Critical Infrastructure Protection: Further Efforts Needed to Integrate Planning for and Response to Disruptions on Converged Voice and Data Networks
Released: 2008-06-26T00:00:00

Letter

Background

An effective communications infrastructure, including voice and data networks, is essential to our ability as a nation to maintain public health and safety during a catastrophic natural disaster, such as a hurricane, or a man-made event, such as a terrorist attack. Technological advances in these networks have led to a convergence of the previously separate networks used to transmit voice and data communications. These new networks—next generation networks—are capable of transmitting both voice and data on a single network and eventually will be the primary means for voice and data transmissions.

Converged voice and data networks have many benefits. For example, these networks use technology based on packet switching, which allows greater resiliency. Packet switching involves breaking a message into packets, or small chunks of data, and transferring the packets across a network to a destination where they are recombined. The resiliency of using a packet-switching network is due to the packet’s ability to be transmitted over multiple routes, avoiding areas that may be congested or damaged. Conversely, conventional voice services use traditional telephone networks, which are based on circuit switching technology. Instead of breaking a message up into packets, circuit-switching uses a dedicated channel to transmit the voice communication. Once all of the channels are occupied, no further connections can be made until a channel becomes available. Figure 1 shows a comparison between packet switching and circuit switching.

Converged networks, however, also pose certain technical challenges. For example, current national programs to provide priority voice services in an emergency are based primarily on voice or traditional telephone networks, which are circuit-switched. Implementing these networks on packet- switched networks is difficult because there is no uniformly accepted standard for providing priority service on a packet-switched network. Also, the Internet-based protocols used on packet-switched networks have vulnerabilities and in certain cases, packet-switched networks may be unreliable for emergency communications due to delays in transmission and loss of packets.

Federal Policies Provide for Critical Infrastructure Protection for Communications

Federal policies call for the protection of essential public and private infrastructures, such as the electric power grid, chemical plants, and water treatment facilities that control the vital functions critical to ensuring our national economic security and public health and safety. These infrastructures, called critical infrastructures, also include communications infrastructure, such as voice and data communication networks. Federal policies also designate certain federal agencies as lead points of contact for each key critical infrastructure sector and assign responsibility for infrastructure protection activities and for coordination with other relevant federal agencies, state and local governments, and the private sector. (See app. II for a description of the sectors and the designated federal agencies.) DHS is the lead federal agency for both the telecommunications and information technology (IT) sectors. DHS is also designated as the focal point for the security of cyberspace—including analysis, warning, information sharing, vulnerability reduction, mitigation, and recovery efforts for public and private critical infrastructure information systems.

As part of its responsibilities, DHS created the National Infrastructure Protection Plan to coordinate the protection efforts of critical infrastructures. The plan recognizes the Internet as a key resource composed of assets within both the IT and the telecommunications sectors. It notes that the Internet is used by all critical infrastructure sectors to varying degrees and that it provides information and communications to meet the needs of businesses, government, and the other sectors. The National Infrastructure Protection Plan requires lead federal agencies for the critical infrastructure sectors to work with public and private sector stakeholders to develop sector-specific plans that address how the sectors’ stakeholders will improve the security of their assets, systems, networks, and functions. We recently reported on how comprehensively these sector-specific plans address the cyber security aspects of their sectors, including the plans for the IT and telecommunications sectors. We found that the plans varied in how sector stakeholders identified their cyber risks and developed plans to identify, respond to, and recover from a cyber attack. Accordingly, we recommended specific measures to help DHS strengthen the development, uniformity, and use of the plans.

DHS’s Office of Cyber Security and Communications Is Responsible for Both Cyber and Telecommunications Security and Recovery

Federal policies provide DHS the lead responsibility for facilitating a public-private response to disruptions to major communications infrastructure, such as voice and data networks. Within DHS, the responsibility is assigned to NCSD and NCS in the Office of Cyber Security and Communications. NCSD has responsibility for the security of data and applications and executes this duty via its operations center—US-CERT— while NCS has responsibility for the communications infrastructure that carries data and applications and carries out its duty through its coordination center, NCC, and its operations center, NCC Watch.

National Cyber Security Division

In June 2003, DHS created NCSD to serve as the national focal point for addressing cyber security issues. NCSD’s mission is to secure cyberspace and America’s cyber assets in cooperation with public, private, and international entities. The division carries out its mission via its US-CERT operations center, which is responsible for, among other things, analyzing and addressing cyber threats and vulnerabilities and disseminating cyber- threat warning information. In the event of a security issue or disruption affecting data and applications, US-CERT is to facilitate coordination of recovery activities with the network and security operations centers of owners and operators of these networks and with government officials (e.g., incident response teams) responsible for protecting government networks. NCSD is the government lead on a public/private partnership supporting US-CERT and serves as the lead for the federal government’s cyber incident response through the National Cyber Response Coordination Group. This group is the principal federal interagency mechanism for coordinating the preparation for and response to significant cyber incidents, such as a major Internet disruption, and includes members from 19 federal departments and agencies.

