Internet Protocol Version 6: DOD Needs to Improve Transition Planning
Released: 2020-06-01T00:00:00

Letter

Background

The internet is a worldwide network of networks comprised of backbone networks, servers, and routers. Network addresses are used to help send information from one internet-connected device, such as a computer, to another by routing the information to its final destination. The protocol that enables the administration of these addresses is the IP.

IP addresses provide a numerical description of the location of networked devices such as computers, routers, and smartphones. These numerical descriptions allow devices to be distinguished from each other over the internet. In some ways, an IP address is like a physical street address. For example, in the physical world, if you want to send a letter from one location to another, the contents of the letter must be placed in an envelope that lists both the sender’s and the recipient’s addresses. Similarly, if data is transmitted across the internet from one device to another, IP addresses must be placed in an IP header with sender and recipient information. In addition to containing the addresses of the sender and the receiver, the header also contains a series of fields that provide information about what is being transmitted. Figure 1 provides a simplified illustration of this concept.

The Internet Engineering Task Force, the principal body engaged in the development of internet standards, developed IPv6 in the 1990s to address IPv4’s limited address space, among other things. Although IPv6 has been available for over 20 years, IPv4, the older IP, is still more widely deployed. Nevertheless, IPv6 deployment is rising worldwide amidst the exhaustion of available IPv4 addresses. However, IPv6 is not backwards compatible with IPv4, which means that organizations such as DOD have to change their network infrastructure and systems in order to deploy IPv6.

DOD relies on its current IPv4 networks to fulfill its mission to provide the military forces needed to deter war and ensure our nation’s security. According to DOD officials leading the transition to IPv6, the department utilizes IPv4 for enterprise-wide and mission partner wired and wireless communications, including infrastructure, technologies, and devices supporting large-scale globally dispersed command and control systems, naval vessels, aircraft, satellites, and ground operations. Figure 2 presents a simplified depiction of the department’s use of IPv4.

DOD’s mission requires considerable IP address space. The department currently has 300,149,760 IPv4 addresses—more than any other organization in the world. These approximately 300 million addresses are divided into blocks; each block contains a series of multiple addresses. DOD has 13 particularly large blocks of addresses, each containing 16,777,216 addresses. Also included in the approximately 300 million addresses are 59,767,040 IPv4 addresses that currently are unused. These addresses are reserved for future use by DOD and its components.

DOD has stated that it expects to exhaust its reserve of unused IPv4 addresses by 2030. According to the officials leading the IPv6 transition effort, the department expects to have to support IPv4 after it exhausts its IPv4 address space in 2030 due to mission system modernization and replacement timelines, as well as new emerging technologies that may require IPv4 resources while the department transitions to IPv6.

IPv6 May Improve Functionality and Provide Benefits

According to prior government reports and DOD documentation, IPv6’s improved functionality would benefit the department in many ways. In addition to the general benefits of eliminating IPv4 address space limitations, enhancing mobility features, and integrating IP security, IPv6 has the potential to enhance DOD battlefield operations, improve decision-making with the increased reliance on the Internet of Things (IoT), support U.S. global technological competitiveness, and enhance mission partner interoperability.

IPv6 eliminates address space limitations. As previously mentioned, IPv6 dramatically increases the amount of possible address space from 4.3 billion addresses in IPv4 to approximately 340 undecillion (3.4 × 10In contrast to IPv4, the massive address space available in IPv6 will allow almost any device to be assigned a unique IP address. This change fosters greater end-to-end communication abilities between devices with unique IP addresses and can better support the delivery of data-rich content such as voice and video.

Enhanced mobility improves connectivity. IPv6 improves mobility features by allowing each device to have a unique IP address independent of its current network or connection point to the internet. This enables mobile IPv6 users to move from network to network while keeping the same unique IP address. The ability to maintain a constant IP address while switching networks is cited as a key factor for the success of a number of evolving capabilities, such as telephone technologies, laptop computers, and internet connected automobiles.

