Telecommunications Networks: Addressing Potential Security Risks of Foreign-Manufactured Equipment
Released: 2013-05-21T00:00:00

Letter

Background

Cybersecurity and Critical Infrastructure Protection Responsibilities

Federal policy calls for critical infrastructure protection activities that are intended to enhance the cyber and physical security of private infrastructures, such as telecommunication networks, that are essential to national and economic security. DHS, Commerce, and FCC have critical infrastructure protection responsibilities over issues related to the security of communications networks. Appendix IV provides additional information on these agencies’ legal authority related to supply chain security for commercial communication networks. In addition, some executive actions have focused on supply chain risk management issues related to cybersecurity, which are described below.

The Homeland Security Act of 2002 established DHS and assigned it the following critical infrastructure protection responsibilities: develop a comprehensive national plan for securing the key resources and critical infrastructure of the United States and disseminate, as appropriate, information to assist in the deterrence, prevention, and pre-emption of or response to terrorist attacks.

Commerce is responsible under Presidential Policy Directive 21 (PPD- 21), in coordination with other federal and nonfederal entities, for improving security for technology and tools related to cyber-based systems, and promoting the development of other efforts related to critical infrastructure to enable the timely availability of industrial products, materials, and services to meet homeland security requirements. Within Commerce, the National Institute of Standards and Technology (NIST) has responsibility for, among other things, cooperating with other federal agencies, industry, and other private organizations in establishing standard practices, codes, specifications, and voluntary consensus standards.

Under PPD-21, FCC is responsible for exercising its authority and expertise to partner with other federal agencies on: identifying and prioritizing communications infrastructure; identifying communications sector vulnerabilities and working with industry and other stakeholders to address those vulnerabilities; and working with stakeholders, including industry, and engaging foreign governments and international organizations to increase the security and resilience of critical infrastructure within the communications sector and facilitating the development and implementation of best practices promoting the security and resilience of the nation’s critical communications infrastructure.

Supply chain risk management has been the focus of executive actions; for example, in January 2008, the President directed the development of a multi-pronged approach for addressing global supply chain risk management as part of the Comprehensive National Cybersecurity Initiative (CNCI), an ongoing effort. More recently, at the direction of the President, a report on the federal government’s cybersecurity-related activities was released, which discussed, among other things, the importance of prevention and response against threats to the supply chains used to build and maintain the nation’s infrastructure. Additionally, in response to one of the report’s recommendations, the President appointed a national cybersecurity coordinator in December 2009.

Description of Core Networks and Access Networks

The United States has several nationwide voice and data networks that along with comparable communications networks in other countries, enable people around the world to connect to each other, access information instantly, and communicate from remote areas. These networks consist of core networks, which transport a high volume of aggregated voice and data traffic over significant distances, and access networks, which are more localized and connect end users to the core network or directly to each other. Multiple network providers in the United States operate distinct core and access networks that interconnect to form a national communications infrastructure (see fig. 1).

Routers and switches send traffic, in the form of data packets, through core and access networks. These pieces of equipment read the address information located in the data packet, determine its destination, and direct it through the network. Routers connect users between networks, while switches connect users within a network. The evolved packet core is the mobile core network used for long-term evolution (LTE) systems, a standard for commercial wireless technologies. LTE is widely accepted as the foundation for future mobile communications. Several major network equipment manufacturers are competing to provide equipment to wireless network providers that are upgrading their networks to deploy LTE.

Global Supply Chain

Communications infrastructure is increasingly composed of components that are designed, developed, and manufactured by foreign companies or by U.S. companies that rely on suppliers that integrate foreign components into their products. Furthermore, we have previously reported that according to NIST, today’s complex global economy and manufacturing practices make corporate ownership and control more ambiguous when assessing supply chain vulnerabilities, as companies may conduct business under different names in multiple countries. For example, foreign-based companies sometimes manufacture and assemble products and components in the United States, and U.S.-based companies sometimes manufacture products and components overseas or employ foreign workers domestically. Figure 2 depicts some of the locations that major network equipment manufacturers we spoke with use for different steps in the production process.

