Since the early 1990s, the explosion in computer interconnectivity, most notably growth in the use of the Internet, has revolutionized the way organizations conduct business, making communications faster and access to data easier. However, this widespread interconnectivity has increased the risks to computer systems and, more importantly, to the critical operations and infrastructures that these systems support, such as telecommunications, power distribution, national defense, and essential government services. Malicious attacks, in particular, are a growing concern. The National Security Agency has determined that foreign governments already have or are developing computer attack capabilities, and that potential adversaries are developing a body of knowledge about U.S. systems and methods to attack them. In addition, reported incidents have increased dramatically in recent years. Accordingly, there is a growing risk that terrorists or hostile foreign states could severely damage or disrupt national defense or vital public operations through computer-based attacks on the nation’s critical infrastructures. Since 1997, in reports to the Congress, we have designated information security a governmentwide high-risk area. Our most recent report in this regard, issued in January, noted that, while efforts to address the problem have gained momentum, federal assets and operations continue to be highly vulnerable to computer-based attacks. To develop a strategy to reduce such risks, in 1996, the President established a Commission on Critical Infrastructure Protection. In October 1997, the commission issued its report, stating that a comprehensive effort was needed, including “a system of surveillance, assessment, early warning, and response mechanisms to mitigate the potential for cyber threats.” The report said that the Federal Bureau of Investigation (FBI) had already begun to develop warning and threat analysis capabilities and urged it to continue in these efforts. In addition, the report noted that the FBI could serve as the preliminary national warning center for infrastructure attacks and provide law enforcement, intelligence, and other information needed to ensure the highest quality analysis possible. In May 1998, PDD 63 was issued in response to the commission’s report. The directive called for a range of actions intended to improve federal agency security programs, establish a partnership between the government and the private sector, and improve the nation’s ability to detect and respond to serious computer-based attacks. The directive established a National Coordinator for Security, Infrastructure Protection, and Counter-Terrorism under the Assistant to the President for National Security Affairs. Further, the directive designated lead agencies to work with private-sector entities in each of eight industry sectors and five special functions. For example, the Department of the Treasury is responsible for working with the banking and finance sector, and the Department of Energy is responsible for working with the electric power industry. PDD 63 also authorized the FBI to expand its NIPC, which had been originally established in February 1998. The directive specifically assigned the NIPC, within the FBI, responsibility for providing comprehensive analyses on threats, vulnerabilities, and attacks; issuing timely warnings on threats and attacks; facilitating and coordinating the government’s response to cyber incidents; providing law enforcement investigation and response; monitoring reconstitution of minimum required capabilities after an infrastructure attack; and promoting outreach and information sharing. PDD 63 assigns the NIPC responsibility for developing analytical capabilities to provide comprehensive information on changes in threat conditions and newly identified system vulnerabilities as well as timely warnings of potential and actual attacks. This responsibility requires obtaining and analyzing intelligence, law enforcement, and other information to identify patterns that may signal that an attack is underway or imminent. Since its establishment in 1998, the NIPC has issued a variety of analytical products, most of which have been tactical analyses pertaining to individual incidents. These analyses have included (1) situation reports related to law enforcement investigations, including denial-of-service attacks that affected numerous Internet-based entities, such as eBay and Yahoo and (2) analytical support of a counterintelligence investigation. In addition, the NIPC has issued a variety of publications, most of which were compilations of information previously reported by others with some NIPC analysis. Strategic analysis to determine the potential broader implications of individual incidents has been limited. Such analysis looks beyond one specific incident to consider a broader set of incidents or implications that may indicate a potential threat of national importance. Identifying such threats assists in proactively managing risk, including evaluating the risks associated with possible future incidents and effectively mitigating the impact of such incidents. Three factors have hindered the NIPC’s ability to develop strategic analytical capabilities. First, there is no generally accepted methodology for analyzing strategic cyber-based threats. For example, there is no standard terminology, no standard set of factors to consider, and no established thresholds for determining the sophistication of attack techniques. According to officials in the intelligence and national security community, developing such a methodology would require an