Added IP security helps to protect data. IP security—a means of authenticating the sender and encrypting the transmitted data—is better integrated into IPv6 than it is in IPv4. This improved integration, which helps make IP security easier to implement, can help support broader data protection efforts. This extra security is accomplished through the use of two header extensions that can be used together or separately to improve the authentication and confidentiality of data being sent via the internet. These headers serve to provide the receiver with a greater assurance of the sender’s identity and provide encryption protection for the transmitted data.

Enhanced capabilities could improve DOD battlefield operations. According to the 2014 DOD IG report on DOD’s IPv6 transition efforts, use of IPv6 could provide DOD with several potential benefits related to battlefield operations, such as improved communication, warfighter mobility, situational awareness, and quality of service. IPv6 auto- configuration capabilities provide secure ad hoc networking and mobility, as well as improved end-to-end security and simplified network management capabilities. This could potentially enable individuals and entire units to disconnect from military base networks, travel into theater, and quickly establish communications. Additionally, IPv6 capabilities could allow warfighters and commanders to improve situational awareness and mission execution during deployment and battle operations, allowing units to securely move from one wireless network to another.

Increased use of the IoT may improve decision-making. The increased address space available with IPv6 enables the increased connectivity necessitated by the proliferation of the IoT. DOD’s IoT could include any object for which remote communication, data collection, or control might be useful, such as vehicles, appliances, medical devices, electric grids, transportation infrastructure, manufacturing equipment, or building systems. According to DOD’s Digital Modernization Strategy from July 2019, IoT could be significant to the department’s decision-making processes because the assortment of connected objects that comprise IoT could enable technology to gain the ability to sense, predict, and respond to DOD’s needs. The department could use computers to track, count, and analyze data from these objects in order to reduce waste, loss, and cost. DOD managers could also know whether these objects were running well or needed replacing, repairing, or recalling.

IPv6 could support U.S. global technological competitiveness. According to a DOD presentation, the transition to IPv6 could allow the department to remain technologically competitive globally. Interest in IPv6 is gaining momentum around the world, particularly in parts of the world that have limited IPv4 address space to meet their industry and consumer communications needs. Regions that have limited IPv4 address space, such as Asia and Europe, have undertaken efforts to develop, test, and implement IPv6. For example,

China has been aggressive at deploying IPv6.

Japan has set up an IPv6 Promotion Council, using tax incentives to encourage research and adoption of IPv6 by its private sector.

Europe has a task force that has the dual mandate of initiating country and regional IPv6 task forces across European states and seeking global cooperation around the world.

Transitioning to IPv6 may preserve mission partner interoperability. According to an August 2017 report from DOD’s CIO, deploying IPv6 capabilities is essential to preserve interoperability with mission partners in the private sector and in other countries and to assure future access to technology. Since the pools of unassigned IPv4 addresses are exhausted, DOD’s mission partners may increasingly rely on IPv6 addresses in the future, furthering the department’s need to increase its IPv6 capabilities.

Transitioning to IPv6 Could Also Present Challenges

Along with the potential benefits, the National Institute of Standards and Technology (NIST) has indicated that transitioning to IPv6 also could present challenges for organizations such as DOD. These challenges include the complexity added by dual IPv4 and IPv6 operations and the immaturity of IPv6 security products and processes.

Complexity added by dual IPv4/IPv6 operations. DOD plans to deploy IPv6 while still supporting IPv4 for legacy applications, services, and clients. This will result in a dual protocol environment and increased complexity. With two protocols, DOD would have to ensure the proper functioning of two separate, but interrelated, networks instead of only one network. Further, hackers and other online adversaries could exploit either the department’s IPv4 or IPv6 network connections when launching cyberattacks.

Immaturity of IPv6 security processes. While IPv6 could offer enhanced security, NIST states that its deployment could also lead to new challenges with respect to the types of threats facing an organization such as DOD. For example, organizations in the process of transitioning to IPv6 may lack robust IPv6 security controls and may have security staff members who lack an overall understanding of IPv6. This could allow attackers to exploit IPv6 assets or leverage IPv6 access to exploit IPv4 assets. While general security concepts are the same for both IPv4 and IPv6 protocols, it may take time and effort for transitioning organizations such as DOD to acquire the level of operational experience and practical deployment solutions that have been developed for IPv4 over the years.

