Influenza Pandemic: Key Securities Market Participants Are Making Progress, but Agencies Could Do More to Address Potential Internet Congestion and Encourage Readiness
Released: 2009-10-26T00:00:00

Letter

Background

An influenza pandemic can occur when an existing virus mutates into a novel strain that is highly transmissible among humans, leading to outbreaks worldwide. Such strains can be highly pathogenic because there is little or no pre-existing immunity in the population. Some of the issues associated with the preparation for and responses to an influenza pandemic are similar to those for any other type of disaster or hazard. However, a pandemic poses some unique challenges. Unlike incidents that are discretely bounded in space or time (e.g., most natural or man-made disasters), an influenza pandemic is an event likely to come in waves, each lasting weeks, months, or years, and pass through communities of all sizes across the nation and the world. While a pandemic will not directly damage physical infrastructure such as power lines or computer systems, it could threaten critical systems by potentially removing the essential personnel needed to operate them from the workplace for weeks or months. The World Health Organization (WHO) and the U.S. Centers for Disease Control and Prevention (CDC) have said that in a severe pandemic, the absences of those who are ill, taking care of ill family members, and fearing infection could reach a projected 40 percent during the peak weeks of a community outbreak, with lower rates of absence during the weeks before and after the peak. In addition, an influenza pandemic could result in 200,000 to 2 million deaths in the United States, depending on its severity. Although representing a novel strain of flu, the H1N1 outbreak, first detected in the United States around April 2009, has caused illness ranging from mild to severe. While most people who have been sick have recovered without needing medical treatment, hospitalizations and deaths from infection with this virus have occurred, and recent CDC news bulletins have indicated the second wave of the disease potentially could be more severe, especially for children and other at-risk groups.

As with most disasters, the initial governmental response to a pandemic will be at the state and local level and will aim to decrease people’s exposure to the virus. Initial responses may include encouraging and facilitating good hand hygiene, requiring ill individuals to isolate themselves, educating people about conditions that put them at high risk for complications, encouraging early treatment, and encouraging creative solutions to increase the distance between people at school and work. Under conditions of increased severity of illness, government response could escalate to include more aggressive actions such as closing schools, shutting down public transportation, and prohibiting large public gatherings at venues such as sporting events. These measures are intended to create “social distance” between people to prevent large numbers of people coming into direct contact in an attempt to minimize transmission of the disease. Similarly, individual organizations are also advised to increase the distance between people in workplaces. At the federal level, the National Strategy for Pandemic Influenza Implementation Plan calls for the Secretary of HHS to lead the federal medical response to a pandemic, and the Secretary of DHS to lead the overall domestic incident management and federal coordination.

Various Agencies Have Responsibility for Ensuring That Critical Telecommunications and Financial Sector Infrastructures Are Protected

Protecting the nation’s critical infrastructure against natural and manmade catastrophic events, including pandemic, has been a concern of the federal government for over a decade. Several federal policies address the importance of coordination between the government and the private sector in critical infrastructure protection. Homeland Security Presidential Directive 7 (HSPD-7), issued in December 2003, identifies various federal agencies, including DHS, as having responsibility for ensuring that steps are taken to protect specific critical infrastructure sectors of the United States. HSPD-7 makes DHS responsible for, among other things, coordinating national critical infrastructure protection efforts and establishing uniform policies, approaches, guidelines, and methodologies for integrating federal infrastructure protection and risk management activities within and across these sectors.

In addition to other sectors, DHS is the lead federal agency for two critical infrastructure sectors—information technology (IT) and communications—that are important for the Internet. Specifically, the entities within DHS responsible for coordinating national efforts to promote critical infrastructure protection activities for those sectors are the National Cyber Security Division and the Office of the Manager of the National Communications System (NCS), respectively. Although the vast majority of Internet infrastructure is owned and operated by the private sector, federal policy recognizes the need to be prepared for the possibility of debilitating disruptions in cyberspace. With the exception of the Department of Defense and intelligence community networks, DHS is the central coordinator for cyberspace security efforts and has responsibility for developing an integrated public-private plan for Internet recovery. FCC, which was established under the Communications Act of 1934 to regulate interstate and international communications by radio, television, wire, satellite, and cable—also oversees the telecommunications infrastructure on which the Internet depends. Because the functioning of the financial markets is important for our nation’s economy, the financial sector is one of the infrastructure sectors that has been designated as critical. Finally, under HSPD-7, the Department of the Treasury (Treasury) is responsible for infrastructure protection activities specifically within the banking and finance sector.

Private Companies Provide the Networks That Comprise the Internet

The public Internet infrastructure is owned and operated primarily by private companies such as telecommunications companies, cable companies, and other Internet service providers. It is a network of many networks used around the world to communicate and share computing resources, engage in commerce, do research, and provide entertainment. As shown in figure 1, the various networks that make up the Internet include the national backbone and regional networks, as well as the residential Internet access networks and the networks run by individual businesses, or “enterprise” networks. The national backbone providers transmit data over long distances using high-speed fiber-optic lines. Because these providers do not service all locations worldwide, regional network providers provide regional service to supplement the long-haul traffic. When a user wants to access a Web site or send an e-mail to someone who is connected to the Internet through a different service provider, the data must be transferred between networks. Data travels from a user’s home computer to the Internet through various means, including coaxial cable, digital subscriber line (DSL), satellite, fiber, or wirelessly to a provider’s facility where it is aggregated with other users’ traffic. Data cross between networks at Internet exchange points, which can be either hub points where multiple networks exchange data or private interconnection points. At these exchange points computer systems called routers determine the optimal path for the data to reach their destination. The data then continue through the national and regional networks and exchange points, as necessary, to reach the recipient’s Internet service provider and the recipient.

A functioning Internet will be important during a pandemic because it could be one important way that governments and private entities share necessary information with the public. Using the Internet to allow people to communicate effectively without coming together physically would assist in creating “social distance” to reduce the potential for illness to further spread. In addition, many organizations, including DHS, have been advocating that businesses and other enterprises consider increased use of telework by their workforce as a way to continue operations while maintaining physical separation from other workers during a pandemic. Doing so would typically involve employees working from home and accessing their business’s networks over an Internet connection. Some entities have also advocated the use of the Internet as a means for reducing the social isolation that could arise when people are asked to avoid contact with others.

Functioning Securities Markets Require Participation by Various Types of Organizations

For the U.S. securities markets to function, ensuring that companies can raise capital to carry on commerce and investors can obtain returns on their savings for spending on necessities or for retirement security, various organizations must be able to operate. Individual investors and institutions such as mutual funds send their orders to buy and sell stocks and options to broker-dealers that, in turn, route these orders to be executed at one of the many exchanges or electronic trading venues in the United States and abroad. After a securities trade is executed, it undergoes clearance and settlement to verify the accuracy of the transaction. Ownership of the securities is then transferred from the seller to the buyer, and the necessary payment between the two parties is exchanged. Separate organizations complete the clearance and settlement process for stocks and for options. In general, a clearing organization collects and compares trade information to ensure the accuracy of the trade and calculates the amounts that are to be exchanged between parties. A depository organization then transfers ownership and maintains the records of securities held by broker-dealers and investors. To facilitate these interactions, the large broker-dealers have accounts directly with the clearing organizations, while smaller and independent broker-dealers act as introducing firms by sending their customers’ orders to an intermediary broker-dealer, known as a clearing firm, that accepts and processes the trades and clears and settles these trades with the central clearing organization. The clearing firm’s systems also maintain the records of the cash and securities holdings of the introducing broker-dealers, and their investor customers.

The monies transferred as part of securities transactions are handled by the banks that maintain accounts for broker-dealers and accept and make payments for these firms’ securities activities. Payment processing systems operated by the Federal Reserve or private firms process the payments that are exchanged between the clearing banks used by the clearing organizations, broker-dealers, and their customers. Virtually all of the information processed is transferred electronically between parties; clearance and settlement and payment transactions take place over proprietary networks that do not traverse the public Internet infrastructure. Figure 2 illustrates how these various organizations participate in a trade.

Although thousands of entities are active in the U.S. securities markets, certain key organizations are more critical to the ability of the markets to function, usually because they offer unique products or perform vital services. For example, markets cannot function without the activities performed by clearing organizations and in some cases, only one clearing organization exists for particular products. In addition, other market participants are critical to overall market functioning because they consolidate and distribute price quotations or information on executed trades. The inability of any one broker-dealer firm to continue operations during an event would not likely affect the markets as a whole, but a small number of large broker-dealers generally account for sizeable portions of the daily trading volume on many exchanges. If several of these large firms were unable or unwilling to operate, the markets might not have sufficient trading volume to function in an orderly or fair way. U.S. securities markets have evolved in the last decade, with trading occurring at a larger number of venues, including existing exchanges, electronic markets, and alternative trading networks operated by broker-dealers or others. As a result, the criticality of some participants to the overall functioning of the markets likely has changed since we began reviewing these issues in 2001, but all continue to play significant roles in U.S. markets.

Several Organizations Oversee the Various Securities Market Participants

Various regulators oversee securities market participants: SEC regulates the stock and options exchanges and the clearing organizations for those products. In addition, SEC issues rules and oversees the broker-dealers that trade on those markets and other participants, such as mutual funds, which are active investors.

Self-regulatory organizations also oversee broker-dealers directly and are responsible for ensuring that their members comply with the securities laws and these organizations’ own rules. FINRA is the primary self- regulatory organization for securities firms conducting business in the United States. As part of its responsibilities, this regulator conducts examinations of its members to ensure compliance with its rules and federal securities laws.

The clearing banks that maintain accounts on behalf of securities market participants are overseen primarily by two different regulators. The Federal Reserve oversees bank holding companies and state-chartered banks that are members of the Federal Reserve System. The Office of the Comptroller of the Currency examines nationally chartered banks.

Securities Market Organizations and Regulators Have Been Addressing Threats to Critical Market Operations since 2001

As we reported in a series of reports issued since the September 11, 2001 terrorist attacks, securities market organizations have made significant progress in addressing various threats with the potential to disrupt their operations. As we reported in 2007, the group of organizations that we considered critical to overall operations of the securities markets— including exchanges, clearing organizations, and payment processors— have acted to significantly reduce the likelihood of physical disasters disrupting the functioning of U.S. securities markets. For example, all these organizations had developed the capability to perform their critical functions at alternate sites geographically dispersed from their primary sites. They all also had improved their physical and information security measures. The broker-dealers and clearing services banks that account for significant trading volumes had also taken steps to increase the distances between their sites for primary and backup operations for clearance and settlement activities and established dispersed backup trading locations.

Market participants have also worked with financial regulators and other organizations on other efforts to improve the overall resiliency of the financial sector; these include periodically conducting industry-wide connectivity testing from backup locations. Coordinated by the Securities Industry and Financial Markets Association and other groups, these tests verify the ability of market participants to operate through an emergency using backup sites, recovery facilities, and backup communications capabilities across the industry; and to provide participants with an opportunity to exercise and check the ability of their backup sites to successfully transmit and receive communications between the backup sites of other market participants. In the 2008 test, more than 250 organizations, including broker-dealers, markets, service bureaus, and industry utilities participated, with test participants representing more than 85 percent of normal market volume. Overall, almost 98 percent of test connections among participants were successful. Financial market organizations have also taken steps to be better prepared for physical or information security attacks. For example, DHS’s Office of Infrastructure Protection assisted some financial market organizations by conducting assessments of the physical security measures these organizations were taking to prevent damage by physical attacks, including reviewing these organizations’ facilities and their physical security measures such as surveillance, perimeter, and intrusion technologies. Officials from Treasury and representatives of selected financial markets also participated in exercises conducted by DHS that involved tabletop events that were intended to create lifelike scenarios of disasters or cyber attacks. These exercises were to help participants better understand the effect of cross-sector dependency (or interdependencies) during such events.

