The speed, functionality, and accessibility that create the enormous benefits of the computer age can, if not properly controlled, allow individuals and organizations to inexpensively eavesdrop on or interfere with computer operations from remote locations for mischievous or malicious purposes, including fraud or sabotage. As public and private organizations use computer systems to transfer more and greater amounts of money, sensitive economic and commercial information, and critical defense and intelligence information, the likelihood increases that malicious individuals will attempt to penetrate current security technologies, disrupt or disable our nation’s critical infrastructures, and use sensitive and critical information for malicious purposes. In a May 2004 report, we discussed how cyber security technologies can provide a near-term solution for improving critical infrastructure security vulnerabilities. However, these technologies offer only single-point solutions by addressing individual vulnerabilities; they do not provide a complete solution. For example, firewalls can control the flow of traffic between networks but cannot protect against threats from within the network; antivirus software can provide some protection against viruses and worms but cannot protect the confidentiality of the data residing on the system. As a result, many researchers have described the use of these types of near-term solutions as being short-sighted. They argue that it is necessary to design systems with built-in security because it is difficult to deploy secure systems based on insecure components. In addition, researchers have indicated that long-term efforts are needed, such as researching cyber security vulnerabilities, developing technological solutions, and transitioning research results into commercially available products. Research in cyber security technology can help create a broader range of choices and more robust tools for building secure, networked computer systems. Recent cyber attacks and threats have underscored the need to strengthen and coordinate the federal government’s cyber security R&D efforts. Examples of recent attacks include the following: In November 2005, the U.S. government issued a warning about a virus disguised in an e-mail purportedly sent from the Federal Bureau of Investigation. The e-mail tells users that they have been visiting illegal Web sites and directs them to open an attachment with a questionnaire that contains a variant of the w32/sober virus. If the attachment is opened, the virus is executed. In October 2005, information security specialists reported that the Zotob worm, which had adversely affected computer networks in mid-August, had cost infected organizations an average of $97,000. Variants of the worm were capable of attacks that included logging keystrokes, stealing authentication credentials, and performing mass mailings. It was estimated that it took 61 percent of the impacted organizations more than 80 hours of work to clean up the infected systems. In March 2005, security consultants within the electric industry reported that hackers were targeting the U.S. electric power grid and had gained access to electronic control systems. Computer security specialists reported that, in a few cases, these intrusions had “caused an impact.” While officials stated that hackers had not caused serious damage to the systems that feed the nation’s power grid, the constant threat of intrusion has heightened concerns that electric companies may not have adequately fortified defenses against a potential catastrophic strike. In January 2005, a major university reported that a hacker had broken into a database containing 32,000 student and employee social security numbers, potentially compromising the identities and finances of the individuals. In similar incidents during 2003 and 2004, it was reported that hackers had attacked the systems of other universities, exposing the personal information of more than 1.8 million people. The number of malicious attacks has increased with the growing number of vulnerabilities. In 2000, the Software Engineering Institute’s CERT® Coordination Center (CERT/CC) received 1,090 reports of security vulnerabilities. By 2005, this number had more than quadrupled to 5,990. Figure 1 illustrates the number of security vulnerabilities reported from 1995 through 2005. Over the years, the federal government has taken these and other actions to improve cyber security efforts: publishing best practices and guidelines that assist in the planning, selection, and implementation of cyber security technologies; partnering with private sector counterparts to assess vulnerabilities and develop plans to eliminate those vulnerabilities; and awarding grants to support cyber security R&D. Research associated with enhancing the cyber security of critical infrastructures has been reinforced through federal requirements aimed at improving the nation’s cyber security posture. Additional requirements for research can be found in legislation that establishes agency responsibilities. For example, the act that establishes the Office of Science and Technology Policy gives the office the responsibility of assisting the President in providing general leadership and coordination of the research programs of the federal government. To provide a historical perspective, table 1 summarizes the key federal cyber security R&D actions that have shaped the development of the federal government’s cyber security R&D policies. Numerous federal agencies and organizations are involved in federally funded cyber security R&D. Several entities oversee and coordinate federal cyber security research; other groups support coordination on an informal basis; and multiple federal agencies fund or conduct this research. The Office of Science and Technology Policy and OMB, both in the Executive Office of the President, provide high-level oversight of federal R&D, including cyber security. The Office of Science and Technology Policy oversees the National Science and Technology Council, which prepares R&D strategies that