OMB Issued Guidance for Federal Agencies’ IPv6 Transition Planning

In August 2005, OMB issued a memorandum to federal CIOs specifying a series of IPv6 transition planning and implementation requirements and associated due dates for federal agencies to enable the use of IPv6. Specific to planning for the transition, the memorandum required agencies to assign an official to lead and coordinate IPv6 transition planning efforts, complete an inventory of IP-compliant devices and technologies, and complete an impact analysis comprised of a cost estimate and a risk analysis by specific due dates during fiscal year 2006. Table 1 lists the transition planning requirements and due dates defined in the OMB memorandum.

DOD Has Engaged in IPv6 Transition Efforts since 2003

Aware of the limitations of IPv4, DOD first began planning for the implementation of IPv6 in June 2003. At that time, the department’s CIO issued the memorandum, “Internet Protocol Version 6 (IPv6).” According to this memorandum, the department’s initial goal was to complete its transition to IPv6 by fiscal year 2008.

Within a month of the issuance of DOD’s June 2003 memorandum, the department designated the Defense Research and Engineering Network (DREN) as the first DOD IPv6 pilot network. DREN, being a research and development network, is not connected to DOD’s operational networks, such as the department’s nonclassified IP router network, which transmits nonclassified operations traffic. According to a DOD report about the DREN pilot, the entire DREN wide-area network was routinely supporting end-to-end IPv6 traffic by July 2005. According to the department, DREN remains DOD’s only IPv6-enabled network.

Further, DOD’s IG reported that the department had undertaken an initial transition effort that temporarily satisfied OMB’s August 2005 implementation requirement to demonstrate IPv6 on its infrastructure by the end of June 2008. Specifically, DOD was able to demonstrate IPv6 within the department’s Defense Information Systems Network. However, according to the report, the department’s IPv6 transition manager said DOD disabled IPv6 functionality due to a lack of trained personnel and potential security risks. We received additional information about why DOD disabled the IPv6 functionality, but we are not including it in the report due to the information being marked as for official use only.

DOD began its next effort to plan and implement IPv6 in response to OMB’s subsequent 2010 guidance. In this guidance, OMB gave agencies—including DOD—requirements intended to further their transitions to IPv6. Two of these requirements stated that agencies were to: upgrade their public-facing IT servers and services (e.g., web and email) to IPv6 by the end of September 2012; and upgrade internal client applications that communicate with public internet servers and supporting enterprise networks to IPv6 by the end of September 2014.

According to DOD, the department originally planned to meet the 2010 OMB requirements; however, it decided not to complete the upgrades due to security concerns. Again, we received additional information about the department’s security concerns; however, we are not including those details in this report because they were marked as for official use only.

DOD Had Not Completed Most of the Selected OMB Planning Requirements

OMB’s IPv6 transition guidance requires federal agencies, such as DOD, to perform specific tasks as part of their IPv6 planning efforts. These tasks include: (1) assigning an official to lead and coordinate agency planning, (2) completing an inventory of existing IP-compliant devices and technologies, (3) developing a cost estimate (as part of an impact analysis), and (4) developing a risk analysis (as part of an impact analysis). Although these requirements were originally due in 2005 or 2006, they are still applicable; OMB has not replaced or rescinded them.

Assigning an official to lead and coordinate agency planning can help agencies better manage their transition to IPv6. Specifically, a senior- level focal point to lead IPv6 transition efforts can provide assurance that the program is based on a coherent strategy and is well coordinated. A lead official may also help an agency avoid duplicative, overlapping, and fragmented efforts, which can result in avoidable additional costs.

According to NIST, having an inventory of IP-compliant assets is crucial to IPv6 transition planning because it helps determine transition requirements and give an agency a clear understanding of the IP capabilities of the devices on the network. Specifically, an inventory helps determine which assets will transition to IPv6, the order in which assets will transition, the transition methods selected, and the security controls that would need to be implemented.