From 2007 through 2011, communications network equipment imported for the U.S. market came from over 100 foreign countries. While the import data do not distinguish whether the imports are from U.S. or foreign-based companies, according to International Trade Commission staff, many of the imports are from U.S. companies manufacturing abroad. Imports of network equipment to the United States grew about $10 billion (about 76 percent) over a 5-year period, from $13.5 billion in 2007 to $23.8 billion in 2011, as shown in figure 3. During this same period, imports from China, which was the leading source country, grew by $4.9 billion (112 percent). In 2011, the top five sources of U.S. imports of networking equipment were China ($9.3 billion), Mexico ($5.2 billion), Malaysia ($2.6 billion), Thailand ($1.9 billion), and Canada ($713 million).

While there is no comprehensive unclassified compilation of attacks to core networks that originated in the supply chain, reliance on a global supply chain introduces some degree of risk. Risks include threats posed by actors such as foreign intelligence services or counterfeiters that may exploit vulnerabilities in the supply chain, thus compromising the availability, security, and resilience of the networks. Multiple points in the supply chain may present vulnerabilities that threat actors could exploit. For example, a lack of adequate testing for software patches and updates could leave a communications network vulnerable to the insertion of code intended to allow unauthorized access to information on the network. Routers and switches can present points of vulnerability because they connect to the core network and are used to aggregate data, according to an FCC official with whom we spoke. For example if a threat actor gained control of a router, that actor could disrupt data traffic to and inside core networks. Supply chain threats and vulnerabilities are discussed in more depth in appendixes II and III, respectively.

Industry Is Addressing the Risks of Using Foreign- Manufactured Equipment

Companies Address Supply Chain Risk through Procurement and Testing Practices

The network providers and equipment manufacturers we met with told us they address the potential security risks of using foreign-manufactured equipment through voluntary risk management practices. Officials from the companies and industry groups that we spoke with said that they consider the level of risk to be affected not by where equipment and components are made, but how they are made, particularly the security procedures implemented by manufacturers. Many of these officials also said they were not aware of any intentional attacks originating in the supply chain, and some said that they consider the risk of this type of attack to be low. Officials from four industry groups and one research institution we spoke with told us that supply chain attacks are harder to carry out and require more resources than other modes of attacks, such as malicious software uploaded to equipment through the Internet, and, therefore, are the less likely vehicle to be used by potential attackers. Three network providers told us the most common anomalies found in equipment are caused by erroneous coding in the software, anomalies that are unintentional. Such anomalies could, however, lead to exploitable vulnerabilities, according to officials from a third-party testing firm. Nonetheless, the companies we spoke with told us that security is a high priority because their brand image and profitability depends, in part, on avoiding any type of breach of security or disruption of service.

Network providers and equipment manufacturers told us that their voluntary risk management practices are in the areas of vendor selection, vendor security requirements, and equipment testing and monitoring, as described below and in figure 4. They said these practices are often a part of their company’s overall security plans and procurement processes and are applied throughout the entire life cycle of their equipment.

The network providers and equipment manufacturers we spoke with said that ensuring the security and reliability of their equipment requires them to carefully select their vendors. In addition to the typical considerations when selecting vendors—prices and product performance, the vendor’s financial stability, and maintenance and service options offered—the providers and manufacturers told us that they consider security-related factors, such as the vendor’s security practices, the industry standards related to security the vendors follow, and past security performance or reputation. Another consideration for some network providers when selecting vendors is how critical the equipment being procured is to network operations. Components that will be used in the core network, for example, are typically purchased from vendors that network providers consider most trustworthy. Some network providers told us they also value having long-term relationships with equipment manufacturers, because they are able to develop trust over time that the manufacturer will provide them with reliable and secure equipment and services.

While network providers said that they are aware of security concerns about vendors from certain countries, they do not exclude vendors from consideration that have manufacturing locations in those countries, in part, because the global nature of the supply chain would make excluding all vendors located in a particular country difficult. Some network providers told us they may exclude or avoid vendors based on factors such as the ownership of the company or concerns about the security of the vendor’s product, and two told us that federal government officials had advised against using specific vendors for national security reasons, as discussed in the following section of this testimony.

Network providers and equipment manufacturers told us that once vendor selections are made, they might require vendors to follow certain security practices, often as part of their contracts. Network providers told us that the security practices they require are typically based on the criticality or perceived risk of the project and the role of the vendor. For example, one network provider we spoke with generates a vendor risk profile for purchases that it considers critical or high risk or if it does not have an established relationship with the vendor. The company uses the profile to collect information on the product or service being provided, the vendor’s access to proprietary information, such as the company’s financial information or customer sensitive information, and available information on a vendor’s subcontractors. This information enables the network provider to identify areas of concern to investigate and to customize the security requirements placed on the vendor. The security practices that both network providers and equipment manufacturers may require of their vendors include the following: physical security measures, such as procedures for securing manufacturing sites, transporting equipment and parts, and packaging equipment and parts; access controls, such as limiting in-house and vendor employees’ access to equipment, maintaining records of who accesses equipment, and restricting who performs patches and updates; and employee security measures, such as requiring employees to have background checks and use passwords and user verification to access systems.