are coordinated across federal agencies. The council operates through its committees, subcommittees, and interagency working groups, which coordinate activities related to specific science and technology disciplines. The Subcommittee on NITRD and the Interagency Working Group on Cyber Security and Information Assurance are the key entities responsible for coordinating cyber security R&D activities among federal agencies. The organization chart in figure 2 depicts the federal organizations involved. While this chart illustrates that several organizations are involved, much of the coordination for cyber security research is actually accomplished at lower level working groups and subcommittees by content matter experts from different agencies. Table 2 contains a brief description of the roles and responsibilities of the federal organizations and groups involved in the oversight and coordination of cyber security research. Participation by federal entities in other interagency groups provides opportunities for enhanced coordination of cyber security R&D efforts on an informal basis. The InfoSec Research Council (the Council) is a voluntary organization that is to facilitate coordination and communication of federal information security research among its members. The Council meets regularly to discuss current research projects, proposed future research initiatives, and critical information security issues. It is also responsible for producing a “hard problems list” that describes what it considers to be the most critical information security problems that, from a government perspective, should be addressed within the next 5 to 10 years. The latest version of the hard problems list was released in November 2005 and includes problems such as addressing insider threats, building secure systems, and improving information security without sacrificing privacy. The development of the list was intended to create consensus on particularly challenging information security issues that can be addressed through federal government coordination, but the Council recognizes that its members also have their own research priorities. The Technical Support Working Group also provides a means for coordination of cyber security R&D. Under the supervision of the Departments of Defense and State, the group operates with the collaboration and voluntary participation of more than 80 federal organizations in its 10 subgroups. In fulfilling its mission to conduct the national interagency R&D program for combating terrorism, the group facilitates interagency communication by serving as a forum for developing user-based counterterrorism technology requirements across the federal government. Its Infrastructure Protection subgroup meets once a year and is responsible for identifying, prioritizing, and executing R&D projects that satisfy interagency infrastructure protection requirements, including cyber security. Research and development officials at several agencies noted that, through other informal activities, they maintained additional contact with personnel at other agencies conducting cyber security R&D. Many mentioned that they participated in other agencies’ project selection and technical review panels. For example, experts from the Department of Homeland Security served on the review panel for the National Science Foundation’s 2005 Cyber Trust program. In addition, officials noted the relatively small size of the federal cyber security research community— many of the same officials attend the coordination meetings and a few officials within the community have worked at other agencies. This familiarity among cyber security experts has allowed for informal knowledge sharing and communication among agencies. While there are multiple agencies involved, three agencies fund and conduct much of cyber security R&D: the National Science Foundation and the Departments of Homeland Security and Defense. In 2004, the National Science Foundation established the Cyber Trust program to complement ongoing cyber security investments in each of its core research areas: computer and networked systems, computing and communication foundations, information and intelligence systems, shared cyber infrastructure, and information technology research. In accordance with the Cyber Security Research and Development Act, the National Science Foundation awards Cyber Trust grants for projects that (1) advance the relevant knowledge base; (2) creatively integrate research and education for the benefit of technical specialists and the general populace; and (3) effectively integrate the study of technology with the policy, economic, institutional, and usability factors that often determine its deployment and use. Recent Cyber Trust grants include research in areas such as approaches to Internet security, system behavior monitoring, and information security risk management architecture. The President’s budget for fiscal year 2006 provides about $94 million to the National Science Foundation for cyber security research, education, and training. The Department of Homeland Security’s R&D efforts are aimed at countering threats to the homeland by making evolutionary improvements to current capabilities and by developing revolutionary new capabilities. The Department of Homeland Security’s cyber security R&D program resides in the agency’s Science and Technology Directorate. According to Department of Homeland Security officials, the cyber security R&D program was funded—out of the department’s $1 billion science and technology budget—with approximately $10 million in fiscal year 2004, $18 million in fiscal year 2005, and $17 million in fiscal year 2006. The Department of Homeland Security’s cyber security R&D activities are largely unclassified and near-term. In addition, some work is funded in partnership with the National Science Foundation. Several agencies within the Department of Defense have cyber security R&D programs. The Department of Defense’s Office of the Director, Defense Research and Engineering, provides coordination and oversight in addition to supporting some cyber security