The U.S. government has invested more than $5 billion since 2009 in GPS and provides GPS service free of direct charge to users worldwide. As shown in figure 1, GPS consists of the space segment, the ground- control segment, and the user segment. The U.S. Air Force develops, maintains, and operates the space and ground-control segments. The space segment consists of a constellation of satellites transmitting radio signals to users. The Air Force manages the constellation to ensure the availability of at least 24 GPS satellites 95 percent of the time. The ground-control segment consists of a global network of ground facilities that track the GPS satellites, monitor their transmissions, perform analyses, and send commands and data to the constellation. The user segment consists of GPS receiver equipment, which receives the signals from the GPS satellites and uses the transmitted information to calculate the user’s three-dimensional position and time. GPS is used extensively and in various ways in many critical infrastructure sectors for PNT information. For example, among other uses, the communications sector uses the GPS timing function to synchronize call handoffs in wireless communications. The energy sector’s bulk power system uses GPS timing in a component that provides status measurements at frequent points in time. The financial services sector uses GPS timing to time stamp financial transactions, match trading orders, and synchronize financial computer systems. The transportation systems sector uses GPS for safe and efficient operations. For example, aircraft use GPS for en-route navigation and landings; the maritime industry uses GPS for navigation and as a safety and situational tool in high-traffic ports; commercial vehicles use GPS for positioning, navigation, and fleet management; and rail systems use GPS for asset management, tracking, and positive train control, which supports collision avoidance. Presidential directive assigns GPS governance roles, and there are other policies and directives that apply to critical infrastructure protection that are important for GPS governance. These policies and directives include: (1) National Security Presidential Directive 39, (2) Homeland Security Presidential Directive 7, (3) the National Infrastructure Protection Plan, and (4) Presidential Policy Directive 21. National Security Presidential Directive 39 (NSPD-39). NSPD-39 assigns governance roles to numerous federal agencies and other entities. In particular, within DOD, the Air Force is responsible for the overall development, acquisition, operation, security, and continued modernization of GPS. DOT serves as the lead civilian agency on GPS-related issues and has lead responsibility for developing requirements for civilian applications. DHS, through the U.S. Coast Guard’s Navigation Center, provides user support to the civilian, non- aviation GPS community. Additionally, NSPD-39 requires that DOT, in coordination with DHS, develop, acquire, operate, and maintain backup capabilities that can support critical civilian and commercial infrastructure during a GPS disruption. NSPD-39 also assigns DHS (in coordination with other agencies) the responsibility to identify, locate, and attribute any interference within the United States that adversely affects GPS use and to develop a central repository and database for reports of domestic and international interference to GPS civilian services. NSPD-39 also directed the federal government to improve the performance of space-based PNT services, including by developing more robust resistance to interference for national security purposes, homeland security, and civilian, commercial, and scientific users worldwide. Furthermore, NSPD-39 assigns the Department of Commerce and the Federal Communications Commission (FCC) responsibility for mitigating electronic interference with U.S. space- based PNT services within the United States. NSPD-39 also established a National Executive Committee for Space-Based PNT (National Executive Committee), chaired jointly by DOD and DOT, to coordinate GPS-related matters across federal agencies. The National Coordination Office for Space-Based PNT (NCO) houses the permanent staff of the National Executive Committee and provides day-to-day support for the committee’s activities. Among other things, the National Executive Committee issued a 5-year plan for space- based PNT that recommends that DHS institute a risk management approach to assess threats, vulnerabilities, and potential consequences to interference to GPS signals and examine the best opportunities to mitigate those risks. See figure 2 for the national space-based PNT organization structure. Homeland Security Presidential Directive 7 (HSPD-7). Issued in 2003, the purpose of HSPD-7 was to establish a national policy for federal departments and agencies to identify, prioritize, and protect critical infrastructure and key resources. HSPD-7 designated DHS as the agency responsible for coordinating the nation’s efforts to protect critical infrastructure. DHS was directed to coordinate protection activities for each critical infrastructure sector through designated Sector-Specific Agencies (SSA). In accordance with applicable laws or regulations, DHS and the SSAs were directed to collaborate with appropriate private sector entities and continue to encourage the development of information sharing and analysis mechanisms to identify, prioritize, and