Defense Infrastructure: Improvements in DOD Reporting and Cybersecurity Implementation Needed to Enhance Utility Resilience Planning
Released: 2015-07-23T00:00:00

Letter

Background

DOD Installations Depend on Utility Services from a Variety of Sources

According to testimony from the Assistant Secretary of Defense for Energy, Installations and Environment, the use of electricity, natural gas, and other utilities is a fundamental characteristic of the nearly 300,000 buildings that DOD owns and operates. These buildings reside on over 500 major installations in the United States and overseas, which provide effective platforms for the training, deployment, redeployment, and support for the military forces that provide for the country’s defense. Installation utilities expenditures are included in the operations and maintenance budget request for Base Operations, and DOD spends a substantial amount of money on utility service. For example, according to DOD, the department spent $4.2 billion on facilities energy in fiscal year 2014.

DOD installations obtain utility services in a variety of ways, such as from commercial utility providers or on-site generation. For example, DOD installations typically acquire electricity and natural gas service through a public or private-sector utility provider.also produce some of their own electricity through on-site power generation or through the use of renewable energy projects. For water and wastewater services, DOD maintains and operates wastewater and drinking water treatment facilities on many of its installations. DOD installations may also obtain potable water by purchasing it from a water utility provider as well as from fresh water sources such as wells and streams. In addition, DOD may contract with a local wastewater treatment facility to manage wastewater.

DOD Roles and Responsibilities for Management of Utility Services on DOD Installations

Within DOD, the military departments are responsible for installation management, with oversight by the Office of the Assistant Secretary of Defense for Energy, Installations and Environment, who reports to the Under Secretary of Defense for Acquisition, Technology and Logistics. The former office is responsible for—among other things—issuing facility energy policy and guidance to DOD components and coordinating all congressional reports related to facility energy, including the Energy Reports. In addition, each military department is responsible for developing policies and managing programs related to energy and utility management, and has assigned a command or headquarters to execute At the installation level, the public works, general these responsibilities.facilities, or civil engineering departments oversee and manage the day- to-day operations of the utilities.

DOD Collaborates with Various Federal Agencies with Responsibilities for Protecting Critical Utility Infrastructure

DOD collaborates with various federal agencies to manage the security of crucial utility infrastructure on which DOD relies for utility service. Managing the security of the nation’s critical utility infrastructure requires collaboration among government agencies, industry groups, and private companies. Various federal departments and agencies are designated as sector-specific agencies and play a key role in critical infrastructure security and resilience activities. Specific to the utilities that are the subject of this report, the Department of Energy is the sector-specific agency responsible for the energy sector. The energy sector includes the production, refining, storage, and distribution of oil, natural gas, and electric power, except for commercial nuclear power facilities. In addition, the Environmental Protection Agency is the sector-specific agency responsible for the water and wastewater sector. The Department of Homeland Security, pursuant to Presidential Policy Directive 21, is to coordinate the overall federal effort to promote the security and resilience of the nation’s critical infrastructure from all hazards. For more information on GAO’s previous work examining federal efforts to protect critical infrastructure and recommendations we have made to improve these efforts, see appendix II.

Cybersecurity Concerns, Industrial Control Systems, and Their Role on DOD Installations

According to DOD’s April 2015 Cyber Strategy, the department will work with the Department of Homeland Security to improve cybersecurity of critical infrastructure to protect the U.S. homeland and vital interests from disruptive or destructive cyber attacks. In addition to its role in coordinating federal efforts to protect critical infrastructure, the Department of Homeland Security is responsible for leading efforts to protect the nation’s cyber-reliant critical infrastructures, which includes ICS. One of its means to do this is the Industrial Control System Cyber Emergency Response Team, which has been receiving reports about cyber incidents on federal and civilian ICS since 2009. Figure 1 shows reported cyber incidents in the energy, and water and wastewater, sectors since 2009.

On DOD installations, ICS are associated primarily with infrastructure, and consist of computer-controlled electromechanical systems that ensure installation infrastructure services—such as utility service—are delivered when and where required to accomplish the mission. Examples include electric infrastructure, for which ICS control actions such as opening and closing switches; for water pipes, opening and closing valves; and for buildings, operating the heating, ventilation, and air conditioning systems. Thus, many DOD missions depend on the unfailing functioning of ICS and therefore on the security of those systems. Further, DOD’s ICS have become increasingly networked and interconnected with other DOD networks and thereby potentially at risk of cyber intrusion or attack. According to DOD’s April 2015 Cyber Strategy, DOD’s own networks and systems are vulnerable to intrusions and attacks. In addition to DOD’s own networks, a cyber attack on the critical infrastructure and key resources on which DOD relies for its operations could impact the U.S. military’s ability to operate in a contingency.

Hazards Caused Utility Disruptions Resulting in Operational and Fiscal Impacts; Physical and Cyber Threats Pose Similar Impacts

DOD and selected installations reported utility disruptions for fiscal years 2012 through 2014; hazards and threats have the potential to cause utility disruptions, with operational and fiscal impacts.

DOD and Selected Installations Reported Utility Disruptions for Fiscal Years 2012 through 2014

Section 2925 of Title 10 of the United States Code requires DOD to report to Congress on a number of facility energy requirements. One of the required reporting elements is to report on utility disruptions on military installations, including—among other things—the total number and location of utility outages on installations, their financial impact, and mitigation measures. This information is reported in DOD’s annual Energy Reports. DOD components, including the four military services, provide OSD with information on utility disruptions that occurred on their installations in a given fiscal year, which OSD compiles for reporting in the Energy Reports. According to DOD, the June 2013 and June 2014 Energy Reports contain information on disruptions that occurred in fiscal years 2012 and 2013, respectively; that lasted 8 hours or longer; and were the result of interruptions in external, commercial utility service.

In its June 2013 Energy Report, DOD reported 87 disruptions and a financial impact of about $7 million for fiscal year 2012. In its June 2014 Energy Report, DOD reported 180 disruptions and a financial impact that averaged about $220,000 per day for fiscal year 2013. At the time of our data collection and analysis, DOD had not issued the Energy Report with utilities disruption data from fiscal year 2014. However, OSD had collected these fiscal year 2014 data from the military services. Figure 2 summarizes the information on the number of utility disruptions reported by the military services to OSD for fiscal years 2012 through 2014.

DOD’s Energy reports do not discuss specific examples of utility disruptions and their impacts on installation operations, in part because the statute does not require such examples. Thus, we decided to gather additional information on DOD utility disruptions from 20 installations we selected inside and outside of the continental United States, caused by hazards. As reflected in the figures below, from fiscal year 2012 to fiscal year 2014, utility disruptions on installations in our sample varied in their frequency, duration, the type of utility service disrupted, and the ownership of the utility infrastructure affected. Figures 3 and 4 summarize information on disruptions lasting 8 hours or longer, occurring in fiscal years 2012 through 2104, and reported to us by 18 of the 20 installations in our sample. Of these 20, 18 reported a total of 150 disruptions lasting 8 hours or longer that occurred in fiscal years 2012, 2013, or 2014. Figure 3 provides information on the type and duration of utility disruptions, and the owner of the utility infrastructure involved in the disruption. Figure 4 provides information on the number of disruptions experienced by installations in our sample.

Hazards Have Caused Utility Disruptions, with Operational and Fiscal Impacts, and Threats Have the Potential to Cause Such Impacts

Utility disruptions caused by hazards, such as mechanical failure and extreme weather events, have resulted in a number of serious operational and fiscal impacts. Further, both DOD and GAO have noted that climate change increases the likelihood of such events and the department must be prepared for—and have the ability to recover from—utility disruptions that impact mission assurance on its installations. According to officials from the 20 installations we visited or contacted, examples of utility disruptions’ impacts on installations’ operations include the following: In July 2013, two unusually strong thunderstorms downed power lines at Naval Air Weapons Station China Lake, California, causing electrical disruptions of 12 and 20 hours. The installation’s missions include supporting the Navy’s Research, Development, Acquisition, Test and Evaluation mission and providing Navy training capability. Because of these disruptions, the installation lost the ability to conduct 17 mission-related events, including 4 test events and 13 maintenance or training flights.