research activities directly. The office is responsible for the Department of Defense’s science and technology as well as for oversight of research and engineering. According to Department of Defense officials, its cyber security research programs totaled about $150 million in fiscal year 2005. Although the Department of Defense’s research organizations (the Office of Naval Research, Army Research Laboratory, and Air Force Research Laboratory) have cyber security programs, the largest investments within its cyber security program are with the Defense Advanced Research Projects Agency and the National Security Agency. The Defense Advanced Research Projects Agency is the central R&D organization of the Department of Defense. Its mission is to identify revolutionary, high-risk, high-payoff technologies of interest to the military—and then to support their development through transition. Its portfolio has shifted toward classified and short-term R&D, and it has the authority to award cash prizes to encourage and accelerate technical accomplishments. There are two types of offices at the agency: technology offices and systems offices. The technology offices focus on new knowledge and component technologies that might have significant national security applications. Systems offices focus on technology development programs leading to products that more closely resemble a specific military end-product; that is, an item that might be in the military’s inventory. One of the technology offices (the Information Processing Technology Office) and one of the systems offices (the Advanced Technology Office) focus on cyber security research and development. The National Security Agency also performs extensive cyber security research. The research is conducted and supported by its National Information Assurance Research Group. Two of the agency’s programs— the Information Systems Security Program and Consolidated Cryptologic Program—fund the majority of its cyber security research. The research focuses on high-speed encryption and certain defense capabilities, among other things. In addition to the three primary agencies that fund or conduct cyber security R&D, other agencies, including the Department of Energy, the National Institute of Standards and Technology, and the Disruptive Technology Office, also fund or conduct this research. The Department of Energy also conducts and funds cyber security R&D. Nearly all of the Department of Energy’s cyber security R&D investments are directed toward short-term or military and intelligence applications. This work is conducted principally at the national laboratories. The National Institute of Standards and Technology’s cyber security research program is multi-disciplinary and focuses on a range of long-term to applied R&D in the creation of security standards, guidelines, and new technologies. The National Institute of Standards and Technology’s fiscal year 2006 budget estimate for cyber security was $9.1 million. The National Institute of Standards and Technology also receives funding from other agencies such as the Departments of Homeland Security and Transportation and the General Services Administration, to work on projects that are consistent with its cyber security mission. For example, it is producing, for the Department of Homeland Security, the National Vulnerability Database. According to the National Institute of Standards and Technology, it is mandated under the Federal Information Security Management Act, the Cyber Security Research and Development Act, the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT ACT) Act (for biometrics), and OMB’s Circular A-130, to develop standards, guidelines, and tests for use by federal agencies. Under the Federal Information Security Management Act, the National Institute of Standards and Technology also conducts security research in support of future standards and guidelines. The Disruptive Technology Office supports the development of technologies to improve the information systems and networks that are used primarily by the intelligence community. Its budget for cyber security research amounts to about $17 million; one third of this amount supports mostly unclassified academic research. However, the office typically classifies the results of this research once it is mature enough to be incorporated into tools for the intelligence community. Federal entities have taken several important steps to improve the oversight and coordination of federal cyber security R&D. These include (1) chartering an interagency working group to focus on this type of research, (2) publishing a federal plan for cyber security and information assurance research that is to provide baseline information and a framework for planning and conducting this research, (3) separating the reporting of budget information for cyber security research from other types of research, and (4) maintaining governmentwide repositories of information on R&D projects. However, limitations exist with the development of a federal cyber security research agenda, the federal plan, and populating the governmentwide repositories that, if not remedied, could diminish the effectiveness of oversight and coordination of cyber security R&D. In August 2005, the National Science and Technology Council chartered the Interagency Working Group for Cyber Security and Information Assurance. This working group succeeds the Interagency Working Group on Critical Information Infrastructure Protection, which reported to the Subcommittee on Infrastructure. The working group reports jointly to the Subcommittee on NITRD and the Subcommittee on Infrastructure. This change is to facilitate better integration of cyber security R&D with the NITRD program and reflect the broader impact of cyber security and information assurance beyond critical information infrastructure protection. According to a NITRD official, the charter of the Interagency Working Group for Cyber Security and Information Assurance was made in response to the February 2005 recommendation of the President’s Information Technology Advisory Committee to