National Communications System

NCS is responsible for ensuring that communications infrastructure used by the federal government is available under all conditions—ranging from normal situations to national emergencies and international crises. The system does this through several activities, including a program that gives calling priority to federal executives, first responders, and other key officials in times of emergency. NCS was established by presidential direction in August 1963 in response to voice communication failures associated with the Cuban Missile Crisis. Its role was further clarified through an executive order issued in April 1984 that established the Secretary of Defense as the executive agent for NCS. In 2003, it was transferred to the responsibility of the Secretary of DHS.

NCS is composed of members from 24 federal departments and agencies. Although it originally focused on “traditional” voice services via common carriers, NCS has now taken a larger role in Internet-related issues due to the convergence of voice and data networks. For example, it now helps manage issues related to disruptions of the Internet backbone (e.g., high- capacity data routes). NCC, which serves as the coordination component of NCS, is the point of contact with the private sector on issues that could affect the availability of the communications infrastructure. According to DHS, the center includes 47 members from major telecommunications organizations, such as Verizon and AT&T. These members represent 95 percent of the wireless and wire line telecommunications service providers and 90 percent of the Internet service provider backbone networks.

During a major disruption in telecommunications services, NCC Watch is to coordinate with NCC members in an effort to restore service as soon as possible. In the event of a major Internet disruption, it is to assist recovery efforts through its partnerships and collaboration with telecommunications and Internet-related companies. Using these partnerships, NCC has also created several programs that, in times of emergency, provide calling priority in to enable first responders and key officials at all levels to communicate using both landline phones and cellular devices.

Federal and Private Sector Experts Have Recommended a More Integrated Approach to Planning for and Responding to Disruptions on Converged Networks

Since February 2002, we, along with federal government and private sector experts, have examined the convergence of voice and data networks into next generation networks. All these experts recommend that federal agencies such as DHS adopt an integrated approach—including integrating their organizations—to planning for and responding to network disruptions. In February 2002, before the formation of DHS, a White House advisory group recommended that the federal government develop such an approach. Specifically, it found that timely information sharing was essential to effective incident response, that existing coordination within the government was ineffective and needed senior management attention, and that NCS should broaden its capabilities to include more IT industry expertise.

In March 2006, the National Security Telecommunications Advisory Committee, a presidential advisory group, also recommended that DHS develop an integrated approach to incident response on next generation networks and update priority communications programs to improve existing recovery abilities. The committee recommended that DHS establish an inclusive and effective incident response capability that includes functions of the NCC and a broadened membership, including firms in the IT sector. The committee also stated that most new communications providers are not members of the NCC, were not easily accessible during an incident, and had not yet developed close working relationships with other industry stakeholders and the federal government.

In June 2006, we recommended that DHS improve its approach to dealing with disruptions by examining the organizational structure of NCSD and NCS in light of the convergence of voice and data networks. We found that DHS had overlapping responsibilities for incident response, which affected the ability of DHS to prioritize and coordinate incident response activities.

Furthermore, in December 2006, the Telecommunications and Information Technology Information Sharing and Analysis Centers, composed of representatives of private telecommunications and IT companies, sent a letter to DHS asking that the department develop a plan to integrate critical infrastructure protection efforts including planning for and responding to disruptions. In a January 2007 written response signed by the Assistant Secretary for Cyber Security and Communications, DHS agreed with the importance of this effort and stated that developing a road map for integration was a priority.

Moreover, in April 2007, the two information sharing and analysis centers established a task force (referred to as a “tiger team” by DHS) with DHS that, among other things, identified overlapping responsibilities between NCC Watch and US-CERT in the following areas: developing and disseminating warnings, advisories, and other urgent evaluating the scope of an event; deploying response teams during an event; integrating cyber, communications, and emergency response exercises into operational plans and participation; and the management of relationships with others, such as industry partners.

Consequently, the tiger team task force recommended merging the two centers to establish an integrated operations center and further recommended that DHS adopt a three-step approach to integration of the centers. The approach should include: moving NCC Watch to office space physically adjacent to US-CERT, developing an integrated operations center by merging US-CERT and NCC inviting private sector critical infrastructure officials to join this new center.