In October through December of 2010 and June of 2013, Vandenberg Air Force Base experienced electrical disruptions due to mechanical failures, resulting in several impacts on installation operations. For example, these disruptions led to key systems being unavailable for space launch operations. Specifically, the disruptions contributed to delaying the launch of one satellite by about 5 days and another by 1 day. In addition, the installation has experienced wildfires. Figure 5 shows fire-damaged utility infrastructure on Vandenberg Air Force Base.

In our May 2014 report on DOD’s adaptation to climate change for infrastructure, we found operational impacts of climate change on installations’ utility resilience. For example, according to DOD officials, the combination of thawing permafrost, decreasing sea ice, and rising sea level on the Alaskan coast have led to an increase in coastal erosion at several Air Force radar early warning and communication installations. Installation officials explained that this erosion has damaged a variety of installation infrastructure, including utilities.

According to our review of information provided by officials from the 20 installations we visited or contacted, the fiscal impact of utility disruptions can vary. Examples of fiscal impact include the following: In late October and early November of 2012, storm surge from Hurricane Sandy destroyed potable water and wastewater utility infrastructure of a pier at Naval Weapons Station Earle, New Jersey. This damage resulted in a disruption of potable water and wastewater services to docked ships. Disruption of these utility services lasted about 1 month until—according to installation officials—the installation could contract to provide temporary potable water and wastewater services, with a variety of costs for the government. For example, according to an installation official, one contract to provide temporary utility service totaled about $2.8 million. Also, according to Navy documentation, the Navy has estimated that more than $23 million will be required to replace the destroyed infrastructure. Vandenberg Air Force Base has also experienced disruptions of potable water utility service. For example, a November 2014 disruption of water used by a power plant that provides electricity to a launch pad had an estimated repair cost of $15,000. Figure 6 shows the repair of damaged potable water infrastructure on Vandenberg Air Force Base.

During unusually cold temperatures in January 2014, the utility company that provides natural gas service to the Army’s Aberdeen Proving Ground, Maryland, implemented a curtailment agreement with the installation. Such agreements allow the utility provider to reduce service during periods of unusually high demand. However, due to mechanical failures, several of the installation’s heating boilers were unable to switch from using natural gas to using fuel oil. As result, the installation was not able to curtail its purchase of natural gas, and was fined almost $2 million by the utility provider. In our May 2014 report on DOD’s adaptation to climate change for infrastructure, we also found fiscal impacts of climate change on installations’ utility resilience. For example, in 2013, Fort Irwin, California, experienced three power disruptions in a span of 45 days. Caused by extreme rain events that created flash flooding, each disruption lasted at least 24 hours. The disruptions limited the effectiveness of instrumentation used to track the training at the National Training Center and provide information used for after-action feedback. To increase future utility resilience, Fort Irwin requested more than $11.5 million for 31 backup generators. In our May 2014 report, we noted that weather-related fiscal impacts on infrastructure may increase in their frequency or severity due to climate change. If so, DOD’s maintenance costs for these weather-related fiscal impacts are likely to increase.

Physical and cyber threats also have the potential to cause utility disruptions with impacts on installation operations. According to DOD officials, while there are no known malicious physical acts that have caused utility disruptions on DOD installations lasting 8 hours or longer, such acts have the potential to cause utility disruptions, with resultant impacts on installation operations. For example, according to the Federal Bureau of Investigation and the Pacific Gas & Electric utility company, in April 2013 an individual or individuals cut fiber optic cables and fired over 100 bullets into 13 large transformers located at a California substation operated by the company, damaging the transformers. According to DOD officials, this incident did not result in disruption of electrical service at DOD installations. However, they explained that the incident is an example of the type of utility disruption threat posed by physical terrorism.

In addition, based on our review of DOD documents and discussions with DOD officials, the department’s utility infrastructure is also under cyber threat. According to DOD’s April 2015 Cyber Strategy, the global proliferation of malicious code or software, called “malware,” increases the risk to U.S. networks and data. A variety of adversaries can purchase destructive malware and other capabilities on the black market. As cyber capabilities become more readily available over time, DOD assesses that state and nonstate actors will continue to seek and develop cyber capabilities to use against U.S. interests. Further, according to the March 2014 OSD memorandum discussed previously, DOD’s computer networks and systems—including ICS—are under “incessant” cyber attack and damage to or compromise of any ICS may be a mission disabler. For example, according to a briefing provided by an official from the United States Cyber Command, an adversary could gain unauthorized access to ICS networks and attack DOD in a variety of ways.

United States Cyber Command officials explained that there are several categories of cyber threats involving a DOD installation’s ICS that have the potential to cause utility disruptions and resulting impacts on installation operations. The first category of cyber threats includes the removal of data from an ICS or a DOD network connected to an ICS. According to OSD’s March 2014 memorandum, a serious mission- disabling event could occur if an ICS was used as a gateway into an installation’s information technology system or possibly DOD’s broader information networks. The second category of cyber threats involves the insertion of false data to corrupt the monitoring and control of utility infrastructure through an ICS. In its March 2014 memorandum, OSD noted that disruption of a computerized chiller controller could deleteriously impact critical military operations and readiness. Figure 7 details an example of a potential cyber attack provided by Navy officials.

The third category of cyber threats is the physical destruction of utility infrastructure controlled by an ICS. According to United States Cyber Command officials, this threat—also known as a “cyber-physical effect”— is the threat about which they are most concerned. This is because a cyber-physical incident could result in a loss of utility service or the catastrophic destruction of utility infrastructure, such as an explosion. According to one of the officials, an example of a successful cyber- physical attack through ICS was the Stuxnet computer virus that was used to attack Iranian centrifuges in 2010. Through an ICS, the centrifuges were made to operate incorrectly, causing extensive damage.

DOD Collects and Reports Utility Disruption Data, but Its Data Are Not Comprehensive and Some Are Not Accurate

DOD has a 5-month process to collect and report on utility disruption data, and uses these data in a number of ways. However, the department’s collection and reporting of utilities disruption data are not comprehensive and some data are not accurate.

DOD Has a 5-Month Process to Collect and Report on Utility Disruption Data, and Uses These Data in a Number of Ways

DOD undergoes an annual process to report on utility disruptions in its Energy Reports, collecting data required by Section 2925 of Title 10 of the United States Code—including utility disruption data—for the reports, over a 5 month time period. The overall process, with participation by installations, military service headquarters, and OSD, is detailed in figure 8.

According to our review of the June 2013 and June 2014 Energy Reports, other DOD documents, and discussions with an OSD official responsible for planning and implementing utility resilience activities, DOD uses the utility disruption data in a number of ways. First, DOD has analyzed these data to support a review of existing DOD guidance on power resilience at DOD installations that is presently informing the department’s policy. Second, according to an OSD official, DOD can use the utilities disruption data as a baseline to establish trends that inform future strategic planning and policymaking. Further, the official explained that these are the only utility disruption data collected for the Energy Reports, and so are especially important to informing DOD’s utility resilience efforts, noting that it is important for OSD decision making to be driven by analyzing data. Also, the official explained that analyses of the utility disruptions’ average duration could inform decisions about which type of backup power infrastructure is the most cost-effective to install on installations. For example, if the average duration of a disruption is 2 to 3 days, individual generators may be the most cost-effective option. In contrast, if the average duration of a disruption is 7 days or longer, natural gas- powered plants located on installations may be the most cost-effective option. Third, DOD uses the utility disruption data collected from its installations to meet the requirement in Section 2925 of Title 10 of the United States Code to report to Congress on—among other things—the total number and location of utility outages on installations, their financial impact, and mitigation measures.

DOD’s Collection and Reporting of Utilities Disruption Data Are Not Comprehensive and Some Data Are Not Accurate

DOD instructions in a template used to collect utility disruption data from installations stipulate that installations should report on external, commercial utility disruptions lasting at least 8 hours. According to officials from the military service headquarters and OSD, they do not review installations’ utilities disruption data to determine whether there are instances that meet the reporting criteria but are not included. Officials from three of the military service headquarters and OSDthat, in fiscal years 2012 through 2014, there were installations that did stated not report on all disruptions that meet these criteria. By comparing the utility disruptions we identified through our independent research to those submitted by the military services to OSD, we confirmed cases of underreporting by installations from all four services, although our comparative analysis does not quantify the extent of underreporting. For example, in fiscal years 2012 and 2013, the Army did not report at least four disruptions, including a 1-week potable water main break at Camp Darby, Italy. Also, in fiscal year 2012 the Navy and Marine Corps did not report at least eight disruptions, seven of which were multiday electrical disruptions that occurred as a result of the June 2012 derecho storm, including a disruption at Marine Corps Base Quantico. Thus, for fiscal year 2012, the number of the Navy and Marine Corps’ unreported disruptions is at least more than double the number of reported disruptions. In addition, for fiscal years 2013 and 2014, the Navy and Marine Corps did not report a total of at least four disruptions.