strengthen and integrate the working group under the NITRD program. In February 2003, the National Strategy to Secure Cyberspace was issued to provide a framework for organizing and prioritizing efforts to protect our nation’s cyberspace. The strategy recommended that the Director of the Office of Science and Technology Policy coordinate the development of an annual federal government cyber security research agenda that includes near-term (1–3 years), mid-term (3–5 years), and long-term (5 years and longer) research for fiscal years 2004 and beyond. In April 2006, the Cyber Security and Information Assurance Interagency Working Group released an interagency plan for cyber security research and development. The plan provides baseline information and a technical framework for coordinated multi-agency research in cyber security and information assurance. The Federal Plan for Cyber Security and Information Assurance Research and Development addresses: types of vulnerabilities, threats, and risks; analysis of recent calls for federal research and development; technical topics in cyber security and information assurance research; current technical and investment priorities of federal agencies in cyber security and information assurance research; results of technical and funding gaps analysis; research of technical topic perspectives, including assessments of the state of the art and key technical challenges; and a summary of roles and responsibilities, by agency. According to the Interagency Working Group for Cyber Security and Information Assurance, which operates under the auspices of the Office of Science of Technology Policy and the National Science and Technology Council, the Federal Plan for Cyber Security and Information Assurance Research and Development is the first step towards developing a federal agenda for cyber security research. The plan specifies the need to develop a road map for addressing identified gaps in cyber security research, but has not committed to a date when the road map would be developed or completed. Key activities for the development of an agenda have not been completed. For instance, mid-term and long-term cyber security research goals have not been defined. Further, the following activities necessary for the agenda have also not been completed: (1) specifying timelines and milestones for conducting research and development activities; (2) specifying goals and measures for evaluating research and development activities; (3) assigning responsibility for implementation, including the accomplishment of the focus areas and suggested research priorities; and (4) aligning the funding priorities with technical priorities. Until a federal agenda as called for in the National Strategy to Secure Cyberspace is developed, increased risk exists that agencies will focus on their individual priorities for cyber security research and development, which may not be the most important national research priorities. Better coordination of research and development efforts will enable the most important topics to receive priority funding and resources and avoid duplication of effort. For the first time, the NITRD program, in response to the President’s Information Technology Advisory Committee recommendation to strengthen coordination, reported budget information for cyber security research separately from other types of research in its supplement to the President’s fiscal year 2007 budget. This important change was made possible with the addition of a new NITRD program component area for cyber security and information assurance. Before this addition, budget amounts for cyber security research projects were difficult to identify because they were often grouped with the non-cyber security research projects in other program component areas. Now, program member agencies are to report budget amounts for cyber security research separately. For example, the National Science Foundation, Department of Defense agencies, and National Institute of Standards and Technology, among others, reported budget amounts for cyber security and information assurance research in the NITRD Supplement to the President’s Fiscal Year 2007 Budget. Although the NITRD supplement included budget amounts for cyber security research, this information was limited. Budget amounts for certain cyber security research activities were reported in another NITRD program component area, and budget information on cyber security research for non-NITRD members—such as the Department of Homeland Security and elements within the Department of Energy—was not included in the supplement. However, in his February 2006 testimony before the House Committee on Science, the former Department of Homeland Security Under Secretary for Science and Technology testified that the science and technology division of the Department of Homeland Security is now participating in NITRD. Further, in June 2006, the OMB issued its annual Circular A-11 budget submission guidance, which requires that agencies submit separate budget amounts for cyber security R&D as part of their 2008 budget submissions. These new requirements should increase the visibility of federal cyber security research and could provide a mechanism for determining the total federal budget in cyber security research and development. In order to improve the methods by which government information is organized, preserved, and made accessible to the public, the E- Government Act of 2002 mandated that the Director of OMB (or the Director’s delegate) ensure the development and maintenance of a governmentwide repository and Web site that integrates information about federally funded R&D. The Director delegated this responsibility to the National Science Foundation. According to the E-Government Act, the repository is to integrate information about each separate R&D task or award, including: the dates on which the task or award is expected to start and end, a brief summary describing the objective and the scientific and technical focus of the task or award, the entity performing the task or award, the amount of federal funds to be