Additionally, network providers and equipment manufacturers told us they might require vendors to allow inspections of their manufacturing sites to check for compliance with the agreed-upon security practices. Representatives from the companies we met with told us that they conduct inspections at varying frequencies and for a number of reasons, including if the vendor is providing a critical piece of equipment or part or is identified as high risk, or if the equipment is performing poorly.

Network providers and equipment manufacturers told us that equipment is tested to detect vulnerabilities. This is done throughout the life cycle of equipment, including during product development, before and after implementation, and when any patches or updates are applied. After equipment is installed into the network, network providers also monitor the equipment constantly to detect abnormal traffic or problems with the equipment that might indicate a potential cyber attack and disrupt network service. According to officials from a third-party testing firm, there are several tools available to test the security of equipment, including: vulnerability scans—searching software and hardware for known vulnerabilities; penetration testing—executing deliberate attempts to attack a network through the equipment, sometimes targeting specific vulnerabilities of concern; and source code analysis—evaluating in depth the underlying software code that can uncover unknown vulnerabilities that would not be detected during a vulnerability scan.

Testing can be performed by the network provider, the equipment manufacturer, or independent third-party testing firms. Most network providers and several equipment manufacturers told us they use third- party testing firms on an ad-hoc basis, such as when requested by a customer or when they do not have the expertise or resources to conduct appropriate tests. Network providers and equipment manufacturers also use these firms when they want to analyze software or firmware source code because equipment manufacturers are reluctant to provide network providers with source code, which they consider intellectual property. Two network providers and one equipment manufacturer told us they use a trusted delivery model that employs a third-party testing firm to ensure that the equipment purchased and received is secure. Under this model, the third-party testing firm tests equipment over the full life-cycle of equipment, including when there are software patches or hardware updates, and uses a number of different techniques, such as source code analysis. Additionally, the testing firm verifies that the equipment delivered and implemented by the network provider matches the equipment tested and that the equipment manufacturer followed certain security procedures.

However, a recent congressional report identified the following potential limitations of third-party testing and available testing techniques.

These firms typically test equipment that is configured in a specific and restrictive way that may differ from the configuration that is actually deployed in the network.

The behavior of equipment can vary widely depending on how and where it is configured, installed, and maintained.

The pace of technology is changing more rapidly than third-party evaluation processes.

Vendors that finance their own security evaluations create a conflict of interest that can lead to skepticism about the independence and rigor of the result.

Officials from a third-party testing firm told us that there are evaluation processes, such as the trusted delivery model, that test the equipment delivered to network providers and deployed into the network against the equipment tested. Although they said it is impossible to test every piece of equipment, the firm tests a statistically significant random selection of equipment that represents all manufacturing lots and geographic locations. They also told us that independence is critical to their business. The officials said the vendor has no visibility into the evaluation process, and, typically, the vendor is obligated to report testing results.

The congressional report further stated that regardless of the testing technique employed, fully preventing a determined and clever insider from intentionally inserting flaws into equipment means finding and eliminating every significant vulnerability from a complex product, a monumental, or even—in the words of one congressional report— ”virtually impossible” task. Similarly, officials from one third-party testing firm whom we spoke with told us that they have concerns about the effectiveness of network monitoring as a way of detecting vulnerabilities. They said that security monitoring, in most cases, can only detect attempts to exploit known vulnerabilities, or in more complex approaches, identify potentially dangerous anomalous network activity. And as systems evolve and are updated, new vulnerabilities that have long existed in the underlying equipment may be inadvertently exposed in a manner that makes exploitation possible.

