Information Sharing: DHS Should Take Steps to Encourage More Widespread Use of Its Program to Protect and Share Critical Infrastructure Information
Released: 2006-05-17T00:00:00

Letter

Background

Information sharing is an important part of activities that enhance the security of our nation’s cyber and physical public and private infrastructures. Federal law and policy related to critical infrastructure protection activities recognize the importance of sharing information about threats, vulnerabilities, and incidents and call for related initiatives. Federal agencies and the private sector have jointly attempted to implement these initiatives for a number of years. The CII Act provides a mechanism to encourage nonfederal entities to voluntarily share sensitive information pertaining to the security and vulnerabilities of their critical infrastructure assets with the federal government, and for that information to be shared with the appropriate federal, state, and local governments for the purposes of analyzing threats and vulnerabilities and issuing alerts and warnings.

Federal Law and Policy Call for Improved Information Sharing

Since 2002, legislation, national strategies, and executive directives have specified actions to improve information sharing for homeland security: The Homeland Security Act of 2002 created DHS and assigned it critical infrastructure protection responsibilities, including (1) developing a comprehensive national plan for securing the key resources and critical infrastructures of the United States; (2) recommending measures to protect the key resources and critical infrastructures of the United States in coordination with other groups; (3) accessing, receiving, and analyzing law enforcement, intelligence, and other threat and incident information to identify and assess the nature and scope of terrorist threats; and (4) disseminating, as appropriate, information to assist in the deterrence, prevention, and preemption of or response to terrorist attacks. In addition, it included specific mechanisms intended to improve information sharing, including the CII Act (discussed in the next section) and the Homeland Security Information Sharing Act.

In 2002 and 2003, the White House’s National Strategy for Homeland Security and its implementing strategies, the National Strategy to Secure Cyberspace and the National Strategy for the Physical Protection of Critical Infrastructures and Key Assets, also highlighted federal actions to promote two-way information-sharing mechanisms.

Issued in December 2003, Homeland Security Presidential Directive 7 established a national policy for federal departments and agencies to identify and prioritize U.S. critical infrastructure and key resources and to protect them from terrorist attack. It defined roles and responsibilities for DHS and agencies with critical infrastructure protection responsibilities to coordinate activities and to encourage the development of information sharing and analysis mechanisms and to support coordinating mechanisms. It required that DHS (1) produce a national infrastructure protection plan (NIPP) summarizing initiatives for sharing information, including providing threat warning data to state and local governments and the private sector, and (2) establish the appropriate systems, mechanisms, and procedures to share homeland security information with other federal departments and agencies, state and local governments, and the private sector in a timely manner.

In January 2006, the draft NIPP recognized the importance of an information-sharing network and policies and protocols for vetting and disseminating information among both government and private sector partners. It identified 17 critical infrastructure sectors, with sector- specific agencies for each—agriculture and food; public health and healthcare; drinking water and wastewater treatment systems; energy (except nuclear power facilities); banking and finance; national monuments and icons; defense industrial base; chemical; commercial facilities; dams; emergency services; commercial nuclear reactors, materials, and waste; information technology; telecommunications; postal and shipping; transportation systems; and government facilities. In addition, the draft NIPP stated that a final PCII rule is expected in 2006. It also required that, upon signing the letter of agreement with DHS regarding critical infrastructure protection responsibilities, sector- specific agencies would commit to protecting critical infrastructure data according to the Protected Critical Infrastructure Information Program and to sharing NIPP-related information as appropriate. However, at the time of our review, DHS was uncertain when the final NIPP would be released.

CII Act Establishes Protection for Voluntarily Submitted Critical Infrastructure Information to Encourage Sharing

The CII Act was enacted into law as Title II, Subtitle B, of the Homeland Security Act. According to the act, CII is information that is related to the security of critical infrastructure or protected systems and that is not customarily in the public domain. Such information includes (1) actual, potential, or threatened interference with, attack on, or incapacitation of critical infrastructure or protected systems by either physical or computer- based attack; (2) the ability of any critical infrastructure or protected system to resist such interference, compromise, or incapacitation; or (3) any planned or past operational problem or solution regarding critical infrastructure or protected systems. To qualify for protections under the act, CII must be voluntarily submitted to DHS by an individual, entity, or information sharing and analysis organization. In addition, CII submissions must be accompanied by a written or oral “Express Statement” that states the information is voluntarily submitted in expectation that it will be protected from disclosure under the act. Voluntary submissions under the act cannot be an alternative for compliance with other laws, such as the requirement to submit data on a facility’s emissions under the Clean Air Act. The CII Act does not apply to information obtained independently through such other laws or regulations.

Under the CII Act, voluntarily shared CII that meets the above requirements receives protections that include exemption from public disclosure under the Freedom of Information exemption from disclosure under state and local laws requiring release of information or records; and restrictions on sharing and use, such as restricting state officials from sharing with other state officials or using the information in civil actions.

The CII Act also imposes penalties for any federal employee who knowingly and inappropriately discloses CII submissions. The possible penalties include fines, imprisonment for not more than 1 year, or both, and the loss of office or employment.

