The communications sector’s infrastructure is a complex system of systems that incorporates multiple technologies and services. The infrastructure includes wireline, wireless, satellite, cable, and broadcasting capabilities, and includes the transport networks that support the Internet and other key information systems. Historically, networks based on time-division multiplexed (TDM) circuit-switches running on copper loops provided voice service for consumers. In a 2015 report and order, FCC noted that for over 100 years customers could rely upon telecommunications carriers for backup power for their residential landline phones during power outages because power is provided over traditional copper telephone lines. In other words, telephones served by copper networks continue to work during commercial power outages as long as the telephones do not need to be plugged into an electrical outlet to function. On the other hand, the physical infrastructure for IP-based networks, such as fiber and co-axial cable, does not carry power, which means telephones connected to IP networks may not work during commercial power outages (see fig.1). According to FCC, networks other than copper and services not based on TDM may not support data-based services such as credit card readers, home alarms, and medical alert monitors. The Alarm Industry Communications Committee noted in comments filed with FCC that the traditional TDM-based telephone service meets the standards necessary for fire protection and other life and safety applications, such as line seizure, the detection of a loss in communications path, and the proper encoding and decoding of tone messages sent by the alarm panel. The committee stressed that as networks transition to IP-based networks, these traits must be preserved. FCC notes that there are a number of distinct but related kinds of technology transitions, including: (1) changes in network facilities and in particular retirement of copper facilities, and (2) changes that involve the discontinuance, impairment, or reduction of legacy services, irrespective of the network facility used to deliver those services. In the case of retiring copper facilities, the Communications Act of 1934, as amended (Communications Act), and FCC rules thereunder allow telecommunications carriers to transition to new facilities without needing FCC approval as long as the change of technology does not discontinue, reduce, or impair the services provided. FCC rules do require incumbent telecommunications carriers to give notice to interconnecting carriers of planned copper retirements, and new FCC rules require incumbent carriers to give notice to retail customers of such planned copper retirements when such retirements remove copper to the customers’ premises without consumer consent, along with particular consumer protection measures. Such consumer protections include explanations of how consumers may seek more information from carriers about the copper retirement process and its possible impact on consumers’ service, and links for the FCC’s consumer complaint portal. With respect to service discontinuance, under the Communications Act, telecommunications carriers must obtain FCC approval before they discontinue, reduce, or impair service to a community or part of a community. FCC regulations include procedures for carriers to discontinue, reduce, or impair service. The regulations state that to discontinue telecommunications service, carriers must notify customers of this intent and file an application with FCC. Once an application is received, FCC issues a public notice and considers these applications on a case-by-case basis and also accepts and reviews comments on proposed discontinuations, reductions, or impairments of telecommunications service. According to the order, FCC will normally authorize the discontinuance, reduction, or impairment of service unless it is shown that to do so would adversely affect the public convenience and necessity, with regard to which FCC considers, among other things, whether customers would be unable to receive service or a reasonable substitute from another carrier. FCC officials told us that there is no forcing action or requirement for telecommunications carriers to transition to IP by a certain date and that the technology transitions are organic processes without a single starting or stopping point. In an August 2015 order, FCC noted that recent data indicate 30 percent of all residential customers choose IP-based voice services from cable, fiber, and other carriers as alternatives to legacy voice services. Furthermore, an additional 44 percent of households were “wireless-only” meaning these households only have wireless telephones. The August 2015 order also states that overall, almost 75 percent of U.S. residential customers (approximately 88-million households) no longer receive telephone service over traditional copper facilities because they rely on IP-based voice services or wireless phone service. Both FCC and DHS play a role in regulating the transition to IP and ensuring public safety communications are not at risk. Pursuant to the Communications Act, FCC is charged with regulating interstate and international communications by radio, television, wire, satellite, and cable throughout the United States. FCC officials stated that FCC is to promote the reliability, resiliency, and availability of the nation’s communications networks at all times, including in times of emergency or natural disaster. Further, FCC has the authority to adopt, administer, and enforce rules related to communications reliability and security, 911, and emergency alerting. FCC’s regulations include requirements for certain telecommunications carriers to report on the reliability and security of communications infrastructures, specifically reporting on network outages. FCC also asks carriers to report voluntarily on the status of the restoration of communications in the event of a large scale disaster. DHS is the principal federal agency to lead, integrate, and coordinate the implementation of efforts to protect communications infrastructure. DHS’s role in critical infrastructure protection is established by law and policy. The Homeland Security Act of 2002, Homeland Security Presidential Directive 7, and the National Infrastructure Protection Plan establish an approach for protecting the nation’s critical infrastructure sectors— including communications—that focuses on the development of public private partnerships and establishment of a risk management framework. These policies establish critical infrastructure sectors, including the communications sector; assign agencies to each sector (sector-specific agencies), including DHS as the sector lead for the communications and information technology sectors; and encourage private sector involvement. Pursuant to Presidential Policy Directive 21, DHS is to coordinate the overall federal effort to promote the security and resilience of the nation’s critical infrastructure from all-hazards. As the nation’s telecommunications systems transition to IP networks, carriers can face challenges during times of crisis that affect end users’ ability to call 911 and receive emergency communications. These challenges include (1) preserving consumer service