Defense Civil Support: DOD Needs to Address Cyber Incident Training Requirements
Released: 2017-11-30T00:00:00

Letter

Background

Defense Support of Civil Authorities

Under the Robert T. Stafford Disaster Relief and Emergency Assistance Act (the Stafford Act), when state capabilities and resources are overwhelmed and the President of the United States declares an emergency or disaster, the governor of an affected state can request assistance from the federal government for major disasters or emergencies. The Stafford Act aims to provide a means of assistance by the federal government to state and local governments in responding to a presidentially declared major disaster or emergency. A governor’s request for the President to declare a major disaster or emergency is required to be based on a finding that the situation is of such severity and magnitude that effective response is beyond the capabilities of the state and the affected local governments and that federal assistance is necessary. Additionally, under the Economy Act, a federal agency may request the support of another federal agency, including DOD, without a presidential declaration of a major disaster or an emergency. This act permits one federal agency to request goods and services from another federal agency provided that, among other things, the service is available and cannot be obtained more cheaply or conveniently by contract.

In July 2016, the White House issued the Presidential Policy Directive on United States Cyber Incident Coordination (hereafter referred to as PPD- 41) to establish principles governing the federal government’s response to cyber incidents involving government or private sector entities. Subsequently, in December 2016, the Department of Homeland Security issued an updated National Cyber Incident Response Plan that outlines domestic cyber-incident response coordination and execution among federal; state, territorial, and local governments; and the private sector. Overall coordination of federal incident-management activities is generally the responsibility of the Department of Homeland Security. DOD supports the lead federal agency in the federal response to a major disaster or emergency. When authorized to provide support to civil authorities for domestic emergencies, DOD may provide capabilities and resources— such as military forces (including the National Guard under Title 10 and Title 32, U.S. Code), DOD civilians, and DOD contractors—through DSCA. DOD components can also provide support to civil authorities under separate authority. For example, under Executive Order 12333, the National Security Agency, as an element of the intelligence community, is authorized to provide technical assistance and cooperation to law enforcement and other civil authorities not precluded by applicable law.

DOD Components with DSCA Responsibilities

In an effort to facilitate DSCA across the nation and at all organizational levels, DOD has assigned responsibilities within the Office of the Secretary of Defense (such as the Assistant Secretary of Defense for Homeland Defense and Global Security); the Chairman of the Joint Chiefs of Staff; various combatant commanders, such as the NORTHCOM and the U.S. Pacific Command (PACOM) Commanders; and the Chief of the National Guard Bureau, among others. A combatant command is a unified or specified command with a broad continuing mission under a single commander established and designated by the President, through the Secretary of Defense and with the advice and assistance of the Chairman of the Joint Chiefs of Staff. DOD’s Assistant Secretary of Defense for Homeland Defense and Global Security is the principal civilian advisor responsible for homeland defense, DSCA, and cyber for the department. This official is to develop policies, conduct analysis, provide advice, and make recommendations on homeland defense, DSCA, emergency preparedness, and cyberspace operations within the department.

The Chairman of the Joint Chiefs of Staff advises the Secretary of Defense on the effects of requests for DSCA on national security and identifies available resources for support in response to DSCA requests. NORTHCOM and PACOM provide support to civil authorities at the federal, state, and local levels, as directed. Further, CYBERCOM synchronizes the planning for cyberspace operations in coordination with other combatant commands, the military services, and other appropriate federal agencies. In August 2017, DOD initiated the process to elevate CYBERCOM from a subunified command to a unified combatant command. According to DOD, this elevation “will help to streamline command and control of time-sensitive cyberspace operations by consolidating them under a single commander with authorities commensurate with the importance of those operations and will ensure that critical cyberspace operations are adequately funded.” Additionally, a dual-status commander could serve as an intermediate link between the separate chains of command for state and federal forces and is intended to promote unity of effort between federal and state forces to facilitate a rapid response during major disasters and emergencies.

DOD’s Section 1648 Report Addressed Some of the Statutorily Required Elements

DOD did not develop a comprehensive plan; instead, the department submitted a collection of separate documents that addressed some, but not all six statutorily required elements (hereafter referred to as DOD’s Section 1648 report). Table 1 lists each of the required elements and shows our determination of the extent to which the elements were addressed in DOD’s Section 1648 report.