provided, and any restrictions that would prevent the sharing of information related to the task with the public. In addition, the Web site on which all or part of the repository resides is to be made available to, and be searchable by, federal agencies and non-federal entities, including the general public, and is to facilitate: the coordination of federal R&D activities; collaboration among those entities conducting federal R&D; the transfer of technology among federal agencies, and between federal agencies and non-federal entities; and access by policy makers and the public to information concerning federal R&D activities. The E-Government Act also requires agencies that fund federal R&D to provide the information needed to populate the repository in the manner prescribed by the Director of OMB. The federal government has established, and currently funds, two governmentwide repositories and Web sites for R&D information that are available to, and searchable by, federal agencies and the public: Research and Development in the United States (RaDiUS) and Science.gov. RaDiUS is a database that contains information on federally funded R&D projects. Science.gov provides information on federal research through links to science Web sites and scientific databases. The repositories generally contain the type of information about R&D tasks or awards required by the E-Government Act. Both are intended to provide the public and agencies with information about federally funded R&D activities and results. However, the RaDiUS and Science.gov repositories were incomplete and not fully populated with information about all federally funded tasks and awards. Query searches for cyber security research projects on the RaDiUS repository produced limited results. For example, we found that (1) as of March 2006, all searches on RaDiUS were limited to awards that were made during or prior to fiscal year 2004, (2) searches on RaDiUS for the Department of Homeland Security did not return any cyber-related results and returned only one project when searching for all projects, (3) searches on RaDiUS for the National Science Foundation’s Cyber Trust program produced only 8 of the 35 Cyber Trust awards listed for 2004. In addition, the Federal R&D Project Summaries database at Science.gov does not include R&D project summaries for the Departments of Homeland Security and Defense and the National Institute for Standards and Technology. As a result, the usefulness of the repositories and Web sites to facilitate the coordination of cyber security R&D activities, collaboration among researchers, and access to research information in a timely and efficient manner was limited. The governmentwide repositories were incomplete and not fully populated, in part, because OMB had not issued guidance to ensure that agencies had provided all information required for the repositories. Although OMB has issued guidance related to improving the public’s access to, and dissemination of, government information and policies for federal agency public Web sites, this guidance does not specifically address reporting information on all federally funded research and development projects to the governmentwide repositories. The E- Government Act specifies that OMB shall issue any guidance determined necessary to ensure that agencies provide all the information required by the act. Our search query results (previously described), and the fact that research and development officials at several federal agencies were not aware of the RaDiUS repository or Web site when asked about the existence of a governmentwide repository for research and development projects indicates that such guidance is necessary. Each of the three primary agencies that fund or conduct cyber security R&D has established technology transfer methods for sharing the results of the research. The following are examples of how each agency conducts technology transfer. The National Science Foundation essentially relies on the researcher or grantee to disseminate information about National Science Foundation- funded research. In accordance with the Bayh-Dole Act, the National Science Foundation allows grantees to retain principal legal rights to intellectual property developed under its grants. According to an agency official, the Grant Policy Manual provides the incentive to develop and disseminate inventions, software, and publications that can enhance their usefulness, accessibility, and upkeep. The official stated that the National Science Foundation’s policy does not, however, reduce the responsibilities of researchers and organizations to make results, data, and collections available to the research community. It was the National Science Foundation’s expectation that grantees would share data, collections, software, and inventions, making their products widely available and useful. The National Science Foundation grantees are required to submit annual and final project reports to the agency; these reports include information on dissemination activities such as publications and conferences. The Department of Homeland Security has several methods for technology transfer, such as attending conferences and workshops and working with industry in several areas to share information about emerging threats and R&D needs. In addition, agency officials stated that their Web site is another way that they share information about R&D activities. The Department of Defense has several programs to encourage the transfer of technology information. For example, within the academic world, the Department of Defense uses published peer review journals to help facilitate information sharing. Within the classified community, research is shared among the Departments of Defense and Homeland Security and the intelligence community. The Department of Defense’s small business innovation research and small business technology transfer programs are used to encourage the transfer of information to the private sector. In addition, every Armed Service research laboratory has a technology transfer office. While technology transfer exists within