Further, according to instructions in the data collection template, installations are supposed to submit data only on external, commercial utility disruptions, not those associated with DOD-owned utility infrastructure, such as the mechanical failure of a DOD-owned transformer or a potable water pipe bursting. This results in underreporting of disruptions in DOD’s Energy Reports. As noted above, at the 20 installations we visited or contacted, more than 90 percent of disruptions involved DOD-owned infrastructure. Specifically, for fiscal years 2012 to 2014, installations in our sample experienced almost 140 utility disruptions involving DOD infrastructure, which would not be captured in the Energy Reports. According to officials from multiple installations we visited or contacted, aging DOD-owned utility infrastructure contributes to utility disruptions. For instance, Kadena Air Force Base officials explained that “failing” DOD-owned utility infrastructure creates challenges to maintaining support to the installation’s mission. The officials provided one example, noting that some wastewater pipes were cast in 1947 and have been in use for over 65 years. Kadena Air Force Base officials told us that, from 2011 to 2014, the installation experienced at least 40 disruptions of electrical, potable water, and wastewater utility services stemming from DOD-owned infrastructure that officials estimate lasted at least 8 hours.

DOD instructions in the data collection template also stipulate that installations should submit costs related to mitigating utility disruptions, such as the cost of generators or fuel on which generators run. In fiscal years 2012, 2013, and 2014, three of the four military services submitted disruption data to OSD that did not include information on mitigation costs. For 194 of those disruptions—or 48 percent of the 404 utility disruptions reported to OSD for that period—installations did not report mitigation costs. Because it is common for DOD installations to have backup generators that provide power during electrical disruptions—and an OSD official stated that the majority of reported disruptions are electrical—it is likely that installations reporting electrical disruptions also experienced costs associated with generators. For instance, Navy officials noted that almost every Navy installation has at least some generators that would run during a disruption and these generators consume fuel that would need to be replaced at a cost. Thus, it is likely that DOD underreported certain costs associated with disruptions such as fuel costs for generators.

In addition to underreporting, our review of the fiscal years 2012 through 2014 utilities disruption data submitted by the military services to OSD and discussions with OSD officials show there were inaccuracies in duration and cost data on disruptions reported in DOD’s June 2013 and June 2014 Energy Reports. In regard to the duration of disruptions, three of the four military services included disruptions lasting less than 8 hours in the data they submitted to OSD. In total, the military services submitted 32 disruptions lasting less than 8 hours for fiscal years 2012 through 2014. However, according to an OSD official, the fiscal year 2012 and 2013 disruptions lasting less than 8 hours were included in the data reported in the June 2013 and June 2014 Energy reports, constituting about 12 percent of the 266 disruptions DOD reported. Further, for fiscal years 2012 and 2013, a total of 104 disruptions were submitted with incomplete information on duration. Specifically, these disruptions lacked start and end times. According to our analysis of Air Force disruptions reported to OSD for fiscal year 2012 and OSD information on the number of Air Force disruptions reported in the June 2013 Energy Report, it is likely that the disruptions were included in the data reported in that report. Further, according to OSD officials, the Army disruptions were included in the data reported in the June 2014 Energy Report. The 104 disruptions without complete information on duration account for almost 40 percent of the 266 disruptions that DOD reported for fiscal years 2012 and 2013.

There were also inaccuracies regarding the cost of disruptions. As discussed above, DOD instructions in the data collection template stipulate that installations should submit direct costs related to mitigating utility disruptions, such as the cost of generators or fuel for them. The instructions also stipulate that indirect costs related to utility disruptions, such as an installation’s lost productivity, should not be submitted. For fiscal year 2012, the Army submitted costs related to the disruption of electrical utility service at Fort Belvoir, Virginia, as a result of the June 2012 derecho storm. According to the Army’s descriptions of these submissions, a total of $4.63 million was for indirect costs, specifically: lost sales, spoiled inventory (e.g., food, medicine), or lost productivity. However, according to OSD officials, these costs were included in the data reported in the June 2013 Energy Report. This $4.63 million of inaccurately reported indirect costs accounts for 66 percent of the approximately $7 million in total costs reported by DOD for fiscal year 2012.

Based on our review of the fiscal year 2014 data submitted by the military services to OSD—and OSD’s data validation efforts—the accuracy of DOD’s data may be improving. For example, based on our review, the services’ fiscal year 2014 data contained some inaccuracies, but there were fewer duration and cost inaccuracies than in the fiscal year 2013 data. Also, OSD’s data validation documentation show OSD removed several inaccurate military service submissions before providing the final fiscal year 2014 data set to the Congress. However, challenges remain in the data collection instructions DOD provides to its installations and in the department’s review and validation of data, which could hinder consistent improvement over time.

According to the Standards for Internal Control in the Federal Government, program managers need operational and financial information in order to determine whether they are meeting their agencies’ plans and goals, and to promote the effective and efficient use of resources. Also, in previous work examining how DOD was meeting reporting requirements, we found that complete and accurate data are key to meeting such requirements. In addition, in previous work examining—among other things—DOD’s efforts to effectively implement existing guidance, we found that clear and complete guidance is important to the effective implementation of responsibilities. The standards also emphasize the importance of accurately recording events. Further, according to the standards, managers should continually assess their processes to ensure the processes are updated as necessary. In addition, according to the Project Management Institute’s 2013 guide to project management, standard practices in program management include—among other things—reviewing a process on a regular basis to recommend changes or updates to the process.

DOD’s underreporting of some disruptions that met the criteria laid out in DOD reporting instructions, and not including disruptions of DOD-owned utility infrastructure in the Energy Reports, are likely due to two factors related to instructions in DOD’s data collection template for installations. First, the underreporting of disruptions that meet DOD’s criteria is likely due to inconsistent guidance provided to installations. Specifically, headquarters officials from both the Marine Corps and Air Force stated that they provided verbal guidance to their installations to submit disruptions only if the disruptions met service-specific criteria different than those stipulated in DOD’s data collection template. For example, Air Force headquarters officials explained that, for collection of data for fiscal year 2014, they instructed their installations to submit disruptions only if they were not mitigated by back-up utility infrastructure, such as an electrical disruption mitigated by a generator. However, the data collection template does not instruct installations to limit their submissions based on these criteria. Also, based on our review, DOD’s instructions to installations place inconsistent emphasis on electrical and nonelectrical utilities and provide an unclear scope of the data to be submitted. For instance, the instructions begin by listing the electrical, water, and gas utilities on which the installation is supposed to report, but the instructions’ details refer only to disruptions in electrical power. Officials from several installations we visited found these instructions confusing. For example, officials from two of the installations stated that they did not submit information on potable water disruptions due to the confusing nature of the instructions.

Second, the instructions in the data collection template stipulate that installations are to submit only external, commercial disruptions because—according to an OSD official—DOD decided to limit the scope of data collection and reporting to external, commercial disruptions. The official explained that when the statutory requirement to collect data on utility disruptions began in fiscal year 2012, DOD’s rationale was that almost all of the electricity used by its installations is provided by non- DOD entities such as external, commercial utility companies.

As discussed above, the military service headquarters and OSD take various steps to validate utility disruption data submitted by the installations and military services, respectively, but the time and rigor they commit to reviewing the disruption data are limited, which could affect their comprehensiveness and accuracy. Specifically, according to officials from both the military service headquarters and OSD, the structure of the current process for collecting and reporting data in the Energy Reports gives relatively little time to validate the utilities disruption data. DOD officials explained that, out of the 5-month process for collecting and reporting these data, there are 3–4 weeks in which they review utility disruption data. Also, officials from certain military service headquarters explained that their review of installations’ data looks for clear “outliers” or data that seem incorrect and that they rely on installations to provide accurate data on instances of commercial external utility disruptions and associated mitigation costs. In addition, OSD spends about 2 weeks reviewing all of the data required for the Energy Report, including the disruption data. OSD’s validation efforts include questions for the military services that address individual items submitted by each service. According to an OSD official, the 2 weeks it has allotted to review all of the Energy Report’s data means that it is difficult to verify installation-level information.