Key responsibilities assigned to DHS under the act are as follows: 1. A requirement for the Secretary of DHS to establish, in consultation with appropriate representatives of the National Security Council and the Office of Science and Technology Policy, uniform procedures for the receipt, care, and storage of voluntary CII submissions to the government. The act also specifies that the procedures include mechanisms for acknowledging the receipt of the voluntarily submitted CII; maintaining the identification of this information as voluntarily submitted to the government under the act; caring for and storing such information; and protecting and maintaining the confidentiality of the identity of the person or entity that submitted information, or the information itself if it is proprietary, is business-sensitive, relates specifically to the submitting person or entity, or is otherwise not appropriately in the public domain. 2. An authorization for either the President or the Secretary of Homeland Security to designate a critical infrastructure protection program within DHS to receive CII. 3. An authorization for DHS to share the information within the federal government and with state and local governments, and that the federal government may use the information to issue advisories, alerts, and warnings using PCII as long as the identity of the source of the information and proprietary, business-sensitive, or information related specifically to a submitting entity is protected from disclosure.

As Required by the CII Act, DHS Has Established Procedures, Organized a Program Office, and Received and Shared Information

In February 2004, DHS issued an interim rule that established procedures, as required by the CII Act, and created a Program Office to administer the program. The office has developed and maintained processes for accepting, protecting, and sharing CII; received about 290 submissions from critical infrastructure owners; begun some outreach with potential submitters to increase information flow; shared PCII on a limited basis with users in DHS and several other federal entities; and trained approximately 750 potential users at DHS, other federal, state, and local government entities and, at least 16 state and local officials how to establish their own programs.

DHS Has Established Procedures as Required by the CII Act

DHS has issued procedures for the receipt, care, and storage of CII, as required by the CII Act. In doing so, DHS first issued a proposed rule on April 15, 2003, and solicited public comment on its provisions. After consideration of the comments received on the proposed rule, DHS issued an interim rule that was effective at the time of release on February 20, 2004. In the interim rule, DHS invited additional comments, stating that it would consider issuing supplemental regulations. DHS received 32 sets of comments on the interim rule from a wide variety of organizations and individuals that raised concerns and offered suggestions and recommendations about various aspects of the program. Currently, the Program Office is operating under the interim rule.

The interim rule includes mechanisms specified by the act regarding acknowledging to the submitter that the Program Office has received the voluntarily submitted CII; maintaining the identification of this information as voluntarily submitted to the government under the act; receiving, handling, storing, and properly marking information as PCII, including reviewing submitted information, determining that it meets the requirements for protection (a process known as validation), and protecting it; safeguarding and maintaining the confidentiality of the submitter of the information, but permitting the sharing of the information, as determined by the Program Manager; and protecting and maintaining the confidentiality of the information, so as to permit (1) the sharing of it within the federal government and with state and local governments and (2) the issuance of notices and warnings related to the protection of critical infrastructure and protected systems, in such a manner as to protect from public disclosure the identity of the submitting person or entity or information that is proprietary, is business-sensitive, relates specifically to the submitting person or entity, and is otherwise not appropriately in the public domain.

To accomplish these requirements, the interim rule established authorities regarding the sharing of protected information with federal, state, and local governments. Under the rule, the Program Manager has the authority to decide what protected information to provide to trained federal, state, or local government employees for purposes that include analysis, warning, asset recovery, reconstitution, and studies of the interdependence of critical infrastructure sectors. For example, the information might be provided if it is needed to study how the banking and finance sector depends on the security of the telecommunications sector so that backup systems can be developed in advance of an incident. In addition, the interim rule states that the Program Manager can share information for other purposes, including the identification, analysis, prevention, preemption, or disruption of terrorist threats to the homeland.

Under the rule, the Program Manager is responsible for administering the program, including (1) reviewing submissions to determine if they meet the requirements for protection—referred to as validation, (2) promulgating directives to operate the program, and (3) preparing training materials as appropriate for the proper treatment of PCII. The Program Manager is also required to establish procedures to ensure that any federal, state, or local entity that wants to use the information appoints one or more employees fully familiar with the procedures as PCII officers. These officers are required to oversee the handling, use, secure sharing, and storage of the information within their respective entity; prevent unauthorized access to the information; and coordinate with the Program Manager.

DHS Has Organized a Program Office, as Authorized by the CII Act

In February 2004, DHS established a Program Office to receive CII. During the course of our review, DHS reorganized and this office is now under the Preparedness Directorate, Office of Infrastructure Protection, and Infrastructure Partnership Division. The Program Office is led by the Program Manager and includes a combination of full-time federal and contractor employees. It is organized into four branches that, among other things, (1) develop and maintain applicable processes for information systems and networks, (2) receive submissions, (3) communicate with submitters about the status of their submission, (4) train users and entities that want to establish their own programs for handling the information, and (5) share PCII.

At the Program Office’s establishment, it published an initial, internal procedures manual describing the activities to implement the provisions of the act and the interim rule and providing guidance for administration of the program. The manual describes the process that (1) the submitters from the private sector and others are to use to send the information to DHS and (2) the Program Office is to use to validate that submitted CII meets the act’s requirements for protection. The manual also describes the process for sharing PCII with authorized users within DHS, other federal entities, and state and local governments.

The Program Office Has Received and Validated Submissions and Initiated Efforts to Increase Submissions

The CII Act specifies that DHS receive all submissions of CII. Once received by the Program Office, the CII submission enters a validation process for determining whether it qualifies for protection under the act. If the qualifications are met, the submission is marked PCII and is to be provided the protections in the act. If the qualifications are not met, the submission is rejected and destroyed. Appendix II discusses these processes in more detail.