the Department of Defense, there are instances in which the Department of Defense does not want research information to be available to the public because the information could expose organizational and technological vulnerabilities. Several federal entities led by the Office of Science and Technology Policy and OMB are involved in overseeing, coordinating, funding, or conducting cyber security R&D. These entities have acted to enhance the oversight and coordination of federal cyber security R&D, including the formation of an interagency working group that developed a federal plan to provide a baseline of information and a technical framework for coordinated multi- agency R&D in cyber security and information assurance. However, key elements of the federal research agenda called for in the National Strategy to Secure Cyberspace have not been developed, thereby increasing the risk that mid- and longer-term research priorities may not be achieved. Without sufficient guidance on reporting R&D information for governmentwide repositories, the repositories cannot be fully populated with data on all cyber security research projects, diminishing their usefulness for coordinating research activities and facilitating technology transfer of research results. Until these issues are addressed, federal research for cyber security and information assurance may not keep pace with the increasing number of threats and vulnerabilities. To strengthen cyber security research and development programs, we recommend that the Director of the Office of Science and Technology Policy take the following action: Establish firm timelines for the completion of the federal cyber security R&D agenda that includes near-term, mid-term, and long-term research. Such an agenda should include the following elements: timelines and milestones for conducting research and development activities; goals and measures for evaluating research and development activities; assignment of responsibility for implementation, including the accomplishment of the focus areas and suggested research priorities; and the alignment of funding priorities with technical priorities. We also recommend that the Director of the Office of Management and Budget implement the following action: Issue guidance to agencies on reporting information about federally funded cyber security R&D projects to the governmentwide repositories. A Senior Policy Analyst in the Office of Science and Technology Policy provided technical comments on a draft of this report, but did not comment on our recommendation that the office establish timelines for the completion of the federal cyber security R&D agenda. We have considered and incorporated the technical comments into the report as appropriate. In providing oral comments on a draft of this report, OMB officials stated that OMB’s August 2006 Fiscal Year 2006 E-Government Act Reporting Instructions require agencies that fund federal R&D activities to describe how they fulfill their responsibilities under section 207(g) of the E- Government Act, including how their R&D information is available through RaDiUS, science.gov, or other means. The officials stated that after reviewing the agencies’ reports and other information, they will consider whether specific guidance is necessary to further ensure agencies provide all R&D information as required under section 207(g) of the E- Government Act. In addition, they were concerned with the report’s limited scope—cyber security R&D—and stated that the requirement to specify and report cyber security as a separate category of R&D is a recent change and therefore might bias the report’s findings. We acknowledge that the scope of our review was limited to cyber security R&D which is why we limited the scope of our findings and recommendations to cyber security R&D. The recent change in reporting requirements relates to the reporting of budgetary information and does not affect our finding on reporting project information to the central repositories. The National Science Foundation and the National Institute of Standards and Technology provided technical comments, which we have incorporated into the report as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the date of this letter. At that time, we will then send copies of this report to the Directors of the Office of Science and Technology Policy, OMB, and National Science Foundation; to the Secretaries of the Departments of Homeland Security and Defense; and to other interested parties. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or members of your staff have questions about this report, please contact Gregory C. Wilshusen at (202) 512-6244 or Keith A. Rhodes at (202) 512-6412. We can also be reached by e-mail at wilshuseng@gao.gov and rhodesk@gao.gov, respectively. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix II. Our objectives were to identify the (1) federal agencies that are involved with cyber security research and development (R&D); (2) actions taken to improve oversight and coordination of cyber security research and development, including the development of a federal research agenda; and (3) methods used for technology transfer at the agencies with significant activities in cyber security research and development. To identify which agencies are involved in federal cyber security R&D, we researched a key report on cyber security R&D from the President’s Information Technology Advisory Committee. We also analyzed relevant federal law and policy, including the Cyber Security Research and Development Act, the National Strategy to Secure Cyberspace, and Homeland Security Presidential Directive 7; we also reviewed our prior reports. We then reviewed budget documents from the Subcommittee on Networking and Information Technology Research and Development (NITRD) to determine the key agencies that fund and conduct cyber security R&D. To identify actions taken to improve oversight and coordination of federal cyber security R&D, including the development of a governmentwide research agenda, we interviewed officials at the National Science Foundation, the