The Internet is a vast network of interconnected networks that is used by governments, businesses, research institutions, and individuals around the world to communicate, engage in commerce, perform research, educate, and entertain. Increasing computer interconnectivity—most notably growth in the use of the Internet—has revolutionized the way that our government, our nation, and much of the world communicate and conduct business. From its origins in the 1960s as a research project sponsored by the U.S. government, the Internet has grown increasingly important to both American and foreign businesses and consumers, serving as the medium for hundreds of billions of dollars of commerce each year. The Internet has also become an extended information and communications infrastructure, supporting vital services such as power distribution, health care, law enforcement, and national defense. Today, private industry—including telecommunications companies, cable companies, and Internet service providers—owns and operates the vast majority of the Internet’s infrastructure. The various networks that make up the Internet include the national backbone and regional networks, residential Internet access networks, and the networks run by individual businesses or “enterprise” networks. When a user wants to access a Web site or send an e-mail to someone who is connected to the Internet through a different service provider, the data must be transferred between networks. Data travels from a user’s device to the Internet through various means, such as coaxial cable, satellite, or wirelessly, to a provider’s facility where it is aggregated with other users’ traffic. Data cross between networks at Internet exchange points, which can be either hub points where multiple networks exchange data or private interconnection points. At these exchange points, computer systems called routers determine the optimal path for the data to reach their destination. Data travel through the national and regional networks and exchange points around the globe, as necessary, to reach the recipient’s Internet service provider and the recipient. The networks that make up the Internet communicate via standardized rules called protocols. For example, a critical set of protocols, collectively known as the domain name system (DNS), ensures the uniqueness of each e-mail and Web site address. This system links e-mail and Web site addresses with the underlying numerical addresses that computers use to communicate with each other. It translates names into addresses and back again in a process invisible to the end user. The global interconnectivity provided by the Internet allows cyber attackers to easily cross national borders, access vast numbers of victims at the same time, and easily maintain anonymity. Attacks can come from a variety of sources, including criminal groups, hackers, and terrorists. Table 1 lists sources of threats that have been identified by the U.S. intelligence community and others. Different types of cyber threats can use various cyber exploits that may adversely affect computers, software, a network, an agency’s operation, an industry, or the Internet itself (see table 2). Groups or individuals may intentionally deploy cyber exploits targeting a specific cyber asset or attack through the Internet using a virus, worm, or malware with no specific target. Recent reports of cyber attacks illustrate that such attacks could have a debilitating impact on national security. In May 2007, Estonia was the reported target of a denial-of-service cyber attack with national consequences. The coordinated attack created mass outages of its government and commercial Web sites. In March 2008, DOD reported that, in 2007, computer networks operated by DOD, other federal agencies, and defense-related think tanks and contractors were targets of computer network intrusions. Although those responsible were not definitively identified, the attacks appeared to have originated in China. In January 2010, it was reported that at least 30 technology companies— most in Silicon Valley, California—were victims of intrusions. The cyber attackers infected computers with hidden programs allowing unauthorized access to files that may have included the companies’ computer security systems, crucial corporate data, and software source code. In January 2010, a California-based company filed suit alleging that two Chinese companies stole software code and then distributed it to tens of millions of end users as part of Chinese government-sponsored filtering software. The company is seeking more than $2.2 billion dollars. Academic researchers found that portions of the company’s software code had been copied and used in initial versions of the Chinese software. Based on an 8-month investigation in 2009, university researchers reported that computer systems in India were attacked. The suspected cyberattackers remotely connected to Indian computers using social networks to install bot-nets that infiltrated and infected Indian computers with malware. The incidents were reported to have been traced back to an underground espionage organization that was able to steal sensitive national security and defense information. As threats to cyberspace have persisted and grown and cyberspace has expanded globally, the federal government has developed policies, strategies, and initiatives that recognize the importance of addressing cybersecurity on a global basis. For example, President Obama’s Cyberspace Policy Review determined that the United States needs a strategy for cybersecurity that brings like-minded nations together on issues such as technical standards and acceptable legal norms regarding territorial jurisdiction, sovereign