Further, cost estimates are critical to decision-makers not only because they help establish budgets, but also because they are integral to determining and communicating a realistic view of likely cost and schedule outcomes that could be used to plan the work necessary to develop, produce, install, and support a program. As we have previously reported, without the ability to generate reliable cost estimates, agencies are at risk of experiencing cost overruns, missed deadlines, and performance shortfalls. In addition, a risk analysis enables an agency to assess the significance of potential threats to the success of its transition to IPv6, as well as assess how those threats could be mitigated or avoided. Further, without a risk analysis to help the agency understand the potential threats and obstacles facing the IPv6 transition initiative, agencies run the risk of creating goals and plans that are too optimistic.

According to DOD, the department began its most recent effort to transition to IPv6 in April 2017. As part of this effort, in November 2019, the department released its IPv6 implementation strategy, which articulates DOD’s overarching vision for its IPv6 transition initiative: to provide secure and reliable IPv6 services that enable innovation for competitive advantage. According to the strategy, DOD’s goals for the effort include implementing an interim solution of using both IPv4 and IPv6 and then planning for an eventual IPv6-only environment.

As of March 2020, DOD had not yet completed three of the four selected transition planning requirements. Specifically, the department had completed the requirement of appointing an agency lead for its IPv6 transition efforts. However, it had not yet completed the three other requirements: complete an inventory, develop a cost estimate, and develop a risk analysis. Table 2 summarizes the status of DOD’s completion of the four selected OMB IPv6 transition planning requirements.

DOD completed OMB’s requirement to have an official lead the IPv6 planning efforts by first assigning its Joint Information Environment Executive Committee responsibility for overseeing the department’s transition to IPv6 in August 2017. The committee, in turn, established the DOD IPv6 Working Group in November 2017 to coordinate and manage department-wide IPv6 planning, implementation, and testing. An official in the Office of the CIO serves as the chair of the working group, and, according to the group’s charter, is responsible for leading meetings, soliciting and prioritizing issue topics for review, and overseeing the coordination of working group activities supporting the department-wide transition to IPv6.

However, DOD did not complete the requirement to develop an inventory of existing IP-compliant devices and technologies. In November 2005, DOD provided a memorandum to OMB that indicated that the department would not complete the inventory of IP-compliant devices and technologies; instead, DOD would continue following its existing transition plan, which did not require an inventory. Further, the DOD officials leading the IPv6 transition effort informed us that the department had not developed such an inventory and that it still does not plan to do so. The officials said that conducting a task of this size would be impractical given DOD’s size and the number of IP-compliant devices in the department.

The officials leading the IPv6 transition also said that DOD has been mitigating the risk of not having an inventory by ensuring that the department has only been acquiring IPv6-capable IT devices since December 2009. However, while only acquiring IPv6-capable devices and applications could help the transition move forward, it would not be as complete as an inventory, given that an inventory would include technology purchased before December 2009.

DOD also did not complete a cost estimate or a risk analysis. According to the DOD officials leading the IPv6 transition effort, the initiative was not a top priority until the CIO released the “Internet Protocol Version 6 Implementation Direction and Guidance” memorandum in February 2019. This memorandum, which was developed to guide the department’s IPv6 transition planning and implementation efforts, gave the transition initiative greater attention in the department. Prior to the issuance of the memorandum, the officials stated that they did not have sufficient resources to conduct the cost estimate and did not have enough understanding to complete the risk analysis. DOD officials leading the IPv6 transition effort explained that the department plans to develop these requirements by the end of May 2020; however, we have not received any documentation confirming this deadline.

Until DOD develops an inventory of IP-compliant technologies and devices, a cost estimate, and a risk analysis, the department’s IPv6 transition initiative may have an increased likelihood of cost overruns, schedule delays, and security vulnerabilities. Specifically, not having an inventory of IP-compliant devices and technologies may lead to the department developing plans without being aware of all the system and infrastructure requirements necessary to successfully transition a large organization such as DOD to IPv6. Further, without a cost estimate, DOD may be making decisions without the benefit of relevant information on the initiative’s potential cost and schedule outcomes, thereby introducing unnecessary risk into the implementation process. Finally, by moving forward without a risk analysis, DOD increases the probability that it is not proactively managing potential threats that could disrupt the transition or introduce new IT security vulnerabilities.