In addition to these three steps, the task force also recommended specific actions to be taken in implementing them. For example, in developing an integrated operations center by merging NCC Watch and US-CERT, the task force recommended, among other things, that DHS (1) appoint a project manager to lead this effort; (2) develop policies and procedures that integrate operations and address overlapping responsibilities, including how the new center is to respond in an integrated manner to threats and incidents; and (3) establish performance measures to monitor progress. In addition, with regard to involving key private sector critical infrastructure officials in the new center, the task force recommended that the department also appoint a project manager to lead this effort. This effort would include seeking participation of appropriate private sector officials, identifying any potential legal issues to having these officials serve in the new center, and developing measures to monitor progress.

In September 2007, DHS approved the report, accepting the recommendations and adopting the three-step approach.

DHS Has Completed the First of Its Three- Step Integration Approach, but Has Yet to Implement the Remaining Steps

DHS has taken the first of three steps toward integrating NCSD and NCS by moving the two centers, NCC Watch and US-CERT, to adjacent office space in November 2007. This close proximity allows the approximately 41 coordination center and 95 readiness team analysts to, among other things, readily collaborate on planned and ongoing activities. In addition, the centers have jointly acquired common software tools to identify and share physical, telecommunications, and cyber information related to performing their missions. For example, the centers use one of the tools to develop a joint “morning report” specifying their respective security issues and problems, which is used by the analysts in coordinating responses to any resulting disruptions.

While DHS has completed the first step, it has yet to implement the remaining two steps and supporting actions. Specifically, the department has not organizationally merged or integrated operation centers or completed any of the supporting actions. For example, the department has not hired a project manager, developed common operating procedures, or established progress measures. In addition, according to DHS officials, they have no efforts planned or underway to implement this step and associated actions.

With regard to involving key private sector officials to participate in the proposed joint center, the department has not accomplished this step and supporting actions either. For example, it has not hired a project manager or sought participation of appropriate private sector officials to work at the new center. DHS officials told us they also have no efforts planned or underway to implement this step and its supporting actions.

A key factor contributing to DHS’s lack of progress in implementing these steps is that completing the integration is not a top department priority. Instead, DHS officials stated that their efforts have been focused on other initiatives, most notably the President’s recently announced cyber initiative, which is a federal governmentwide effort to manage the risks associated with the Internet’s nonsecure external connections. Officials from DHS’s Office of Cyber Security and Communications stated that they are in the process of drafting a strategic plan to provide overall direction for the activities of NCS and NCSD, including completing the integration of the centers. However, the plan is in draft and has been so since mid-2007. In addition, DHS officials could not provide a date for when it would be finalized. Consequently, the department does not have a strategic plan or related guidance that provides overall direction in this area and has not developed specific tasks and milestones for achieving the remaining two integration steps.

Until DHS completes the integration of these two centers, it risks being unable to efficiently plan for and respond to disruptions to communication infrastructure, including voice and data networks, and the information traveling on these networks, increasing the probability that communications will be unavailable or limited in times of need.

Conclusions

While DHS has taken initial steps toward integrating the key centers that plan for and respond to disruptions to the communications infrastructure, including voice and data networks, and the data and applications on these networks, these offices are still not fully integrated as envisioned. Consequently, the risks associated with not having a fully integrated response to disruptions to the communications infrastructure remain. Effectively mitigating these risks will require swift completion of the integration. To do this will also require strong leadership to make the integration effort a department priority and to managing it accordingly, including completing the strategic plan and defining remaining integration tasks and milestones. To do less will continue to expose the nation’s communications networks to continuing risk of inadequate response to an incident.

Recommendations for Executive Action

We are making two recommendations to the Secretary of Homeland Security to direct the Assistant Secretary for Cyber Security and Communications to Establish milestones for completing the development and implementation of the strategic plan for NCSD and NCS.

Define specific tasks and associated milestones for establishing the integrated operations center through merging NCC Watch and US-CERT and inviting and engaging key private sector critical infrastructure officials from additional sectors to participate in the operations of the new integrated center.

Agency Comments and Our Evaluation

In written comments on a draft of this report (see app. III), signed by the Acting Director of DHS’s Departmental Liaison Office, the department concurred with our first recommendation and stated it is taking steps to implement it. Specifically, the department said that as part of its effort to develop and implement a strategic plan, it intends to take into consideration, among other things, the recommendations of the various expert groups that have studied issues confronting DHS in this area and the lessons learned from collocating the two centers. Further, the department stated that this strategic planning also is to provide for integrating the centers’ existing overlapping functions with the aim of increasing mission effectiveness.

With regard to our second recommendation, DHS stated that, while it supports further integration of overlapping functions, it does not support organizationally merging the centers at this point and added that the lack of a merger will not impact its ability to respond to incidents.