An OSD official and certain headquarters officials also explained that—in their limited time to validate all of the data included in the Energy Reports—they prioritize validation of other data types above their review of the utilities disruption data. These other types of data represent the 11 other categories of data that DOD is required to include in the Energy Report. According to certain military services headquarters officials, they prioritize validation of other data types above their review of the utilities disruption data because they feel OSD places a higher priority on other data, such as those related to DOD requirements or renewable energy projects. In our review of OSD’s data validation of the military services’ fiscal years 2013 and 2014 data for the Energy Reports, we found that a large majority of the questions are about types of data other than utilities disruption data.

As we discussed previously, our sample of 20 installations is nongeneralizable, and so we cannot assume that this trend applies to the universe of DOD’s installations. However, the research conducted on these installations provides valuable insight for our study. For more information on our research methodology, see appendix I. to report, given that 66 percent of the costs DOD included were indirect costs. Because DOD used these data to support an existing utility resilience initiative and may use the data to inform future planning and policymaking, accurate data are especially important to informing DOD’s utility resilience efforts. Third, the limited collection and reporting of utilities disruption data in DOD’s Energy Reports may hamper congressional oversight of DOD utility resilience actions.

The Military Services Have Taken Actions and Implemented DOD Guidance to Mitigate Risks of Utility Disruptions but Face Challenges in Implementing Cybersecurity Guidance for Industrial Control Systems

The military services have taken actions and implemented a number of different pieces of DOD guidance to mitigate the risk of utility disruptions. In addition the military services have begun planning for the implementation of DOD Instruction 8510.01, Risk Management Framework (RMF) for DOD Information Technology (IT), to generally mitigate the risk of cyber incidents on all DOD information technology systems and ICS, but face challenges in implementing this guidance for ICS.

Military Services Have Taken Actions and Implemented DOD Guidance to Mitigate Utility Disruptions

Based on our review of DOD documents, and according to officials from installations both inside and outside the continental United States that we visited or contacted, installations have taken various actions to mitigate the effects of disruptions in electrical, potable water, wastewater, and natural gas utility service.

19 of the 20 installations we visited or contacted use backup generators to provide emergency power to certain facilities. For example, Marine Corps Base Camp Pendleton has about 158 facilities with active emergency generators that it utilizes during electrical disruptions. Further, the installation has identified a prioritized order for refueling, the goal of which is to keep the generators operating during emergency situations.

At the locations we visited or contacted, installations have taken a number of actions to mitigate risk to potable water and wastewater utility service. For instance, at Wheeler Army Airfield, Hawaii, officials explained that—in the event of an electrical disruption disabling potable water pumps—the installation’s potable water system is fed by water tanks, and certain pump stations have emergency generators. In addition, Vandenberg Air Force Base has a sewage pond that can store up to 3 days’ worth of sewage in the event that the pipes leading to the treatment facility cannot be used. Installations have also developed contingency plans for access to potable water resources in addition to their primary source. Further, certain installations have upgraded their utility infrastructure in order to improve its resilience. According to Naval Weapons Station Earle officials, the potable and wastewater infrastructure, destroyed by Hurricane Sandy, is designed to be stronger and thus more resilient in the face of future extreme storms. Figure 9 shows both the damaged and repaired infrastructure.

In addition, installations in our sample have taken steps to plan for emergency situations in which utility service could be disrupted. For example, the Naval Base San Diego, California, emergency management plan has an appendix that addresses potential disruptions in electrical, potable water, and wastewater utility service; includes planned response actions; and lists installation organizations responsible for certain actions. Also, according to officials at Tengan Pier and White Beach in Japan, both installations participate in emergency management exercises that provide them with the opportunity to focus on various utility disruption scenarios, such as an exercise that features a typhoon scenario. Finally, Joint Base Pearl Harbor-Hickam, Hawaii, has an emergency management plan that identifies all emergency resources available at the installation such as portable generators, portable pumps, generators providing power to other utilities (water production facilities, wastewater treatment plant, and lift stations), and information on emergency capabilities and assessment teams.

The installations in our sample also are generally taking steps in response to DOD guidance related to utility resilience and have taken steps to mitigate the risk to installations posed by utility disruptions caused by both threats and hazards.headquarters officials, there are several pieces of DOD-wide guidance related to utility resilience. Table 1 summarizes selected DOD guidance and our analysis of implementation efforts by installations in our sample. Examples of actions taken by installations to implement this guidance follow the table.

Based on our review of DOD documents and discussions with officials at military service headquarters and installations, implementation efforts include actions such as preparing emergency response plans, conducting vulnerability assessments, and assessing the condition of utility infrastructure. For example, Aberdeen Proving Ground’s emergency response plan identifies utility system vulnerabilities, emergency preparedness requirements, and remedial actions intended to mitigate the risk of potential utility service disruptions. Officials from several locations stated that their installations had undergone various assessments of the vulnerability of utility infrastructure to terrorist attack. Furthermore, officials from Naval Base San Diego and Naval Air Weapons Station China Lake stated that they were conducting a utility inventory and risk assessment, which would assess and rate the condition of the utility and also document the consequences of failure of utility infrastructure.

In addition to mitigation actions and implementation of guidance taken at the installation level, DOD has undertaken a number of department-wide initiatives to enhance utility resilience. For example, in 2013, the Assistant Secretary of Defense for Energy, Installations and Environment directed a review of existing DOD guidance on power resilience at DOD installations. While reliable and continuous access to all types of utilities is important to DOD missions, OSD officials stated that they focused this review on power because other utility services may depend on—and many DOD missions specifically rely on—reliable access to power. Officials from the Office of the Assistant Secretary of Defense for Energy, Installations and Environment are currently reviewing the responses from the DOD installations, which were compiled and submitted by each military service, and developing recommendations for power resilience requirements.

In addition, DOD has taken—or participated in—efforts to enhance department-wide cybersecurity of ICS. For instance, the United States Cyber Command and the Joint Test and Evaluation Program—under the Director, Operational Test and Evaluation, Office of the Secretary of Defense—initiated a collaborative effort in 2014 to develop a set of procedures to detect, mitigate, and respond to cyber incidents on DOD ICS perpetrated by advanced persistent threat actors, such as nation states. These procedures are intended to be employed by DOD installation personnel such as installation information technology managers and ICS facility engineers. An official from the command stated that the draft procedures will be tested at a joint exercise in June 2015 and expects the procedures to be completed by December 2015.

Also, according to our review of documents from the Department of Homeland Security and DOD—and discussions with officials from both agencies—DOD has undertaken efforts to better understand cyber threats to ICS that monitor and control DOD utility infrastructure on which DOD relies. In one example of such efforts, the Idaho National Laboratory—under the direction of the Department of Homeland Security and with participation from DOD—conducted the Aurora Test in 2007. This test demonstrated how catastrophic physical damage can be caused to utility infrastructure—in this case a diesel generator—from a remote location through an adversary’s exploitation of vulnerabilities in the ICS used to monitor and control electrical substations. After the test, the diesel generator was inspected and it was determined that it would not be capable of operation without extensive repairs or a complete overhaul. While not all generators are configured in the fashion of the Aurora Test, U.S. Cyber Command officials stated that the Aurora Test is applicable to DOD generators since some have the same equipment as discussed in the Aurora Test and that cyber methods can be used to misconfigure how this equipment operates causing damage or destruction to the equipment. Figure 10 shows a still photo from a video of the Aurora test.

DOD Updated Cybersecurity Guidance for Industrial Control Systems, and the Military Services Have Taken Initial Steps to Implement the Guidance

In addition to the guidance mentioned previously, DOD has developed guidance that addresses utility resilience with respect to the cybersecurity of ICS that control and monitor utility systems, and the military services have begun planning for its implementation.

In March 2014, the department issued DOD Instruction 8510.01, which establishes the policy for a risk management framework for all DOD information technology, including ICS. DOD Instruction 8510.01 replaces the previous DOD policy for information assurance, the DOD Information Assurance Certification and Accreditation Process, which primarily addressed security related to information technology systems. According to officials, the former accreditation process required that the communication connection between an ICS and a DOD communication network be accredited. However, it did not require ICS to be certified and accredited. DOD officials stated it would be very rare for any organization to have conducted an assessment of the cyber vulnerabilities of an ICS system on a DOD installation because—before DOD’s adoption of DOD Instruction 8510.01—ICS had not been a focus of security assessments. For example, according to a Navy and Marine Corps document, currently most Navy and Marine Corps ICS have very little in the way of security controls and cybersecurity measures in place.