Companies Collaborate on Supply-Chain Security Standards, Best Practices, and Information Sharing

There are currently no industry standards that address all aspects of supply chain risk management, including supply chain security, and few best practices that provide industry with guidance on determining what practices to use. However, according to officials from companies and industry groups and the experts we spoke with, there are several industry-led efforts to establish standards and best practices and share information related to supply chain security. Some network providers and equipment manufacturers told us that they developed their own practices based on national and international standards that address information systems’ security, such as those practices described within the certification program called the Common Criteria, and those developed by the International Organization for Standardization (ISO), the International Electrotechnical Commission (IEC), NIST, and the Internet Engineering Task Force. However, these standards are not specific to supply chain security. Additionally, federal agencies that we have identified as having jurisdiction over issues related to the security of communications networks have not established supply chain security requirements for the communications industry, as discussed further in the next section of this testimony. The companies we spoke with also told us they have been participating in information sharing about cybersecurity issues, including supply chain security, in venues including informal conversations, industry group meetings, and discussions with the federal government. Below are the two industry-led efforts most frequently discussed during our interviews.

The Open Group Trusted Technology Forum (OTTF)

The OTTF is a forum within The Open Group, which is a global consortium that represents all sectors of the IT community including academics, equipment manufacturers, federal agencies, and software developers. The Open Group establishes certification programs and voluntary consensus standards, such as standards for security, enterprise architecture, interoperability, and systems management. The OTTF’s objective is to create and adopt standards to improve the security and integrity of commercial off-the-shelf information and communication products, including hardware and software, as they are being developed and moved through the global supply chain. In April 2013, the OTTF published a voluntary standard that is intended to enhance the security of global supply chains by mitigating the risks of tainted and counterfeit products. The OTTF intends to provide an accreditation program that will allow information and communication providers, equipment manufacturers, and those vendors that supply software or hardware components to the providers and manufacturers, to become accredited if they meet the standard’s requirements and conformance criteria. Officials from DOD said that although it is unknown whether industry will adopt this standard and what the associated costs will be to maintain and use it, developing such process-based certifications along with product certifications, such as the Common Criteria, may prove beneficial in covering more of the global IT supply chain.

Communications Sector Coordinating Council (CSCC)

In accordance with Homeland Security Presidential Directive 7, the CSCC is an industry-led group that represents the viewpoints from the U.S. communications sector and facilitates coordination between industry and the federal government on improving physical and cyber security of the communications critical infrastructure., Representatives from the CSCC told us that the CSCC began meeting with the federal government in March 2011 to discuss supply chain security, which led to the creation of a CSCC working group to facilitate dialogue, planning, and coordination among the government and industry on supply chain risk management. This group’s objectives include enhancing the government’s understanding of industry’s current risk management practices, the government’s sharing of supply chain threat information, and identifying and sharing best practices for supply chain risk management. The working group is scheduled to conclude its work in December 2013.

Federal Government Has Begun Efforts to Address the Risks of Using Foreign- Manufactured Equipment

The White House released an Executive Order in February 2013 that is likely to have an impact on communications supply chain security. We identified other federal efforts, such as the Interim Telecommunications Sector Risk Management Task Force, that could impact communications supply chain security, but the results of those efforts are considered sensitive, so we do not include them here.

Executive Order on Cybersecurity for Critical Infrastructure

An Executive Order released in February 2013 calls for NIST to develop a framework to reduce cyber risks to critical infrastructure and for DHS and others to spearhead increased information sharing between the federal government and owners and operators of critical infrastructure including communications networks. As discussed below, federal officials told us that supply chain security may be included in these efforts, but the extent has yet to be determined.

The Executive Order instructs NIST to develop a cybersecurity framework (framework) to reduce cyber risks to critical infrastructure using an open public review and comment process. This framework would provide technology-neutral guidance to critical infrastructure’s owners and operators. In February 2013, NIST published a request for information (RFI) in which NIST stated it is conducting a comprehensive review to develop the framework and is seeking stakeholder input. According to NIST officials, the extent to which supply chain security of commercial communications networks will be incorporated into the framework is largely dependent on the input it receives from stakeholders. The officials added that while it is reasonable to assume that they may receive comments about supply chain security, which crosses critical infrastructure sectors, it is possible they may not receive comments specific to the use of foreign-manufactured equipment in commercial communication networks.

In adopting the preliminary framework, the Executive Order requires agencies with responsibility for regulating the security of critical infrastructure to provide a report—in consultation with national security staff, DHS, and the Office of Management and Budget—which states whether the agencies have clear authority to establish requirements based on the framework and whether any additional authorities are necessary. DHS officials stated that without seeing the context of the report, they could not say whether it would identify authorities specifically related to the supply chain security of commercial communications networks and the conditions under which those authorities could be used.