National Institute of Standards and Technology, the National Security Agency, the Departments of Defense and Homeland Security, the Subcommittee on NITRD, the Technical Support Working Group, the Office of Science and Technology Policy, and the Infosec Research Council. We also reviewed NITRD budgetary documents, examined federal policy, reviewed the Office of Management and Budget reports and guidance, observed meetings and reviewed meeting agendas and minutes to determine the extent of coordination for federal cyber security R&D. To evaluate the development of a governmentwide research agenda, we reviewed the National Strategy to Secure Cyberspace to determine the requirements for the annual federal cyber security R&D agenda and compared them to the Federal Plan for Cyber Security and Information Assurance Research and Development issued by the Interagency Working Group on Cyber Security and Information Assurance. To evaluate the completeness of the RaDiUS repository, in March 2006, we executed search queries on “cybersecurity”, “cyber security”, “cyber”, “cyber trust” and “information assurance” to determine whether the database contained cyber-related program data for the federal agencies. To evaluate the completeness of the Science.gov repositories, in August and September 2006, we executed search queries on “cybersecurity”, “cyber security”, and “information assurance” to determine whether the database contained cyber-related program data for the federal agencies. We compared the results to the list of cyber projects provided by the individual agencies. We did not validate the data returned with the agencies conducting cyber security research. In addition, we analyzed relevant laws, including the E-Government Act of 2002 and interviewed officials at the National Science Foundation, the National Institute of Standards and Technology, the National Security Agency, and the Departments of Defense and Homeland Security to evaluate the completeness of the two mandated governmentwide repositories. To identify methods used for technology transfer at the agencies with significant cyber security research activities, we identified the agencies and other groups that have responsibility for management and oversight of federal cyber security R&D, interviewed officials at these agencies to determine their methods for technology transfer, and reviewed agency policies on technology transfer. We also analyzed relevant laws, including the Bayh-Dole Act. We conducted our work from August 2005 through August 2006 in accordance with generally accepted government auditing standards. In addition to the individuals named above, Kristi Dorsey, Nalani Fraser, Nancy Glover, Richard Hung, Anjalique Lawrence, and Suzanne Lightman were key contributors to this report.

Summary: Research and development (R&D) of cyber security technology is essential to creating a broader range of choices and more robust tools for building secure, networked computer systems in the federal government and in the private sector. The National Strategy to Secure Cyberspace identifies national priorities to secure cyberspace, including a federal R&D agenda. GAO was asked to identify the (1) federal entities involved in cyber security R&D; (2) actions taken to improve oversight and coordination of federal cyber security R&D, including developing a federal research agenda; and (3) methods used for technology transfer at agencies with significant activities in this area. To do this, GAO examined relevant laws, policies, budget documents, plans, and reports. Several federal entities are involved in federal cyber security research and development. The Office of Science and Technology Policy and OMB establish high-level research priorities. The Office of Science and Technology Policy is to coordinate the development of a federal research agenda for cyber security and oversee the National Science and Technology Council, which prepares R&D strategies that are to be coordinated across federal agencies. The Council operates through its committees, subcommittees, and interagency working groups, which oversee and coordinate activities related to specific science and technology disciplines. The Subcommittee on Networking and Information Technology Research and Development and the Cyber Security and Information Assurance Interagency Working Group are prominently involved in the coordination of cyber security research. In addition, other groups provide mechanisms for coordination of R&D efforts on an informal basis. The National Science Foundation and the Departments of Defense and Homeland Security fund much of this research. Federal entities have taken several important steps to improve the oversight and coordination of federal cyber security R&D, although limitations remain. Actions taken include chartering an interagency working group to focus on cyber security research, publishing a federal plan for guiding this research, reporting budget information for this research separately, and maintaining repositories of information on R&D projects. However, a federal cyber security research agenda has not been developed as recommended in the National Strategy to Secure Cyberspace and the federal plan did not fully address certain key elements. Further, the repositories do not contain information about all of the federally funded cyber security research projects in part because OMB had not issued guidance to ensure that agencies provided all information required for the repositories. As a result, information needed for oversight and coordination of cyber security research activities was not readily available. Federal agencies use a variety of methods for sharing the results of cyber security research with federal and private organizations (technology transfer), including sharing information through agency Web sites. Other methods include relying on the researcher to disseminate information about his or her research, attending conferences and workshops, working with industry to share information about emerging threats and research, and publishing journals to help facilitate information sharing.