and (2) supporting existing emergency communications services and equipment. FCC, DHS, and other stakeholders have taken steps to help address these challenges, but some persist. Providers face challenges in preserving service during times of crisis such as natural disasters or outages caused by malicious acts and accidents. For example, weather events, such as hurricanes and tornados, can damage telecommunications infrastructure and the power sources communications systems rely on to provide service. A 2012 DHS report entitled 2012 Risk Assessment Report for Communications identified risks to communication networks from violent weather that include fuel not being available for generators during a commercial power outage; aerial infrastructure unable to withstand high winds; utility poles unable to withstand high winds; and underground infrastructure unable to withstand flooding. Destruction of communications infrastructure by storms can affect both legacy copper wire and IP networks. For example, in talking with officials from New York and New Jersey about Hurricane Sandy, the officials told us the storm damaged both copper lines and fiber optic cable. However, as explained previously, in general, consumers with basic telephones and service provided over copper lines can still operate during a commercial power outage, as long as the carrier’s central office maintains power and keeps supplying line power through an all-copper network. In contrast, consumers with service provided over IP networks require a backup power source, such as a battery, since IP network infrastructure does not carry electrical power for the purpose of powering end devices, such as telephones. Officials we contacted from four state agencies, and representatives from four trade and industry organizations and consumer groups emphasized the importance of backup power for communications during emergencies. To address backup power requirements during a commercial power outage, FCC issued rules addressing 911 reliability and the reliability and continuity of communications networks for both carriers’ central office facilities and consumers’ homes. Specifically, in 2013, FCC issued new rules on central office backup power certification requirements for certain 911 service providers. In an August 2015 order, FCC noted that many consumers remained unaware they needed to take action to ensure their landline telephone service remained available in the event of a commercial power outage. FCC concluded that the transition to all-IP networks had the potential to create a widespread public safety issue if unaddressed. Therefore, FCC adopted rules to help ensure consumers have the information and tools necessary to maintain landline home telephone service during emergencies. When these rules become effective, FCC will require that telecommunications carriers communicate information to consumers regarding backup power, such as the availability of backup power sources, service limitations with and without backup power, and purchase options. FCC will also require telecommunications carriers to give consumers the option to purchase a backup power device with at least 8 hours of standby power during a commercial power outage enabling calls, including those to 911. Furthermore, FCC will require carriers to offer consumers the option to purchase 24 hours of backup power within 3 years. In addition to weather events, telecommunication network outages can occur through malicious acts, such as vandalism and cyber attacks, and by accidental cable cuts and software coding errors. For example, a fiber optic cable north of Phoenix was vandalized in February 2015, causing large-scale telephone and Internet outages across much of Northern Arizona. According to local officials we contacted, the outage lasted about a day and included Flagstaff, Sedona, Prescott, and surrounding areas potentially affecting more than 300,000 people. Officials told us that the Flagstaff police department’s 911 lines were down, so they sent staff to a backup site at the Arizona Department of Public Safety to answer calls; the police department also lost all Internet, a loss that prevented it from checking for warrants and driver’s licenses. Additionally, officials told us that some businesses closed because they could not process credit card transactions, that ATMs did not work, and that Northern Arizona University lost Internet service. According to a Flagstaff official, the telecommunications carrier is now building, and expects to complete by 2016, an additional fiber optic cable that will improve resiliency and redundancy. Cyber attacks can also challenge both IP networks and traditional legacy networks; however, DHS officials told us that IP networks are more prone to cyber attacks than legacy networks, because legacy networks are closed systems that are less vulnerable to cyber attacks. Under the terms of a 2013 executive order and a related presidential policy directive, it is the policy of the United States to strengthen the security and resilience of its critical infrastructure against both physical and cyber threats. In a 2015 report, the Communications Security, Reliability and Interoperability Council (CSRIC) identified cybersecurity threats to Voice over IP (VoIP) and voice services that include disrupting network availability, compromising confidentiality, and spoofing a caller’s identity. According to FCC officials, CSRIC is developing recommendations to support the real-time sharing of cyber threat information among private sector entities. For our recent products related to cybersecurity and information security, see related GAO products listed at the end of this report. As with legacy copper networks, accidents also cause IP network outages affecting communication capabilities. For example, a truck accident in 2014 took out 400 feet of aerial fiber optic cable along a rural road in Mendocino County, California. According to a local incident report, telephone, Internet, cellular, and 911 services went down for thousands of residents, and Internet service was out almost completely along a 40-mile corridor for approximately 45 hours. According to local officials we contacted, 911 services were unavailable, and the county sheriff estimated that 20 percent of county residents lost vital services. Alert notifications through phone calls were unavailable for residents waiting to receive evacuation notices just as a nearby wildfire was growing. According to an incident report, health care providers could not be reached; banks and supermarkets closed because they were unable to function without Internet, telephone, and ATM services; and electronic food stamp benefits were unavailable. IP network outages caused by human error, such as software coding errors, can affect large numbers of people over wide geographic areas. Such outages are sometimes referred to as “sunny day” outages. For example, in April 2014, a 911 call-routing facility in Colorado stopped directing emergency calls to 911 call centers in 7 states. The outage was caused by a coding error and resulted in a loss of 911 services for more than 11-million people for up to 6 hours. Unlike legacy copper networks, IP networks permit call control to be distributed among just a few large servers