DOD officials agreed that their submission was not a comprehensive plan. These officials told us they developed a report that they believed would address the required elements of the legislation and articulate the department’s comprehensive work to prepare for supporting civil authorities in response to a cyber incident with plans, policies, guidance, among other things. Specifically, DOD’s Section 1648 report is a collection of separate documents that, according to DOD, outline core federal, state, local, and private sector roles and responsibilities; summarize plans for coordination at all levels of government and across sectors in the event of a cyber incident; and prescribe the roles and responsibilities of the active and reserve components.

DOD’s Report Fully Addressed Two of the Six Elements Required by the Statute

As noted in the table above, DOD’s Section 1648 report addressed two of the six elements required by the statute–to provide (1) descriptions of the roles, responsibilities, and expectations of federal, state, and local authorities and (2) a description of legislative and administrative actions necessary to carry out its plan to support domestic cyber incident response efforts. Specifically, DOD’s Section 1648 included copies of the PPD-41 and the Department of Homeland Security’s National Cyber Incident Response Plan. Both of these documents provide general descriptions of the roles, responsibilities, and expectations of federal, state, and local authorities. For example, the National Cyber Incident Response Plan was developed to articulate the roles and responsibilities, capabilities, and coordinating structures that support how the nation responds to and recovers from significant cyber incidents posing risks to critical infrastructure.

DOD’s Section 1648 report also included a description of administrative actions that the department believed were necessary to carry out its plan to support domestic cyber incident response efforts. Specifically, according to the report, DOD had drafted a directive type memorandum to provide supplementary policy guidance, assign responsibilities, and detailed procedures for providing defense support for cyber incident response. This memorandum was signed and issued by DOD subsequent to the department submitting its Section 1648 report to Congress. DOD officials also acknowledged that there were incorporating cyber into all aspects of policy, doctrine, and guidance. In the report, DOD stated that the department believed current authorities were sufficient and did not recommend any legislative actions.

DOD’s Report Partially Addressed Three of Six Elements Required by the Statute but the Information Provided Was Incomplete

DOD partially addressed three of the six elements required by the statute—to provide (1) descriptions of the roles, responsibilities, and expectations of the active and reserve components of the armed forces; (2) the department’s plans for coordination with heads of other federal agencies and state and local governments; and (3) a list of exercises previously conducted that are used in the formulation of the plan.

DOD’s Section 1648 report includes a copy of DOD Directive 3025.18, Defense Support of Civil Authorities, which establishes DSCA policy and provides guidance for the execution and oversight of DSCA, as an appendix. This directive includes a section that identifies roles and responsibilities of DOD components such as the Joint Staff, the combatant commands, and the military departments, among others.

However, we have previously reported that DOD’s guidance does not clearly define the department’s roles and responsibilities. For example, we found inconsistency on which combatant command would be designated the supported command and have the primary responsibility for providing support to civil authorities during a cyber incident. Consequently, as noted in appendix I, we recommended that DOD issue or update guidance that clarifies roles and responsibilities for relevant entities and officials to support civil authorities in a domestic cyber incident. However, key DOD documents such as DOD Directive 3025.18, DOD’s Section 1648 report, and the Directive Type Memorandum issued in June 2017 do not clarify roles and responsibilities of DOD components, liaisons, and personnel who DOD had previously assigned coordination roles and responsibilities for supporting civil authorities. As a result, there is still uncertainty about these roles and responsibilities within the department. For example, disagreement still exists among officials in the department regarding whether NORTHCOM and PACOM (as the geographic combatant commands) or CYBERCOM, which according to command officials maintains the department’s existing inventory of cyberspace command and control capabilities, is the supported command in a cyber incident requiring civil support. DOD officials acknowledged to us that there are a number of planning and guidance documents that need to be updated to clarify roles and responsibilities. Until DOD clarifies the roles and responsibilities of its key entities for cyber incidents, as we recommended, department leaders and components will continue to experience uncertainty about the roles and responsibilities of different components and commands in providing support to civil authorities in the event of a significant cyber incident.