As of January 2006, the Program Office had received 289 submissions, of which 266 were validated as PCII, 8 were in the process of being validated, 14 were rejected, and 1 was withdrawn. The validated submissions include risk and vulnerability assessments about individual infrastructure assets from a variety of critical infrastructure sectors, such as the energy, agriculture and food, banking and finance, and chemical sectors. In addition, entities have submitted data on their operations and on security methods used to protect their assets. According to program officials, submissions were rejected or withdrawn generally because they did not meet the program’s requirements, such as not being submitted with an Express Statement or not being CII as defined in the law, even after the Program Office contacted the submitters for additional information to try to resolve this problem.

To manage the submissions, the Program Office developed, as directed in the interim rule, and is using the Protected Critical Infrastructure Information Management System (PCIIMS)—an electronic database that tracks the receipt and storage of CII submissions, according to program officials. For each submission, the system allows reviewing officials to record the date of receipt, name of the submitter, description of the information received, manner of acknowledgment, tracking number, and validation status. Once a submission is validated as PCII, the information is placed on a secured electronic storage device within the Program Office. Staff in the Program Office reported that they are also working on an updated version of the management system that is expected to streamline and automate the validation process, reducing the time needed to determine if submissions qualify for protection.

To increase submissions, the Program Office has initiated outreach efforts to publicize the PCII program to the public and private sectors. As part of its outreach efforts, the Program Office launched a public Web site in March 2004, presenting program facts and answers to frequently asked questions. In addition, the Program Office prepared over 2,300 fact sheets and about 4,000 brochures that it distributed to public and private stakeholders. It also activated e-mail and telephone help lines to respond to inquiries or comments. To promote the PCII program to private industry, the Program Office has discussed the program in over 30 articles in trade publications, briefed infrastructure sector representatives and participated in industry conferences and seminars, and provided presentation kits that DHS analysts use to explain the program to potential submitters.

In addition, the Program Office implemented an e-submissions process in August 2005 to make submissions easier. According to the Program Office, the benefits to e-submissions include increased transaction speed, improved record-keeping efficiency, increased participation, and improved security. Submitted files are encrypted in transit to prevent access by anyone except Program Office staff and are stored in a stand-alone database maintained at a secure location.

The Program Office is also collaborating with other information sharing and collection efforts to make submission of CII easier. For example, the Program Office gave DHS’s National Cyber Security Division (NCSD) limited authority to receive recurring submissions. At the time of our review, NCSD had not used the authority; however, according to NCSD officials, the validation authority is a positive step because it provides a private sector entity with an additional method to share information with them. In addition, the Center for Food Safety and Applied Nutrition within the Department of Health and Human Service’s Food and Drug Administration, is partnering with the Program Office. The center plans to ask a number of dairy facilities to share CII on the safety of the nation’s milk supply. The information will be submitted to the Program Office to be validated and will then be made available to the Food and Drug Administration for safety analyses. In New York, the Risk Analysis and Management for Critical Asset Protection program—developed in a public/private sector partnership for DHS by the American Society of Mechanical Engineers as a methodology for performing risk assessments— is offering a method to electronically submit CII to the Program Office for protection. Using the program, infrastructure asset owners will be able to submit results about the security of their facilities to DHS.

The Program Office Has Begun to Share PCII, Trained about 750 Users, and Established a Mechanism to Initiate PCII Programs at Other Entities

As the CII Act authorizes, DHS has begun to share PCII with users. For example, according to NCSD officials, the Program Office received information that it later shared with them. They said that this information was important to investigating a cyber-related incident, but it would not have been provided by the infrastructure owners without CII Act protections. In addition, the Federal Emergency Management Agency (FEMA) received one piece of information from the Program Office. Agency officials said they learned about the information while in discussions with officials from a state who told them that they would not share the information unless it could be protected. On the basis of this requirement, FEMA requested the state to submit the information to the Program Office and had FEMA officials trained in the use and handling of PCII. According to a FEMA official, this information led to the development of generic best practices related to dam security that were presented at a workshop. Also, a few other federal agencies have used the information. For example, in February 2005, at the request of NCSD, the National Security Agency (NSA) became the first non-DHS federal agency to receive PCII. This information was used to assist in the research of a cyber-related incident and did not result in any public alerts. In addition, officials from the Nuclear Regulatory Commission reported that they had reviewed one PCII report.

Prior to allowing federal, state, or local government users access to the information, the Program Office trains them to ensure that users have a clear understanding of how to handle and safeguard PCII and how to access the information on an as-needed basis, according to program officials. The Program Office began user training sessions in February 2004 and established a Web-based training program in November 2004. At the time of our review, approximately 650 individuals from within DHS, including contract personnel, had been trained, along with 110 individuals from other federal, state, and local agencies.

The Program Office also accredits federal, state, and local agency PCII programs. Only accredited entities can receive and store this information. Accreditation ensures that an entity is qualified to manage its own program for handling, using, sharing, and safeguarding PCII, including applicable databases and systems. After determining its need for PCII, an entity must complete the following steps to earn accreditation: (1) appoint a program officer and at least one deputy program officer, both of whom must complete a 3-day course about the use and handling of PCII and pass a certification examination; (2) provide a senior official with the authority to represent the entity and enter into a memorandum of agreement (MOA) with the Program Office; and (3) pass an accreditation review by the Program Office.

