Analysis of the effects of the terrorist attacks of September 11, 2001, suggests various "lessonslearned" concerning public and private information infrastructures. What results are some insightsto the range of challenges and opportunities facing policymakers as they seek to identify relevanttechnical solutions to homeland security concerns. This report considers these homeland securityissues in the context of critical information infrastructure protection and continuity of operations (COOP) planning. As part of the congressional and presidential efforts to develop and implement a comprehensive response to homeland security concerns, the role of information technology (IT) has become anincreasingly important focus. In July 2002, the President released the country's first NationalStrategy for Homeland Security , outlining the strategic objectives, critical mission areas, andinitiatives in support of the Administration's proposed Department of Homeland Security. (1) Thestrategic objectives included: preventing terrorist attacks within the United States; reducingAmerica's vulnerability to terrorism; and minimizing the damage and recover from attacks that dooccur. In November 2002 Congress passed, and the President signed into law, the HomelandSecurity Act of 2002 ( P.L. 107-296 ) creating the Department of Homeland Security. Common toboth the national strategy document and the legislation is an emphasis on developing informationsharing initiatives and fostering partnerships between and within the levels of government and thesectors of industry. The heavy reliance upon information technology to carry out mission critical tasks and provideother citizen services highlights the need to ensure these assets are protected, backed up, and resilientto attack. Moreover, the growth of the use of electronic government (e-government) applicationsto conduct government-to-citizen interactions, as well as government-to-business and government-to-governmenttransactions, has put additional pressure on the need to reconstitute systems quicklyto minimize any disruptions and financial costs associated with a major infrastructure failure. (2) Inaddition, renewed emphasis is being placed on reducing the vulnerability of the nation's criticalinformation infrastructures while more fully integrating and utilizing public and private informationtechnology assets. (3) Taken together, these issuesdemonstrate the importance of ensuring thereliability and continuity of information technology systems, as part of the government's overallapproach to homeland security. The accounts of successes and failures regarding how agencies andbusinesses responded to the September 11, 2001 attacks provide an unusual opportunity to examineoptions for further improving the nation's emergency preparedness. In addition to the destruction of buildings and the loss of life, the September 11, 2001 attacks on the World Trade Center (WTC) and the Pentagon inflicted heavy damage on elements of thecountry's information and communication infrastructure. This, in turn, affected how both public andprivate organizations were able to respond to the events of the day. First responders experienceddifficulties communicating among themselves. (4) Citizens and some governmental officialsexperienced problems communicating by telephone due to overloaded and destroyed circuits. Asdescribed in the sections below, some agencies and businesses directly affected by the attacks haddifficulties recovering and reestablishing data operations due to inadequate infrastructure and/or thelack of backup systems. Faced with an overloaded telecommunications system, many turned to theInternet, which continued to function as designed, to send and receive e-mail messages regarding thesafety of family, friends, and colleagues. However, even in areas not directly affected by the attacks,citizens and government employees sometimes found a dearth of information because some agenciesshut down Web sites or did not use them to provide information regarding available resources andinstructions on when and where to report for work. For example, it was reported that as of nearly48 hours after they occurred, neither the General Services Administration (GSA) or the CentralIntelligence Agency (CIA) had posted any information regarding the terrorist attacks. It was alsoreported that of the Office of Personnel Management (OPM) shut down its Web site due to concernsrelated to cyberterrorism. (5) It is important to note that many of the technology-related problems that emerged from the September attacks have less to do with the capabilities of the technology itself than with how it wasimplemented. For example, phone lines can be disrupted, so organizations with critical functionsneed to secure redundant, but separate, means to communicate. Data can be stored and sent nearlyanywhere, but agencies need to establish protocols for regularly backing up important informationto secure, remote centers. The mixed performance of information infrastructures suggests that boththe public and private sectors need to reexamine their information planning and practices so that theycan better weather and rebound from catastrophic events. The damage sustained by two importanteconomic and military locations, combined with efforts to restore services and prepare contingencyplans, also raise questions regarding the federal government's