The Internet is a vast network of interconnected networks. It is used by governments, businesses, research institutions, and individuals around the world to communicate, engage in commerce, do research, educate, and entertain. While most Americans are familiar with Internet service providers—such as America Online and EarthLink—that provide consumers with a pathway, or “on-ramp,” to the Internet, many are less familiar with how the Internet was developed, the underlying structure of the Internet, and how it works. In the late 1960s and the 1970s, the Department of Defense’s Advanced Research Projects Agency developed a network to allow multiple universities to communicate and share computing resources. In the ensuing decades, this project grew to become a large network of networks and was joined with an array of scientific and academic computers funded by the National Science Foundation. This expanded network provided the backbone infrastructure of today’s Internet. In 1995, the federal government began to turn the backbone of the Internet over to a consortium of commercial backbone providers. From that point on, the Internet infrastructure was owned and operated by private companies—including telecommunications companies, cable companies, and Internet service providers. Today’s Internet connects millions of small, medium, and large networks. When an Internet user wants to access a Web site or to send an e-mail to someone who is connected to the Internet through a different Internet service provider, the data must be transferred between networks. Transit across the Internet is provided by either national backbone providers, regional network operators, or a combination of both. National backbone providers are companies that own and operate high-capacity, long-haul backbone networks. These providers transmit data traffic over long distances using high-speed, fiber-optic lines. Because national backbone operators do not service all locations worldwide, regional network providers supplement the long-haul traffic by providing regional service. Data cross between networks at Internet exchange points—which can be either hub points where multiple networks exchange data or private interconnection points arranged by transit providers. At these exchange points, computer systems called routers determine the optimal path for the data to reach their destination. The data then continue their path through the national and regional networks and exchange points, as necessary, to reach the recipient’s Internet service provider and the recipient (see fig. 1). The networks that make up the Internet communicate via standardized rules called protocols. These rules can be considered voluntary because there is no formal institutional or governmental mechanism for enforcing them. However, if any computer deviates from accepted standards, it risks losing the ability to communicate with other computers that follow the standards. Thus, the rules are essentially self enforcing. One critical set of rules is the Transmission Control Protocol/Internet Protocol suite. These protocols define a detailed process that a sender and receiver agree upon for exchanging data. They describe the flow of data between the physical connection to the network and on to the end-user application. Specifically, these protocols control the addressing of a message by the sender, its division into packets, its transmission across networks, and its reassembly and verification by the receiver. This protocol suite has become the de facto communication standard of the Internet because many standard services (including mail transfer, news, and Web pages) are available on systems that support these protocols. Another critical set of protocols, collectively known as the Domain Name System, ensures the uniqueness of each e-mail and Web site address. This system links names like www.senate.gov with the underlying numerical addresses that computers use to communicate with each other. It translates names into addresses and back again in a process invisible to the end user. This process relies on a system of servers, called domain name servers, which store data linking names with numbers. Each domain name server stores a limited set of names and numbers. They are linked by a series of 13 root servers, which coordinate the data and allow users to find the server that identifies the sites they want to reach. Domain name servers are organized into a hierarchy that parallels the organization of the domain names. For example, when someone wants to reach the Web site at www.senate.gov, his or her computer will ask one of the root servers for help. The root server will direct the query to a second server that knows the location of names ending in the .gov top-level domain. If the address includes a subdomain, the second server refers the query to a third server—in this case, one that knows the addresses for all names ending in senate.gov. The third server will then respond to the request with a numerical address, which the original requester uses to establish a direct connection with the www.senate.gov site. Figure 2 illustrates this example. Another critical set of rules is called the Border Gateway Protocol—a protocol for routing packets between autonomous systems. This protocol is used by routers located at network nodes to direct traffic across the Internet. Typically, routers that use this protocol maintain a routing table that lists all feasible paths to a particular network. They also determine metrics associated with each path (such as cost, stability, and speed), so that the best available path can be chosen. This protocol is important because if a certain path