Since July 2005, when the PCII Accreditation Program began, the Program Office has trained at least 16 federal and state officials who serve or will serve as program officers or deputy program officers for their respective agencies, according to program officials. Not all of the federal and state entities represented by the 16 officers and deputies have completed the accreditation process. According to program officials, as of January 2006, two entities were fully accredited—Maryland and the Food and Drug Administration’s Center for Food Safety and Applied Nutrition. In addition, Arizona, California, and Massachusetts were in the process of being accredited, and other federal entities and states had initiated discussions with the Program Office about becoming accredited. Regarding additional federal agencies, the Nuclear Regulatory Commission is participating in the accreditation process. In addition, according to the Department of Agriculture’s Director of Homeland Security and information technology staff, the Department of Agriculture will establish a PCII program, which will require them to become accredited. (See app. II for a more detailed description of the accreditation process.)

According to the Program Manager, the Program Office is most interested in accrediting entities that have lead roles in critical infrastructure protection—such as the Departments of Agriculture, Energy, and the Treasury. However, the Program Manager noted that accreditation is voluntary and some of these agencies may not be interested. In addition, according to the Program Manager, the Program Office will continue to accredit other entities, such as states and other federal agencies, that express an interest in PCII.

Figure 1 summarizes the efforts related to implementation of the CII Act.

DHS Faces Challenges in Implementing the CII Act

DHS faces challenges in implementing the CII Act through the PCII program. These challenges include better defining specific government needs for CII, determining how the information will be used, assuring the private sector that the information will be protected and who will be authorized to have access to it, and demonstrating to critical infrastructure owners the benefits of sharing the information. By overcoming these challenges, DHS and other users may make strides toward reducing critical infrastructure owners’ lack of trust in the government’s ability to use and protect their sensitive information.

Defining specific government needs: The act broadly defines what CII can be voluntarily submitted to the government for protection, and the interim rule reiterates the same broad definitions for use by the Program Office in its implementation of the act. However, DHS has not defined the specific information—such as industry-specific vulnerabilities and interdependencies—needed under the program, nor has it comprehensively worked with other federal agencies with critical infrastructure responsibilities to find out what they need. The lack of specificity on the part of DHS in clearly communicating to the private sector what information is needed has impeded the willingness of potential submitters to provide their sensitive information to DHS. The Program Manager and other program officials said that until the potential users of PCII within DHS and other federal agencies with critical infrastructure responsibilities have fully identified their information needs, the private sector will not know what to submit.

An official representing the chemical infrastructure sector agreed that infrastructure owners need to know what kind of information is required so they can provide meaningful submissions. In October 2005, the National Infrastructure Advisory Council also made the point that when requesting information, the government must clarify why they need the information. In addition, defining the needs for information requiring protection is what drives potential users to participate in the program. For example, Maryland and California initiated the accreditation process because, according to responsible officials, they had defined specific information needs that required protection.

Determining how information will be used: The act broadly defines how PCII may be shared with other government entities and used to issue advisories, alerts, and warnings. The interim rule provides procedures on how information will be shared with other entities for the same broad uses. However, potential users within DHS have not specified how they will use the information. In addition, DHS has not yet used the information to issue any advisories, alerts, or warnings, according to DHS officials. An Infrastructure Partnership Division official also said that until more information is submitted under the program, it will be difficult for DHS to determine how it will use the information.

In October 2005, the National Infrastructure Advisory Council stated that the private sector might be more willing to share information if “when requesting information, the government clarified how they will use it.” In addition, an official representing the chemical infrastructure sector agreed that entities would be more likely to submit CII if they knew how it would be used. We have also reported in the past that uncertainty about how the information would be used and who it would be shared with posed a barrier to critical infrastructure sectors sharing information with the government.

The Program Office faces the challenge of building a demand for PCII among potential users of the information by demonstrating how it will help users achieve their critical infrastructure missions. Without identifying a specific use for PCII, entities are often reluctant to commit the necessary effort toward accreditation. For example, according to an NSA official who used PCII once, while there was value to having the information his office had already used, its use did not impact his office’s final conclusions on the investigation they were conducting or result in any analytical or warning products being issued. Because the use for the information was considered an isolated case, NSA does not plan to establish an accredited PCII program.

In addition, FEMA officials who also used PCII once, noted that PCII they had received was valuable in developing security-related best practices that FEMA presented at a workshop. However, they have no current plans to establish a formally accredited program because they are uncertain how they will use the information in the future. Also, as previously discussed, user participation in the PCII program is completely voluntary, even for agencies that have particular responsibilities for a critical infrastructure sector. Nonetheless, the Program Office is attempting to train enough users and help other government entities establish programs so that there is a critical mass of users to help make the program viable.