intense interagency effort and dedication of resources. Second, the NIPC has sustained prolonged leadership vacancies and does not have adequate staff expertise, in part because other federal agencies have not provided the originally anticipated number of detailees. For example, as of the close of our review in February, the position of Chief of the Analysis and Warning Section, which was to be filled by the Central Intelligence Agency, had been vacant for about half of the NIPC’s 3-year existence. In addition, the NIPC had been operating with only 13 of the 24 analysts that NIPC officials estimate are needed to develop analytical capabilities. Third, the NIPC did not have industry-specific data on factors such as critical system components, known vulnerabilities, and interdependencies. Under PDD 63, such information is to be developed for each of eight industry segments by industry representatives and the designated federal lead agencies. However, at the close of our work in February, only three industry assessments had been partially completed, and none had been provided to the NIPC. To provide a warning capability, the NIPC established a Watch and Warning Unit that monitors the Internet and other media 24 hours a day to identify reports of computer-based attacks. As of February, the unit had issued 81 warnings and related products since 1998, many of which were posted on the NIPC’s Internet web site. While some warnings were issued in time to avert damage, most of the warnings, especially those related to viruses, pertained to attacks underway. The NIPC’s ability to issue warnings promptly is impeded because of (1) a lack of a comprehensive governmentwide or nationwide framework for promptly obtaining and analyzing information on imminent attacks, (2) a shortage of skilled staff, (3) the need to ensure that the NIPC does not raise undue alarm for insignificant incidents, and (4) the need to ensure that sensitive information is protected, especially when such information pertains to law enforcement investigations underway. However, I want to emphasize a more fundamental impediment. Specifically, evaluating the NIPC’s progress in developing analysis and warning capabilities is difficult because the federal government’s strategy and related plans for protecting the nation’s critical infrastructures from computer-based attacks, including the NIPC’s role, are still evolving. The entities involved in the government’s critical infrastructure protection efforts have not shared a common interpretation of the NIPC’s roles and responsibilities. Further, the relationships between the NIPC, the FBI, and the National Coordinator for Security, Infrastructure Protection, and Counter-Terrorism at the National Security Council have been unclear regarding who has direct authority for setting NIPC priorities and procedures and providing NIPC oversight. In addition, the NIPC’s own plans for further developing its analytical and warning capabilities were fragmented and incomplete. As a result, there were no specific priorities, milestones, or program performance measures to guide NIPC actions or provide a basis for evaluating its progress. The administration is currently reviewing the federal strategy for critical infrastructure protection that was originally outlined in PDD 63, including provisions related to developing analytical and warning capabilities that are currently assigned to the NIPC. On May 9, the White House issued a statement saying that it was working with federal agencies and private industry to prepare a new version of a “national plan for cyberspace security and critical infrastructure protection” and reviewing how the government is organized to deal with information security issues. In our report, we recommend that, as the administration proceeds, the Assistant to the President for National Security Affairs, in coordination with pertinent executive agencies, establish a capability for strategic analysis of computer-based threats, including developing related methodology, acquiring staff expertise, and obtaining infrastructure data; require development of a comprehensive data collection and analysis framework and ensure that national watch and warning operations for computer-based attacks are supported by sufficient staff and resources; and clearly define the role of the NIPC in relation to other government and private-sector entities. PDD 63 directed the NIPC to provide the principal means of facilitating and coordinating the federal government’s response to computer-based incidents. In response the NIPC undertook efforts in two major areas: providing coordination and technical support to FBI investigations and establishing crisis management capabilities. First, the NIPC provided valuable coordination and technical support to FBI field offices, which established special squads and teams and one regional task force in its field offices to address the growing number of computer crime cases. The NIPC supported these investigative efforts by (1) coordinating investigations among FBI field offices, thereby bringing a national perspective to individual cases, (2) providing technical support in the form of analyses, expert assistance for interviews, and tools for analyzing and mitigating computer-based attacks, and (3) providing administrative support to NIPC field agents. For example, the NIPC produced over 250 written technical reports during 1999 and 2000, developed analytical tools to assist in investigating and mitigating computer-based attacks, and managed the procurement and installation of hardware and software tools for the NIPC field squads and teams.