According to a March 2014 DOD memorandum, for the first time DOD is now requiring that ICS be made secure against cyber attacks by implementing the Risk Management Framework. cybersecurity threats to ICS—discussed earlier in this report—DOD Instruction 8510.01 directs the DOD Chief Information Officer and the heads of each DOD component to oversee the implementation of the instruction. In addition, DOD Instruction 8510.01 states that DOD component heads must complete tasks such as, among others, conducting an impact-based categorization of existing ICS, assigning qualified personnel to risk management framework roles, and identifying and programming funding for the implementation in budget requests. According to DOD, by implementing DOD Instruction 8510.01, the military services will be able to identify vulnerabilities, adopt cybersecurity controls, and mitigate risks of cyber incidents on ICS that could cause potentially serious utility disruptions.

Memorandum from the Acting Deputy Under Secretary of Defense for Installations and Environment, Subject: Real Property-related Industrial Control System Cybersecurity (Mar. 19, 2014).

Instruction 8510.01. Air Force, Navy, and Marine Corps officials stated that they have polices that assess the cybersecurity of ICS, but that the policies do not cover the requirements in DOD Instruction 8510.01. In addition, Navy headquarters officials stated that they issued draft guidance in February 2015, which, according to these officials, outlines the Navy’s process for accreditation of ICS cybersecurity per requirements in DOD Instruction 8510.01.

Navy, Marine Corps, and Air Force officials stated that they are developing technical capabilities that will assist with the implementation of DOD Instruction 8510.01. For example, Air Force officials are developing a concept called ICSNet, which includes hardware and software designed to monitor ICS operations and provide intrusion-detection capabilities. Further, OSD officials stated that they are refining the Enterprise Mission Assurance Support Service tool, which manages certification and accreditation processes for DOD Instruction 8510.01, to better support ICS-specific requirements.

The Military Services Face Challenges Implementing Cybersecurity Guidance for Industrial Control Systems

The military services face three challenges—conducting an inventory of existing ICS; finding qualified personnel with the necessary skills to implement the cybersecurity requirements; and identifying funding needed to implement DOD Instruction 8510.01—related to their implementation of cybersecurity guidance for ICS. According to military service officials, the services have not yet implemented DOD Instruction 8510.01 and transitioning to the instruction is a complex and difficult task. Evidence of this difficulty is that—according to officials from the office of the DOD Chief Information Officer—DOD revised the original time frames to transition to DOD Instruction 8510.01 because they were unachievable. Specifically, the original time frames required the military services to transition ICS without a current accreditation to DOD Instruction 8510.01 by September 2014, among other things. DOD’s adjusted time frames allow the services until the second quarter of fiscal year 2018 to implement DOD Instruction 8510.01. According to Army officials, the adjusted time frames will allow the military services additional time to plan for the transition. However, even with the additional time, the services may be challenged to implement DOD Instruction 8510.01.

Military service headquarters officials stated that they are still developing an inventory of their services’ respective ICS. DOD Instruction 8510.01 requires that ICS should be categorized based on the potential impact on an organization. As part of this categorization, it is necessary to inventory the ICS and collect information about the system, such as the type of information collected and maintained on the system and technical aspects of the system, such as the type of operating system used. Military officials we spoke with explained that an inventory of ICS is an important tool for managing the various types and locations of ICS on military installations. Navy officials explained that a complete inventory of ICS would help headquarters officials communicate information about updated security vulnerabilities to system owners.

However, as of February 2015, none of the military services had a complete inventory of existing ICS. While each service is taking steps to obtain a complete inventory, the data collection process is challenging. For example, the Air Force is planning on issuing a data call to its installations in May 2015 and expects that the process will take 6 months to complete. Currently, Air Force officials stated that they are aware of 280 ICS across the Air Force and estimate that the total number of systems on active-duty Air Force bases is around 1,900. Marine Corps officials stated that they also issued a data call to their installations to collect information on the numbers and types of ICS, but the information that they received was only 80 percent complete. Marine Corps officials explained there are challenges that impeded their ability to collect the information. For example, officials stated that the management of ICS at the installation level is decentralized such that no one individual has visibility over all of the ICS on the installation. Navy officials stated they have an ICS inventory of about 18,000, which includes about 37,000 buildings. Officials stated that obtaining a complete list may be challenging without the authority to address all organizations on Navy installations. In addition, they stated that some tenants on Navy-operated installations do not wish to share information about their ICS. However, if the ICS owned by another service on a joint base—or by a tenant on Navy base—is connected to a Navy network, it may be a cybersecurity risk to the Navy installation. Also, Navy officials stated that it is still unclear which organizations on Navy bases have the responsibility for these types of ICS, and that the Navy will need to overcome these challenges if it is to have a complete ICS inventory.

Furthermore, officials from each military service stated that identifying personnel with the appropriate expertise will be a challenge due to a shortage of personnel with experience in both the operation and maintenance of ICS and in cybersecurity. DOD Instruction 8510.01 states that qualified personnel should be assigned to risk management framework roles. According to United States Cyber Command and military services headquarters officials, there are very few personnel that have both the cybersecurity technical skills and the skills regarding the operation and maintenance of ICS. Specifically, the Navy does not have the personnel with expertise to determine the necessary cybersecurity controls for each ICS or to maintain the cybersecurity controls for the ICS once they are in place. Air Force officials stated that the most important issue related to implementation of DOD Instruction 8510.01 for ICS at the installation level is the lack of a qualified staff member assigned the responsibility for ICS cybersecurity. Moreover, officials also identified a lack of available training to provide personnel with the necessary skills. For example, Army and Navy officials stated that the DOD training and certification classes currently available are specific to information technology systems such as desktop computers, and not to ICS. The Marine Corps has begun providing training to a limited number of personnel, but had to use training provided by the Department of Homeland Security’s Industrial Control System Cyber Emergency Response Team. Department of Homeland Security officials stated that they have limited capacity and are not funded or staffed to support the training needs of DOD.

Military service headquarters officials also stated there are several funding-related challenges to implement DOD Instruction 8510.01, including that implementation may require significant resources and costs involved in implementation have not been fully identified. DOD Instruction 8510.01 states that it is DOD policy that resources for implementing the DOD Risk Management Framework must be identified and allocated as part of the Defense planning, programming, budgeting, and execution process. For example, a required aspect of implementation is identifying resources to remediate or mitigate vulnerabilities discovered through the assessment process.

According to some estimates provided by the military service headquarters officials, implementing DOD Instruction 8510.01 for ICS will require substantial resources. For example, Navy officials estimated that the Navy will need “billions of dollars” to secure ICS over what they characterized as the long term, 10 to 20 years, which involves developing a standardized approach that helps protect ICS and implementing updates to systems so that the systems are operating within current cybersecurity standards.officials, this cost figure also includes all of the necessary training According to the involved and the creation of new positions. In addition, Marine Corps headquarters officials estimate that the cost to implement DOD Instruction 8510.01 could range between $3.8 million to $4.2 million per year for the “first few years” of implementation. The officials stated that these costs include funding to develop the technical capability that is being developed in partnership with the Navy and hiring contractor support to assess ICS against the cybersecurity standards.

Further, military service headquarters officials explained that the military services have not yet programmed funding for implementation. For example, Army officials stated that they anticipate including $2.5 million in the fiscal year 2017-2021 budget request to be used in fiscal year 2017 to conduct an inventory of ICS, however budget decisions have not yet been made for these budget years. Further, no funding is programmed for fiscal years 2015 and 2016. Navy officials stated that some tasks related to ICS cybersecurity have been funded using existing funds. For example, funds from the Navy Facilities Engineering Command’s working capital fund were used to pay for some ICS cybersecurity assessments. However, the Navy has not yet specifically programmed funds to implement DOD Instruction 8510.01. In addition, military service officials stated that they have not fully identified the costs involved in implementing DOD Instruction 8510.01 and face challenges in identifying those costs. For example, Army and Marine Corps officials stated that it is difficult to develop an accurate estimate of resources needed to support the implementation of DOD Instruction 8510.01 without a complete inventory and prioritization of ICS, which is not yet complete. Specifically, Marine Corps officials stated that while they have developed an estimate, it is still just their “best guess” based on available information. Furthermore, Air Force officials explained that one of the elements of the overall cost to implement DOD Instruction 8510.01 depends on the costs associated with the technical capability the Air Force is developing in order to implement DOD Instruction 8510.01. However, officials explained that they are still in the early stages of developing the capability and have not fully identified the costs. Without knowing the costs, officials explained that they cannot estimate the overall costs to implement DOD Instruction 8510.01.