DOD Had Not Completed Most of Its Own Required Transition Activities

DOD’s February 2019 memorandum lists 35 required activities for transitioning to IPv6 that DOD’s various components or offices, such as the Office of the CIO, are to complete or work on during fiscal years 2019 through 2021. Of these 35 activities, 18 were to be completed prior to March 2020.

However, DOD had not completed most of the required activities. Specifically, of the 18 activities that were to be completed by March 2020, the department had completed six and had not completed 12. In addition, the department had completed one of eight other activities that did not have specific due dates. Table 3 outlines the department’s seven IPv6 transition activities that had been completed as of March 2020. (See appendix I for a full list of DOD’s transition activities and their completion status.)

One notable required activity that DOD completed was to develop a CIO- approved strategy to implement its transition to IPv6. DOD’s strategy outlines, among other things, the overall goals for the IPv6 transition initiative. These goals include implementing a network that is both IPv4 and IPv6 capable; planning for an IPv6-only environment; and establishing and optimizing training for IPv6.

In addition, DOD’s Defense Information Systems Agency leveraged online training providers to offer on demand IPv6 training courses for network engineers and cybersecurity personnel. In addition to basic familiarization training for those new to IPv6, select training courses are labeled as being at the advanced level.

However, the department had not completed 12 of 18 activities that were due prior to March 2020. Notably, DOD missed its original September 2019 deadline to enable IPv6 on all commercially hosted public facing unrestricted services. According to the department officials leading the IPv6 transition, DOD expects to be able to complete this task by the end of July 2021. The department also missed its original June 2019 deadline for identifying the public facing unrestricted services hosted by DOD. The officials leading the IPv6 transition initiative stated that DOD currently plans to complete this activity by May 2020. Other activities that were past due in March 2020 include: developing supplemental guidance for the acquisition of IPv6-capable products, updating and maintaining IPv6 standards and implementation profiles, and determining DOD’s cybersecurity architecture and posture impacts, among others.

DOD officials leading the IPv6 transition effort stated that the department had not yet completed its required activities because the original time frames that the department had established were unrealistic. Although the activities were initially thought to have been reasonable, DOD adjusted the activities’ due dates after the department began executing the tasks and realized that it would take a large amount of work to accomplish their goals and complete the activities.

One contributing factor for the unrealistic due dates is that DOD developed this list of required activities without the benefit of an inventory of IP-compliant devices and technologies, a cost estimate, or a risk analysis. Without completing these basic planning requirements, DOD significantly reduced the probability that it could have developed a realistic transition schedule. Addressing requirements would supply DOD with sources of meaningful information that would enable the department to develop realistic, detailed, and informed transition plans and time frames.

Conclusions

While DOD’s current IPv6 transition effort is showing progress, the department has not completed most of OMB’s planning requirements. Notable signs of progress include the appointment of an official to lead the initiative and the development of an overarching strategy document that outlines the transition’s scope and goals. Nevertheless, DOD had not completed an inventory of IP-compliant technologies, a cost estimate, or a risk analysis before moving ahead with developing its February 2019 guidance and working against the guidance’s list of transition activities. The lack of an inventory is problematic due to the role that it should play in developing transition requirements. In addition, without a cost estimate to guide decision-makers, DOD’s current IPv6 transition plans could be based on unrealistic assumptions about costs and resource demands. Further, by moving forward without a risk analysis, DOD increases the probability that it is not proactively managing potential threats that could either disrupt the transition or introduce new IT security vulnerabilities. Completing these longstanding planning requirements would enable DOD to develop realistic plans with accurate transition requirements and proactive risk mitigation strategies, among other things.

Recommendations for Executive Action

We are making three recommendations to DOD.