role and the private sector's ability toensure the protection and continuity of the country's information infrastructure (e.g.,telecommunications, computer networks, Internet, etc.) in the future. It is likely that the full extent of the damage to information technology resources will not be made public due to concerns about national security and business continuity. Traditionally, bothpublic and private sector organizations have been very reluctant to reveal publicly the extent towhich their operations are affected by computer viruses and worms, hacker attacks, or similarsecurity weaknesses. This reluctance to share information occurs for two primary reasons. The firstis the interest in maintaining the confidence of customers/constituents, and, by extension, in the caseof publicly traded companies, maintaining market value. The second reason is concern over beingidentified as a target for future attacks, and the possibility of revealing (unwittingly or not) othervulnerabilities. However, despite the validity of these concerns, the reluctance to share informationwith the appropriate actors can serve as an impediment to recovery and prevention planning byfurther embedding potential weaknesses into the information infrastructure the country has becomeincreasingly dependent upon. Despite the imperfect nature of the information available, a numberof lessons learned can be identified and are discussed below. To place these lessons in context, thenext section provides a brief synopsis of how the public and private information infrastructuresperformed and were affected in the wake of the initial destruction and the immediate reaction byindividuals, businesses, and the federal government. Due to the scope of the situation, it is not possible to provide a comprehensive accounting of all the organizations affected by the terrorist attacks. However, a variety of examples are discussedin context to provide a sense of the range of issues facing the public and private sectors as theycontinue to review and implement new initiatives. One means to gain an overall sense of theimmediate impact of the September 11, 2001 attacks is to consider how people and organizationscommunicated. The attacks spurred a tremendous spike in telephone calls that overloaded the capacity of some networks. Verizon normally handles 115 million calls per day in New York City and 35 million inWashington, DC, for a normal daily total of 150 million calls. Following the attacks, the combinedtotal jumped to 340 million calls. Similarly, Cingular Wireless said its call volume jumped 400%. Requests were made to international telecommunications carriers, such as France Telecom, to controlthe flow of calls to the United States in an effort to keep trans-Atlantic links open. (6) Many people turned to cellphone-based text messaging, Internet-based instant messaging, and the use of two-way radio features of cellphones to get around the congested phone networks. AOLreported a 20% jump in instant messaging volume, handling 1.2 billion messages on September 11,2001. (7) The National Communications System (NCS) activated the Government Emergency Telecommunications Service (GETS). Using a special phone number and a personal identificationnumber, GETS calls receive priority handling before all other calls on phone lines operated by ATT,Sprint, and WorldCom. During the week following the attacks, 3,000 GETS calls were made inWashington. An additional 4,000 GETS calls to and from Manhattan were completed with a 95%success rate. (8) The General Services Administration (GSA) also provided mobile communications centers that supported several agencies, including the Federal Bureau of Investigation (FBI). In addition, theGSA Federal Technology Service (FTS) made 500 computers available to agencies within the firsttwo days of the attacks. (9) Many agencies used their Web sites to keep the public informed and provide information on how to help the victims. One of those was the Federal Emergency Management Agency (FEMA)Web site. FEMA was one of the first agencies to post information about the attacks on the morningof September 11, 2001. On September 12, the FEMA site had 3.4 million visitors, an all-time highfor the agency. GSA used its site to notify people about the status of various governmentalbuildings. Many agencies, including the Department of Defense, used their sites to keep employeesinformed of changes. (10) Some Members ofCongress, including Senators Charles Schumer andHillary Rodham Clinton of New York, and Senator George Allen of Virginia, also turned theircongressional sites into information centers regarding the attacks. (11) FirstGov's Web staff, who were evacuated from their Washington, DC, offices, worked at home immediately following the attacks, collecting information, phone numbers, and URLs for relevantsites. They posted this information to the FirstGov site on September 12. Many commercial newssites and other government sites then posted links to the FirstGov site (12) , helping drive 448,552unique visitors accounting for 1.75 million page hits during the week of September 9-15. FirstGovalso changed its site update schedule from every two weeks to updating it every 12 hours. (13) At 8:45 AM, American Airlines Flight 11 crashed into the north tower of the World Trade Center. Eighteen minutes later, United Airlines Flight 175 crashed into the south tower.