To assist in infrastructure protection issues, representatives from a broad range of financial regulatory agencies formed the Financial and Banking Information Infrastructure Committee (FBIIC). This group meets regularly to communicate information and coordinate efforts among the financial regulators and enhance the resiliency of the financial sector. In addition, representatives of the financial trade associations and other entities share information relating to infrastructure protection among financial market participants through the Financial Services Sector Coordinating Council for Critical Infrastructure Protection and Homeland Security (FSSCC). Formed in 2002, FSSCC acts as the private sector council that assists Treasury in addressing critical infrastructure protection issues within the banking and finance sector. FSSCC works to help reinforce the financial services sector’s resilience against terrorist attacks and other threats to the nation’s financial infrastructure. FSSCC has published reports summarizing best practices and lessons learned for issues of common concern to the industry at large. Members of FSSCC also meet periodically with the financial regulators to share information about common concerns and challenges. Financial market organizations also have received consolidated information through other sources. For example, the Financial Services Information Sharing and Analysis Center (FS/ISAC) consolidates threat information for the sector.

The financial sector has also taken steps to ensure that key officials from financial regulators and financial market organizations will be able to communicate during disasters. Under the Government Emergency Telecommunications Service (GETS) Program, participating staff receive a card that provides them with a code that can be dialed to increase the priority of telephone calls they place during crises. To better ensure that critical communication among financial market participants occurs, FBIIC issued an interim policy on the GETS Card Program in July 2002 that outlines how staff from financial institutions can obtain such cards. To qualify for GETS sponsorship, the FBIIC policy states that organizations must perform functions critical to the operation of key financial markets. This priority currently is only available for voice calls and not for data communications over the Internet. Another FBIIC telecommunications effort involves the FCC’s Telecommunications Service Priority (TSP) Program, which is used to identify and prioritize telecommunication services that support national security or emergency preparedness missions. Under TSP, private-sector organizations, through the sponsorship of a selected group of federal agencies, including SEC and the Federal Reserve, can have some of their key telecommunications circuits added to an inventory maintained by NCS that will provide increased priority for restoration of these key circuits in the event of a disruption.

Internet Congestion During a Severe Pandemic That Hampers Teleworkers Is Anticipated, but Responsible Government Agencies Have Not Developed Plans to Address Such Congestion and May Lack Clear Authority to Act

Increased use of the Internet by students, teleworkers, and others during a severe pandemic is expected to create congestion in Internet access networks that serve metropolitan and other residential neighborhoods. For example, localities may choose to close schools and these students, confined at home, will likely look to the Internet for entertainment, including downloading or “streaming” videos, playing online games, and engaging in potential activities that may consume large amounts of network capacity (bandwidth). Additionally, people who are ill or are caring for sick family members will be at home and could add to Internet traffic by accessing online sites for health, news, and other information. This increased and sustained recreational or other use by the general public during a pandemic outbreak will likely lead to a significant increase in traffic on residential networks. If theaters, sporting events, or other public gatherings are curtailed, use of the Internet for entertainment and information is likely to increase even more. Furthermore, the government has recommended teleworking as an option for businesses to keep operations running during a pandemic. Thus, many workers will be working from home, competing with recreational and other users for bandwidth.

According to a DHS study and Internet providers, this additional pandemic-related traffic is likely to exceed the capacity of Internet providers’ network infrastructure in metropolitan residential Internet access networks. Residential Internet users typically connect their computers to their Internet service providers’ network through a modem or similar Internet access device. These Internet access devices route home users’ traffic to a network device that aggregates it with that of other users before forwarding it to the other parts of the provider’s network and its ultimate destination on the Internet. As shown in figure 3, the traffic aggregating device differs depending on the technology used for Internet access—DSL, a cable network, or other means. But all these technologies use network architectures that basically aggregate the traffic of multiple users on a single device that then routes it to other parts of the providers’ networks. For example, within a DSL network architecture, the user’s traffic travels on a dedicated pair of copper wires from a home computer to the provider’s location—usually known as a central office—which houses a device called the digital subscriber line access multiplexer (DSLAM). The DSLAM aggregates this traffic and that of other users of this provider from individual residential neighborhoods before sending it on to regional networks and eventually to the national Internet backbone. Traffic from home users who connect to the Internet through a cable provider moves from the home computer over coaxial cables and fiber optic cables then ultimately to a network device known as a cable modem termination system (CMTS). The CMTS also aggregates this traffic with that of other users from other individual residential neighborhoods and sends it to the regional networks and the national Internet backbone. During a pandemic, congestion is most likely to occur in the traffic to or from the aggregation devices that serve residential neighborhoods, interfering with teleworkers’ and others’ ability to use the Internet.

Congestion affecting home users is likely to occur because the parts of providers’ DSL, cable, satellite, and other types of networks that provide access to the Internet from residential neighborhoods are not designed to carry all the potential traffic that users could generate in a particular neighborhood or that all connect to a particular aggregating device for efficiency and cost reasons. Providers do not build networks to handle 100 percent of the total traffic that could be generated because users are neither active on the network all at the same time, nor are they sending maximum traffic at all times. Instead, providers use statistical models based upon past users’ patterns and projected growth to estimate the likely peak load of traffic that could occur and then design and build networks based on the results of the statistical model to accommodate at least this level. According to one provider, this engineering method serves to optimize available capacity for all users. For example, under a cable architecture, 200 to 500 individual cable modems may be connected to a provider’s CMTS, depending on average usage in an area. Although each of these individual modems may be capable of receiving up to 7 or 8 megabits per second (Mbps) of incoming information, the CMTS can transmit a maximum of only about 38 Mbps. Providers’ staff told us that building the residential parts of networks to be capable of handling 100 percent of the traffic that all users could potentially generate would be prohibitively expensive.

A 2007 DHS study that was conducted in cooperation with various government, communication sector, and financial sector entities used modeling of residential and other network configurations to confirm that the increased traffic generated in neighborhoods during a severe pandemic is likely to exceed the capacity of the providers’ aggregation devices in metropolitan residential neighborhoods. The study examined the technical feasibility of the pandemic telecommuting strategy advocated by the government. The study also focused on identifying action plans to better prepare the nation for telecommuting during an influenza pandemic. As part of the study, a model was developed using data and assumptions from a large U.S. metropolitan area to represent a typical Internet provider’s network configuration, including devices and network capacities. For cost reasons, the study used DSL network architecture for the purposes of the congestion modeling, but the preparers acknowledged that other means of accessing the Internet had similar architectures and thus the impact of a pandemic would be similar. The contractors that prepared the study simulated Internet traffic in amounts that corresponded to the level of Internet use in a residential neighborhood under three scenarios of pandemic severity—20, 40, and 90 percent absenteeism from the workplace. The study’s model predicted that at the 40 percent absenteeism level—the level that health organizations have indicated is likely under a relatively serious pandemic—the highest point of congestion across the entire Internet infrastructure could occur within residential Internet access networks. Specifically, at the 40 percent absenteeism level, the study predicted that most users within residential neighborhoods would likely experience congestion when attempting to use the Internet. Based on our assessment of the study, we concluded that the methodology applied and the likely congestion points identified were reasonable. Furthermore, communication sector representatives we interviewed confirmed the likelihood of Internet congestion between a user’s home and the point at which that traffic combines with other users at the providers’ aggregation devices. Although this study assessed the impact on a large city, the severity of congestion could vary across neighborhoods or nationally depending on the capacities of residential neighborhood Internet access networks, with cities or areas with larger populations and higher incomes generally having large broadband capacities and less-populated rural or poorer areas possibly having less broadband capacity. However, the study used typical telecommunications network configurations for a large U.S. city and found that congestion was likely. As a result, we believe that its findings mean that most other locations in the United States could experience similar problems.

Although predicting that the most severe congestion would occur within residential access networks, the study overseen by DHS also noted that pandemic-related congestion was possible in other parts of the networks that comprise the Internet. For example, users could experience congestion at the point at which traffic is transferred between service providers because of potential differences in transmission capacity. Additionally, teleworkers connecting to their companies’ networks (the “enterprise” networks) could overload various components of these networks, such as the devices that provide security—firewalls—or servers that provide access to various applications because some businesses’ networks may not have scaled these devices to accommodate the anticipated increase in telecommuting traffic during a pandemic. The steps being taken by financial organizations to ensure their enterprise networks are prepared for pandemic levels of use are discussed later in this report.

Providers’ Options for Reducing Internet Congestion Are Limited and Could Require Government Action

Providers’ options for addressing expected pandemic-related Internet congestion include providing extra capacity, using network management controls, installing direct lines to organizations, temporarily reducing the maximum transmission rate, and shutting down some Internet sites. Each of these methods is limited either by technical difficulties or questions of authority. In the normal course of business, providers attempt to address congestion in particular neighborhoods by building out additional infrastructure—for example, by adding new or expanding lines and cables. Internet provider staff told us that providers determine how much to invest in expanding network infrastructure based on business expectations. If they determine that a demand for increased capacity exists that can profitably be met, they may choose to invest to increase network capacity in large increments using a variety of methods such as replacing old equipment and increasing the number of devices serving particular neighborhoods. Providers will not attempt to increase network capacity to meet the increased demand resulting from a pandemic, as no one knows when a pandemic outbreak is likely to occur or which neighborhoods would experience congestion. Staff at Internet providers whom we interviewed said they monitor capacity usage constantly and try to run their networks between 40 and 80 percent capacity at peak hours. They added that in the normal course of business, their companies begin the process to expand capacity when a certain utilization threshold is reached, generally 70 to 80 percent of full capacity over a sustained period of time at peak hours.

However, during a pandemic, providers are not likely to be able to address congestion by physically expanding capacity in residential neighborhoods for several reasons. First, building out infrastructure can be very costly and takes time to complete. For example, one provider we spoke with said that it had spent billions of dollars building out infrastructure across the nation over time, and adding capacity to large areas quickly is likely not possible. Second, another provider told us that increasing network capacity requires the physical presence of technicians and advance planning, including preordering the necessary equipment from suppliers or manufacturers. The process can take anywhere from 6 to 8 weeks from the time the order is placed to actual installation. According to this provider, a major constraint to increasing capacity is the number of technicians the firm has available to install the equipment. In addition to the cost and time associated with expanding capacity, during a pandemic outbreak providers may also experience high absenteeism due to staff illnesses, and thus might not have enough staff to upgrade network capacities. Providers said they would, out of necessity, refrain from provisioning new residential services if their staff were reduced significantly during a pandemic. Instead, they would focus on ensuring services for the federal government priority communication programs and performing network management techniques to re-route traffic around congested areas in regional networks or the national backbone. However, these activities would likely not relieve congestion in the residential Internet access networks.

Providing critical employees direct connections that bypass residential congestion may be another option for facilitating telework during a pandemic, but this option can be cost prohibitive to employers and is not widely used. Specifically, some providers offer network solutions such as private lines to businesses and governments. Private line services allow businesses to run their corporate networks and applications separately from public Internet traffic and could provide a point-to-point dedicated path between teleworkers’ homes and offices, bypassing the residential neighborhood congestion points. However, according to provider staff we spoke with, installing private lines in a residence requires advance planning and is expensive. One provider noted that a direct connection is not a solution that can be invoked when the pandemic strikes.