becomes unavailable, the system will send data over the next best path (see fig. 3). From its origins in the 1960s as a research project sponsored by the U.S. government, the Internet has grown increasingly important to both American and foreign businesses and consumers, serving as the medium for hundreds of billions of dollars of commerce each year. According to the U.S. Census Bureau, retail e-commerce sales in the United States were an estimated $86 billion in 2005. The Internet has also become an extended information and communications infrastructure, supporting vital services such as power distribution, health care, law enforcement, and national defense. Federal regulation recognizes the need to protect critical infrastructures. In December 2003, the President updated a national directive for federal departments and agencies to identify and prioritize critical infrastructure sectors and key resources and to protect them from terrorist attack. (See table 1 for a list of critical infrastructure sectors.) This directive recognized that since a large portion of these critical infrastructures is owned and operated by the private sector, a public/private partnership is crucial for the successful protection of these critical infrastructures. In its plan for protecting these critical infrastructures, DHS recognizes that the Internet is a key resource composed of assets within both the information technology and the telecommunications sectors. It notes that the Internet is used by all sectors to varying degrees, and that it provides information and communications to meet the needs of businesses, government, and the other critical infrastructure sectors. Similarly, the national cyberspace strategy states that cyberspace is the nervous system supporting our nation’s critical infrastructures and recognizes the Internet as the core of our information infrastructure. It is also important to note that there are critical interdependencies between sectors. For example, the telecommunications and information technology sectors, like many other sectors, depend heavily on the energy sector. In recent years, cyber attacks involving malicious software or hacking have been increasing in frequency and complexity. These attacks can come from a variety of actors. Table 2 lists sources of cyber threats that have been identified by the U.S. intelligence community. An intelligence report on global trends forecast that terrorists may develop capabilities to conduct both cyber and physical attacks against nodes of the world’s information infrastructure—including the Internet and other systems that control critical industrial processes—such as electricity grids, refineries, and flood control mechanisms. The report stated that terrorists already have specified the U.S. information infrastructure as a target and currently are capable of physical attacks that would cause at least brief, isolated disruptions. According to a Congressional Research Service report, the annual worldwide cost of major cyber attacks was, on average, $13.5 billion from 2000 to 2003. A more recently published report estimated that the worldwide financial impact of virus attacks was $17.5 billion in 2004 and $14.2 billion in 2005. In the event of a major Internet disruption, multiple organizations could help recover Internet service. These organizations include private industry, collaborative groups, and government organizations. Private industry is central to Internet recovery because private companies own the vast majority of the Internet’s infrastructure and often have response plans. Collaborative groups—including working groups and industry councils—provide information-sharing mechanisms to allow private organizations to restore services. Additionally, government initiatives could facilitate responding to major Internet disruptions. Private industry organizations are critical to recovering Internet services in the event of a major disruption because they own and operate the vast majority of the Internet’s infrastructure. This group of Internet infrastructure owners and operators includes telecommunications companies (such as AT&T and Verizon Communications), cable companies (such as Cox Communications and Time Warner Cable), Internet service providers (such as AOL and EarthLink), and root server operators (such as VeriSign and the University of Maryland). These entities own or operate cable lines; telephone lines; fiber-optic cables; or critical core systems, such as network routers and domain name servers. These private companies currently deal with cyber attacks and physical disruptions on the Internet on a regular basis. According to representatives of Internet infrastructure owners and operators, these firms typically have disaster recovery plans in place. For example, a representative from a major telecommunications company stated that the company has emergency response plans for its primary and secondary emergency operations centers. Similarly, representatives of a cable trade association reported that most cable companies have standard disaster recovery plans and a network operations center from which they can monitor recovery operations. Infrastructure representatives also noted that in the event of a network disruption, companies that are competitors work together to resolve the disruption. They said that although the companies are competitors, they have a business interest in cooperating because it is common to rely on each other’s networks. For example, a representative of a major telecommunications company noted that the company has “mutual-aid” agreements with its competitors to exchange technicians and hardware in the event of an emergency.