nationwide, meaning each server can serve millions, or even tens of millions, of customers, according to FCC. State officials from New York and California told us that IP networks allow for increased consolidation of equipment and facilities, which means that when an outage does occur, it can potentially last longer and affect more people across a wider area than legacy networks. An FCC investigation into a multistate 911 outage in 2014 found that this geographical consolidation of critical 911 capabilities may increase the risk of a large “sunny day” outage caused by software failures rather than disasters or weather conditions. According to this investigation, large-scale outages may result when IP networks do not include appropriate safeguards. In 2013, FCC adopted rules requiring 911 service providers to certify annually that they comply with industry-backed best practices or implement alternative measures that are reasonably sufficient to assure reliable 911 service. IP networks may not support existing communication services that key government officials and others rely on during times of crisis. Communications networks can become congested during emergencies, preventing government officials and other national security and emergency preparedness personnel from communicating with one another. To overcome this congestion, DHS maintains priority telecommunications services, such as the Government Emergency Telecommunications Service (GETS) that provide priority calling capabilities to authorized users. GETS was initially designed in the 1990s to operate with legacy networks during times of congestion. DHS officials told us that over the past 5 years similar priority features have been implemented in the core IP networks of select U.S. nationwide long- distance service providers. DHS officials told us congestion, caused by high-call volume and potentially as a result of cyber attack, will continue to be a challenge in an IP environment. FCC officials told us that although congestion may not be as likely in IP networks as it was in legacy networks, it will still occur. As shown in figure 2, numerous government officials and non-government organizations in critical positions rely on GETS when networks become congested during times of crisis. The value of priority telecommunications service when compared to regular network performance becomes apparent during times of crisis. For example, according to DHS, during Hurricane Sandy and the immediate aftermath, networks were congested due to damage and high call volume into and out of the storm-damaged area. Likewise, according to DHS officials and a DHS report on the Boston Marathon bombing, as news of the bombs spread, cell phone networks became congested with users and were largely unavailable for about 90 minutes. As shown in table 1, GETS had high call-completion rates during recent times of crisis. DHS officials told us that the current GETS will likely lose some functionality during the transition to an all-IP environment. The officials said they are planning a project that will provide priority for IP wireline access, but the project has not yet received approval for acquisition. In 2015, a multi-agency executive committee reported that the national security and emergency preparedness community must be able to rely on these priority services to complete their mission-essential communications in the IP environment. DHS is working on a program that is aimed at enabling users to have priority voice, data, and video communications as networks evolve, but according to DHS officials, data and video capabilities will not be available for several years. In the meantime, as telecommunications carriers transition from legacy networks to IP networks, key national security and emergency preparedness personnel might not be able to complete important GETS calls during times of crisis. CSRIC is currently assessing how priority services programs can take advantage of IP technologies and intends to recommend protocols that can be used to ensure priority communications upon the retirement of legacy services. As CSRIC noted, this is important since the federal government is losing priority capabilities that rely on networks that will eventually be replaced by IP-based infrastructure. According to FCC officials, CSRIC estimates that the recommendations on protocols and standards that can support the delivery of priority communications for first responders and national security personnel over IP networks will be complete in March 2017. New IP networks may no longer support other government and consumer public safety services and equipment that work in the existing legacy network. Examples of such items include alarm systems and 911 call center systems. According to the Alarm Industry Communications Committee, telecommunications carriers installing new IP services may prevent alarm signals from being transmitted, and some IP services may improperly encode alarm signals. In comments submitted to FCC, the Association of Public Safety Communications Officials International (APCO) noted that alarm systems and medical alert monitors need to be provided for under new IP networks. APCO commented that alarms and alerts are a critical part of the input into 911 call centers and any identified shortfalls or anomalies should be identified to ensure that any effect to the public or public safety is known well ahead of time. APCO also commented that copper replacements in the foreseeable future must accommodate existing 911 call centers in the relevant service area, including those that have not yet transitioned to IP-based systems. As discussed, that transition will not be immediate and continuity of operations with existing 911 systems is vital for public safety. In addition to addressing the specific challenges affecting IP networks during times of crisis described above, FCC has taken a variety of other actions to help ensure the overall reliability of IP networks, including the following: Proposed criteria in August 2015 to evaluate and compare the replacement of legacy services. FCC had not previously codified any specific criteria by which it evaluated the adequacy of substitute services, but proposed changes to the process in a further notice of proposed rulemaking. Specifically, FCC proposed that to be eligible for automatic grant of authority under FCC’s rules, a telecommunications carrier seeking to discontinue an existing retail service must demonstrate that any substitute service meet criteria related to (1) interoperability with devices and services, such as alarm services and medical monitoring; (2) support for 911 services and call centers; (3) network capacity and reliability; (4) quality of both voice service and Internet access; (5) access for people with disabilities, including compatibility with assistive technologies; (6) network security in an IP-supported network; (7) service functionality; and (8) coverage throughout the service area. In addition, FCC proposed to require that part of the evaluation to discontinue a legacy retail service should include whether the carrier has an adequate consumer education and outreach plan. FCC noted it believes establishing these criteria will benefit industry and consumers alike and will minimize complications when