Technically Feasible Options Would Likely Require a Government Directive

In the current network environment, providers’ capability to address pandemic-related Internet congestion by prioritizing certain users’ traffic, including that of financial sector teleworkers, is limited. Specifically, provider systems are not designed to identify and provide priority to individual users when traffic is routed over the Internet and multiple networks are used for the connection. Furthermore, Internet providers’ networks also are not currently designed to identify particular types of customers connected to the Internet. For example, the networks cannot distinguish between critical employees teleworking and recreational users.

Providers identified one technically feasible alternative that has the potential to reduce Internet congestion during a pandemic, but raised concerns that it could violate customer service agreements and thus would require a directive from the government to implement. Although providers cannot identify users at the computer level to manage traffic from that point, two providers stated that if the residential Internet access network in a particular neighborhood was experiencing congestion, a provider could attempt to reduce congestion by reducing the amount of traffic that each user could send to and receive from his or her network. Such a reduction would require adjusting the configuration file within each customer’s modem to temporarily reduce the maximum transmission speed that that modem was capable of performing—for example, by reducing its incoming capability from 7 Mbps to 1 Mbps. However, according to providers we spoke with, such reductions could violate the agreed-upon levels of services for which customers have paid. Therefore, under current agreements, two providers indicated they would need a directive from the government to take such actions.

Shutting down specific Internet sites would also reduce congestion, although many we spoke with expressed concerns about the feasibility of such an approach. Overall Internet congestion could be reduced if Web sites that accounted for significant amounts of traffic—such as those with video streaming—were shut down during a pandemic. According to one recently issued study, the number of adults who watch videos on video- sharing sites has nearly doubled since 2006, far outpacing the growth of many other Internet activities. However, most providers’ staff told us that blocking users from accessing such sites, while technically possible, would be very difficult and, in their view, would not address the congestion problem and would require a directive from the government. One provider indicated that such blocking would be difficult because determining which sites should be blocked would be a very subjective process. Additionally, this provider noted that technologically savvy site operators could change their Internet protocol addresses, allowing users to access the site regardless. Another provider told us that some of these large bandwidth sites stream critical news information. Furthermore, some state, local, and federal government offices and agencies, including DHS, currently use or have plans to increase their use of social media Web sites and to use video streaming as a means to communicate with the public. Shutting down such sites without affecting pertinent information would be a challenge for providers and could create more Internet congestion as users would repeatedly try to access these sites. According to one provider, two added complications are the potential liability resulting from lawsuits filed by businesses that lose revenue when their sites are shutdown or restricted and potential claims of anticompetitive practices, denial of free speech, or both. Some providers said that the operators of specific Internet sites could shut down their respective sites with less disruption and more effectively than Internet providers, and suggested that a better course of action would be for the government to work directly with the site operators.

Additional Capabilities to Prioritize Traffic or Expand Capacities May Be Available in the Future

Providers could help reduce the potential for a pandemic to cause Internet congestion by ongoing expansions of their networks’ capacities. Some providers are upgrading their networks by moving to higher capacity modems or fiber-to-the-home systems. For example, some cable providers are introducing a network specification that will increase the download capacity of residential networks from the 38 Mbps to about 152 to 155 Mbps. In addition to cable network upgrades, at least one telecommunications provider is offering fiber-to-the home, which is a broadband service operating over a fiber-optic communications network. Specifically, fiber-to-the-home Internet service is designed to provide Internet access with connection speeds ranging from 10 Mbps to 50 Mbps.

Although not generally feasible in the current environment, the ability to prioritize individual user’s traffic is envisioned to be technically possible in future upgrades of the infrastructure of the Internet and telecommunications networks, but such capabilities are estimated to be years away. As we recently reported, DHS is working with international standards bodies to help develop standards that could allow greater flexibility to prioritize data communications in the future; this effort is a part of what is referred to as the Next Generation Networks. However, these capabilities are not expected to be ready for several years due to the complexity of the systems and the need to develop standards that work across varying providers’ infrastructures, including internationally. In addition, we reported DHS had difficulty getting its full budgets approved, which may have contributed to the delay in developing standards. As a result, the expanded features of this newer network architecture are not expected to be a viable solution for addressing pandemic-related Internet congestion in the near future.

DHS Has Done Some Pandemic Planning but Has Not Taken Actions Needed to Effectively Address Potential Pandemic-related Internet Congestion

Although responsible for coordinating protection of the communications- critical infrastructure sector, which includes the networks that comprise the Internet, DHS has not yet developed a strategy to address pandemic- related Internet congestion, coordinated with federal partners, determined if sufficient authority exists to take necessary actions, or assessed the need for a public communications campaign to minimize congestion that is expected to occur during a pandemic. Under HSPD-7 and the National Strategy to Secure Cyberspace, DHS is the lead agency for coordinating the protection of critical assets in the communications sector from attacks. Also under these authorities, DHS is responsible for facilitating a public-private response to the recovery from major Internet disruption. In addition to being a focal point to the cyber-critical infrastructure protection effort, DHS has been designated as one of two federal agencies responsible for coordinating the United States’ pandemic response. As specified in the Implementation Plan for the National Strategy for Pandemic Influenza, DHS is to coordinate the nation’s response in conjunction with HHS.

DHS has undertaken several pandemic planning activities. As discussed earlier in this report, DHS and representatives from the government, communications sector, and financial sector conducted a study to assess specifically the technical feasibility of the pandemic telecommuting strategy and identify ways for the nation to better prepare to support the strategy. In coordination with interagency partners and the critical infrastructure sector coordinating councils, DHS has completed individual sector-specific pandemic guidelines and provided Webinars to sector partners on their respective plans. These guidelines are intended to assist the sectors and businesses with the sectors’ plan for a severe influenza pandemic, and include some consideration of potential Internet congestion. For example, the guidelines for the information technology and communications sectors recommend that entities in these sectors consider advising employees to limit household use of streaming video or other bandwidth-intensive Internet activities. The guidelines also recommend consideration of obtaining multiple means of accessing the Internet. The guidelines have been provided to the sector coordinating councils via a secure DHS information portal, as well as to the members of the National Governor’s Association. DHS officials told us that some of the sectors have made the guidelines available to the public. More recently, DHS completed the DHS 2009-H1N1 Implementation Plan, which provides planning guidance for DHS and identifies specific roles and responsibilities for the DHS components such as the Office of Policy or the Transportation Security Administration. According to DHS officials, the plan also directs all DHS components to develop plans that address key preparation and response actions, performance of mission essential functions, workforce protection, continuity of operations, and communications with key stakeholders during the H1N1 influenza pandemic.

However, while these planning activities are designed to help government and private sector partners prepare for a pandemic, they are limited in addressing the anticipated Internet congestion. Although serving as the coordinating agency for Internet recovery and pandemic response, DHS staff told us that their agency does not have a strategy to address Internet congestion. According to DHS staff, their agency has not begun developing such a strategy because since the September 11 terrorist attacks, they have had other crises such as Hurricane Katrina to address. A senior official at a financial markets regulator told us that leadership by the government had been lacking in addressing this potential risk to the financial sector. Without action by DHS to address this potential congestion, employees in critical sectors of the nation’s economy, including those in financial services, might not be able to effectively telework or otherwise communicate or transmit data over the Internet.

In addition, although various federal and private sector organizations would likely be required to coordinate an effective Internet congestion response strategy, DHS has neither reached out nor coordinated with other partners, such as other federal or state agencies with telecommunications oversight authorities, to prepare such a strategy. As we previously reported, the experience of Hurricane Katrina showed the need to improve leadership at all levels of government in order to better respond to a catastrophic disaster. As part of this, the legal authorities, roles and responsibilities, and lines of authority at all levels of government must be clearly defined, effectively communicated, and well understood in order to facilitate rapid and effective decision making. In order to respond effectively to pandemic-related Internet congestion, DHS will need to effectively plan and work with other parts of the federal government and possibly state and local governments and the private sector in its efforts. Other organizations that could be relevant include FCC, which, as previously noted, is charged with regulating interstate and international communications by radio, television, wire, satellite, and cable. DHS staff representing the Office of Policy acknowledged that such coordination would be necessary to address Internet congestion effectively and ensure that the various parts of the federal government are not conducting conflicting activities. For example, the staff told us the Department of Education was hoping to have schools use the Internet during a pandemic to allow students to access remote learning courses if schools were closed. The staff acknowledged that, as a result, DHS would have to coordinate with the other relevant agencies to ensure that their various actions are appropriately taken into account in developing a congestion plan. According to DHS staff, DHS has engaged in dialogues with other agencies about pandemic-related issues on a regular basis. Agency staff once again cited time constraints and the need to focus on other crises as reasons for not having discussed the development of a coordinated strategy for addressing Internet congestion. However, unless DHS starts coordinating with other federal, state, and even private sector parties on possible Internet congestion solutions, there may not be sufficient time to develop a coordinated strategy to address a rapidly emerging severe pandemic.

Further, although an effective congestion response strategy could require directing the private sector entities that operate the Internet’s infrastructure today to take actions that could negatively affect users, DHS has not determined whether it or other agencies have the necessary authorities to require providers to take such actions. We previously reported that the authorities of federal government agencies regarding the Internet were unclear. Given the importance of the Internet infrastructure to our nation’s communications and commerce, we suggested that Congress consider clarifying the legal framework guiding Internet recovery. Although DHS staff identified a list of potential authorities that may or may not apply, they told us they were not able to specify whether their agency had clear or specific authority to require telecommunications providers to take actions to address congestion, such as reducing customer transmission speeds or blocking entertainment Web sites. Instead, DHS’s approach would be to assess the authorities as part o the development of any such strategy. While this approach could help DH determine at some point if it or some other relevant federal agency had adequate authority to address potential Internet congestion, it would increase the risk that the federal government will not be able to respond rapidly or effectively if a pandemic quickly emerges.

Other federal government agencies might have authority to direct providers to take certain actions during a pandemic, but whether these are adequate is uncertain. Under the Communications Act of 1934, as amended (the Act), FCC has authority to regulate the telecommunications providers specifically and has authority generally with respect to interstate and foreign communication by wire and radio. According to FCC staff, there may be actions the FCC could take regarding the Internet to address threats to national security or public safety. However, in commenting on a draft of this report, FCC officials noted that there is an ongoing court challenge to FCC’s authority regarding the Internet. In addition, FCC staff were not sure whether FCC would have sufficient authority to require private sector organizations to take all actions that may be deemed necessary in an emergency situation to relieve congestion and facilitate commerce, including teleworking by financial sector employees. As part of preparing a national broadband access plan, FCC has recently sought public comments on options for prioritizing Internet traffic in a pandemic. According to FCC staff, very few comment letters addressed the prioritization issue. Based on our review, some service providers expressed interest in the government considering including a prioritization scheme in the plan. Additionally, one provider suggested the plan should give providers flexibility to actively manage networks during a pandemic. Finally, one financial sector organization noted that the plan should include a prioritization scheme to prioritize Internet traffic based on how critical it is to national and economic security.