Challenges with conducting an inventory of existing systems, identifying individuals with the necessary expertise, and programming and identifying funding to implement DOD Instruction 8510.01 may hamper the military services’ abilities to plan for and execute the implementation of DOD Instruction 8510.01 by the March 2018 time frame. For example, if the Air Force’s inventory is not completed until November 2015, it only has 28 months to transition an estimated 1,900 ICS to DOD Instruction 8510.01, which means that almost 70 ICS would need to be accredited each month to meet DOD’s time frames. In addition, given that there are three remaining fiscal years until DOD’s fiscal year 2018 deadline for fully transitioning to DOD Instruction 8510.01, the fact that the military services have not programmed for or fully identified transition costs means that the services may be at risk of not adequately funding key transition tasks. According to DOD’s April 2015 Cyber Strategy, because DOD’s capabilities cannot necessarily guarantee that every cyberattack will be denied successfully, the department must invest in resilient and redundant systems so that it may continue operations in the face of disruptive or destructive cyberattacks on DOD networks. Until DOD Instruction 8510.01 is implemented, DOD installations’ ICS remain vulnerable to exploitation because of a lack of cybersecurity controls. Vulnerabilities in ICS can be exploited by various methods causing loss of data, denial of service, or the physical destruction of infrastructure. For instance, as previously discussed, Stuxnet is an example of a computer worm, a method of cyberattack that can target ICS vulnerabilities. In 2010, Stuxnet targeted ICS used to manage centrifuges in an Iranian nuclear processing facility. According to DOD, the same type of ICS can be found in the critical infrastructure on numerous DOD installations. Without overcoming challenges related to completing inventories, acquiring and training personnel, and identifying and programming for funding, all of which are required under DOD Instruction 8510.01, the military services’ ICS may be vulnerable to cyber incidents that could degrade operations and negatively impact missions.

Conclusions

To support its operational missions, DOD depends on reliable access to electrical, potable water, wastewater, and natural gas utility services on its installations. As events of the past few years have demonstrated, this access can be disrupted by hazards such as extreme weather and mechanical failures. These extreme weather events may be further exacerbated by the impacts of climate change. In addition, as we and DOD have noted, utilities are vulnerable to threats from physical and cyber terrorism. Given the possibility of disruptions that result in serious operational impacts, decision makers in DOD and Congress need reliable information on the actual scope of disruptions in order to exercise oversight and ensure that resources are available to take necessary steps at installations and across the department to increase resilience. Without guidance that clarifies the reporting requirements of installations— including the need to fully report on all types of disruptions, including disruptions of nonelectrical utilities—and requires the inclusion of disruptions to DOD-owned utilities, decision makers may lack a comprehensive understanding of the types of utility disruptions on DOD installations. In addition, DOD and the military services have the opportunity to take steps that could improve the comprehensiveness and accuracy of the data they collect, such as assessing the effectiveness of the current 5-month data collection process. Data that are more complete and accurate are important, especially given that DOD has stated that the utility disruption data it collects have been used to support ongoing and future plans for resiliency initiatives. As our report indicates, installations have taken steps to mitigate the impacts of disruptions and increase resilience, with infrastructure that provides redundancy and through the implementation of utility resiliency guidance. However, DOD and the military services face several challenges in supporting the department’s effort to implement its Risk Management Framework for ICS. We recognize that DOD is in the early stages of this effort and that it plans on full implementation. Full implementation is important, since cyber attacks on ICS can lead to the loss of operational data and disruption of utility service. As previously discussed, we have identified long-standing challenges with the government’s cybersecurity efforts. Without taking steps now to conduct an inventory of existing ICS, identify individuals with the expertise needed to implement DOD Instruction 8510.01, and program and identify resources for implementation, the military services risk future delays in their efforts to plan and execute the steps necessary to protect installation infrastructure from utility disruptions that could have direct operational mission impacts.

Recommendations for Executive Action

In order to provide DOD and Congress with more comprehensive and accurate information on all types of utility disruptions, we recommend that the Secretary of Defense direct the Secretaries of the Army, Navy, and Air Force; the Commandant of the Marine Corps; and the Assistant Secretary of Defense for Energy, Installations and Environment to take the following two actions to provide more consistent guidance to the installations:

First, in guidance provided to their installations, the military services should clearly state that all disruptions lasting 8 hours or longer should be reported, regardless of the disruptions’ impact or mitigation. In addition, the military services and OSD should work together to revise the data collection template’s instructions, clarifying that disruptions in all four categories of utility service—electrical, potable water, wastewater, and natural gas—should be reported.

Second, the military services and OSD should revise the data collection template’s instructions to include reporting of disruptions caused by DOD-owned utility infrastructure.

Also, in order to improve the comprehensiveness and accuracy of certain data submitted by the military services to OSD and reported in the Energy Reports—such as potentially underreported data on mitigation costs and inaccurate data on both disruptions’ duration and cost—we recommend that the Secretary of Defense direct the Secretaries of Army, Navy, and Air Force, the Commandant of the Marine Corps, and the Assistant Secretary of Defense for Energy, Installations and Environment to work together to improve the effectiveness of data validation steps in DOD’s process for collecting and reporting utilities disruption data. For example, the military services and OSD could determine whether more time in the 5-month process should be devoted to data validation and whether equal priority should be given to validating all types of data included in the Energy Reports.

Further, in order to minimize the risk of delays in their efforts to implement DOD Instruction 8510.01, we recommend that the Secretary of Defense direct the Secretaries of the Army, Navy, and Air Force; and the Commandant of the Marine Corps to address challenges related to inventorying existing ICS, identifying personnel with the appropriate expertise, and programming and identifying funding, as necessary.

Agency Comments and Our Evaluation

We provided a draft of this report to DOD and the Department of Homeland Security for review and comment; both departments provided technical comments that we considered and incorporated as appropriate. DOD provided written comments on our recommendations, which are reprinted in appendix III.

In its written comments, DOD partially concurred with our first two recommendations (now combined as one recommendation), concurred with two recommendations, and non-concurred with one recommendation. DOD also stated that it did not agree with GAO’s analysis of the comprehensiveness and accuracy of the department’s reporting on utility disruptions in the June 2013 and 2014 Energy Reports. However, as discussed in this report, DOD’s collection and reporting of utilities disruption data are not comprehensive and some data are not accurate. For instance, in regard to comprehensiveness, we confirmed cases of installations in each military service that did not report on the commercial, external disruptions on which they are directed to report by DOD reporting guidance. Also, in regard to accuracy, there were inaccuracies in duration and cost data on disruptions reported by DOD. For example, more than 100 disruptions without complete information on duration account for almost 40 percent of the disruptions that DOD reported in the June 2013 and 2014 Energy Reports.

Our first recommendation—aimed at providing DOD and Congress with more comprehensive and accurate information on all types of utility disruptions—originally appeared as two recommendations in the draft report provided to DOD for comment. Based on that draft, DOD partially concurred, asking us to consider combining the two recommendations, because they both impact DOD guidance. DOD’s suggested combination of our first and second recommendations—as written in the department’s response—meets the intent of the original two recommendations. Thus, we have combined them into one recommendation, and in subsequent conversations with DOD, an OSD official confirmed that the department concurs with the combined recommendation. DOD’s written responses did not provide information on the timeline or specific actions it plans to take to implement our recommendations.