carriers seek approval for large scale discontinuances. It also noted that having clear criteria in place will better allow carriers to know how they can obtain approval for discontinuing legacy service once they are ready to do so. According to representatives from Public Knowledge, this organization had urged FCC to establish metrics to compare the services that carriers are discontinuing with replacement services. The organization’s representatives noted that without ensuring new services are actually substitutes for the services being phased out, there is a risk that entire communities could lose critical functionality in their communications networks. In the further notice of proposed rulemaking, FCC tentatively concluded that several of the criteria proposed by Public Knowledge are the appropriate criteria. Updated copper retirement rules and definitions to help ensure the public has the information needed to adapt to an evolving communications environment. FCC issued new rules in an August 2015 report and order that, among other things, require incumbent carriers to directly notify consumers of plans to retire copper networks to the customer’s premises without customer consent. In this report and order, FCC also updated its definition of copper retirement due to the frequency and scope of copper network retirement. Included in this definition is de facto retirement, i.e., the failure to maintain these copper lines that is the functional equivalent of removal or disabling. FCC noted that it made these changes in rules and definitions since the record developed in that proceeding reflects numerous instances in which notice of copper retirement has been lacking, leading to consumer confusion, and therefore consumers need direct notice for these important network changes that may directly affect them. Collected and analyzed network outage data, looking for trends, and communicated with telecommunications carriers. FCC developed and maintains the Network Outage Reporting System (NORS) for collecting confidential outage information from telecommunications carriers. These carriers are required to report information about disruptions or outages to their communications systems that meet specified thresholds. According to FCC, engineers on its staff monitor and analyze the outage reports in real time looking for trends in outages, communicate with carriers about outages, and produce a high-level network outage report. FCC officials told us that even though the outage information is not publicly reported, they believe the act of reporting helps network providers correct problems and that by combining multiple reports, FCC gains insight on network reliability and working with carriers cooperatively leads to better outcomes with fewer, less severe outages. FCC shares NORS reports with DHS’s Office of Emergency Communications, which may provide information from those reports to such other governmental authorities as it may deem to be appropriate. Otherwise, reports filed in NORS are presumed confidential and are thus withheld from routine public inspection. However, in March 2015, FCC proposed, among other things, granting states read-only access to those portions of the NORS database that pertain to communications outages in their respective states to advance compelling state interests in protecting public health and safety. Representatives from two state agencies and two consumer organizations we contacted told us that granting states access to outage reports would improve the overall reliability of communications networks by giving them additional information. Tracked the status of the restoration of communications in the event of a large scale disaster. FCC developed and maintains the Disaster Information Reporting System (DIRS), a voluntary system used by members of the communications sector intended to provide information on the status of restoration efforts to FCC and DHS. DIRS reports include information on major equipment failures and the service and geographic area affected. According to FCC officials, DIRS is only activated during major disasters, and since these incidents are unique, the system is not designed to track trends. For example, the officials said that DIRS is often activated during hurricanes, but because of differences in wind speed, direction, and other challenges, outages from one hurricane do not necessarily indicate infrastructure will be affected the same way in another hurricane. Chartered CSRIC to provide FCC with recommendations on ways to improve security, reliability, and interoperability of communications systems. FCC officials told us CSRIC has not specifically looked at ways to improve reliability of IP networks; however, there have been a number of working groups that aim to improve the overall reliability of telecommunications networks. Specifically, in September 2014, CSRIC issued a report and series of best practices for providing backup power to customers relying on IP networks and on consumer notification. DHS has also taken the following actions to help ensure the reliability of IP networks during times of crisis: Coordinated with other federal government agencies, owners and operators of communications networks, and state, local, tribal, and territorial governments. As the Sector Specific Agency for the communications sector, DHS manages the industry-government relationship, encourages private sector involvement through the involvement of the sector-coordinating councils, and maintains the Communications Sector Specific Plan. According to representatives of the Communications Sector Coordinating Council, the Council works closely with DHS, and they noted DHS is helpful in providing assistance for educational and outreach programs, including ensuring training opportunities occur when needed. DHS also coordinates with stakeholders by participating in CSRIC and by coordinating and serving as the Executive Secretariat support to the President’s National Security Telecommunications Advisory Committee—a presidential advisory group comprised of chief executives from major telecommunications companies, network service providers, and the information technology, and aerospace industries. Additionally, DHS’s Office of Emergency Communications provides coordination support by offering training, coordination, and tools to stakeholders. Coordinated the development and implementation of the 2010 Communications Sector Specific Plan and is currently working on an updated plan. The sector specific plan was developed by DHS, the Communications Sector Coordinating Council, and the Government Communications Coordinating Council and is intended to ensure the sector effectively coordinates with sector partners, other sectors, and DHS. According to representatives of the Communications Sector Coordinating Council, they met regularly with DHS to update the sector specific plan. The plan provides a framework for industry and government partners to establish a coordinated strategy to protect the nation’s critical communications infrastructure. Part of this framework includes conducting national risk assessments. With respect to communications, DHS issued a report entitled 2012 Risk Assessment Report for Communications, which according to the report, represents the culmination of