Some observers have suggested that an authority granted to the President in the Communications Act of 1934 could conceivably be used to take actions to address Internet congestion during a pandemic. In their view, the President may have, under certain limited circumstances involving a state or threat of war, the power to authorize government control of the telecommunications systems and, if properly invoked and delegated, this might broadly provide authority for the government to require private sector entities to take actions intended to address congestion. However, according to FCC staff we spoke with, while the authority under the Act may grant the President powers over telecommunication systems during wartime, they did not know whether such powers could be exercised in a pandemic. However, until DHS, as the lead agency responsible for coordinating protection of telecommunications, including the Internet, takes action to work with other agencies to assess whether sufficient authorities exist to direct necessary actions by the private sector, the potential for a timely and effective federal response to congestion is reduced.

Voluntary Reductions in Internet Use May Be an Effective Response to Congestion, but DHS Has Not Taken Steps to Encourage It

Although its own study identified voluntary public reduction of Internet use as an effective means of reducing pandemic congestion, DHS has not begun steps to assess the feasibility and effectiveness of obtaining such public cooperation. According to the DHS study and to providers and others we spoke with, voluntary actions taken by the general public could have significant potential to reduce the surges in traffic loads that residential users may experience during a pandemic. For example, the general public could be asked to limit video streaming, gaming, and peer- to-peer and other bandwidth-intensive applications during daytime work hours. They could also be encouraged to use broadcast news sources in place of online news. A similar campaign developed by another agency— HHS—to publicize pandemic awareness strategies showed that such public education efforts can require months to prepare and cost millions of dollars to test and implement. For example, as part of creating various radio and television messages to provide information to the public about how to prepare for a pandemic, HHS conducted market research using various techniques, including focus groups, to gauge the public’s opinion about a pandemic. In 2005-2006, when they began this effort, HHS staff stated that it took the agency about 6 months to develop the public service announcements (PSA). In 2006-2007 HHS staff spent about 4 months planning and producing PSAs. The cost of running radio PSAs in 137 cities over an 11-month period in 2007 was about $1.5 million dollars.

DHS staff acknowledged that such a campaign would also require cooperation and coordination among multiple federal and other agencies to be effective and avoid conflicting goals and activities. For example, agencies would need to work together to ensure that some were not planning to recommend increased use of the Internet to provide information, education, or for other purposes during a pandemic. For example, HHS may advocate using the Internet to maintain social ties during a pandemic, which would make the goal of easing congestion by staying off-line more challenging. However, DHS staff told us they had not begun efforts to evaluate the feasibility or effectiveness of such a campaign or taken steps to begin developing such an effort because other activities supporting its operational mission have taken priority. Until DHS takes such action, its ability to implement what its own study predicted would be an effective tool for reducing potential Internet congestion in a timely fashion is reduced.

Key Securities Market Participants Have Prepared Response Plans, but Not All Have Documented Staffing Analyses or Plans for Alternatives to Teleworking

We reviewed seven organizations whose operations are critical to the overall functioning of U.S. securities markets and found that all have developed formal plans that address key elements of pandemic preparedness. But some have limitations that could increase the risk that aspects of their operations would be disrupted by a pandemic. In response to our last report, SEC and the banking regulators issued guidance to key financial market participants stipulating that an institution’s pandemic plan, at a minimum, must include the following five key elements: 1. a process for monitoring the pandemic’s progress and a series of escalating response steps as various pandemic phases are reached; 2. a preventive program to minimize, to the extent possible, illness among employees, including social distancing of employees by curtailing meetings; 3. a documented strategy of facilities or procedures designed to allow the organization to continue its critical operations in the event that large numbers of its staff are unavailable for prolonged periods; 4. a testing program to better ensure that the practices and capabilities that an organization implements to address a pandemic will be effective and allow it to continue its critical operations; and 5. an oversight program to ensure ongoing review and updates to the pandemic plan.

All Seven Critical Organizations Have Escalating Plans and Preventive Programs

All seven of the critical financial market organizations we reviewed have developed formal pandemic plans that call for them to monitor a pandemic’s progress and take escalating steps as the phases of a pandemic outbreak progress. Health authorities, including WHO and CDC, have issued phased timelines that track the progress of a pandemic from earliest detection to widespread global illness. Because being able to operate effectively at the height of a pandemic could require an organization to have taken steps in advance, an effective pandemic plan should contain more and stronger measures that would be taken as the phases of the pandemic progress. Such a strategy provides sufficient time to take steps that require more planning or lead time, such as purchasing needed supplies or conducting training in advance of the actual pandemic. Gradually implementing responses as the pandemic progresses also could prevent organizations from generating undue expenses if what appears to be a pandemic early on does not turn out to be one that significantly disrupts operations.

Our analysis of the seven critical organizations’ pandemic plans showed that each included activities that escalated as the pandemic progressed. All the organizations are currently monitoring the information regarding the potential spread of viruses that could lead to a pandemic through the CDC or WHO Web sites and communicate closely with local authorities, such as the New York City Office of Emergency Management. In the early stages of a pandemic these organizations would take preventive actions, such as monitoring the world pandemic situation and creating awareness of wellness practices before widespread outbreaks begin (i.e., WHO Phases 1 through 3). But as the pandemic levels advance, the organizations’ plans generally call for them to implement more extensive responses, such as relocating staff to increase social distancing or sending some staff home to telework. For example, one organization’s pandemic plan describes efforts to impose business travel restrictions; prepare additional communications to employees, customers, and regulatory bodies; and stock up on additional critical supplies during WHO Phase 4 in case a pandemic disrupts supply chains. As the alert level rises to Phase 5, the plan escalates the actions to initiate daily absenteeism tracking, expand the deployment of hand-sanitizing gel, and do additional facility cleaning. When WHO declares a pandemic (i.e., WHO Phase 6), the organizations will take steps to implement social distancing, such as sending a number of employees to the backup facility and designating people to work from home. All of the plans follow this general design, and during the H1N1 outbreak, all the organizations began implementing some of these steps. In particular, as the alert level escalated from WHO Phase 4 to Phase 5 in April of 2009, several organizations communicated to staff on additional measures they were taking, which included placing more hand sanitizers in the workplace and cleaning facilities more often. As WHO raised its pandemic phase further to the highest level (i.e., WHO Phase 6), indicating that a broad outbreak of an influenza epidemic was believed to be imminent, organizations, according to SEC staff, were prepared to take further steps that correspond with an outbreak—such as performing medical screenings of staff reporting to work—although such measures ultimately were not necessary due to the milder nature of the H1N1 outbreak here in the United States.

As a result of their experiences with the recent H1N1 flu outbreak, some market organizations and financial regulators told us they were considering developing modified trigger points in the plans that might not follow the WHO designations exactly. Officials from these organization said they had made this decision because of their experience with the relatively benign nature of the H1N1 virus in the United States. The health authorities’ pandemic phases were designed for a disease that causes high levels of severe illness, and even deaths, like some of the previous flu pandemics have caused. However, even though the United States continues to report the largest number of novel H1N1 cases of any country worldwide, most people who have become ill in 2009 have recovered without requiring medical treatment. As a result, staff from several of the critical market organizations did not need to fully implement their plans at that time because their employees were not seriously ill, if at all, and the plans could be modified to adapt to such a scenario.

Our analysis indicated that all seven critical organizations also had fully addressed another key element of pandemic planning by instituting preventive programs intended to reduce the impact of a pandemic on their organizations. Because an organization has a much greater chance of continuing operations during a pandemic if fewer of its employees are ill, an effective pandemic plan should include a preventive program to reduce the likelihood of employees becoming sick. The steps the organizations took included providing information and educational campaigns to keep employees informed of pandemic news and developments. For example, during the recent H1N1 outbreak, staff at these seven organizations developed memos to employees on the status of the outbreak and steps the organizations were taking based on news and briefings from the federal, state, and local authorities. Further, all the organizations have developed internal Web sites to educate employees on general information on preventing spread of disease, including hand-washing techniques and coughing etiquette and provided personal hygiene items such as hand sanitizers and masks. In addition, three of the organizations prepared extensive education outreach campaigns (e.g., hand-washing awareness week) shortly after the financial regulators’ pandemic planning requirements were issued, in mid-2007. Most of the organizations have also developed policies regarding restricting travel as a way to reduce illness among their employees. For example, the organizations’ plans typically called for curtailing international travel at WHO Phase 4, and some required staff returning from abroad to quarantine themselves for a period, such as 7 days, to lower the chance of spreading illness.

Critical Organizations Reviewed Have Plans to Continue Operations with High Absenteeism, but Some Have Limitations in Their Staffing Plans and Teleworking Alternatives

All seven critical securities market organizations we reviewed have developed plans with procedures intended to allow them to continue the functions critical to their operations despite high levels of absenteeism, but not all have fully analyzed or thoroughly documented their staffing levels or developed formal alternatives if teleworking proves unfeasible due to Internet congestion. Although congestion during a pandemic could interfere with individuals’ ability, including teleworkers and others, to access the Internet, the primary communications of the critical markets organizations would not be affected because these organizations and their participants communicate via high-capacity, proprietary networks that do not traverse the public Internet infrastructure. According to the health authorities, one of the most significant challenges of a pandemic will be staffing shortages due to absenteeism caused by employees either too ill to work, taking care of ill family members, or afraid to come to work because of the chance of infection. Unfortunately, organizations could also permanently lose critical staff if the pandemic causes significant levels of deaths. Therefore, a responsive pandemic plan should include procedures for ensuring that an organization can continue performing its critical functions even with as much as a 40 percent reduction in its workforce for a prolonged period—the level that the federal government has advised should be used for planning for a severe pandemic.

In general, the seven critical organizations that we reviewed all intend to use existing geographically dispersed facilities to increase the distance among staff who perform critical functions. Staff from all seven critical organizations are spread among facilities located across the United States, including data centers, which are monitored by computer operators, and office or business centers with key staff that assist customers. Each of these organizations has created duplicate sites with redundant staffed data centers and locations or space for other critical staff. For example, officials from one organization told us that their three facilities are considerably distant from each other (i.e., hundreds of miles) in order to mitigate the effect of natural disasters, power and telecom outages, and other wide-scale regional disruptions, including a pandemic. The organizations plan to use these geographically dispersed sites to maximize social distancing and increase their ability to continue operating during a pandemic. Having sites with staff that perform critical functions in more than one location also provides these organizations with pools of cross- trained employees that they can draw on during a pandemic. For example, one organization’s pandemic plan relies on staff performing critical activities that are evenly divided across two geographically distant facilities in different regions of the country. This organization also has an alternate facility in the same metropolitan area as its primary location. Under its plan, during the final stage of a pandemic, when the United States is experiencing sustained transmission of the disease, some staff from its primary site are to report to the nearby alternate facility to do their critical activities, thus allowing the organization to increase the physical distance between the individual members of its critical staff.

Staffing Analyses or Documentation Can Be Improved

Although each organization has developed plans for continuing operations during a pandemic, our analysis indicated that three of the seven have not fully analyzed or documented the number of staff able to perform critical functions who would be available during a pandemic. With the federal government indicating that organizations should plan for absenteeism of 40 percent at the peak of a severe pandemic, under such circumstances approximately one in every three of an organization’s employees could be ill or caring for ill family members. Although regulators’ guidance does not specify the extent of cross-training required, we believe that, at a minimum, an organization would need two staff capable of performing each critical activity to allow for one to be absent while the other continues working. Organizations should probably have three staff capable of performing or cross-trained to take over these tasks to provide additional assurance that enough staff would be available. For example, the federal guidance on continuity of operations planning recommends that organizations should probably have three staff capable for key positions.

