technology Agency Public Safety Communications Office, and observed the operations of the McConnell Public Safety and Transportation Operations Center in Fairfax County, Virginia, and the Arlington County Emergency Communications Center in Arlington, Virginia.

We determined that information provided by the federal, state, and local agencies, such as plans, guideline, and manuals, was sufficiently reliable for the purposes of our review. To arrive at this assessment, we corroborated the information by comparing it with statements from relevant agency officials.

We conducted this performance audit from November 2012 to January 2014 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective.

Appendix II: Comments from the Department of Homeland Security

Appendix III: Comments from the Federal Communications Commission

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

GAO staff who made significant contributions to this report include Michael W. Gilmore, Assistant Director; Nancy Glover; Barbarol James; Kenneth A. Johnson; David Plocher; and Adam Vodraska.