In an effort to describe the department’s plans for coordination with heads of other federal agencies and state and local governments, DOD’s Section 1648 report provided information on the department’s role in supporting a whole-of-government approach during a significant cyber incident. Specifically, DOD included copies of PPD-41, the Department of Homeland Security’s National Cyber Incident Response Plan, and DOD’s Department of Defense (DOD) Significant Cyber Incident Coordination Procedures. These documents recognize that the department coordinates with other federal agencies (and state and local governments, as appropriate) through the Cyber Response Group and the Cyber Unified Coordination Group that were consistent with PPD-41. According to PPD-41, the Cyber Unified Coordination Group is the primary method for coordinating between and among federal agencies responding to a significant cyber incident, as well as for integrating private sector partners into incident response efforts.

While DOD’s Section 1648 report recognizes the role and value of these two groups, these groups have limited coordination opportunities with state and local governments. For example, the Cyber Response Group is a national-level policy coordination group composed of federal department and agencies (i.e., does not include state and local governments). Also, the Cyber Unified Coordination Group is an ad-hoc group that is convened in response to a significant cyber incident and will not include state and local governments unless it is required by the scope, nature, and facts of a particular significant cyber incident.

In addition, the report did not identify any plans for coordinating with heads of other federal agencies and state and local governments, as required by the statute. DOD guidance and joint doctrine state that, among the defense coordinating officers’ multiple responsibilities, they are supposed to develop and promote relationships with federal, state, tribal, and local governmental and non-governmental organizations, and with private sector entities in the assigned Federal Emergency Management Agency (FEMA) region. However, DOD’s Section 1648 report did not identify how the defense coordinating officers, their supporting elements, or other DOD components that coordinate with civil authorities—including state and local governments—plan to coordinate in preparation to provide support of DSCA activities.

We are not making a recommendation on this issue because we previously recommended that DOD issue or update guidance that clarifies roles and responsibilities for DOD components—such as for the defense coordinating officers and their supporting elements—to support civil authorities in response to a domestic cyber incident.

DOD’s Section 1648 report also includes a list of cyber civil support exercises that DOD conducted over the last 3 years. However, this list was incomplete because DOD did not include all exercises where DOD components provided support to civil authorities in a cyber incident. For example, the report did not include NORTHCOM’s 2015 exercises—Vista Host and Vista Code. These two exercises examined planning assumptions, potential resource requirements, and roles and responsibilities associated with cyber-related defense support to civil authorities operations. By not including this information in this one-time report, DOD missed an opportunity to provide Congress more complete information about exercises that the department is conducting to prepare itself and commands to support civil authorities for a cyber incident within the United States.

During our review of DOD’s Section 1648 report, we also found that the department had yet to conduct a command and control (i.e., operational- level) exercise focused on providing support to civil authorities in a cyber incident—a gap acknowledged by officials from NORTHCOM, PACOM, and CYBERCOM. According to these officials, the exercises identified in the Section 1648 report focused on strategic–level decisions (e.g., Cyber Guard 16 Legal and Policy table top exercises) or tactical-level actions (e.g., Cyber Guard 16). CYBERCOM officials told us that they believe that Cyber Guard is a tier 1 exercise. However, a 2015 DOD Cyber Strategy implementation document stated that while Cyber Guard is a valuable “whole-of-nation” scenario, its focus is much more tactical in nature and that the department needed another tier 1-level exercise. Similarly, officials from both DHS and DOD acknowledged that Cyber Guard was a tactical-level exercise.

As previously discussed and identified in appendix I, we previously recommended that DOD conduct a tier 1 exercise to prepare its forces in the event of a disaster with cyber effects. CYBERCOM officials told us the command is currently planning an internal staff exercise to address our recommendation to exercise its forces at the operational-level of leadership. However, an internal staff exercise (i.e., an exercise that does not exercise command-and-control relationships with other combatant commanders) will not be consistent with DOD guidance that states tier 1 exercises are designed to prepare national-level organizations and combatant commanders and staff at the strategic and operational levels to integrate a diverse audience in highly complex environments. We maintain our position that Cyber Guard in its current form is not a tier 1 exercise that would enable the department to achieve its DOD Cyber Strategy goal of exercising its DSCA capabilities in support of the Department of Homeland Security (DHS) and other agencies, including state and local authorities. We continue to believe that DOD should conduct a tier 1 exercise to improve the department’s planning efforts to support civil authorities in a cyber incident.