Because these organizations have multiple operating sites with staff located in each that are capable of performing many of their critical activities, they have some assurance that they likely have enough employees to continuing operating during a pandemic. But, not all organizations have fully analyzed or documented the number of staff that could be available across all critical positions and tasks. All the organizations have identified their critical functions and all have lists of at least some of the essential staff for each of the departments performing those functions. Four critical organizations have developed lists that show the current staff for each critical function, backup staff, and sufficient numbers of staff who are cross-trained or already know these functions who could serve as additional backup support. One of these organizations rotates the performance of its critical functions through three geographically distant operation sites on an ongoing basis, ensuring a large group of cross-trained staff. For example, this organization has a list of 36 staff for one of the critical departments, all of whom are trained to perform functions normally requiring 8 staff. Thus the organization has 8 backup staff as well as 20 additional trained staff that it can draw upon. Another of the four organizations identified seven essential services that its organization needs to perform and prepared listings for each of these departments that identify the primary staff performing the functions, the backups for these staff, and additional staff that are knowledgeable or cross-trained to perform these duties. For example, one of the essential departments has a list of 19 staff that are trained to perform one set of critical functions that normally require only 5 employees—a surplus of 14. In addition, this organization cross-trained an additional 7 staff to serve as further backup support. Henceforth, these organizations identified additional staff beyond the primary and backup employees for each critical function—producing more than two staff capable of performing each critical activity—to have greater assurance of being able to perform their critical functions.

The importance of sufficiently analyzing and documenting the adequacy of critical staffing was demonstrated by one of the critical organizations that has comprehensively identified its staff and backups. This organization participated in an industry-wide pandemic exercise that revealed it needed to identify even larger numbers of trained staff for some departments. The exercise simulated the impact of a pandemic by declaring that all staff with last names beginning with certain letters would be unavailable for work. Although at one point in the exercise the scenario called for 40 to 50 percent absenteeism, this organization found that in one of its critical departments, as many as 78 percent of its staff were projected to be unavailable. As a result, this organization has re-examined its staffing arrangement to identify staff that currently perform other activities that could be used to perform critical functions if needed. The results from the exercise demonstrated the need to determine, in advance of an outbreak, sufficient numbers of staff capable of performing critical functions.

In contrast, three of the seven critical organizations have not fully developed lists of staff capable of performing critical functions. For example, at one organization each critical department listed essential staff, but only at a managerial level (e.g., vice president of a department, and one backup) but did not identify staff that perform the department’s functions on a day-to-day basis. The other two organizations created lists of essential staff by department, but the lists were completed only during the recent H1N1 outbreak rather than in advance. None of these three organizations listed primary, backup, or other staff for the critical functions. Officials at one of these organizations told us they have staff at several geographic locations and that business continuity tests for one of their critical departments demonstrated they can operate their organization’s critical information systems. As a result, they said that the geographic distance among locations and testing efforts provided them with a group of cross-trained staff that would be sufficient to continue operations even if 40 percent were absent. While this provides some assurance that this organization may be able to withstand a pandemic, as one organization learned, undergoing more extensive analysis and documentation allows organizations to identify gaps in staffing levels that would be unique to a pandemic, when large numbers of staff could be unavailable for prolonged periods. In addition, such analyses identify all critical tasks and those staff capable of performing them—primary, backup, and additional cross-trained staff—providing these organizations with greater assurance that adequate numbers of staff exist for each task within its critical departments. Until these organizations fully document their staffing analyses to ensure they have sufficient depth of staff capable of performing critical functions, some aspects of these organizations’ operations may be affected during a pandemic.

Alternative Strategies to Teleworking Should Be Considered

In addition to better analyzing and documenting their staffing plans, some of the organizations that intend to use teleworking as part of their strategy for continuing operations during a pandemic need to address limitations in their teleworking plans. As noted previously, the critical market organizations included in our review generally rely on proprietary communications networks that will not likely be affected by any pandemic-related congestion. However, five of the seven critical organizations plan to have some of their critical staff telework during a pandemic, and the readiness of these organizations to successfully have employees telework varies. Based on our reviews, only one of the five organizations fully developed suitable alternatives to teleworking in case of Internet congestion. This organization identified hotels with increased broadband Internet access capability in the employees’ residential neighborhoods that staff could report to in order to improve their ability to telework. Another of the five organizations developed a plan for some of the critical staff that would be teleworking to come into one of its facilities that is currently prepared as a backup site. This facility is currently ready for operations and has ample space to provide adequate social distance for employees that find they cannot successfully telework due to congestion. However, the organization has not made adequate preparations for some critical staff in another geographic area to telework during a pandemic. If these employees are not able to telework, the organization plans to have them report to its office there and work in an unused part of the facility. But it has not outfitted this area with additional workstations that would allow its staff to work there effectively.

Furthermore, three of the critical organizations whose plans include possibly having some of their critical employees telework have not fully developed plans for alternatives to teleworking should congestion arise.

Our review of their plans show that the three organizations have not designated the necessary positions or employees who would telework. Determining the total number of teleworkers in advance of an outbreak would allow the organizations to confirm that their network systems can fully support that number, which would likely be higher than it might be in the course of a normal work day, and that these employees have full access to all the applications or systems they need in order to perform their critical duties effectively from home. These organizations have also not developed and assessed the feasibility of alternatives to teleworking in their plans. For example, one of these organizations told us that, if congestion occurs, they would bring staff back into their facilities and have them conduct their work wirelessly. However, they have not documented this in their planning or tested the feasibility of this approach for all potential critical activities. The other two organizations have not determined in their plans what steps they would take to respond to congestion problems experienced by their teleworking employees. Until all the critical organizations develop additional measures to ensure they have viable alternative strategies if teleworking proves difficult, they might be at greater risk of having some aspects of their operations disrupted during a pandemic.

Critical Organizations Reviewed Have Tested Plans and Ensured Ongoing Review to Varying Extents

Our analysis shows that while all seven of the critical organizations we reviewed participated in an industry-wide pandemic scenario test, some have not conducted similar tests internally. All of the organizations reported that they participated in a 3-week industry-wide pandemic exercise, sponsored jointly by FBIIC, FSSCC, Treasury, and the Securities Industry and Financial Markets Association, which began in September 2007. The exercise simulated a pandemic occurring in three waves and reaching an absenteeism rate as high as 49 percent. As previously mentioned, each scenario update included an absenteeism distribution specified by first letters of employees’ last names, as a way to approximate the scenario’s target absenteeism rate. The scenario updates were provided to participants 1 week in advance so that each organization had adequate time to review its human resources records, identify the absent individuals, and determine the distribution of the absent employees among their various departments and units as appropriate. This method provided a probable picture of the range of absent employees, which could be from the lowest levels to the top of an organization. Organizations that did not want to carry out such a review of their records were allowed to simply use the provided absenteeism rate (25 percent, 49 percent, and 35 percent) for each scenario update.

Officials from the critical organizations indicated that the exercise was useful in planning for a possible pandemic. As noted previously, one organization participating in this exercise experienced as much as 78 percent absenteeism in some of its departments—higher than the expected 49 percent projection—and has taken steps to identify additional staff capable of performing its critical functions. Officials from another organization said the exercise highlighted variation in human resource policies—for example, in the distribution of antiviral medication and the use of hazard pay across regional offices. As a result, the organization convened relevant staff to discuss consistent policy issues and infrastructure resiliency across regions. In addition to the industry-wide effort, three of the organizations have conducted or plan to conduct additional internal pandemic tests to ensure readiness. One of the organizations has conducted pandemic exercises for managers and staff at each facility, using a set of questionnaires corresponding to various scenarios. Another organization told us that it planned to conduct a full- day pandemic response test at all of its facilities in 2009. However, four of the organizations have not run internal pandemic scenario tests. As discussed earlier, the results from the industry-wide test demonstrated the need for the critical organizations to assess their staffing, backup, and cross-training levels to ensure they are sufficient to meet the organization’s needs during a pandemic. Internal pandemic scenario tests would give organizations just such an opportunity.

In addition to pandemic scenario testing, all seven organizations have tested their abilities to run critical applications and functions at their alternate backup facilities as part of their business continuity testing. These efforts will provide further assurance that these sites will be viable for use during a pandemic. Some of the organizations rotate operations between the primary and the backup facility on a regular basis, while others operate certain processes simultaneously at the primary and the secondary facilities. For example, one of the organizations conducts six remote-site recovery tests per year, simulating failure of applications. Meanwhile, another organization has begun recovery testing by alternating its full production cycle between the two key facilities. Further, all but one of the five firms that intend to employ teleworking as part of their pandemic plan have assessed their work-from-home capabilities—an essential part of planning for extensive teleworking to ensure that the organizations’ telecommunications systems can support the large amounts of traffic that would be generated. One organization in particular tested work-from-home infrastructure to ensure continuity of daily production as early as mid-2007 and continues to test connectivity as its telecommunications infrastructure is upgraded. Another organization told us it conducted several work-from-home tests in 2008, including server stress test and tests featuring full-volume transaction levels. This kind of testing is critical to pandemic planning, especially for those organizations that intend to have some of their critical staff work from home.

Our analysis also indicates that six of the seven of the organizations have procedures in place to ensure their pandemic plans are being reviewed and updated. Because pandemic plans should be sufficiently flexible to effectively address a wide range of possible effects that could result from a pandemic, ongoing review and updates will ensure a plan has up-to-date policies, standards, and procedures. Officials from the six organizations told us that the pandemic plans are reviewed on a regular basis, either at the business-department level or in some cases by the audit committee or the Board of Directors. For example, at one organization the audit committee reviews the pandemic plan and reports its assessment and findings to the Board of Directors on an annual basis. At another organization, the departmental plan is prepared by the department manager and is approved by the director. However, at one organization executives have seen the pandemic plan, but it has not been formally approved. This organization told us it recently instituted a pandemic flu committee that will formally review and approve the pandemic plan. Regular review and approval by senior management helps to ensure that adequate resources are dedicated to implementing the plan. Furthermore, with the changes occurring across financial organizations due to the recent market turmoil, regular review helps an organization confirm that its plan is still aligned effectively to its organizational structure.

SEC Has Taken Significant Steps to Assess Securities Market Organizations’ Pandemic Preparedness, but Could Do More

As the regulator that oversees stock and options exchanges, clearing organizations, and broker-dealers, SEC has taken various actions to ensure that market organizations are preparing for a pandemic, including issuing guidance and conducting examinations of market participants’ preparations, but could take additional steps to better oversee firms’ readiness. To ensure the readiness of the participants in the securities markets, SEC has issued various communications that provided guidance outlining its expectations for these entities’ pandemic preparation efforts. For example, in April 2006, SEC sent a letter to securities exchanges and clearing organizations advising them to plan for a pandemic and make preparations intended to keep the markets operating. SEC’s letter noted that the organizations’ existing business continuity programs were usually designed to address a discrete event and therefore could prove inadequate to address the potentially long-lasting impact of a pandemic. SEC staff also spoke at conferences, meetings with market participants, and other forums, such as those sponsored by industry trade associations, to share information about pandemic issues. Although securities regulators had taken various actions to help the financial markets prepare, our 2007 report indicated that additional actions could further improve the financial market’s readiness to withstand an influenza pandemic. In response to our recommendation, SEC provided more specific guidance between July and October 2007 to the securities exchanges, clearing organizations, and broker-dealers that indicated that these organizations’ pandemic plans include various key elements, such as procedures for continuing operations during even severe pandemics, and that the plans be in place by the end of 2007.