Other DHS officials stated that their own use of PCII had been purely incidental. For example, DHS’s Office of Intelligence and Analysis has not found PCII to be essential for its operations largely because its emphasis is on analyzing and responding to immediate threats, while PCII is information relating to vulnerabilities. At this early stage of the program’s maturity, an official said PCII is not viewed by the Intelligence and Analysis analysts as providing better or more relevant information than that which they receive on a daily basis from the intelligence community and the many other sources used to identify threats. On the other hand, the Deputy Director of the Infrastructure Partnership Division stated that analysts within the division could find PCII very useful to their mission. In addition, DHS officials believe that as more PCII becomes available, they will use it in their new Homeland Infrastructure Threat and Risk Analysis Center—a national center for the integration, analysis, and sharing of information related to the threat of terrorist attacks on critical infrastructure.

Assuring the private sector that the information will be protected and who will be authorized to have access to it: To implement the protection requirements in the act, the interim rule establishes procedures for marking, safeguarding, and sharing the information. In addition, the Program Office has established (1) the training program to equip authorized users with knowledge of how to safeguard the information and (2) the PCII Accreditation Program to ensure that other organizations have processes and policies to promote the safeguarding of the information.

However, potential submitters often continue to be reluctant to provide their sensitive information because they are not certain that their information will be fully protected. They fear that the information could be inadequately protected, used for future legal or regulatory action, or inadvertently released. For example, as follows, specific provisions in the law and rule impact perceptions that the submitted information will not be protected, according to DHS, other federal agencies, and the private sector: Originator control: Under the rule, the Program Manager has the authority to decide what PCII to provide to federal, state, or local government employees for approved purposes; the originator of the critical information cannot control how the submission is shared at the federal level. According to an official representing a multisector organization, infrastructure sector entities are hesitant to share information because of its sensitivity, without having control over who has access to it. According to the Program Manager, the Program Office is considering a method that they believe would meet the act’s intent— that is, submitters would identify at the time of submission what users they believe should or should not be able to receive the information. Under this method, the Program Office would contact the submitter if a need arose for another entity to use the information. According to DHS, this method has been used for some PCII submissions. However, this method has not yet been instituted.

Direct submissions: To receive protection, all submissions must be received by DHS directly from the original submitter. For example, the Department of Defense cannot receive information from members of the defense industrial base and protect it as PCII or forward it to DHS to be labeled and protected. However, in commenting on the interim rule, one federal agency, as well as four infrastructure sector organizations, expressed interest in being able to directly receive or submit this information because of existing relationships. For example, an official representing a multisector organization stated that private and public critical infrastructure entities have already built relationships with each other over many years and have sufficient trust to share information with each other. According to the Program Manager, the issue of direct submission will have to be addressed at some point; however, at this early stage in the program, it is not worth the risk of having PCII inappropriately released by an agency, because any mistake would undermine the entire effort to build trust.

Legal precedents: According to the Program Manager, there have been no court cases addressing the CII Act. According to the Program Office and the Homeland Security Advisory Council report, until the courts uphold the protections, the private sector will frequently be hesitant to use the program.

In addition, potential submitters of CII have been hesitant to provide their sensitive information because they are not certain how information would be protected under the final rule. As of January 2006, DHS had not issued a final rule, as planned. DHS had established April 2005, June 2005, and August 2005 as deadlines for the rule to be issued, but it missed these time frames. The Program Manager and other program officials reported that the draft final rule had been undergoing legal review within DHS since the summer of 2005 and would go to the Office of Management and Budget (OMB) for interagency review before becoming final. However, they could not predict when this would occur and did not have any target deadlines established. In addition, the Program Manager and other program officials were uncertain what changes, if any, would be made to the rule during legal and interagency review.

We have reported in the past that the uncertainty about how information would be protected by federal agencies was a barrier to critical infrastructure sectors sharing information with the federal government. For example, in May 2005, we reported that critical infrastructure entities did not openly share cybersecurity information with DHS, in large part, because they were concerned that the potential release of sensitive information could increase the threat to the respective entity. Also, in April 2004, we testified that the reluctance by information-sharing organizations to share information had focused on concerns over potential government release of that information, among other things.

In addition, the Program Office has been challenged to implement a program that will provide protection to CII consistently across federal, state, and local government entities while adhering to the scope of the act and the interim rule. Some of the challenges that DHS, states, and private sector entities identified were as follows: Sharing PCII with and among the state and local governments: Under the act, state officials are not allowed to directly share PCII with officials in other states, unless the Program Office gets written consent from the person or entity submitting the information. This is a challenge that limits sharing when state officials meet and when a state official knows that information could be useful to another state official to address a vulnerability or threat. The Program Office is considering resolving this issue by having submitters grant written approval for this type of sharing when they submit CII—similar to how the issue of originator control could be handled.

Penalties for inappropriate disclosure are limited to federal employees: The act imposes criminal and administrative penalties for federal employees that disclose PCII; however, those penalties do not apply to contractors or state and local officials, who could face significantly less penalty for disclosure. The variation of penalties could impact the level of protection. For example, contractors are not subject to criminal penalties and contract termination serves as a deterrent to mishandling the information. For states, the Program Office has suggested that these issues can be resolved through a MOA between the state entity and the Program Office that would stipulate state laws are to be used to prosecute violators. According to the Program Office, this arrangement was made under the memorandum signed with Maryland and California.