a 2-year period during which 29 government and 32 industry sector partners assessed physical, cyber, and human risks of concern that could potentially affect local, regional, and national communications. According to DHS officials, the Communications Sector Coordinating Council and Government Communications Coordinating Council determined an updated risk assessment was not needed because details of the changing risk environment will be discussed and updated in other sector documents, such as the sector specific plan. DHS officials also told us the new plan should be completed in 2015 and will be updated to include the communications sector’s transition to IP networks and will include more focus on cybersecurity-related content. We did not evaluate the 2010 plan because it was being updated and did not evaluate the 2015 plan because it was not issued at the time of our review. Coordinated the development of the 2014 National Emergency Communications Plan. This plan aims to enhance emergency communications capabilities at all levels of government in coordination with the private sector, nongovernmental organizations, and communities. DHS developed recommendations to help meet the plan’s five broad goals related to (1) governance and leadership, (2) planning and procedures, (3) training and exercises, (4) operational coordination, and (5) research and development. According to the plan, DHS’s Office of Emergency Communications intends to coordinate with public safety agencies and emergency responders and will identify strategies and timelines to accomplish the plan’s goals, objectives, and recommendations and measure progress nationwide. In the private sector, telecommunications carriers have also worked to ensure their IP networks are functional during times of crisis in the following ways: Built resiliency and reliability into IP networks as part of business operations and planning for emergencies. According to DHS, as the owners and operators of the majority of the nation’s communications networks, private sector entities are responsible for protecting key commercial communications assets, as well as ensuring the resiliency and reliability of communications during day-to-day operations and emergency response and recovery efforts. In addition, commercial communications carriers have a primary role in network restoration during outages and service failures and support reconstitution for emergency response and recovery operations. Representatives of the three largest telecommunication carriers told us they are taking action at the company level to improve reliability because building reliability and resilience into networks are part of normal business operations. For example, these carriers have developed emergency preparedness plans for events such as hurricanes, to help ensure network reliability. These plans included pole replacement, decreased dependency on aerial facilities, and adding additional generators. Officials from one major carrier told us that customers expect the phone to work when they pick it up to make a call and that the company risks losing customers if it cannot provide reliable service. Participate in a variety of groups intended to provide information and improve the overall reliability of communications networks. For example, in addition to groups like CSRIC and the Communications Sector Coordinating Council described above, telecommunications carriers participate in other organizations such as the Alliance for Telecommunications Industry Solutions (ATIS). ATIS’s Network Reliability Steering Committee advises the communications industry through developing and issuing standards, technical requirements and reports, best practices, and annual reports. ATIS also launched a task force looking at how the IP transition affects public safety communications infrastructure. State authorities from three public utility agencies told us that they have taken action to ensure the reliability of IP networks. These actions include collecting consumer complaints, levying fines, reviewing outage data, and making recommendations for improvement. For example, officials at one state agency told us that they receive and investigate complaints and if an issue is identified levy fines or open a rulemaking proceeding. Officials at another state agency told us they review outage data and make recommendations for improvements based on lessons learned. According to the DHS’s 2010 Sector Specific Plan, the state Public Utility Commission is the primary authority for implementing regulations, and individual telecommunications carriers work directly with state authorities regularly to address regulatory issues. However, according to the National Regulatory Research Institute, more than half the states have made changes to their regulatory authority that reduced or eliminated retail telecommunications regulation. For example, one state agency told us that although the commission previously had a role in ensuring the reliability and robustness of the communications network, it no longer has that authority. FCC is collecting data on the IP transition and sought comment on collecting additional data on the transition’s effect on consumers, but could do more to ensure it has the information it needs to make data- driven decisions about the IP transition. The primary way FCC intends to gather information about the IP transition is through service-based experiments. In particular, FCC established a framework in January 2014 within which carriers can conduct voluntary service-based experiments. These voluntary experiments would allow telecommunications carriers to substitute new communications technologies for the legacy services over copper lines that they are currently providing to customers and to test a variety of approaches to resolving operational challenges that result from transitioning to new technology and that may affect users. According to FCC, these experiments are not intended to test technologies or resolve legal or policy debates. FCC established technical parameters for each experiment, including requiring each proposal to provide sufficiently detailed information about how the experiments will be designed to allow meaningful public comment and thorough evaluation of the proposed experiment. Specifically, each experiment proposal must include other information such as: the purpose and proposed metrics for measuring success; the scope of the experiment (geography, product, or service offering); the technical parameters including a description of any physical or network changes and how the experiment will affect customers and other providers and product or service offerings; and timelines. FCC noted it would find useful experiments that collect and provide data on key attributes of IP-based services, such as network capacity, 911 services and call centers, and cybersecurity. According to FCC officials, the voluntary experiments can begin without FCC approval; however, carriers planning to discontinue service have to seek permission from FCC prior to doing so. At the time of our review, the experiments were still in the early stages, and FCC had not approved the discontinuation of any existing services. As shown in figure 3, at the time of our review, AT&T proposed experiments in two locations