DOD’s Report Did Not Address One of the Elements Required by the Statute and DOD Has Not Ensured That Staff Are Trained

DOD’s Section 1648 report did not address one of the six required elements—to provide a plan for internal DOD collective training activities that are integrated with exercises conducted with other agencies and state and local governments. Instead, the department provided a classified list of planned exercises for 2017 that, according to officials, have training value for cyber incident response. Officials from ODASD (HDI/ DSCA) and ODASD (Cyber Policy) told us that DOD does not train for DSCA. Rather, the department trains and exercises its forces to conduct military missions and can apply the knowledge and experience from these activities to support civil authorities when requested and approved. The officials emphasized that, while exercises generally test whether DOD forces have learned training, in the case of DSCA exercises are a key training tool.

While exercises may have training value, DOD did not provide information on existing DSCA-related training efforts within the department—such as on NORTHCOM’s DSCA course offered to officials from DOD and other federal agencies. Specifically, according to NORTHCOM officials, the command’s DSCA course focuses on training senior military officers, DOD civilians, and their staff to ensure DOD’s readiness to support its homeland defense and civil support missions. The officials explained that this course introduces participants to national, state, local, and DOD statutes, directives, plans, command and control relationships, and capabilities with regard to disaster and emergency response. By not including this information in this one-time report, DOD missed an opportunity to provide Congress more complete information about training that the department is conducting to prepare itself and commands to support civil authorities for a cyber incident within the United States.

In addition, during our review, we found that DOD had not met the training requirements outlined in PPD-41, which was included in DOD’s Section 1648 report. Specifically, the policy directive requires federal agencies, including DOD, to update cyber incident coordination training to incorporate the tenets of PPD-41 by December 2016 and to identify and maintain a cadre of personnel qualified and trained in the National Incident Management System and unified coordination to manage and respond to a significant cyber incident. According to the PPD-41, the overarching document guiding DOD’s Section 1648 report, these personnel would provide necessary expertise to support tasking and decision making by a Cyber Unified Coordination Group.

In addition, DOD’s Significant Cyber Incident Coordination Procedures require the Chairman of the Joint Chiefs of Staff, through the National Military Command Center, to maintain a list of senior DOD officials from specified organizations that could represent DOD during a Cyber Unified Coordination Group and who are trained in the National Incident Management System.

As of August 2017, DOD officials acknowledged the department had not updated its cyber incident coordination training to incorporate the tenets of PPD-41. Joint Staff officials told us they have staff qualified and trained in the National Incident Management System; however, the officials were unable to provide us a list of senior officials from DOD organizations that could participate in a Cyber Unified Coordination Group that had been trained in the National Incident Management System.

An official from the Office of DOD Principal Cyber Advisor acknowledged the Joint Staff is not tracking personnel who have been qualified and trained in the National Incident Management System, as required by the DOD Significant Cyber Incident Coordination Procedures. Consequently, it is unclear whether senior DOD officials who may be asked to participate in a Cyber Unified Coordination Group will be trained in the National Incident Management System. Until DOD updates its cyber incident response training and maintains a list of senior DOD officials from organizations who could represent DOD during a Cyber Unified Coordination Group and who are trained in the National Incident Management System, the department will not be in compliance with PPD- 41 and may not have the personnel with expertise to manage and respond to a significant cyber incident.

Conclusions

DOD recognizes that a disruptive, manipulative, or destructive cyberattack could present a significant risk to U.S. economic and national security and that the department must be prepared to support civil authorities in all domains—including in cyberspace. While DOD addressed some of the required elements set forth in Section 1648, the report submitted does not highlight the full scope of the department’s planning and preparation efforts to support civil authorities in response to a cyber incident. We are not making recommendations on these issues because we have previously made recommendations in areas where the Section 1648 report did not contain complete information. However, without complying with the training requirements outlined in PPD-41 and the DOD Significant Cyber Incident Coordination Procedures, the department cannot reasonably ensure it has the personnel with expertise to manage and respond to a significant cyber incident. Taking action to improve the areas we have highlighted should help DOD sustain the progress it has already made. With the President’s decision to elevate CYBERCOM to a unified combatant command, such actions will also help as DOD continues to plan to support civil authorities in response to a cyber incident and where CYBERCOM has a significant role.