In regard to our recommendation originally appearing third—that OSD and the military services revise the data collection template’s instructions to include reporting of disruptions caused by DOD-owned infrastructure— DOD did not concur. The department stated that reporting on these disruptions provides a “low value proposition;” the data collected by the department for the Energy Reports is not being used to guide its strategic decisions; and collecting the data would be “onerous.” We disagree that collecting data on utility disruptions caused by DOD-owned infrastructure would be of low value. As discussed in the report, our research indicates that DOD-owned infrastructure, which DOD controls, may play a larger role in disruptions than indicated by the Energy Reports, which only address external, commercial disruptions involving equipment over which DOD has little control. For example, the installations we visited or contacted reported disruptions involving DOD infrastructure with significant impacts, such as delayed satellite launches at Vandenberg Air Force Base and almost $26 million in estimated repair costs at Naval Weapons Station Earle. In addition, DOD stated that the data we collected on utility disruptions caused by DOD-owned infrastructure only confirm trends in the data on external, commercial disruptions already collected by DOD. However, we continue to believe its Energy Reports may be missing a substantial number of disruptions by not including disruptions caused by DOD-owned infrastructure. Our analysis found that more than 85 percent of utility disruptions in our sample involved DOD-owned infrastructure on which DOD does not report in the Energy Reports. Further, the department stated that the utility disruption data it collects for the Energy Reports is not being used to guide strategic decisions. However, as previously discussed in our report, DOD has used utility disruption data collected for the Energy Reports to support a DOD- wide utility resilience initiative. This was a strategic-level decision, although based on limited information, since data on disruptions involving DOD-owned infrastructure were not collected for DOD’s annual reports. We believe that, if DOD takes actions to improve the comprehensiveness and accuracy of its utilities disruption data, the data could serve as a valuable tool in making additional well-informed utility resilience decisions. Collecting data on disruptions caused by DOD-owned infrastructure may give the department information on disruptions it has a greater ability to mitigate and DOD would have more complete information on which to make any future strategic decisions, such as the resiliency initiative discussed above. And, by collecting and reporting data on utility disruptions caused by DOD-owned infrastructure, the department would be giving Congress a more complete picture of disruptions on DOD installations. Finally, DOD stated that collecting data on disruptions caused by DOD-owned infrastructure would create an “onerous” reporting requirement that requires collection, review, and coordination across the department. However, DOD provided no evidence that collecting these additional data would be “onerous.” The installations we contacted were able to provide these data to us and DOD’s current data collection process already includes collection, review, and coordination across the department.

In regard to our recommendations originally appearing fourth and fifth— regarding improvements in DOD’s process for collecting and reporting utilities disruption data and addressing challenges in implementing DOD Instruction 8510.01, regarding ICS—DOD concurred. However, DOD did not provide information on the timeline or specific actions it plans to take to implement our recommendations.

DOD also requested that, in our recommendations, we remove references to the Marine Corps, because it is part of the Department of the Navy. In regard to the issues on which we made recommendations, the Marine Corps and Navy collaborate and take some shared actions, under the Department of the Navy. However, the Marine Corps and Navy also take actions that are specific to each military service. For example, the Marine Corps and Navy headquarters collect utilities disruption data from their installations through distinct processes and the two services have distinct plans for implementing DOD Instruction 8510.01. For this reason, we believe the recommendations are appropriately directed at the Marine Corps and Navy as separate military services.

We are providing copies to the appropriate congressional committees; the Secretaries of Defense, Homeland Security, the Army, the Navy, and the Air Force, the Commandant of the Marine Corps, and the Assistant Secretary of Defense for Energy, Installations, and Environment. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-4523 or leporeb@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV.

Appendix I: Scope and Methodology

To determine whether threats and hazards have caused utility disruptions on Department of Defense (DOD) installations—and if so—what impacts they have had, we reviewed various types of documents on utility disruptions and resulting impacts on installation operations. Examples of documents we reviewed include DOD and Department of Homeland Security assessments of utilities’ vulnerability to both hazards and threats, and DOD’s June 2013 and June 2014 Annual Energy Management Reports (Energy Reports). In addition, we interviewed or contacted officials from a nongeneralizable sample of 20 DOD installations from inside and outside the continental United States. To identify the installations for our sample, we took a number of steps. First, we reviewed military service data submitted to the Office of the Secretary of Defense (OSD) on utility disruptions that occurred on DOD installations from fiscal years 2012 to 2014 and lasted 8 hours or longer. According to our analysis of information provided by an OSD official, the military services account for about 87 percent of the utility disruptions reported to OSD for fiscal years 2012 to 2014. Because their installations account for a large majority of reported disruptions, we focus on the military services’ utility disruptions in this report. Because DOD’s data in its Energy Reports do not provide specific examples of disruptions and their impacts, we conducted independent research using publicly available information, such as news articles, the details of which we then asked officials from the military services to verify. We collected additional data on utility disruptions from 2005 to 2014 on installations inside and outside the continental United States, in order gather a large number of utility Next, we disruptions lasting 8 hours or longer, and their impacts.reviewed the military services’ data and the additional data we gathered, in order to select the 20 installations to include in our nongeneralizable sample. We selected installations based on whether the installations had more than one instance of utility disruption, or had a disruption of multiple types of utility service; and we chose installations from each military service. For installations inside the continental United States, we visited the sites, collected information in interviews, and gathered supporting documentation. For sites outside the continental United States, we collected written answers to the questions, along with supporting documentation. From the 20 installations, we gathered information on utility disruptions and their impacts; actions they had taken to mitigate such impacts; and implementation of selected pieces of DOD utility resilience guidance, discussed in more detail below. As discussed above, the installations in our sample provided information on utility disruptions from 2005 to 2014, lasting 8 hours or longer. In our sample of 20 installations, 18 installations reported a total of 150 disruptions lasting 8 hours or longer that occurred in fiscal years 2012, 2013, or 2014; 2 installations reported disruptions lasting 8 hours or longer that occurred Although the information we collected was not prior to fiscal year 2012.representative of all installations, the selection of these installations provided valuable insights for our review. In addition, we assessed the reliability of all computer-generated data provided by the installations in our sample by reviewing existing information about the data and the systems that produced the data and by interviewing agency officials knowledgeable about the data to determine the steps taken to ensure its completeness and accuracy. We determined that these data were sufficiently reliable for the purposes of presenting the number and certain characteristics of utility disruptions, as reported by officials from installations in our sample. However, as noted in our report, we determined those utilities disruption data reported by DOD in its June 2013 and June 2014 Energy Reports were not sufficiently reliable for the purpose of comprehensively or accurately presenting the total number, average duration, or cost of utility disruptions. Table 2 lists the installations we visited or contacted and their locations.

To determine the extent to which DOD’s collection and reporting of information on utility disruptions is comprehensive and accurate, we reviewed the statutory reporting requirement for the Energy Reports, compared the military services’ data submissions for fiscal years 2012 through 2014 with information we collected from the installations we visited or contacted, and reviewed DOD’s process for collecting and reporting on this data. DOD is statutorily required to report on—among other things—the total number and location of utility outages on installations. To respond to this requirement, the military services provide information to OSD. We reviewed the military services’ submissions of as well utility disruption data to OSD for fiscal years 2012 through 2014,as the June 2013 and June 2014 Energy Reports in which DOD reported these data. We reviewed these two reports because, at the time of our review, DOD had not yet issued its June 2015 report. To identify the comprehensiveness of DOD’s reporting, we compared the military services’ data submissions to OSD with the independent research we conducted at 20 installations in our sample, as described above. When comparing the data from our sample with the military service data submitted to DOD, we included only the 150 disruptions that occurred on the sample’s installations from fiscal years 2012 through 2014. In addition, we reviewed DOD instructions on the data submissions that provide information to the military services on the scope and type of information the military services and their installations are supposed to submit to OSD. We then compared the services’ submissions to DOD instructions for installations that provided these data. Our comparison covered the 3 years the military services submitted data for DOD’s Energy Reports, fiscal years 2012 through 2014. Also, we reviewed documentation of OSD’s validation of the military services’ submissions. In addition, we met with officials at installations from our sample, the military services’ headquarters, and OSD to discuss how utilities data were collected, validated, and reported. We also discussed the data validation processes used by officials at both the military services’ headquarters and OSD. Further, to determine how DOD uses these utilities disruption data, we reviewed the June 2013 and June 2014 Energy Reports and met with officials at both the military services’ headquarters and OSD. Finally, we compared DOD’s processes for the collection, validation, reporting, and use of these data to several leading practices for the use and management of data and process improvement. Sources for these leading practices include the Standards for Internal Control in the Federal Government; our previous work that discusses improvement of infrastructure planning processes to better account for climate change impacts and improvement in the accuracy and completeness of data used to meet reporting requirements; and the Project Management Institute.