Demonstrating benefits to critical infrastructure owners of sharing the information: DHS and other interested federal agencies have not clearly demonstrated to the potential CII submitters the benefit of sharing their sensitive information; therefore, potential submitters may not be willing to take the risk of inappropriate use and release. Federal, state, and private sector officials stated that some of the benefits that potential submitters expect to receive include improved reaction by first responders; improved intelligence and strategic analyses of threat information; and improved performance of services, such as vulnerability analyses for small entities unable to afford their own efforts. However, at the time of our review, DHS’s emphasis was on analyzing and responding to immediate threats, rather than on combining threat and vulnerability information into strategic analyses.

Our prior work has shown that the federal government lacks the analytical processes that would provide the sorts of benefits sought by infrastructure owners. We reported that further efforts are needed to address the critical challenges of improving the federal government’s capabilities to analyze incident, threat, and vulnerability information obtained from numerous sources. We also reported that improvements are needed in the federal sharing of appropriate, timely, and useful warnings and other information concerning cyber and physical threats to federal entities, state and local governments, and the private sector.

Our prior work has also identified demonstrating benefits as a challenge to the federal government. In April 2004, we testified that in white papers, the Information Sharing and Analysis Center Council emphasized that perhaps the greatest barriers to information sharing stem from practical and business considerations, and that the benefits of sharing information are often difficult to discern, while the risks and costs of sharing are direct and foreseeable. In addition, in May 2005, we reported that even when organizations within infrastructure sectors shared information with DHS, the entities did not consistently receive useful information in return.

Overcoming these challenges could help to encourage more submissions, which in turn would provide the opportunity for the government to provide benefits back to the private sector submitters, thereby creating a virtuous cycle that builds on itself until a critical mass of users and submitters is reached and the program becomes self-sustaining. This would help to address the lack of trust in the government that the private sector has consistently identified as a reason to limit information sharing. The Program Manager and other DHS officials acknowledged the need to establish trusted relationships between the CII submitters and the information users in federal, state, and local governments.

Conclusions

DHS has made progress in implementing the CII Act by establishing procedures and creating a Program Office to administer the program. However, DHS is still in the early stages of its efforts to expand the submission and use of PCII and will have to overcome major challenges for its program to be viable. This effort includes issuing a final rule, as DHS has planned to do, so that potential submitters will know how the program will operate. Further, although DHS has a lead responsibility for federal critical infrastructure protection efforts, its planning efforts to date have not articulated what specific information it and other federal agencies with critical infrastructure responsibilities need and how the information will be used. Without this knowledge, the private sector will continue to be hesitant to provide information to DHS. The Program Office is aware of changes it could make to the program that might increase submissions of CII and provide incentives to users, such as providing clarity regarding how the information will be protected, establishing some level of originator control, allowing direct submissions, and providing a mechanism for state- to-state sharing. However, to date, these options and initiatives have not been aggressively pursued. If DHS were able to surmount these challenges, it and other government users may begin to overcome the lack of trust critical infrastructure owners have in the government’s ability to use and protect their sensitive information.

Recommendations for Executive Action

In order for DHS to address the challenges to the PCII program—defining specific needs, determining how and who uses the information, assuring submitters that the information will be protected, and demonstrating benefits to critical infrastructure owners—we recommend that the Secretary of Homeland Security take the following four actions: In the short term, establish a specific deadline in the near future for releasing the final rule to OMB and for interagency review so that potential submitters have more assurance about how their sensitive information will be protected.

Concurrently, consistent with other infrastructure planning efforts such define and communicate to the private sector what CII DHS and federal entities need to fulfill their critical infrastructure responsibilities and how federal, state, and local entities are expected to use the information submitted under the program; determine whether creating mechanisms, such as providing originator control and direct submissions to federal agencies other than DHS, would increase submissions; and expand efforts to use incentives to encourage more users, such as mechanisms for state-to-state sharing.

We are not making new recommendations regarding improving the effectiveness of DHS’s information-sharing efforts at this time because our previous recommendations, including performance of a national threat assessment and establishment of a strategic analysis capability for computer-based threats, have not yet been fully implemented.

Agency Comments

We received oral comments on a draft of this report. An audit liaison official from the DHS Departmental GAO/OIG Liaison Office stated that DHS concurred with our findings and recommendations, based on the comments received from officials from the Preparedness Directorate, including the Program Office; the Transportation Security Administration; DHS’s General Counsel; and others.

In addition, the DHS Departmental GAO/OIG Liaison Office provided technical corrections that it received from the Preparedness Directorate, including the Program Office; DHS’s General Counsel; and others. We also received technical corrections from other officials who were cited in our report. We have incorporated the DHS and other technical corrections in this report as appropriate.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the date of this letter. At that time, we will send copies of this report to interested congressional committees, the Secretary of Homeland Security, and other interested parties. We will also make copies available to others upon request. In addition, this report will be available at no charge on the GAO Web site at http://www.gao.gov.

If you or your staffs have any questions concerning this report, please contact either Dave Powner at 202-512-9286 or pownerd@gao.gov, or Eileen Larence at 202-512-6510 or larencee@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Other GAO staff who contributed to this report are listed in appendix III.

Objectives, Scope, and Methodology

In response to your request that we review the implementation of the Critical Infrastructure Information (CII) Act of 2002, we determined (1) the status of the Department of Homeland Security’s (DHS) implementation efforts and (2) the challenges DHS faces in implementing the act.