responsibility, and use of force. It includes an action to develop U.S. government positions for an international cybersecurity policy and strengthen international partnerships to create initiatives that address the full range of activities, policies, and opportunities associated with cybersecurity. The policy review also recommended that the President establish a cybersecurity coordinator position to integrate the government’s cybersecurity policies. Subsequently, in December 2009, a Special Assistant to the President and Cybersecurity Coordinator, referred as the Cybersecurity Coordinator in this report, was appointed with responsibility for addressing the recommendations made in the Cyberspace Policy Review, including coordinating interagency cybersecurity policies and strategies and developing a comprehensive national strategy to secure the nation’s digital infrastructure. In addition, The National Strategy to Secure Cyberspace recognized that securing cyberspace is a global matter due to the interconnectedness of the world’s computer systems. Accordingly, it states that securing global cyberspace requires international cooperation to raise awareness, share information, promote security standards, and investigate and prosecute cybercrime. Also, Homeland Security Presidential Directive 7 (HSPD-7) directs DHS to, among other things, develop a comprehensive and integrated plan outlining goals and initiatives for protecting critical infrastructure that includes a strategy for working with international organizations. The directive also designates the Department of State, in conjunction with the Department of Commerce, DOD, DHS, DOJ, the Department of the Treasury, and other appropriate agencies, to work with foreign countries and international organizations to strengthen the protection of U.S. critical infrastructure and key resources. Further, while National Security Presidential Directive 54/Homeland Security Presidential Directive 23 (NSPD-54/HSPD-23), establishing the Comprehensive National Cybersecurity Initiative (CNCI), is focused on safeguarding federal executive branch government information systems, it includes one initiative focused on building an approach that deters interference and attacks in cyberspace by improving warning capabilities, articulating roles for private sector and international partners, and developing appropriate responses for both state and nonstate actors. It also recognizes the need to develop an approach to better manage the federal government’s global supply chain. There are a number of key entities and efforts whose international activities significantly influence the security and governance of cyberspace. Although these 19 organizations, listed in table 3, do not represent all international cyber-related entities and efforts, they were consistently identified as key by the organizations and experts we interviewed. The organizations range from information-sharing forums that are nondecision-making gatherings of experts to private organizations to treaty-based, decision-making bodies founded by countries. Their efforts include those to address topics such as incident response, technical standards, and law enforcement cooperation. These entities have reported ongoing initiatives that involve governments and private industry stakeholders to address a broad set of topics, such as implementation of incident response mechanisms, the development of technical standards, the facilitation of criminal investigations, and the creation of international policies related to information technology and critical infrastructure. Asia-Pacific Economic Cooperation (APEC) is a cooperative economic and trade forum designed to promote economic growth and cooperation among 21 countries from the Asia-Pacific region. APEC’s Telecommunication and Information Working Group (TEL) is to support security efforts associated with the information infrastructure of member countries through activities designed to strengthen effective incident response capabilities, develop information security guidelines, combat cybercrime, monitor security implications of emerging technologies, and foster international cooperation on cybersecurity. According to APEC, the working group has pursued some of these activities by collaborating with other international organizations, such as the Association of Southeast Asian Nations, the International Telecommunication Union, and the Organisation for Economic Cooperation and Development. Association of Southeast Asian Nations (ASEAN) is an economic and security cooperative comprised of 10 member nations from Southeast Asia. According to the 2009-2015 Roadmap for an ASEAN Community, it seeks to combat transnational cybercrime by fostering cooperation among member-nations’ law enforcement agencies and promoting the adoption of cybercrime legislation. In addition, the road map calls for activities to develop information infrastructure and expand computer emergency response teams (CERT) and associated drills to all ASEAN partners. The Council of Europe is an organization of 47 member countries founded in 1949 to develop common and democratic principles for the protection of individuals. In 2001, the council adopted a Convention on Cybercrime to improve international cooperation in combating actions directed against the confidentiality, integrity, and availability of computer systems, networks, and data. This convention identified agreed-upon cyber-related activities that should be deemed criminal acts in countries’ domestic law. These acts included illegal access to a computer system, computer-related fraud, activities involving child pornography, and copyright infringement. The U.S. Senate ratified this convention in August 2006.