We do not agree. To the contrary, there is strong evidence that shows that DHS’s ability to respond is negatively impacted by the use of separate centers, rather than a single integrated and merged entity. Specifically, our past work has shown that overlapping responsibilities for incident response have adversely affected DHS’s ability to prioritize and coordinate incident response activities. For example, private-sector firms have reported that in responding to a critical incident, DHS made time-consuming and duplicative requests for information without identifying how this information would be beneficial in helping respond to the event. In addition, the DHS-commissioned expert task force on the subject recently reported that without an organizationally integrated center, the department will not have a comprehensive operating picture of the nation’s cyber and communications infrastructure and thus not be able to effectively implement activities necessary to prepare, protect, respond, and recover this infrastructure. Further, our interviews with private- sector cyber and communications infrastructure executives performed as part of this engagement found that they also favor a merged organization that includes broad industry participation. This evidence calls for DHS to take a closer look at the issue of whether to merge the centers.

DHS also commented on the report’s description of the roles and responsibilities of NCC and US-CERT. Specifically, DHS noted that our original characterization of NCC as dealing with voice systems and US-CERT with data systems was not totally accurate. Instead, DHS offered that a more accurate distinction would be that NCC deals with communication infrastructure, including voice and data networks, and US-CERT deals with the security of systems and data using the networks, which DHS commonly refers to as cyber situational awareness and response. We agree with this comment and have incorporated it in the report where appropriate.

In addition to its written response, the department also provided technical comments that we have incorporated in the report where appropriate.

We will send copies of this report to interested congressional committees, the Secretary of Homeland Security, and other interested parties. In addition, this report will be available at no charge on GAO’s Web site at http://www.gao.gov. If you have any questions on matters discussed in this report, please contact David A. Powner at (202) 512-9286 or at pownerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV.

Appendix I: Objective, Scope, and Methodology

Our objective was to determine the status of Department of Homeland Security (DHS) efforts to integrate the activities of its National Cyber Security Division (NCSD) and National Communications System (NCS) in preparing for and responding to disruptions in converged voice and data networks.

To accomplish this, we first analyzed pertinent laws, policies, and related DHS documentation (e.g., charters and mission statements) showing the responsibilities of NCSD and NCS, particularly with regard to the increasing convergence of voice and data networks. We also analyzed key studies on DHS’s approach to managing convergence. We did this to identify key findings and recommendations pertinent to our objective. In particular, we focused on the Industry-Government Tiger Team Report and Recommendations for a Cyber Security and Communications Joint Operations Center, which recommended establishing an integrated operations center. DHS adopted the recommendations as part of its three- step approach to establish such a capability by (1) moving the National Coordination Center (NCC) Watch to office space physically adjacent to the US Computer Emergency Readiness Team (US-CERT), (2) developing an integrated operations center by merging NCC Watch and US-CERT, and (3) inviting private sector critical infrastructure officials to participate in this new center. We also interviewed DHS and industry officials who served on the tiger team task force and developed the report findings and recommendations.

To determine the status of DHS’s efforts to integrate the centers, we analyzed department progress against the three steps specified in DHS’s approach. We also obtained and analyzed plans and related documentation from DHS on its status in establishing an integrated operations center capability. In particular, we assessed department plans and related documentation on the status of collocating and merging the NCS and NCSD operations centers. In addition, we analyzed documentation on DHS’s status in inviting key private sector infrastructure officials to join the operations of the new center. We also interviewed relevant officials in these organizations, including the managers of the National Coordination Center and the U.S. Computer Emergency Readiness Team, the Director of NCS, and the Acting Director of NCSD, to get their perspectives and to validate our understanding of their efforts to date. We also interviewed private sector officials—including the Chair of the Communications Information Sharing and Analysis Center and the President and Vice President of the IT Information Sharing and Analysis Center—to obtain their perspectives on DHS’s progress in addressing convergence, including establishing the integrated center and to determine whether they had received DHS invitations to participate in the operation of the integrated center.

Next, to identify gaps, we compared the state of DHS’s progress against the task force recommendations adopted by DHS as part of its three step approach to integration. When gaps were identified, we also interviewed responsible DHS officials to determine any causes and their impact.

We conducted this performance audit in the Washington, D.C. metropolitan area from September 2007 to June 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Critical Infrastructure Sectors

Appendix III: Comments from the Department of Homeland Security

Appendix IV: GAO Contact and Staff Acknowledgments

Staff Acknowledgments

In addition to the individual named above, Gary Mountjoy (Assistant Director), Scott Borre, Camille Chaires, Neil Doherty, Vijay D’Souza, Nancy Glover, Lee McCracken, and Jeffrey Woodward made key contributions to this report.