The Executive Order also calls for the federal government to increase information sharing with owners and operators of critical infrastructure, including communications networks, information sharing that could include sharing of supply chain-related threats. The order directs DHS to share unclassified cyber threat information and expand a voluntary information-sharing program that provides classified cyber threat information to critical infrastructure owners and operators with government security clearances. DHS officials told us that they foresee that this information sharing could encompass threats originating in the supply chain.

Other Approaches to Supply Chain Risk Management

Risk Management Approaches from Selected Countries

Australian Reform Proposal

The Australian government is considering a reform proposal to establish a risk-based regulatory framework to better manage national security challenges to Australia’s telecommunications infrastructure. The Attorney-General, in consultation with industry, has created a proposal that addresses supply chain risks by introducing a universal obligation on carriers and carriage service providers to protect their networks and facilities from unauthorized access or interference. Specifically, the proposal requires carriers and carriage service providers to be able to demonstrate competent supervision and effective controls over their networks. The government would also have the authority to use enforcement measures to address noncompliance, as described in table 1.

Under this framework, the government would provide guidance to inform carriers and carriage service providers how they can maintain competent supervision and effective control over their networks and educate carriers and carriage service providers on national security risks. The approach would require amendments to telecommunications statutes, such as the Telecommunications Act and other relevant laws.

India enacted a new approach in 2011 through its operating licenses for telecommunications service providers. India’s Department of Telecommunications (DoT) is responsible for granting operating licenses to India’s telecommunications service providers. In May 2011, DoT issued amendments to its operating licenses that included new or revised requirements for providers and equipment vendors to improve the security of India’s telecommunications network infrastructure. Under the amendments, telecommunications service providers are to be completely responsible for security of their networks, including the supply chain of their hardware and software. Key security requirements are described in table 2.

The United Kingdom (UK) enacted new security and resilience requirements for network and service providers in 2011 through revisions to its Communications Act of 2003. The UK’s Office of Communications (Ofcom), the independent regulator and competition authority for the UK communications industries, is responsible for enforcing the requirements. According to Ofcom officials, these requirements address supply chain risks by focusing on the ability of the network and service providers to manage the overall security of their infrastructure and maintain network availability. Ofcom officials told us they are still developing their overall approach to enforcing the requirements, which are described in table 3.

A Chinese network equipment manufacturer voluntarily partnered with the UK government to establish a Cybersecurity Evaluation Centre to test its equipment for use in UK networks. According to officials from Ofcom and the Chinese manufacturer, the facility was created in part to address national security concerns related to using equipment from a vendor that did not have an established relationship with the UK government or UK network providers. The Chinese manufacturer provides the facility with the design and source code for all equipment, which is then tested for vulnerabilities by staff with UK security clearances. According to officials from Ofcom and representatives from the Chinese manufacturer, network providers cannot use the equipment until it has been approved through the testing process. In addition, the UK government requires all software patches be tested using the same process before they are installed on the equipment by the network providers. According to officials from the Chinese manufacturer, this voluntary approach helped increase trust with its customers. However, in November 2012, the chairman of the UK parliament’s intelligence and security committee confirmed to us that the committee is reviewing the commercial relationship between the Chinese manufacturer and a British telecommunications provider and the Chinese manufacturer’s overall presence in the UK’s critical national infrastructure.

Expanding Use of the U.S. Process for Reviewing Foreign Acquisitions

The U.S. government’s Committee on Foreign Investment in the United States (CFIUS) conducts reviews to determine whether certain transactions that could result in foreign control of U.S. businesses pose risks to U.S. national security. Industry representatives from the U.S. Communications Sector Coordinating Council told us the council and participating federal entities are discussing whether a voluntary notification process similar to CFIUS should be used for network provider purchases of foreign-manufactured equipment. In addition, the House Intelligence Permanent Select Committee report recommended that legislative proposals seeking to expand CFIUS to include purchasing agreements should receive thorough consideration by relevant congressional committees.

CFIUS follows a process established by statutes and regulations for examining certain transactions that could result in foreign control of U.S. businesses. Parties generally submit voluntary notices of transactions to CFIUS, but CFIUS also has the authority to initiate reviews unilaterally. Pursuant to the Foreign Investment and National Security Act of 2007, CFIUS must complete a review of a covered transaction within 30 days. In certain circumstances, following the review, CFIUS may initiate an investigation that may last up to 45 additional days., If CFIUS finds that the covered transaction presents national security risks and that other provisions of law do not provide adequate authority to address the risks, then CFIUS may enter into an agreement with, or impose conditions on, the parties to mitigate such risks. If the national security risks cannot be resolved and the parties do not choose to abandon the transaction, CFIUS may refer the case to the President, who can choose whether to suspend or prohibit the transaction., As shown in table 4, presidential decisions are rare. Table 4 also shows the number of CFIUS covered transactions, withdrawals, and other outcomes from calendar years 2009 to 2011.