coordinate the protection of critical infrastructure and key resources. National Infrastructure Protection Plan (NIPP). In 2006, DHS addressed the requirements of HSPD-7 by issuing the first NIPP, which DHS updated in 2009. The NIPP provides an overarching approach for integrating the nation’s many critical infrastructure protection initiatives. The cornerstone of the NIPP is its risk management framework, which defines roles and responsibilities for DHS, the SSAs, and other federal, state, regional, local, and private sector partners. Assessing risks is part of this framework, and the NIPP specifies core criteria for risk assessments. The NIPP specifically identifies GPS as a system that supports or enables critical functions in critical infrastructure sectors. Presidential Policy Directive 21 (PPD-21). Issued in February 2013, PPD-21 supersedes HSPD-7 and states that critical infrastructure must be secure and able to withstand and rapidly recover from all hazards. The directive refines and clarifies the critical infrastructure-related functions, roles, and responsibilities across the federal government, as well as aims to enhance overall coordination and collaboration. PPD-21 directs DHS to conduct comprehensive assessments of the vulnerabilities of the nation’s critical infrastructure in coordination with the SSAs and in collaboration with critical infrastructure owners and operators. Executive Order 13636 was also issued in February 2013 to improve critical infrastructure cybersecurity. According to DHS, implementation of the executive order and PPD-21 includes updating the NIPP by October 2013. Disruption of the GPS signal can come from a variety of sources, including radio emissions in nearby bands, jamming, spoofing, and naturally occurring space weather. Spectrum encroachment from radio emissions in nearby bands can cause interference to the GPS signal when the stronger radio signals overpower the relatively weak GPS signals from space. Additionally, according to FCC, some GPS receivers are purposefully designed to receive as much energy as possible from GPS satellites, which makes the receivers vulnerable to interference from operations in nearby bands. With this type of interference, GPS devices pick up the stronger radio signals and become ineffective. Jamming devices are radio frequency transmitters that intentionally block, jam, or interfere with lawful communications, such as GPS signals. Spoofing involves the replacement of a true satellite signal with a manipulated signal, whereby the user may not realize they are using an incorrect GPS signal and may continue to rely on it. Articles and lab experiments have illustrated potential for harm in the bulk power system, maritime navigation, financial markets, and mobile communications, among other areas. Space weather can also cause interference to GPS signals. For example, during solar flare eruptions, the sun produces radio waves that can interfere with a broad frequency range, including those frequencies used by GPS. In September 2011, to fulfill the National Executive Committee’s request for a comprehensive assessment of civilian GPS risks, DHS issued the National Risk Estimate (NRE) to the NCO; DHS officials said the final NRE was published in November 2012 with minor revisions. According to DHS officials, the NRE is modeled after other risk estimates and efforts in the intelligence community. In developing the NRE, DHS conducted a scenario-based risk assessment for critical infrastructure using subject matter experts from inside and outside government. The NRE focuses on 4 of the 16 critical infrastructure sectors: communications, emergency services, energy, and transportation systems. According to DHS officials, they chose these 4 sectors because they use GPS to support or fulfill their core missions and because they provide an appropriate cross- section of risks and potential impacts that could apply broadly to other sectors. The NRE considers three types of GPS disruption scenarios: (1) naturally occurring disruptions, such as space weather events; (2) unintentional disruptions, such as radio frequency signals interfering with GPS signals; and (3) intentional disruptions, such as jamming or spoofing. DHS solicited information from federal and private sector stakeholders and held several workshops on various risk scenarios with the subject matter experts, including one on the overall likelihood of occurrence of the risk scenarios. DHS also held sector-specific workshops on the consequences of GPS disruptions and alternative futures for each sector based on varying degrees of community attention to these security challenges. DHS used alternative futures to consider the risk outlook over the next 20 years. According to DHS, the process of developing the NRE helped clarify aspects of critical infrastructure dependence on GPS and vulnerability to interference or an outage that were previously uncertain. Specifically, DHS officials told us that the NRE helped them understand the significance of the wide usage of GPS timing in systems throughout the nation’s critical infrastructure. According to DHS, through the NRE workshops and the exchange of ideas, sector representatives also developed greater awareness of risks. Risk assessments, such as the NRE, involve complex analysis; conducting a risk assessment across multiple sectors of systems with many unknowns and little data is particularly challenging.