and CenturyLink proposed one location. According to AT&T documents, initially AT&T plans to encourage voluntary migration to IP-based services for existing customers through outreach and education. Subsequently, AT&T plans to seek FCC approval to “grandfather” existing customers and offer only wireless and wireline IP-based services for new orders. The documents also note that eventually, those existing customers will also have to transition to such alternatives, but not until FCC has evaluated the results and approved AT&T to discontinue legacy service and move forward to the full IP transition. As part of the trials, AT&T plans on collecting and reporting to FCC information including data on the progress of the experiment, customer complaints, network performance, call quality, and issues relating to access by persons with disabilities. According to FCC officials, FCC intends to contract with a major research organization to collect and analyze data from the AT&T experiment locations. At the time of our review, FCC officials told us this data collection is expected to begin in several months. Unlike the AT&T experiments, CenturyLink submitted a proposal that does not directly affect consumers. Instead this experiment focuses on business end users and service providers, and according to CenturyLink’s own proposal, the experiment would be very narrow in scope. CenturyLink also noted that it was not seeking to discontinue any services or requesting a waiver of any FCC rules, even for the purposes of the experiment. FCC is taking and plans to take additional steps to collect information on how consumers are experiencing the IP transition. FCC officials said they have begun taking action to improve consumer complaint data and make them more transparent, including launching a new consumer help center intended to collect additional consumer complaint data and working with various groups to share this and other data. FCC also plans to work with state, local, and tribal governments to leverage existing data-collection efforts and develop common definitions, categories, and a metric that will allow for comparison of consumer experiences in different parts of the country and help create a more comprehensive picture of the consumer experience as networks transition. FCC sought comment on how it could supplement its data-gathering process on the effects of technology transitions beyond consumer complaints and inquiries. In light of the scale of the IP transition and the potential for disruptions to consumers and public safety, FCC recognizes it will need information on the effects of the transition to ensure IP communications networks are reliable. Federal standards for internal control, which provide the overall framework for identifying and addressing major performance and management challenges, stress the importance of obtaining information from external sources that may have a significant impact on an agency achieving its goals. Furthermore, in its January 2014 order, FCC noted that one of its statutory responsibilities is to ensure that its core values, including public safety and consumer protection, endure as the nation transitions to modernized communications networks. In the order, FCC noted that fulfilling this responsibility requires that FCC learn more about how the modernization of communications networks affects consumers. The order also states that FCC intends to collect data through the service-based experiments that would permit the making of data-driven decisions about the IP transition. However, it is unclear if FCC will be able to make data-driven decisions about the IP transition because of the limited number and scale of the proposed experiments. For example, one major carrier did not propose any experiments. Furthermore, as some organizations have commented, AT&T’s experiments have limitations including the small number of experiments; a lack of geographic dispersion; and a lack of diverse population densities, demographics, and climates. These experiments, as planned, will affect less than 55,000 living units combined, which according to Public Knowledge, likely represent approximately 0.07 percent of AT&T’s wireline customers. Additionally, the proposed experiments do not include high-density urban areas; areas with colder climates or mountainous terrains; or areas that encompass diverse populations. Finally, none of the proposed experimental areas includes critical national security or public safety locations, such as those serving Department of Defense or Federal Aviation Administration facilities. FCC’s other efforts related to data collection on the IP transition include enhancing consumer complaint data, leveraging existing data collection efforts at the state and local level, and seeking comments on how FCC could supplement its data-gathering process. However, it remains unclear if FCC can meet its information needs through these efforts. For example, as noted above, DHS officials expressed concerns about the priority services that national security and emergency preparedness personnel rely on during times of crisis, such as GETS, losing functionality in an IP environment. FCC may need additional information to help ensure that such personnel can continue to make important calls during times of crisis. Another area of uncertainty with the IP transition is the availability of 911 services and compatibility with medical devices and other equipment. In particular, according to AT&T, in its proposed experimental areas, approximately a third of customers who chose not to migrate to wireless service expressed concerns regarding 911 calls and compatibility with medical devices and other equipment. Furthermore, FCC’s solicitation of comments about the data-gathering process may not necessarily result in a change in FCC’s existing policies. Although FCC’s efforts to collect data represent a good start, we found FCC lacks a detailed strategy that outlines how it will address its remaining information needs, including determining what information from states and localities is available to be leveraged, a methodology for obtaining that information, and the resources required. As a result, FCC cannot ensure that it has the information necessary to make data-driven decisions about the IP transition. FCC has recognized the importance of collecting data that would enable it to make data-driven decisions about the IP transition and has sought comment on how it could supplement its data-gathering process. Nevertheless, at the time of our review, FCC had little information on the effect of the transition, namely because the service-based experiments— FCC’s primary method for collecting data on the transition—were very limited in number and scale, did not cover consumer services in urban areas, and did not include critical national security or public safety locations. Although FCC has other data collection efforts under way, it is unclear whether FCC’s efforts will address its remaining information needs, especially those related to the functionality of priority services and 911 availability. Developing a strategy for collecting information about how the IP transition affects public safety and consumers would help FCC address these areas of uncertainty as it oversees the IP transition and