The Secretary of Defense should direct the DOD CIO to complete a department-wide inventory of existing IP-compliant devices and technologies to help with planning efforts and requirements development for the transition to IPv6. (Recommendation 1)

The Secretary of Defense should direct the DOD CIO to develop a cost estimate as described in OMB memorandum M-05-22 for the department’s transition to IPv6. (Recommendation 2)

The Secretary of Defense should direct the DOD CIO to develop a risk analysis as described in OMB memorandum M-05-22 for the department’s transition to IPv6. (Recommendation 3)

Agency Comments and Our Evaluation

We provided a draft of this report to DOD and OMB for review and comment. In response, DOD agreed with two recommendations and disagreed with one recommendation that we made to the department. OMB did not state whether it agreed or disagreed with the report’s findings.

In written comments, DOD stated that it agreed with our recommendations to develop a cost estimate and risk analysis for the department’s transition to IPv6 (Recommendations 2 and 3). The department said that it plans to complete both the cost estimate and the risk analysis by the end of May 2020.

However, DOD stated that it did not agree with our recommendation to complete a department-wide inventory of existing IP-compliant devices and technologies (Recommendation 1). Specifically, the department referred to the draft IPv6 guidance that OMB developed in March 2020, stating that the draft guidance will rescind OMB’s fiscal year 2005 IPv6 guidance, which includes the inventory requirement. DOD also said that creating such an inventory would be impractical given the department’s size. It added that it has been mitigating the risk of not having an inventory by only acquiring IPv6-capable devices since December 2009.

We acknowledge that OMB’s March 2020 draft IPv6 guidance, once finalized, would rescind its fiscal year 2005 IPv6 guidance. However, the draft guidance focuses on completing the operational deployments of IPv6, not on the initial key transition step of completing an inventory, as required in the 2005 guidance.

The draft guidance also requests information on agencies’ completion of certain milestones using the percentage of IP-enabled devices that are IPv6-only as the metric. DOD’s completed inventory would be essential to accurately responding to OMB’s draft requirement. In addition, NIST’s current IPv6 transition guidance cites an inventory of IP devices as a key step in transitioning to IPv6 since such information would help identify requirements for transitioning, including which assets would transition and what security controls would be needed. As DOD has acknowledged, however, it has not yet completed an inventory. Accordingly, we believe that our recommendation that DOD complete a department-wide inventory of its existing IP-compliant devices and technologies is warranted.

In addition, DOD provided a technical comment, which we incorporated as appropriate. DOD’s comments are reprinted in appendix II.

In comments provided via email on May 8, 2020, an Associate General Counsel in OMB’s Office of General Counsel expressed OMB’s appreciation for the opportunity to review and comment on our draft report. The official did not state whether OMB agreed or disagreed with the report’s findings. OMB also provided a technical comment, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional committees, the Secretary of DOD, and the Acting Director of OMB. In addition, the report is available at no change on the GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-6240 or dsouzav@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III.

Appendix I: DOD’s IPv6 Implementation and Planning Activities

In February 2019, the Department of Defense’s (DOD) Chief Information Officer (CIO) released “Internet Protocol Version 6 Implementation Direction and Guidance,” a memorandum containing guidance and a list of required implementation and planning activities for the department’s transition to Internet Protocol version 6 (IPv6). For each activity, the memorandum included information such as the component or office responsible for completing the work and a description of the work to be completed. Out of 35 total activities, seven were completed and 12 were past due as of March 2020. One key contributing factor behind the activities’ unrealistic deadlines was that the department developed this list of required activities without having completed key planning efforts, such as an inventory of IP-compliant devices and technologies, a cost estimate, or a risk analysis. Table 4 shows the status of the completion of the required transition activities as called for in the department’s guidance.

Appendix II: Comments from the Department of Defense

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Larry Crosland (Assistant Director), Meredith Raymond (Analyst in Charge), Amy Apostol, Chris Businsky, West Coile, Kristi Dorsey, Vernetta Marquis, and Evan Rapson made key contributions to this report.