Recommendations for Executive Action

We are making the following two recommendations to DOD: The Assistant Secretary of Defense for Homeland Defense and Global Security, in coordination with the Chairman of the Joint Chiefs of Staff and other appropriate DOD components, should update the department’s cyber incident coordination training to incorporate the tenets of PPD-41.

The Chairman of the Joint Chiefs of Staff should maintain a list of senior DOD officials from organizations that could represent DOD during a Cyber Unified Coordination Group and that are trained in the National Incident Management System.

Agency Comments and Our Evaluation

We provided a draft of our report to DOD for review and comment. In its written comments, DOD partially concurred with our first recommendation and concurred with the second. DOD’s written comments are reprinted in their entirety in appendix IV.

DOD partially concurred with our recommendation to update the department's cyber incident coordination training to incorporate the tenets of PPD-41. In its response, DOD acknowledged the need to continue its emphasis on cyber incident coordination training and states that the department is wholly committed to updating the appropriate training as part of its formal after action reviews during each exercise and training event. DOD stated that it prepares for cyber incidents by exercising interagency roles and responsibilities, and command and control within a cyber threat scenario. While these exercises emphasize the development of comprehensive cyber incident response plans and seek to foster cyber incident coordination, DOD did not identify any specific exercise or training event in which the department will incorporate the tenets of PPD- 41. Accordingly, we continue to believe that our recommendation is warranted. As we reported and DOD acknowledged, Cyber Guard is a tactical-level exercise that would not fully incorporate all DOD components that would participate in a unified cyber response consistent with PPD-41. DOD would meet the intent of our recommendation by conducting one or more cyber incident exercises that incorporate the tenets of PPD-41 into command and control (i.e., operational-level) relationships across all relevant commands and not just across CYBERCOM.

DOD concurred with our recommendation that the Joint Staff maintain a list of senior DOD officials from organizations who could represent DOD during a Cyber Unified Coordination Group and who are trained in the National Incident Management System. DOD stated that the Joint Staff will ensure that senior DOD personnel are familiar with the National Incident Management System, or advised by personnel that are, prior to representing the department during a Cyber Unified Coordination Group. The department also plans to re-emphasize these efforts as part of its onboarding process for newly assigned senior leaders, as appropriate.

We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, the Assistant Secretary of Defense for Homeland Defense and Global Security, the Chairman of the Joint Chiefs of Staff, and the Secretary of Homeland Security. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-9971 or kirschbaumj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix V.

Appendix I: Status of Three Recommendations from Our Recent Reports on Defense Cyber Civil Support

During our review of the Department of Defense’s (DOD) Section 1648 report, we followed up on three recommendations from our recent reports that could improve the department’s planning and processes for supporting civil authorities in a cyber incident. Table 2 summarizes the status of these recommendations.

Appendix II: Section 1648 (a) of the National Defense Authorization Act for Fiscal Year 2016

SEC. 1648. COMPREHENSIVE PLAN AND BIENNIAL EXERCISES ON RESPONDING TO CYBER ATTACKS. (a) COMPREHENSIVE PLAN OF DEPARTMENT OF DEFENSE TO SUPPORT CIVIL AUTHORITIES IN RESPONSE TO CYBER ATTACKS BY FOREIGN POWERS.— (1) PLAN REQUIRED.— (A) IN GENERAL.—Not later than 180 days after the date of the enactment of this Act, the Secretary of Defense shall develop a comprehensive plan for the United States Cyber Command to support civil authorities in responding to cyber attacks by foreign powers (as defined in section 101 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801)) against the United States or a United States person. (B) ELEMENTS.—The plan required by subparagraph (A) shall include the following: (i) A plan for internal Department of Defense collective training activities that are integrated with exercises conducted with other agencies and State and local governments. (ii) Plans for coordination with the heads of other Federal agencies and State and local governments pursuant to the exercises required under clause (i). (iii) A list of any other exercises previously conducted that are used in the formulation of the plan required by subparagraph (A), such as Operation Noble Eagle. (iv) Descriptions of the roles, responsibilities, and expectations of Federal, State, and local authorities as the Secretary understands them. (v) Descriptions of the roles, responsibilities, and expectations of the active components and reserve components of the Armed Forces. (vi) A description of such legislative and administrative action as may be necessary to carry out the plan required by subparagraph (A). (2) COMPTROLLER GENERAL OF THE UNITED STATES REVIEW OF PLAN.—The Comptroller General of the United States shall review the plan developed under paragraph (1)(A).