enable FCC to make data-driven decisions. To strengthen FCC’s data collection efforts, the Chairman of FCC should develop a strategy to gather additional information on the IP transition to assess the transition’s potential effects on public safety and consumers. We provided a draft of this report to FCC and DHS for their review and comment. FCC provided written comments, reproduced in appendix II and technical comments, which we incorporated as appropriate. DHS provided technical comments, which we incorporated as appropriate. In written comments, FCC did not state whether it agreed or disagreed with our recommendation that it develop a strategy to gather additional information on the IP transition to assess the transition’s potential effects on public safety and consumers. FCC stated that it agreed with us about the importance of ensuring an informed, data-driven process for determining which services can be seamlessly supported during the IP transition, which services will need to be transformed, and which services will no longer be supported in an IP world, while preserving FCC’s core functions of public safety, universal service, competition, and consumer protection. FCC noted that it is essential that it have sufficient information to make informed decisions and further stated that it has a comprehensive data strategy in place to oversee the IP transition. According to FCC, its strategy for overseeing the transition combines traditional regulatory approaches with innovative methods that match the dynamism of the communications environment. FCC stated that the service-based experiments are by no means the sole means by which FCC is overseeing the IP transition and provided examples of actions it has taken to oversee the transition. For example, FCC stated that it took the following actions, which we had already highlighted in our report: enhanced its notification process for retirement of copper facilities; provided clear direction to industry concerning the circumstances in which approval must be sought before removing a service from the marketplace; collected NORS disruption data; and engaged with the private sector and other relevant stakeholders through FCC’s federal advisory committees, including CSRIC. In the letter, FCC also stated that it had taken action on some issues that were outside the scope of our review, including revising information it obtains from states on the states’ collection and use of 911 fees and maintaining a “Text-to-911 Registry.” While these actions are useful for FCC to oversee the IP transition, we continue to believe that FCC needs to develop a strategy to gather additional information on the potential effects of the IP transition. Especially with respect to the priority services that national security and emergency preparedness personnel rely on during times of crisis, by having a strategy to collect additional information on the IP transition, FCC could help ensure that such personnel can continue to make important calls during times of crisis. Furthermore, as AT&T noted, some residential customers have expressed concerns regarding 911 availability and compatibility with medical devices and other equipment in an IP environment. Developing a strategy to collect additional information on the transition’s effects could help FCC address these areas of uncertainty. We are sending copies of this report to the Chairman of FCC, the Secretary of Homeland Security, and appropriate congressional committees. In addition, the report is available at no charge on GAO’s website at http://www.gao.gov. If you or members of your staff have any questions about this report, please contact me at (202) 512-2834 or goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Major contributors to this report are listed in appendix III. This report examines the reliability of the nation’s communications networks in an Internet Protocol (IP) environment. Specifically, we reviewed (1) the potential challenges affecting IP networks during times of crisis and how the challenges affect end users, and (2) the actions FCC, DHS, and other stakeholders have taken to ensure the reliability of IP communications during times of crisis. To identify challenges affecting IP networks and how the challenges affect end users, we reviewed relevant documents from the Federal Communications Commission (FCC) and Department of Homeland Security (DHS) including orders, notices and proposed rulemakings, reports, and risk assessments, as well as relevant statutes and regulations. We reviewed comments filed with FCC regarding the IP transition and emergency communications. To ensure we reviewed a broad range of comments, we selected comments by stakeholders that represented a variety of interests, including public interest groups, industry and trade associations, and state and local authorities. We reviewed reports and best practices from federal advisory committees, trade associations, and consumer groups. We reviewed our prior recommendations, as well as those made by DHS, the Communications Security, Reliability, and Interoperability Council, and the National Security Telecommunications Advisory Committee related to priority telecommunications services. We also searched various Web-based databases to identify existing articles, peer-reviewed journals, trade and industry articles, government reports, and conference papers. We identified articles from 2010 to 2015. We examined summary-level information about the literature identified in our search that we believed to be germane to our report. It is possible that we may not have identified all of the reports with findings relevant to our objective, and there may be other challenges affecting IP networks during times of crisis that we did not present. To determine the actions taken by FCC, DHS, and other stakeholders to ensure the reliability of IP communications during times of crisis, we reviewed relevant FCC proceedings, reports, and documents. Specifically, we reviewed FCC proceedings related to technology transitions and ensuring consumer backup power for continuity of communications, reports on disruptions to communications reports on major disruptions to 911-related communications, and documents related to outage-reporting information. To identify information on the proposed IP transition experiments, we reviewed AT&T and CenturyLink’s proposals, stakeholder comments submitted to FCC on these proposals, and other documents related to the experiments. We assessed FCC’s efforts to collect data on the effect of the IP transition against criteria established in the federal Standards for Internal Control. We reviewed relevant DHS documents including the 2013 National Infrastructure Protection Plan, the 2010 Communications Sector Specific Plan, and the 2012 Risk Assessment Report for Communications. We also reviewed reports and best practices from the Communications Security, Reliability, and Interoperability Council and the Alliance for Telecommunications Industry Solutions. To obtain additional information on the challenges affecting IP networks and how these challenges affect end users, and to obtain information on state efforts to ensure reliability we selected locations in six states—New York, New Jersey, Arizona, California, Florida, and Alabama—to