To determine the extent to which DOD has taken actions and developed and implemented guidance to mitigate risks to operations at its installations in the event of utility disruption, we collected and reviewed DOD documents related to actions taken to mitigate risks, utility resilience guidance, and implementation efforts. We collected these documents from the 20 installations in our nongeneralizable sample and from the military service headquarters. To determine the extent to which DOD has taken actions to mitigate risks to operations at its installations in the event of utility disruptions, we reviewed documents such as those describing backup generators on installations and the refueling plans for those generators. We also reviewed documents describing installations’ plans for situations in which utility service is disrupted, to include emergency management plans. To determine DOD guidance related to utility resilience, we reviewed Defense Energy Program Policy Memorandum 92-1, DOD Instruction 2000.16, DOD Antiterrorism (AT) Standards (Oct. 2, 2006, incorporating change Dec. 8, 2006), DOD Instruction 4170.11, Installation Energy Management (Dec. 11, 2009), DOD Directive 3020.40, DOD Policy and Responsibilities for Critical Infrastructure (Jan. 14, 2010, incorporating change Sept. 21, 2012). In addition, we also reviewed documents related to the installations’ implementation steps, such as vulnerability analyses that cover all threats and hazards. In addition, we met with officials from our sample of installations, and from military service headquarters to discuss actions taken to mitigate risks of utility disruptions, identify guidance related to utility resilience, and to identify steps taken to implement the guidance. Furthermore, we collected and reviewed DOD documents and guidance related to cybersecurity of industrial control systems (ICS), which are often used to monitor and control utility infrastructure on DOD installations. Specifically, we reviewed DOD Instruction 8510.01, Risk Management Framework (RMF) for DOD Information Technology (IT) (Mar. 12, 2014). We reviewed documentation from OSD and the military services regarding cybersecurity of ICS, to include briefings and acquisition documents. We collected additional information from the Department of Homeland Security’s Industrial Control System Cyber Emergency Response Team, to include documents describing common vulnerabilities of ICS. Also, we met with officials from the military services’ and DOD’s Offices of the Chief Information Officer, officials from the military services’ headquarters offices, and OSD to discuss actions DOD had taken to begin implementation of DOD Instruction 8510.01 and challenges regarding implementation. Finally, we compared DOD’s implementation actions to the implementation goals in DOD Instruction 8510.01.

We conducted this performance audit from June 2014 to July 2015, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Previous GAO Work on the Vulnerabilities of Utility Infrastructure

Previous GAO work has examined the federal government’s efforts to manage the physical security of the nation’s critical infrastructure and the vulnerabilities of the systems that support critical infrastructure, including the commercial electric grid, to cyber attacks.

In October 2009, we reported that DOD’s most critical assets are vulnerable to electrical power disruptions, but that DOD lacks sufficient information to determine the full extent of its vulnerability. We recommended that DOD complete vulnerability assessments and develop guidelines for assessing the critical assets’ vulnerabilities to long-term electrical power disruptions, among other things. In June 2011, DOD implemented this recommendation by updating guidance for the execution of vulnerability assessments and issued a timeline to ensure the accomplishment of tasks and to provide feedback to components on the status of actions, including electrical power-related risks and vulnerabilities.

GAO, Critical Infrastructure Protection: DHS Could Better Manage Security Surveys and Vulnerability Assessments, GAO-12-378 (Washington, D.C.: May 31, 2012). approach to delivering this information to improve timeliness. Regarding potable water, in 2005, we found that community water systems faced obstacles in implementing security measures, including insufficient financial resources to implement security enhancements and determining how best to use available funds given competing priorities such as non- security-related infrastructure upgrades. We did not make any recommendations in this report. In regard to wastewater, we reported in 2006 that these facilities have made security improvements but they have been limited, and that additional coordination among the Environmental Protection Agency and Department of Homeland Security regarding initiatives to enhance wastewater facility security is needed. We recommended that these two agencies, among others, identify how to reduce overlap and duplication and how access to timely security threat information could be improved. The Environmental Protection Agency implemented this recommendation by updating the Water Information Sharing and Analysis Center, which improved access to timely and authoritative security threat information.

In January 2011, we also reported on the vulnerabilities of the systems that support critical infrastructure including the commercial electric grid to cyber attacks. Specifically, we identified several challenges to securing electricity systems and networks, including a lack of a coordinated approach to monitor industry compliance with voluntary standards, a focus by utilities on regulatory compliance instead of comprehensive security, and a lack of security features consistently built into systems. We made recommendations to the Federal Energy Regulatory Commission to address these challenges by periodically evaluating the extent to which utilities are following voluntary cybersecurity standards and developing strategies for addressing any gaps in compliance with these standards, among other things. While the Federal Energy Regulatory Commission agreed with these recommendations, they have not yet been implemented.

Additionally, in December 2014 we reported that federal facilities’ industrial control systems (ICS) are vulnerable to cyber attacks.Specifically, we reported that these ICS—used to control things such as heating, ventilation, air conditioning, and electronic card readers—are increasingly being connected to the Internet and their vulnerability to potential cyber attacks is also increasing. We found that the Department of Homeland Security had not developed a strategy that defines the problem; roles and responsibilities; necessary funds; and a methodology for assessing the cyber risk. We recommended that the Department of Homeland Security develop a strategy with these components to address the cyber risk to these ICS. The department concurred with this recommendation and stated that it will develop a strategy.

Appendix III: Comments from the Department of Defense

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Laura Durland, Assistant Director; Ben Atwater; Hilary Benedict; Carolynn Cavanagh; Peter Haderlein; Karl Maschino; Steven Putansu; Jeanett Reid; Amie Steele; Christopher Turner; Erik Wilkins-McKee; Michael Willems; and Gregory Wilshusen made key contributions to this report.

Related GAO Products

High-Risk Series: An Update. GAO-15-290. Washington, D.C: February 11, 2015.

Federal Facility Cybersecurity: DHS and GSA Should Address Cyber Risk to Building and Access Control Systems. GAO-15-6. Washington, D.C: December 12, 2014.

Critical Infrastructure Protection: DHS Action Needed to Enhance Integration and Coordination of Vulnerability Assessment Efforts. GAO-14-507. Washington, D.C.: September 15, 2014.

Maritime Critical Infrastructure Protection: DHS Needs to Better Address Port Cybersecurity. GAO-14-459. Washington, D.C.: June 5, 2014.

Climate Change Adaptation: DOD Can Improve Infrastructure Planning and Processes to Better Account for Potential Impacts. GAO-14-446. Washington, D.C.: May 30, 2014.

Information Security: Agencies Need to Improve Cyber Incident Response Practices. GAO-14-354. Washington, D.C.: April 30, 2014.

Climate Change: Energy Infrastructure Risks and Adaptation Efforts. GAO-14-74. Washington, D.C.: January 31, 2014.

Cybersecurity: National Strategy, Roles, and Responsibilities Need to Be Better Defined and More Effectively Implemented. GAO-13-187. Washington, D.C.: February 14, 2013.

Critical Infrastructure Protection: DHS Could Better Manage Security Surveys and Vulnerability Assessments. GAO-12-378. Washington, D.C.: May 31, 2012.

Cybersecurity: Threats Impacting the Nation. GAO-12-666T. April 24, 2012.

Critical Infrastructure Protection: Cybersecurity Guidance Is Available, but More Can Be Done to Promote Its Use. GAO-12-92. Washington, D.C.: December 9, 2011.

Cybersecurity: Continued Attention Needed to Protect Our Nation’s Critical Infrastructure. GAO-11-865T. Washington, D.C.: July 26, 2011.

Electricity Grid Modernization: Progress Being Made on Cybersecurity Guidelines, but Key Challenges Remain to be Addressed. GAO-11-117. Washington, D.C.: January 12, 2011.

Critical Infrastructure Protection: Key Private and Public Cyber Expectations Need to Be Consistently Addressed. GAO-10-628. Washington, D.C.: July 15, 2010.

Defense Critical Infrastructure: Actions Needed to Improve the Identification and Management of Electrical Power Risks and Vulnerabilities to DOD Critical Assets. GAO-10-147. Washington, D.C.: October 23, 2009.

Information Security: TVA Needs to Address Weaknesses in Control Systems Networks. GAO-08-526. Washington, D.C.: May 21, 2008.