To ensure that securities market organizations are taking adequate steps to be ready for a pandemic, SEC has been conducting examinations of various market participants’ preparations that cover, among other things, pandemic preparedness plans. To assess the extent to which securities exchanges, electronic markets, and clearing organizations are adequately managing risks to their operations, staff from SEC’s Division of Trading and Markets regularly conduct examinations through its Automation Review Program (ARP). Since beginning this program in the late 1980s, SEC has issued guidance and conducted examinations that address operations risk issues at these organizations, including reviewing physical and information security and business continuity planning. As of September 2009, 22 securities exchanges, electronic markets, and clearing organizations were subject to ARP’s guidance and examinations, including five of the organizations whose operations we consider critical to the securities markets.

As part of the ARP examinations, SEC staff have been addressing these organizations’ pandemic preparedness during their reviews of business continuity issues. During these examinations, SEC staff were using an examination module, adapted from the Federal Reserve, to assess whether these organizations have developed plans that adequately address the five key elements of a pandemic plan, including whether the organizations identified their critical staff, had procedures for reducing the likelihood of their staff becoming ill, and tested their plans. From January 2007 to June 2009, SEC’s Division of Trading and Markets staff had conducted nine examinations addressing business continuity planning and pandemic preparedness at the critical organizations included in our review. Although examiners generally found in the 2007 examinations that organizations were in various stages of pandemic preparations, and in some cases had not addressed all the required elements of a pandemic plan, our review of the examination reports that SEC conducted in 2008 and 2009 indicate that these organizations improved their plans to better address the key elements of pandemic preparedness. However, after examining one of the organizations in October 2008, SEC staff made various recommendations to direct this organization to improve its pandemic planning. For example, SEC recommended that the organization’s plan better address the impact of staff reductions on its operations and that it test its pandemic procedures.

SEC Examinations of Organizations’ Staffing Analyses Could Go Farther

Although SEC has conducted inspections to ensure that critical organizations are preparing plans that address all the key pandemic areas, SEC’s examination reports did not always cite as deficiencies the limited analysis or documentation of these organizations’ staffing levels. The pandemic assessment questions used by SEC staff addressed issues related to staff dependencies, including whether the organizations identified their key functions and staff for these functions and conducted cross-training of staff to ensure that sufficient staff would be available during a pandemic. However, as noted earlier, our reviews of the critical market organizations indicate that three of the five critical securities market organizations have not adequately documented the number of staff who could perform critical functions if many of the staff that currently perform those functions are unavailable during a pandemic. Our reviews of SEC’s examination reports show that SEC staff identified weaknesses in the staffing analysis at one of these critical organizations but not at the other two. SEC staff acknowledged that ensuring adequate numbers of critical staff is important. But they said they had not expected the organizations to document the adequacy of their staffing for all their positions because staff in critical departments were likely to be interchangeable and thus could fill in for each other. Moreover, in their opinion, specific staffing lists could quickly become out of date given the higher rate of staff turnover at these organizations during this current financial crisis.

Although we agree that the critical organizations may have staff throughout their organizations that could step in for ill employees during a pandemic, until such staffing depth is better assessed and documented, these organizations cannot be fully assured of their ability to operate during such an event. As we noted previously, even organizations that created listings of the staff capable of performing critical functions found during testing that what they thought was sufficient depth in staffing was actually inadequate in some departments. In addition, this current period of increased staff turnover among financial organizations likely further increases the risk that an organization could have thinner staffing for some key positions that might not be identified until a pandemic is occurring. As a result, until SEC staff take steps to ensure that these organizations better document the adequacy of the depth of their critical function staffing, some aspects of these organizations’ operations could be disrupted during a severe pandemic.

SEC Examinations of Teleworking Could Address Alternatives

Although SEC’s ARP staff’s reviews address the extent to which the critical organizations plan to have employees telework during a pandemic, their examinations thus far have not included checking for viable alternate strategies if Internet congestion occurs. SEC staff told us that as part of their pandemic examinations at securities market organizations, they were reviewing various teleworking issues by addressing the relevant questions in their examination module regarding whether the organizations had remote access arrangements and whether the organizations had assessed the capacities of their communications links. The SEC module also asks whether an organization analyzed the locations of its staff’s homes to see if there were large numbers of staff that may be trying to connect from a single area and thus be more vulnerable if congestion or disruption occurs in that area. However, neither the SEC staff’s examination module nor the examination reports we reviewed address whether these organizations developed formal plans for what to do with their teleworking staff if congestion prevents that strategy from being viable. As noted earlier, our reviews of the critical organizations indicate that not all have developed adequate alternative strategies in the event that staff are unable to telework effectively. Until SEC staff take steps to ensure that all organizations develop such strategies, the risk exists that a pandemic could disrupt some areas of these organizations’ operations.

SEC Has Also Taken Steps to Assess the Pandemic Preparedness of Some Broker-Dealers

In addition to taking steps to assess the readiness of securities exchanges, electronic markets, and clearing organizations to continue operating during a pandemic, SEC staff have been reviewing the preparations of large broker-dealers whose activities are important to overall market functioning. In the aftermath of the September 11, 2001 terrorist attacks, SEC and the banking regulators made coordinated efforts to ensure the resiliency of the U.S. securities markets with respect to clearance and settlement activities. As the attacks showed, the inability of individual securities market participants to promptly clear and settle transactions can pose significant financial risks to other participants. In response, SEC, the Federal Reserve, and the Office of the Comptroller of the Currency jointly issued the Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System (Sound Practices) in April 2003. The Sound Practices paper establishes business continuity expectations for the clearance and settlement activities of organizations that support critical financial markets. These organizations include the core clearing and settlement entities that process securities transactions (core organizations) and firms that play a significant role in critical financial markets (significant firms)—generally defined as those firms whose participation in the markets results in their consistently clearing or settling at least 5 percent of the value of the transactions in any of the product markets specified in the paper. Since issuing the paper, these regulators have been conducting examinations of the clearing organizations, significant broker-dealers, and clearing banks that are subject to these practices to ensure they have in place business continuity arrangements sufficient to meet various recovery goals for their clearance and settlement activities.

All of the recent examinations that SEC staff conducted under the Sound Practices effort also addressed the pandemic preparations for the significant number of broker-dealers whose role in the critical financial market activities were deemed significant for selected securities and other product markets. In early 2008, staff in SEC’s Office of Compliance Inspections and Examinations, which is responsible for conducting examinations of broker-dealers, mutual funds, and investment advisers, conducted reviews of the then-largest existing broker-dealers. Because of these entities’ high trading volumes in various securities or other products, the markets could be significantly affected if they were unable to clear and settle their transactions. As part of these reviews, SEC staff obtained documentation on how these broker-dealers were addressing the key elements of pandemic planning. Based on these assessments, SEC staff found that the largest broker-dealers appeared to be implementing pandemic plans that generally addressed the key elements. However, as part of conducting some operations risk examinations of a broader group of broker-dealers during 2008, SEC staff also examined the extent to which four midsized firms that cleared trades for other broker-dealers had begun preparations for a pandemic. During these reviews, SEC staff found that, unlike the larger firms, three of these four clearing broker-dealers had no formal pandemic plans in place.

FINRA Has Also Taken Steps to Assess Broker- Dealer Readiness for a Pandemic

In addition to the broker-dealers overseen by SEC, we also reviewed FINRA, the self-regulatory organization that oversees most broker-dealers in the United States. FINRA oversees broker-dealers, including “introducing” firms that accept customer orders and “clearing firms” that process introducing firms’ orders. Prior to H1N1 and our inquiries, FINRA had not fully assessed the pandemic readiness of broker-dealers, including clearing firms. However, since then, FINRA administered a voluntary survey of significant firms, in which a majority of the firms reported they are engaged in some level of pandemic planning. The results of the survey will be used to identify areas for improvement moving forward, including a new examination module that addresses pandemic readiness. For further information on FINRA’s activities, see appendix II.

Conclusions

The increased demand on the Internet resulting from the number of students, workers, and other family members at home during the day during a severe pandemic is expected to create congestion by exceeding the current capacity of Internet providers’ network infrastructure in residential neighborhoods. Telecommunications providers will have limited options to expand network infrastructure during an outbreak, and possible network management techniques would likely require government action in order for providers to avoid violating existing customer service agreements. DHS is the federal agency responsible for working with the private sector to ensure that the critical communications sector, which includes the networks that comprise the Internet, is protected from attacks and other disasters. Although DHS has taken some actions relating to pandemic and possible Internet congestion, it has not taken the necessary steps to develop a strategy for addressing such congestion.

In addition, developing an effective Internet congestion response plan will likely require coordination with various other federal agencies, including the Department of Education, HHS, and FCC. As the experience of Hurricane Katrina showed, working in advance of a crisis to understand the proper roles and responsibilities of various federal and other entities is important for ensuring an effective response, but DHS has not taken extensive actions to coordinate with other relevant federal and private sector entities about actions that could potentially reduce Internet congestion and how best to respond. In addition, an important step for ensuring the federal government is prepared to address pandemic-related Internet congestion will be identifying whether any federal entity currently has the needed authority to take any actions determined to be necessary. However, whether DHS, FCC, or others have sufficient existing authorities to direct private sector Internet providers to take the actions necessary to relieve congestion is not clear. Similarly, although its own study showed that obtaining public cooperation in reducing nonessential use of the Internet could greatly resolve the potential pandemic-related congestion, DHS has not taken steps to assess the effectiveness and feasibility of mounting such a campaign to begin developing one. Until DHS develops an effective response strategy, coordinates with federal and other partners on actions to take, determines whether sufficient authorities to act exist or are sought, and evaluates the need for a public campaign, employees in critical sectors of the nation’s economy, including those in financial services, might not be able to effectively telework or otherwise communicate or transmit data over the Internet during a pandemic.

Seven critical securities market organizations that we reviewed have taken significant steps to better ensure they would be able to continue operating during a pandemic, including by developing plans that address the key elements of pandemic planning. However, some of these organizations could better document the adequacy of their staffing levels and ensure they have prepared viable alternatives in the event that their teleworkers experience Internet congestion. SEC has taken various steps, including issuing guidance and conducting examinations, to ensure that financial market organizations, including those critical to the overall functioning of the markets, are prepared to continue operating during a pandemic. However, taking additional steps during their examinations to ensure that these organizations have fully documented the adequacy of their staffing analyses, developed formal alternatives to teleworking, and tested these would provide greater assurance that the financial markets’ full range of operations will not be disrupted by a pandemic.

Recommendations for Executive Action

To better ensure that securities market participants as well as organizations in other critical sectors of the economy will continue to have access to the Internet during a pandemic, we recommend that the Secretary of Homeland Security take the following four actions: develop a strategy outlining actions that could be taken to address coordinate with other relevant federal and private sector entities about actions that could potentially reduce Internet congestion, work with other federal partners to determine if sufficient authority exists for one or more relevant agencies to take any contemplated actions to address Internet congestion, and assess the effectiveness and feasibility, and undertake if warranted, a public education campaign to reduce such congestion.

To better ensure that important securities market participants are making adequate preparations for pandemic, we recommend that the Chairman, SEC, ensure that SEC staff take steps to ensure that critical financial market organizations are fully documenting the adequacy of their staffing levels to withstand high absenteeism and have formally developed alternative strategies in the event that congestion limits teleworking effectiveness.