To assess the current state of CII Act implementation, we analyzed the CII Act and the Procedures for Handling Critical Infrastructure Information: Interim Rule, the procedures that DHS issued in February 2004, and related public comments. In order to understand DHS’s efforts to establish a Protected Critical Infrastructure Information (PCII) Program to accept and protect CII, we gathered and analyzed relevant strategies, policies, and procedures, including the PCII Information Program Management Directive (draft); the PCII Program Procedures Manual, Configuration Management Plan, Mission Needs Statement, Concept of Operations for Management (draft), and Systems Risk Assessment. We held interviews with key officials from DHS’s Preparedness Directorate and Intelligence and Analysis Office (formerly, the Information Analysis and Infrastructure Protection Directorate, which included the Disclosure Office, the Infrastructure Coordination Division, and the Information Analysis Division). We observed controls and tools used for the receipt, care, and storage of PCII, as outlined in the Program Office’s manuals. In addition, we interviewed officials from the Program Office, including the Program Manager and representatives from each of the office’s four branches (Management, Communications, Operations, and Systems). We compared what was expected under the CII Act with what had been accomplished by DHS. Further, we interviewed key officials from DHS units in the Federal Emergency Management Agency and the Transportation Security Administration. We also held interviews with representatives from entities that could potentially submit CII, including infrastructure sector entities and public interest groups, such as the Partnership for Critical Infrastructure Security, the American Chemistry Council, the American Petroleum Institute, and the Edison Electric Institute. We also held interviews with representatives from entities that had used PCII, including federal, state, and local organizations, such as the Department of Defense, National Security Agency, Department of Agriculture, Federal Reserve System, Nuclear Regulatory Commission, Maryland Emergency Management Agency, and California Office of Homeland Security.

To determine the challenges to implementing the CII Act, we analyzed reports by private sector advisory councils and critical infrastructure protection experts that have identified related challenges. We also interviewed officials knowledgeable about public/private information sharing and about the act from DHS, federal agencies, state and local governments, private sector entities, and public interest groups. In addition, we relied on prior GAO work on information sharing between federal and nonfederal entities.

Our work was conducted from May 2005 to February 2006 in accordance with generally accepted government auditing standards.

Procedures for Processing CII and Accrediting Entities

Processing CII

The CII Act requires DHS to establish uniform procedures for the receipt, care, and storage of CII that is voluntarily submitted to DHS. In February 2004, the Program Office implemented a process to review CII and began accepting voluntarily submitted information to determine if it qualifies for protection. For this explanation, the process is divided into three steps: submission, validation, and sharing. Figure 2 summarizes the Program Office’s process.

Step 1: Submission

The CII Act requires all submissions of CII to be submitted to DHS for protection under the act. Submission to DHS means any voluntary transmittal of CII to the DHS PCII Program Office. CII that is not submitted to DHS does not qualify for protection. Based on the Program Office’s process, the submission requirements include the following: Sources expected to submit CII to DHS for consideration for protection, or validation, are those with direct knowledge about the security of a critical infrastructure element, and include, but are not limited to, Information Sharing and Analysis Organizations (ISAO), private sector entities, state and local governments, and foreign governments and companies.

Federal agencies may not independently submit private sector information for PCII protection, unless they are working together in partnership with a private sector entity or the agency is part of an ISAO.

Submissions must be accompanied by an Express Statement and a Certification Statement before they can be validated as PCII. According to the CII Act, only those submissions that are accompanied by an Express Statement will have the presumption of protection under the act.

An Express Statement indicates that the information is voluntarily submitted to the federal government with the expectation that it will be protected under the CII Act. A Certification Statement states that the information is voluntarily submitted, is required or is not required to be submitted to the federal government, and is not customarily in the public domain.

The Program Office accepts submissions electronically through a secure Internet portal or through physical materials, such as floppy disks, video tapes, audio tapes, facsimiles, or letters.

Step 2: Validation

Validation is the process for determining whether a submission with an Express Statement qualifies for protection under the CII Act and, therefore, will be protected as provided by the act. The Program Manager will establish time frames for completing the validation process to ensure effective, efficient, and timely validation determinations. On the basis of a review of the information submitted, the Program Manager or designated representative makes an initial determination regarding whether the information qualifies for protection.

Program Office procedures require that submissions be acknowledged and tracked throughout the validation process. If the submission is received with both an Express Statement and a Certification Statement, it will be processed without delay.

Information received without an Express Statement will be destroyed immediately, and the submitter will be asked to resubmit. Submissions received with an Express Statement, but without a complete Certification Statement, will be presumed to be CII and will be processed. However, the submitter will be contacted to provide a Certification Statement.

When information is submitted with an Express Statement, the Protected Critical Infrastructure Information Management System (PCIIMS) will assign it a unique tracking number, which will be used in all future communications with the submitter and for recording the current status of submitted information.

The Program Office must acknowledge receipt of submitted information in writing within 30 calendar days of its receipt. Acknowledgment of receipt means only that the information has been received by the Program Office and is accompanied by an Express Statement.

If the submission is accompanied by both an Express Statement and a Certification Statement, and the Program Office determines that the information meets the definition of CII, then the information will be validated as PCII; the PCIIMS will be updated to indicate that the information qualifies for protection under the CII Act; the submitter will be notified of the decision, and the validated PCII will be made available to authorized users.