Discussions between the Communications Sector Coordinating Council and participating federal entities on adapting a CFIUS-type voluntary notification process for use on equipment purchases are ongoing, and it is not clear how the proposal will develop, if at all. The council is trying to understand the threats the government is concerned about and whether these could be best addressed by a CFIUS- type process or some other means. According to some members of the council, options range from a simple notification process, wherein network providers notify the federal government of proposed equipment purchases, to a complete review and approval process of the proposed transactions, including the aforementioned 30-day review and 45-day investigation periods.

Potential Issues Related to Use of These Approaches

While these approaches are intended to improve supply chain security of communications networks, they may also create the potential for trade barriers, additional costs, and constraints on competition. Additionally, there are other issues specific to the approach of expanding the CFIUS process to include foreign equipment purchases. We identified these issues based on interviews with foreign government officials and U.S. industry stakeholders, and our review of foreign proposals and other documentation. While the issues we identified provide a range of considerations that U.S. federal agencies would need to take into account if they chose to implement these approaches, they do not represent an exhaustive list.

Some of the approaches may create a trade barrier or cause trade disputes. The Office of the United States Trade Representative (USTR) has reported that standards-related measures that are non-transparent, discriminatory, or otherwise unwarranted can act as significant barriers to U.S. trade. USTR has reported concerns regarding some of India’s licensing requirements for telecommunications service providers including the following: the requirement for telecommunications equipment vendors to test all equipment in labs in India; the requirement to allow the service provider and government agencies to inspect a vendor’s manufacturing facilities and supply chain and perform security checks for the duration of the contract to supply the equipment; and the imposition of strict liability and possible blacklisting of a vendor for taking inadequate precautionary security measures, without the right to appeal and other due process guarantees.

These requirements may result in trade-distorting conditions by making it more expensive and burdensome for foreign equipment manufacturers to do business in India. According to USTR, it is too early to evaluate whether the proposed reforms in Australia, new requirements and voluntary Cybersecurity Evaluation Centre in the UK, and an extension of CFIUS to equipment purchases would create trade barriers or cause trade disputes. Three U.S.-based equipment manufacturers told us that extending CFIUS to equipment purchases could cause other countries to implement similar policies, which may result in barriers to entry in other countries and trade disputes.

All of the approaches may increase costs to industry and the federal government. The Australian and UK governments recognize that changes to the regulatory framework would include a cost to industry, which may increase prices for consumers. Representatives from the Chinese equipment manufacturer stated that although voluntarily setting up the Cybersecurity Evaluation Centre was expensive, it was the cost of doing business in the UK. Similarly, one telecommunications industry group reported that India’s 2011 License Amendments would increase compliance costs for Indian telecommunications services providers. The majority (6 of 8) of equipment manufacturers we spoke with told us that any proposal to extend CFIUS to equipment purchases would increase costs for network providers, equipment manufacturers, and ultimately consumers. In addition, it is likely that the responsible federal agencies will also incur additional administrative costs in implementing any supply chain risk management requirements.

All of the approaches may have an impact on the business decisions of network providers and equipment manufacturers and competition within the industry. The Australian government is aware that its proposed framework could have effects on the industry, and it is trying to anticipate these effects and explore how they might be mitigated. It is also seeking input from industry and government stakeholders on any potentially broader effects on competition in the telecommunications market and on consumers. Similarly, a telecommunications industry group reported the Indian requirements complicate the relationship between telecommunications service providers and their equipment vendors, creating concerns about access to intellectual property and giving each an incentive to shift the risk of enforcement onto the other (though the current requirements still place the principal obligations on the licensees). Representatives from a U.S.-based equipment manufacturer told us that extending the CFIUS process to equipment purchases could potentially lead to vendors being excluded from the U.S. market without appeal rights; this would result in limited competition and therefore potentially higher prices for consumers. Similarly, four network providers and one think tank also told us that extending CFIUS to equipment purchases would limit competition and raise costs.