Appendix III: Objective, Scope, and Methodology

Our objective was to determine the extent to which the Department of Defense’s (DOD) Section 1648 report submission addressed the statutorily required elements.

To determine the extent to which DOD’s Section 1648 report addressed the statutorily required elements, we analyzed the text of DOD’s Section 1648 report. To conduct our analysis of DOD’s Section 1648 report, two of our analysts analyzed the text of the Section 1648 report and assessed the extent to which the report addressed the six elements required by the statute. The analysts assessed each element in the report as “fully addressed,” “partially addressed,” or “not addressed.” If the Section 1648 report addressed all aspects of the required element, the analysts determined that DOD had “fully addressed” the element. If the report addressed some aspects of a required element, but not all, the analysts determined that DOD had “partially addressed” the element. If the report did not address any aspects of a required element, the analysts determined that DOD “did not address” the element. A third independent analyst reviewed the initial determinations and assessed whether they were accurate.

For further information, we met with relevant officials from DOD components—such as from the Office of the Assistant Secretary of Defense for Homeland Defense and Global Security, including the Office of the Deputy Assistant Secretary of Defense for Homeland Defense Integration and Defense Support of Civil Authorities and the Office of the Deputy Assistant Secretary of Defense for Cyber Policy; the Joint Staff; U.S. Northern Command (NORTHCOM); U.S. Pacific Command (PACOM); U.S. Cyber Command (CYBERCOM); and the National Guard Bureau. We also interviewed Department of Homeland Security officials to obtain clarifying and supporting information on the process by which the department plans and prepares for a cyber incident requiring civil support. In the cases in which the analysts determined that the plan did not address some aspects of a required element, they discussed their preliminary analyses with officials from the Office of the Assistant Secretary of Defense for Homeland Defense and Global Security to seek additional information. Additionally, DOD officials offered clarification regarding the Defense Support of Civil Authorities process, DOD roles and responsibilities in civil support, and information on ongoing initiatives.

We conducted this performance audit from May 2017 to November 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix IV: Comments from the Department of Defense

Appendix V: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the individual named above, Tommy Baril (Assistant Director), Tracy Barnes, David Beardwood, Pamela Davidson, Ashley Houston, Gabrielle Matuzsan, and Spencer Tacktill made key contributions to this report.

Related GAO Products

Defense Civil Support: DOD Needs to Identify National Guard’s Cyber Capabilities and Address Challenges in Its Exercises. GAO-16-574. Washington, D.C.: September 6, 2016.

Civil Support: DOD Needs to Clarify Its Roles and Responsibilities for Defense Support of Civil Authorities during Cyber Incidents. GAO-16-332. Washington, D.C.: April 4, 2016.

Civil Support: DOD Is Taking Action to Strengthen Support of Civil Authorities. GAO-15-686T. Washington, D.C.: June 10, 2015.

Homeland Defense: DOD Needs to Address Gaps in Homeland Defense and Civil Support Guidance. GAO-13-128. Washington, D.C.: October 24, 2012.

Homeland Defense: DOD Can Enhance Efforts to Identify Capabilities to Support Civil Authorities during Disasters. GAO-10-386. Washington, D.C.: March 30, 2010.

Homeland Defense: DOD Needs to Take Actions to Enhance Interagency Coordination for Its Homeland Defense and Civil Support Missions. GAO-10-364. Washington, D.C.: March 30, 2010.