If the initial review determines that the information submitted does not meet the requirements for protection under the CII Act, the Program Office must inform the submitter that the initial determination is that the submission does not meet the requirements to be PCII; request the submitter to provide a complete Certification Statement and/or provide additional information within 30 days of the submitter’s receipt of the Program Office’s request; give the submitter the opportunity to withdraw the submission before consider any additional information provided in making the final validation determination; whenever possible, the final review will be performed by the same staff member who performed the initial review.

Newly validated PCII is added to the PCII Submissions Catalog, which is a list of all available PCII information prepared in a non-PCII format so that it can be easily shared. For each submission, the PCII Submissions Catalog contains its tracking number, date of submission, description of submission, and number of pages.

Step 3: Sharing

A copy of the PCII Submission Catalog is provided to all PCII officers for distribution at their discretion to users and analysts for their review. If after reviewing the catalog the users want to request PCII, they may do so through their entity’s PCII officer.

The Program Office is authorized to provide access to PCII when it determines that this access supports a lawful and authorized government purpose as specified in the CII Act. The Program Office may provide PCII to federal government departments and agencies and to state and local government entities that have executed the standard memorandum of agreement (MOA) with the Program Manager and have met the requirements of the PCII Accreditation Program.

Before accessing and storing PCII, organizations or entities must be accredited and have a PCII officer to supervise strict compliance with procedures. Before individual users can access PCII, they must be trained in the proper use, handling, and safeguarding of PCII. Authorized users can request access to PCII on a need-to-know basis. However, users outside of DHS do not have the authority to store PCII until their agency is accredited. In cases where the user is from an entity that is not accredited, the Program Office and the user make arrangements for the user to access the information at the Program Office.

If access is granted, the information is downloaded from the Program Office’s secure storage to a paper copy or compact disk. It is then either hand delivered to the user or loaded to another secure system and accessed by the user through a controlled folder on the secure system.

The Program Office is responsible for tracking PCII to the state or local government entity to which it was initially provided. The officially designated PCII officer of each government entity is responsible for sharing and tracking PCII under their control.

Federal government entities may share PCII in their possession provided they verify that the recipient entity has been accredited by the Program Office to receive PCII and will maintain a tracking mechanism that provides a record of what PCII they provided to whom and when they provided it.

State and local governments receiving PCII are not authorized to share PCII with entities external to their governmental entity, unless they obtain the express approval of Program Manager and the explicit written consent of the submitter.

Authorized recipients may use PCII for securing the critical infrastructure and protected systems; analysis of potential threats and vulnerabilities; warning of imminent attack; studying the interdependency between critical infrastructure sectors; recovery and reconstitution of damaged infrastructures; or another information purpose, including, without limitation, the identification, analysis, prevention, preemption, and/or disruption of terrorist threats to our homeland.

Accrediting Entities to Receive PCII

Before federal, state, or local government entities can access and store PCII, they must have executed a MOA with the Program Office and have met the requirements of the PCII Accreditation Program. At the time of our review, the Program Office was updating its February 2004 procedures manual with guidance on its accreditation process. The accreditation process was established to ensure that each entity and user has a clear understanding of how to initiate and manage their entities’ program and adequate policies, procedures, secure systems, and databases for handling, using, sharing, and safeguarding PCII. The Program Office’s Operations Branch is responsible for managing the process, and the Communications Branch is responsible for outreach and training activities in support of the process. Figure 3 outlines the key steps in the accreditation process.

The following are key steps in the accreditation process.

After a government entity or other accreditation candidate determines its need for PCII, the entity requests an application from the Program Office and nominates a PCII officer and deputy. Any nonfederal government employee who is nominated to be a PCII officer or deputy must sign a nondisclosure agreement concerning PCII.

The Program Office appoints the nominated PCII officer and deputy for the candidate entity after they complete a 3-day training course and pass a certification examination.

A senior official with the authority to represent the candidate entity enters into a MOA with DHS. The MOA (1) constitutes an entitywide obligation and an executive-level commitment to achieving and maintaining PCII accreditation and (2) sets forth the responsibilities and obligations of the PCII officer and deputy as well as the requirements for handling, using, sharing, and safeguarding PCII throughout the federal, state, or local entity.

The PCII officer completes a self-assessment of how well the entity’s policies, procedures, and oversight measures comply with the minimum requirements and procedures set forth in the accreditation guide. The Program Office reviews the self-assessment and works with the accreditation candidate’s PCII officer to address any needs for further development activities.

Once the PCII officer has submitted a self-assessment and addresses any immediate issue, a site assessment team visits the offices and facilities of the accreditation candidate to determine its ability to comply with the requirements set forth in the PCII procedures manual.

The Program Office accredits the government entity after all needs identified by the assessments are addressed. The PCII officer must submit an annual report to the Program Office to keep the office appraised of any developments in the participant’s PCII program. A fully accredited entity must be reaccredited every 3 years. In addition, the Program Office may also elect to conduct a site visit of an accredited entity at any time to ensure that the minimum requirements are continually being met or to respond to requests for consultation or guidance from the entity.

GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to the persons named above, R. Rochelle Burns, Neil Doherty, Michael Gilmore, Steve Gosewehr, Barbarol James, Victoria Miller, Susan Quinlan, Nik Rapelje, and Amos Tevelow made key contributions to this report.