The appropriate universe of equipment supply contracts that would be subject to review would need to be defined if the CFIUS process were extended to cover these transactions. There were 269 notices of transactions covered by the CFIUS process from 2009 through 2011. By comparison, four network providers and two equipment manufacturers we spoke with noted that network providers conduct thousands of transactions a year and expressed concerns about their being subject to a CFIUS-type process. Specifically, the two manufacturers said it would be difficult for CFIUS members to oversee all of these transactions in a timely fashion, adding expense to the procurement process for network providers and equipment manufacturers that could be passed on to consumers. In addition, CFIUS member agencies may incur significant administrative costs if asked to review thousands of procurement transactions per year.

Chairman Walden, Ranking Member Eshoo, and Members of the Subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time.

Contact and Acknowledgments

If you or your staff members have any questions about this testimony, please contact me at (202) 512-2834 or goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony are listed in appendix V.

Appendix I: Scope and Methodology

We focused our review on the core networks that constitute the backbone of the nation’s communications system and the equipment—such as routers, switches and evolved packet cores—that transport traffic over these networks. We also focused on the wireline, wireless, and cable access networks used to connect end users to the core wireline networks. We did not address broadcast or satellite networks because they are responsible for a smaller volume of traffic than other networks.

To obtain information on all of our objectives we conducted a literature review and semi-structured interviews with or obtained written comments from academics, industry analysts, and research institutions; federal entities; domestic and foreign equipment manufacturers; industry and trade groups; network providers; and security and software audit firms as shown in table 5.

We selected the stakeholders based on relevant published literature, our previous work, stakeholders’ recognition and affiliation with a segment of the communications industry (domestic and foreign equipment manufacturers, industry and trade groups, network providers and so forth), and recommendations from the stakeholders interviewed. We also spoke with federal entities that have a role in addressing cybersecurity, international trade, and the Committee on Foreign Investment in the U.S. (CFIUS).

To describe how communications network providers and equipment manufacturers help ensure the security of foreign-manufactured equipment that is used in commercial communications networks, we interviewed network providers; domestic and foreign equipment manufacturers (routers, switches, and evolved packet cores); and industry and trade groups. Information we collected included specific industry practices, such as the use of security provisions in contracts; the extent to which domestic and international standards help guide their practices; and any industry-wide efforts addressing supply chain security. We focused this work on the five wireless and five wireline network providers with the highest revenue, the eight manufacturers of routers and switches with the highest market shares in the U.S. market, and two cable network providers. To identify the top five U.S. wireless providers by subscribers, we used data from the Department of Defense and verified the subscribership data against investor relations reports from the providers. To identify the top five U.S. wireline providers by subscribers, we used publicly available rankings and verified the subscriber data against investor relations reports from the providers. We selected the top eight manufacturers of routers and switches based on 2010 U.S. market share. We selected two of the top three U.S. cable companies based on 2011 subscriber data.

To identify how the federal government is addressing the potential risks of foreign-manufactured equipment that is used in commercial communications networks, we asked federal agencies to identify statutes and regulations to identify potential sources of the federal government’s legal and regulatory authority over how communications network providers ensure the security of their U.S. commercial networks. Additionally, we interviewed and collected documentation from 13 federal entities to identify related federal efforts, such as interagency information sharing initiatives and those with the private sector.

To determine other approaches, including those of foreign countries, for addressing the potential risks of using foreign-manufactured equipment in commercial communications networks, we conducted a literature review and interviewed stakeholders. We identified other approaches from governmental entities in Australia, India, and the United Kingdom (UK) that address supply chain risks for commercial communications networks. These countries were chosen to show the variation in how foreign governments are approaching supply chain risk management. We also considered criteria such as the availability of public information on the approach to allow for a detailed review and language considerations. While the results of the data collected from these three countries may not encompass all possible approaches, it provided important insights into the approaches that some countries are using to address supply chain risks for commercial communications networks.

We reviewed documents and interviewed officials from governmental entities in Australia, India, and the UK to describe the approaches and issues that could arise from using these approaches. We identified these issues based on interviews with foreign government officials and U.S. industry stakeholders, and our review of foreign proposals and other documentation. The issues identified provide a range of considerations, but is not an exhaustive list of all issues that could be considered.