Agency Comments and Our Evaluation

We provided a draft of this report to the Secretary of Homeland Security, the Secretary of Health and Human Services, the Secretary of the Treasury, the Chairman of the Board of Governors of the Federal Reserve System, the Chairman of the Financial Industry Regulatory Authority, the Comptroller of the Currency, the Chairman of the Securities and Exchange Commission, and the Chairman of the Federal Communications Commission for their review and comment. In her letter, SEC’s Chairman noted that she shares our concern that Internet congestion could impair certain aspects of the securities markets during a pandemic (see app. IV). She noted that she also agrees that critical market organizations can take steps to improve their existing pandemic plans. Accordingly, the Chairman indicated that SEC will issue letters to these organizations recommending that they further document their staff cross-training arrangements and their plans to maintain operations if Internet congestion impairs their ability to rely on telework for support functions. Further, SEC staff will review compliance with this recommendation in future examinations of these organizations. The Chairman also noted that SEC is prepared to assist other agencies to help address the problem of potential Internet congestion.

In a written response to a draft of this report, the Director of DHS’s Departmental GAO/OIG Liaison Office concurs in part with our recommendations that DHS should, among other things, develop a strategy outlining actions that could be taken to address potential Internet congestion. The Director’s letter states that the agency agrees to take these steps to mitigate the impact of any pandemic-related congestion on the systems that the federal government uses to communicate critical national security/emergency preparedness (NS/EP) information, but that addressing Internet congestion for other communications, as a general matter, does not fall within DHS’s responsibilities, and that DHS does not have the responsibility for developing an Internet congestion strategy separate and apart from assuring NS/EP communications. While we agree that DHS should ensure that NS/EP communications are maintained, DHS has been broadly tasked with leading efforts to prevent disruptions to the nation’s overall telecommunications infrastructure and is the agency best positioned to do so. As discussed in this report, federal policies and plans assign DHS lead responsibility for facilitating a public/private response to and recovery from major Internet disruptions. DHS was designated under HSPD-7 as the lead agency for coordinating the protection of the communications sector—a role it plays for several of the other sectors that have been identified as the nation’s critical infrastructures and key resources. As lead agency for this sector, DHS is to conduct vulnerability assessments and encourage risk management strategies to protect and mitigate against attacks. HSPD-7 also notes that agencies are responsible for working with their sectors to reduce the consequences of catastrophic failures not cased by terrorism. Similarly, the 2009 National Infrastructure Protection Plan notes that risk in the 21st century results from a complex mix of man-made and naturally occurring threats and hazards, including terrorist attacks, accidents, natural disasters, and other emergencies. Under this plan’s risk analysis and management framework, sector-specific agencies are to combine consequence, vulnerability, and threat information to produce assessments of risks to a sector and enhance protection by setting goals and objectives, establishing priorities for mitigating risks, and implementing protective programs and resiliency strategies. Based on the study that DHS itself led, congestion resulting from a pandemic appears to be one of the threats for which DHS is tasked with ensuring an adequate governmental response. Furthermore, for example, The National Strategy to Secure Cyberspace notes that the Internet is at the core of the information infrastructure upon which we depend, connecting millions of other computer networks and making most of the nation’s essential services and infrastructures work. According to this strategy, DHS has important responsibilities to develop plans to secure these key resources and infrastructures and provide assistance to the private sector and other government entities with respect to recovery plans for failures in critical information systems. DHS has already been working to address threats to the Internet, for example, by establishing an Internet Disruption Working Group to work with the private sector to establish priorities and develop action plans to prevent major disruptions of the Internet and to identify recovery measures in the event of a major disruption. DHS also has an ongoing relationship with the communications sector coordinating council, which consists of various private sector telecommunications providers, that could assist in assessing and developing solutions to this issue. As a result of these responsibilities and its existing capabilities, we believe that DHS is the appropriate agency to take the lead in developing a strategy to address potential pandemic-related Internet congestion and to coordinate with other relevant federal and private sector entities about actions that could reduce such congestion.

DHS also commented that congestion that affects the Internet outside of NS/EP communications falls within the operational and administrative interests of other federal agencies. While we agree that other agencies, such as FCC, should play a role in addressing the potential negative impact on our nation’s commerce and economy from pandemic-related Internet congestion, under the existing governmental policies, DHS is the agency that is specifically tasked with addressing threats that have the potential to disrupt the critical communications sector. Furthermore, this report notes the uncertainty that exists over whether FCC has the authority to act to address Internet-related congestion problems. The uncertainty of roles and authorities regarding this issue is the reason we recommended that DHS work with other federal partners to determine if sufficient authority exists for one or more relevant agencies to take any actions necessary to address Internet congestion that may occur during and because of a severe pandemic crisis. While other agencies could play critical roles in addressing this issue, we believe that DHS, as the communications sector lead agency, should provide this leadership and coordinate a response. The Director’s letter also includes some additional technical comments that we address as appropriate in appendix V.

We also received technical comments from FCC and HHS, which are incorporated as appropriate in the report.

We are sending copies of this report to the Secretary of Homeland Security, the Chairman of the Securities and Exchange Commission, and other interested parties. The report will be available at no charge on the GAO Web site at http://www.gao.gov.

If you or your staff have any questions regarding this report, please contact Mathew Scire at (202) 512-8678 or sciremj@gao.gov; David Powner at (202) 512-9286 or pownerd@gao.gov; or Nabajyoti Barkakati at (202) 512-4499 or barkakatin@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine (1) the potential impact of a severe pandemic on the Internet and the actions telecommunications providers and government agencies are taking to address possible congestion, (2) the adequacy of the actions that securities market organizations are taking to prepare pandemic plans, and (3) steps that securities and other regulators are taking to assess the readiness of securities market organizations to continue operating during a pandemic.

To describe the potential impact of a pandemic on the Internet and the actions that communications providers and relevant government agencies are taking to address possible congestion, we interviewed staff from two communications providers and two cable providers that are among the largest providers of Internet access service in the United States, as well as two industry associations representing such providers. In addition, we interviewed relevant officials at the Department of Homeland Security (DHS), Federal Communications Commission (FCC), and the Department of the Treasury to discuss their efforts and authorities to address potential Internet congestion. We also interviewed representatives from telecommunications and Internet providers that are members of the U.S. Communications Sector Coordinating Council that provides input to DHS regarding critical infrastructure protection issues. We also interviewed staff at the Department of Health and Human Services (HHS)—including staff from the Centers for Disease Control and Prevention—to learn about their efforts to educate the public about pandemic strategies. To assess the potential Internet congestion that could occur during a pandemic, we conducted a literature search and reviewed relevant studies and reports. Specifically, we reviewed a study conducted by DHS in cooperation with various government, communication sector, and financial sector representatives. The study evaluated the technical feasibility of the pandemic strategy advocated by the government and identified action plans to better prepare the nation for telecommuting during a pandemic influenza. Our review of the study included an evaluation of the study’s methodology, and interviews with the DHS staff who oversaw the research on this study, including the Director and Chief of Staff of the Office of Cyber Security and Communications. To confirm the accuracy of the study’s findings, we interviewed communication sector representatives who participated in the study. We also reviewed after action reports from two pandemic exercises—one sponsored by the Financial Services Sector Coordinating Council, Financial and Banking Information Infrastructure Committee, and the Securities Industry and Financial Markets Association, and another conducted by the United Kingdom financial sector to test the financial sectors’ resilience to pandemic influenza.

To assess the actions that critical securities market organizations and key market participants are taking to prepare pandemic plans, we reviewed the actions of seven organizations—including exchanges, clearing organizations, and payment processors—whose ability to operate is critical to the overall functioning of the financial markets. To maintain the security and the confidentiality of their proprietary information, we agreed with these organizations that our report would not discuss their efforts to address pandemic readiness and ensure business continuity in a way that could identify them. To assess how these organizations ensure they can continue operations in the face of a pandemic outbreak, we discussed their business continuity and pandemic preparedness plans with their staff and visited their facilities. We reviewed and analyzed their pandemic plans and supporting business continuity documents and compared the plans to the key elements that banking and securities regulators have issued as guidance to financial organizations regarding pandemic planning. In evaluating these organizations’ pandemic readiness, we attempted to determine whether these organizations’ pandemic plans adequately address the five elements required by the regulators, including: (1) a process for monitoring the pandemic’s progress and a plan that escalates response steps as various pandemic phases are reached; (2) a preventive program to minimize, to the extent possible, illness among employees, including social distancing of employees by curtailing meetings; (3) a documented strategy of facilities or procedures designed to allow the organization to continue its critical operations in the event that large numbers of its staff are unavailable for prolonged periods, including an analysis of staffing levels needed for critical functions and, as applicable, an alternative to teleworking; (4) a testing program to ensure that the practices and capabilities will be effective and allow it to continue its critical operations; and (5) an oversight program to ensure ongoing review and updates to the pandemic plan.

To assess financial regulators’ efforts to assess the readiness of securities market organizations to continue operating during a pandemic, we reviewed relevant regulations and guidance and interviewed officials at the Securities and Exchange Commission (SEC), the Board of Governors of the Federal Reserve System (Federal Reserve), and the New York Federal Reserve Bank, the Office of Comptroller of the Currency, and the Financial Industry Regulatory Authority (FINRA). We also collected and reviewed data and reports from SEC, FINRA, and the Federal Reserve on the examinations they conducted of exchanges, clearing organizations, and broker-dealers. Furthermore, we reviewed a random sample of exams conducted by FINRA of business continuity practices at clearing firms that provide order routing and post-trade clearance and settlement processing for other broker-dealers (introducing firms) from 2006 through 2008. We randomly selected 9 firms of varying sizes from a total population of 56. To assess whether the level of preparations varied by firm size, we reviewed examinations for 3 large firms (that provided clearing for 100 or more other broker-dealer firms), 3 medium-sized firms (those that cleared for between 20 and 99 firms), and 3 small firms (those clearing for 19 or fewer firms). We also interviewed officials at one of the larger clearing firms.

We conducted this performance audit from June 2008 to October 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: FINRA Efforts to Oversee Pandemic Readiness of Broker-Dealers

Although the Financial Industry Regulatory Authority (FINRA)—the self- regulatory organization that oversees most broker-dealers in the United States—undertook some actions to improve broker-dealers’ awareness of the potential impact of a pandemic, it has only recently begun to take steps to more fully ensure such firms are making adequate preparations. In addition to oversight by the Securities and Exchange Commission (SEC), FINRA oversees broker-dealers conducting business domestically in the United States. The broker-dealers that FINRA oversees include, but are not limited to, two different types: Introducing broker-dealer firms whose staff open customer accounts and accept orders to buy and sell securities, but whose firms are not usually members of the exchanges or clearing organizations.

Clearing firms that maintain accounts at the central securities clearing organization and process trades on behalf of their own customers as well as those for the customers of the introducing brokers that use them for trade execution or clearing processing. Clearing firms also maintain the cash and securities holdings for their introducing firms’ customers.

According to data from FINRA, as of June 2009, 56 firms that clear for other broker-dealers (clearing firms) were operating in the U.S. markets, with some clearing for hundreds of firms but many clearing for less than 20 firms.