provide additional details. We selected these locations because they represent a mix of communities that experienced a major communications outage since 2012 or contain an area with a proposed IP transition experiment. These regions also contain a mix of rural, suburban, and urban communities, and demographics including economic differences and average age of residents. We reviewed documents such as reports, comments to FCC, and comments to state agencies. We interviewed officials from state Public Utility Commissions or similar agencies including the New York Department of Public Service, New Jersey Board of Public Utilities, California Public Utilities Commission, and Florida Public Service Commission. We interviewed representatives from other organizations that had experienced the effects of outages or were involved with the proposed IP transition experiments including the City of Flagstaff, the Arizona Telecommunications and Information Council, the Broadband Alliance of Mendocino County, and the Communications Workers of America. We interviewed officials from FCC and DHS and representatives from AT&T, Verizon, and CenturyLink. We also interviewed representatives from selected stakeholder groups including trade and industry associations and consumer and public interest groups, as shown in table 2. We identified stakeholders to interview based on our review of comments filed in FCC’s Technology Transitions proceeding, as well as based on recommendations from other organizations we interviewed. In addition to the individual named above, Sally Moino (Assistant Director), Richard Calhoon, David Hooper, Michael Kaeser, Aaron Kaminsky, Malika Rice, Amy Rosewarne, and Andrew Stavisky made key contributions to this report. Federal Information Security: Agencies Need to Correct Weaknesses and Fully Implement Security Programs. GAO-15-714. September 29, 2015. Cybersecurity: Recent Data Breaches Illustrate Need for Strong Controls across Federal Agencies. GAO-15-725T. June 24, 2015. Cybersecurity: Actions Needed to Address Challenges Facing Federal Systems. GAO-15-573T. April 22, 2015. Information Security: IRS Needs to Continue Improving Controls over Financial and Taxpayer Data. GAO-15-337. March 19, 2015. Information Security: FAA Needs to Address Weaknesses in Air Traffic Control Systems. GAO-15-221. January 29, 2015. Information Security: Additional Actions Needed to Address Vulnerabilities That Put VA Data at Risk. GAO-15-220T. November 18, 2014. Information Security: VA Needs to Address Identified Vulnerabilities. GAO-15-117. November 13, 2014. Federal Facility Cybersecurity: DHS and GSA Should Address Cyber Risk to Building and Access Control Systems. GAO-15-6. December 12, 2014.

Summary: The communications sector is essential to the nation's economy and government operations and for the delivery of public safety services, especially during emergencies. As the sector transitions from legacy networks to IP-based networks, consumer and public safety groups and others have raised concerns about how the communications networks will function during times of crisis. GAO was asked to examine the reliability of the nation's communications network in an IP environment during times of crisis. GAO examined (1) the potential challenges affecting IP networks in times of crisis and how the challenges may affect end users, and (2) the actions FCC, DHS, and other stakeholders have taken to ensure the reliability of IP communications. GAO reviewed FCC and DHS documents as well as FCC proceedings and comments filed with FCC on the IP transition and emergency communications. GAO assessed FCC's efforts to collect data on the effect of the IP transition. GAO interviewed officials from FCC and DHS, and representatives from the three largest telecommunications carriers, industry associations, and public interest and consumer advocacy groups. As the nation's telecommunications systems transition from legacy telephone networks to Internet Protocol (IP)-based networks, telecommunications carriers can face challenges during times of crisis that affect end users' ability to call 911 and receive emergency communications. These challenges include (1) preserving consumer service and (2) supporting existing emergency communications services and equipment. For example, during power outages, consumers with service provided over IP networks and without backup power can lose service. The Federal Communications Commission (FCC) is working to address this issue by adopting rules that will require carriers to provide information to consumers on backup power sources, among other things. Another challenge is that IP networks may not support existing telecommunications “priority” services, which allow key government and public-safety officials to communicate during times of crisis. FCC, the Department of Homeland Security (DHS), and telecommunications carriers have taken various steps to ensure the reliability of IP communications, for example: FCC proposed criteria—such as support for 911 services, network security, and access for people with disabilities—to evaluate carriers' replacement of legacy services when carriers seek to discontinue existing service. DHS coordinated the development of the Communications Sector Specific Plan to help protect the nation's communications infrastructure. Carriers told GAO they build resiliency and reliability into their IP networks as part of business operations and emergency planning. FCC is also collecting data on the IP transition, but FCC could do more to ensure it has the information it needs to make data-driven decisions about the transition. FCC has emphasized that one of its statutory responsibilities is to ensure that its core values, including public safety capabilities and consumer protection, endure as the nation transitions to modernized networks. FCC stated that fulfilling this responsibility requires learning more about how the transition affects consumers. FCC plans on collecting data on the IP transition primarily through voluntary experiments proposed and run by telecommunications carriers. However, it is unclear if FCC will be able to make data-driven decisions about the IP transition because of the limited number and scale of the proposed experiments. In particular, there are only three proposed experiments that cover a very limited number of consumers; none of the experiments covers consumer services in high-density urban areas or includes critical national-security or public-safety locations. FCC also sought comment on how to supplement its data-gathering process; however, soliciting comments may not necessarily result in a change in FCC's existing policies. GAO found FCC lacks a detailed strategy that outlines how it will address its remaining information needs. Developing a strategy for collecting information about how the IP transition affects public safety and consumers would help FCC make data-driven decisions and address areas of uncertainty as it oversees the IP transition. FCC should strengthen its data collection efforts to assess the IP transition's effects. FCC did not agree or disagree with the recommendation and stated it has a strategy in place to oversee the IP transition. However, GAO continues to believe FCC should strengthen its data collection efforts.