We also assessed the potential for using the CFIUS review process for purchases of foreign-manufactured equipment because a voluntary notification process similar to CFIUS is being discussed by government and industry stakeholders. We reviewed the Foreign Investment and National Security Act of 2007, related regulations, and CFIUS’s annual reports to Congress to describe the CFIUS process. We reviewed CFIUS’s transaction data to describe the number of covered transactions, investigations, and Presidential decisions made from calendar years 2009 to 2011 to provide context. Additionally, we interviewed officials from federal agencies and industry stakeholders on how the commercial communications market in the United States may be affected if any of the identified approaches are used when U.S. communications companies purchase equipment manufactured in foreign countries. We conducted data reliability testing to determine that any data used are suitable for our purposes.

We conducted this performance audit from December 2011 to May 2013 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Examples of Threats to the Information Technology Supply Chain

Supply chain threats are present at various phases of the life cycle of communications network equipment. Each of the key threats presented in table 6 could create an unacceptable risk to a communications network.

Appendix III: Examples of Supply Chain Vulnerabilities

Threat actors can introduce the threats described in appendix II by exploiting vulnerabilities at multiple points in the global supply chain. Table 7 describes examples of the types of vulnerabilities that could be exploited.

Appendix IV: Potential Sources of Authority for Taking Action to Ensure Supply Chain Security

In examining potential sources of authority related to supply chain security, we focused on DHS, FCC, and Commerce because of their roles in critical infrastructure protection. Homeland Security Presidential Directive 7 (2003) designated DHS as the sector-specific federal agency for the telecommunications critical infrastructure sector. It required DHS to set up appropriate systems, mechanisms, and procedures to share cyber information with other federal agencies and the private sector, among others. The Communications Sector-Specific Plan of the National Infrastructure Protection Plan characterizes FCC and Commerce as partners that have relevant authority and support DHS’s communications critical-infrastructure protection efforts.

DHS has not identified specific authorities that would permit it to take action to ensure the security of the supply chain of commercial networks. Officials from DHS’s Office of General Counsel stated that the Homeland Security Act might have applicable authority, although this authority is not specific to the security of the supply chain of commercial networks. DHS further stated that it cannot say what specific authority it might use if it needed to take action because it has not faced a set of circumstances related to a commercial network’s supply chain security requiring action.

Officials from FCC’s Office of General Counsel stated that FCC could regulate network providers’ supply chain practices to assure that the public interest, convenience, or necessity are served if circumstances warranted. Specifically, FCC could impose supply chain requirements on providers of common carrier wireline and wireless voice services and, in specific circumstances, information services providers, using FCC’s authority under the Communications Act. Officials stated that FCC has not yet attempted to use these sources of authority to impose regulations specifically designed to address cybersecurity threats.

FCC officials stated that because the agency has not adopted regulations or policies related to supply chain security in commercial communications networks, reliance on these sources of authority has not been tested by legal challenges in court. According to FCC officials, legislative changes to the Communications Act to provide express recognition of the agency’s authority to address such threats would reduce the risk of such challenges and may facilitate adoption of supply chain security regulation.

FCC officials added that although its current legal authority could allow FCC to act to impose supply chain requirements on network providers, it has not determined the extent to which it has authority to regulate companies that manufacture network equipment. In the past, the agency regulation of equipment manufacturers has focused on interference management. FCC officials told us that they are actively participating in discussions within the executive branch regarding supply side issues, though which agencies should take the lead on this issue has not been determined.

Commerce officials stated that Section 232 of the Trade Expansion Act of 1962, as amended, could potentially provide authority for Commerce to use when communications equipment purchases pose a potential risk to national security. According to Commerce documents, Section 232 gives Commerce statutory authority to conduct investigations to determine the effect of imports on national security. If an investigation finds that an import may threaten to impair national security, then the President may use his statutory authority to “adjust imports,” by taking measures recommended by the Secretary of Commerce, including barring imports of a product. Commerce has not used, or attempted to use, this authority for any cases involving the communications sector. Commerce officials stated that they reviewed this authority in 2010 in part because a major network provider was considering purchasing foreign-manufactured communications equipment from a company that the federal government believed might pose a national security threat. Since the network provider decided not to purchase equipment from that company, Commerce did not review the potential applicability of Section 232 to that transaction.

Appendix V: GAO Contact and Staff Acknowledgments

GAO Contact

Contact and Acknowledgments

In addition to the contact named above, Heather Halliwell, Assistant Director; Derrick Collins; Swati Deo; Anne Doré; Bert Japikse; Sara Ann Moessbauer; Josh Ormond; Amy Rosewarne; and Hai Tran made key contributions to this testimony.