Although most broker-dealers are not required to recommence operations after disasters, FINRA expects its member firms to have business continuity plans that, among other things, assess how pandemic risks could affect the firm. Unlike the core exchanges and clearing organizations and critical broker-dealers covered by the Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System, which SEC requires to be able to resume operations on the same business day on which a wide-scale disruption occurs, broker- dealers have the option of recommencing their operations or shutting down if they are unable to continue. Since 2004, FINRA has had rules that require broker-dealers to have a business continuity plan in place that describes how the firm will: maintain appropriate backup and recovery functions for critical data; alternate communications between the member and the employees; and maintain all mission critical systems, such as those that process taking orders, and clearing and settling securities trades. As a result, at a minimum the FINRA business continuity rule requires all of its member broker-dealers to have adequate plans for ensuring customers have prompt access to their funds and securities in the event that the broker-dealer discontinues business operations. Although FINRA’s business continuity rules were issued before a pandemic was widely recognized as a potential threat to the financial markets, the organization issued guidance in 2006 that encourages broker-dealers to ensure that they assess whether or not their business continuity plans would be suitable for prolonged, widespread public health emergencies, such as a pandemic outbreak. Also in 2006, FINRA requested comment on potential regulatory relief granted in response to a pandemic. FINRA officials told us they have also emphasized the importance of addressing pandemic as part of business continuity planning to the broker-dealer staff that attend industry conferences and workshops.

However, prior to June 2009, FINRA had not begun to actively assess the readiness of broker-dealers, including clearing firms. FINRA examines firms on a rotational basis—depending on the risk level and complexity of firms’ operations—every 1, 2, or 4 years for compliance with a broad range of regulatory issues, including business continuity planning. According to data submitted to us by FINRA, across the 56 firms that clear for other broker-dealers, their staff conducted 40 examinations for compliance with the business continuity rules in 2006, 39 in 2007, 46 in 2008, with 33 completed or scheduled for 2009. When FINRA conducts the business continuity examinations, the inspectors use 1 or more of 13 business continuity planning examination modules to guide the inspection. However, the initial set of business continuity examination modules that FINRA staff have been using in their examinations to assess firms’ compliance with the business continuity rule did not include questions related to pandemic preparedness.

In addition, our own review of FINRA-conducted inspections found that FINRA officials have not been addressing pandemic issues to a great extent in business continuity examinations conducted through June 2009. We reviewed FINRA business continuity exams from 2006 to 2008 for a randomly selected sample of 9 of the 56 clearing firms that clear for other firms to assess the extent to which pandemic issues were being addressed. To assess whether the level of preparations varied by firm size, we reviewed examinations for 3 large firms (that provided clearing for 100 or more introducing brokers), 3 medium-sized firms (those that cleared for between 20 and 99 firms), and 3 small firms (those clearing for 19 or fewer firms). Our review found that the inspections for 8 of the 9 firms showed evidence the FINRA examiner reviewed the firm’s plan for compliance with the 10 business continuity elements required to be addressed by FINRA’s business continuity rule. However, we found limited evidence that the examiners reviewed pandemic readiness at the firms. For three of the firms, the examination documentation included some general discussions about these firms’ pandemic planning, and in three cases we saw evidence that pandemic plans were included in the documents reviewed by the FINRA examiners.

Although the full extent to which clearing firms are ready to continue operating during a pandemic has not been assessed, some evidence raised concerns that not all are making adequate preparations. We did not attempt to systematically determine clearing firms’ pandemic readiness, but we did interview staff at one of the largest clearing firms. This firm’s staff described a pandemic plan and procedures that appeared reasonably likely to be able to continue operations even in the face of significant absenteeism. However, as noted earlier, a limited review by SEC staff conducted in 2008 found that three of four midsized clearing firms have not developed plans for continuing operations during a pandemic. If clearing firms such as these are not able to continue operating, customers of the introducing broker-dealers that use the clearing firms experiencing such problems potentially could find access to their funds and securities curtailed for significant periods of time. For example, FINRA staff told us transferring the customer accounts of broker-dealers that cease operations can take several days or weeks, depending on the circumstances.

In response to the recent H1N1 outbreak and our inquiries in relation to this review, FINRA staff told us they have begun various efforts to more broadly assess the readiness of broker-dealers, including clearing firms, for a pandemic. Beginning in June 2009, FINRA conducted a voluntary survey of broker-dealer firms to determine preparedness for a pandemic. The survey included questions asking, among other things, whether the firm has conducted a review of the potential impact of a pandemic, and whether the firm has a business continuity plan specifically addressing a pandemic, and if so, how that plan is being tested. The survey results show that almost all respondents report having conducted a review of the potential impact of a pandemic, and have business continuity plans that specifically address pandemic preparedness. FINRA is using the results of the survey to develop additional guidance on pandemic preparedness practices for the industry. In addition, FINRA staff told us they have developed a new examination module that addresses pandemic preparedness. This module requires their examiners to determine whether the firm’s business continuity arrangements for resuming business operations appear reasonable given the conditions likely to prevail during a pandemic. For example, the module directs the examiner to review the firm’s business continuity planning to determine if the procedures address risks associated with pandemic, such as taking steps to limit the spread of influenza among its staff, and assessing the firm’s operational capabilities using teleworking and the impact of requiring employees to work remotely. The new module was piloted by FINRA examiners during the summer of 2009, and then, once revised as needed, will be used in upcoming exams. FINRA officials told us they will conduct a pandemic preparedness review at all the firms that clear for other broker-dealers by the end of 2011.

Appendix III: Steps Taken by Bank Regulators to Assess Pandemic Preparedness in Key Clearing Banks

Banking regulators for the key clearing banks have taken actions to assess pandemic readiness among banks, including those that clear transactions for the securities markets. The Federal Reserve and the Office of Comptroller of the Currency issued guidance in 2006 that call for all banks under their supervision to include the unique impacts of a pandemic in their business continuity planning. Similar to securities regulators, the bank regulators had taken actions to help banks and thrifts address pandemic efforts in our last review. For example, in a joint notice from the regulators that oversee banks and thrifts, the agencies indicated that their institutions should review the U.S. government’s national pandemic strategy to consider what actions may be appropriate for their particular situations, and whether such actions should be included in their event response and contingency strategies. Furthermore, banking regulators had also begun to review pandemic planning in the context of their ongoing supervisory activities. However, in response to the recommendation we made in our 2007 report, the Federal Reserve and the Office of the Comptroller of the Currency subsequently notified institutions that play systemically important roles in securities and other markets that these entities should have plans that address even severe pandemics. In addition, the Federal Financial Institutions Examination Council issued an updated examination manual regarding information technology and business continuity issues that includes steps that banks should be taking related to pandemic planning.

Banking regulators have also been conducting reviews to ensure that banks are preparing for possible pandemics, and through these efforts confirmed that the critical market institutions under their supervision met the 2007 deadline to have a pandemic plan in place, and that those plans include the required elements. For example, the Federal Reserve began a series of reviews—using a set of questionnaires to collect information on the planning elements established in the guidance—in January 2008 to assess the progress made by the top 15 banking organizations in the country and concluded that considerable progress has been made among its member banks in pandemic planning. The review objectives were to provide a broad perspective of the state of pandemic preparedness at systemic institutions, identifying trends within the pandemic preparedness planning process, and to provide peer benchmarking attributes to the participating institutions. Office of the Comptroller of the Currency officials told us they continue to monitor progress on pandemic planning in national banks through ongoing supervision rather than targeted exams, and they have been evaluating the banks’ efforts using the newly issued business continuity planning guidance that includes the requirements for pandemic plans.

Appendix IV: Comments from the Securities and Exchange Commission

Appendix V: Comments from the Department of Homeland Security

The following are GAO’s comments on the Department of Homeland Security’s letter dated October 14, 2009.

GAO Comments

1. The likely usefulness of teleworking as a way for government agencies and businesses to continue operations during a pandemic is one of the reasons we believe that DHS should take the lead in addressing potential Internet congestion that could arise during a severe pandemic, including working with private sector providers to encourage them to take proper steps to be prepared not only to ensure that NS/EP communications are not affected, but that any adverse impact on all other communications is also mitigated. 2. Although not citing the FCC opinion and order by number, our report does discuss some of the network management techniques noted by those documents that providers might be able to use to relieve pandemic-related congestion. However, as our report notes, these techniques may have limitations in resolving the type of congestion envisioned to occur in residential neighborhoods. In addition, providers told us that they would require government direction to implement such techniques to reduce congestion, which is why we recommend that DHS begin taking steps to determine what strategies, actions, and authorities are needed to address this issue so that if it appears that private sector providers must be asked to take steps, such direction can come from the appropriate government source.

Furthermore, as the report notes, providers told us their remote network management tools may be a way for them to continue their operations with reduced workforces resulting from pandemic-related absenteeism and that these tools could be used to re-route traffic around congested areas in regional networks or the national backbone, but not to relieve congestion in the residential neighborhoods. 3. As our report states, the DHS study of the impact of pandemic on Internet access notes that obtaining the cooperation of the general public in limiting bandwidth-intensive Internet activities was shown by the study’s modeling to be an effective way to relieve congestion. Uncertainty over whether such cooperation could be obtained is the reason that we recommend that DHS assess the effectiveness and feasibility of implementing a public information campaign, and if warranted, begin developing one. Regarding DHS’s suggested addition of the techniques noted in the FCC order, as we noted above, we discussed these techniques with providers and learned they may have limitations in addressing the type of congestion envisioned to arise in a pandemic and providers would likely require government direction to take such actions. 4. This comment was sent to us earlier as a part of DHS’s technical comments and we have revised the text to note that some of this information has been made available publicly. The best practices that DHS cites in response would likely improve telecommunication providers’ readiness for a pandemic, but likely would not be sufficient to relieve the congestion in residential neighborhoods. 5. This statement was intended to serve as an example of the types of comments FCC received regarding the prioritization issue. We did not assess whether this suggestion was feasible or comports with other FCC practices. 6. As noted above, the best practices DHS cites could assist providers in being better prepared for a pandemic. However, they are not likely sufficient to address residential neighborhood congestion, which is why DHS’s own study also proposed best practices for enterprises, teleworkers, and the public. Providers did not provide us information on any steps they were taking to advise the public about practices that could relieve congestion during a pandemic. In fact, one provider told us a good approach to manage Internet congestion effectively would be for the government to work with providers to publicize appropriate best practices and issue related guidance. As a result, we recommend that DHS assess the effectiveness and feasibility of such practices and implement such a campaign if warranted. 7. We changed the language in this report to note that DHS has not taken action related to evaluating a public education campaign because other activities supporting its operational mission have taken priority. Nevertheless, we believe that such activities should be undertaken to address potential pandemic-related congestion. 8. As this report discusses, much of the securities market’s critical communication would not be affected by congestion of the public Internet infrastructure because it travels over dedicated proprietary networks. However, financial sector organizations are planning to use teleworking to varying degrees as part of their plans to continue operations during a pandemic. As a result, these staff, as a well as the staff of other U.S. federal, state, or local governments and private businesses that plan to use teleworking from home during a pandemic would be affected by the congestion that is envisioned to affect residential neighborhoods. As a result, we recommend that DHS to take actions to address this issue.

Furthermore, our report discusses securities market organizations’ activities to prepare themselves to effectively telework during a pandemic and describes the limitations we found in these efforts. As a result, we made recommendations to SEC to further improve its oversight, which it has agreed to implement.

Appendix VI: GAO Contacts and Staff Acknowledgments

Acknowledgments

In addition to the contacts named above, Cody Goebel and Michael Gilmore, Assistant Directors; Chir-Jen Huang; Yola Lewis; Kristeen McLain; Marc Molino; Carl Ramirez; Linda Rego; and Hai Tran made major contributions to this report.