Cybersecurity has been called "one of the most urgent national security problems facing the new administration." Cyber and telecommunications activities are sometimes conflated to indicate the same meaning or capability. One might distinguish the term cyber from that of telecommunications with the former being the data or applications residing on the latter which is the electronic medium in which the activity occurs. Electronic information systems, also termed "information infrastructures," now support a wide range of security and economic assets in the public and private sectors. Such systems have been successfully infiltrated in recent years by a range of attackers, some of whom are suspected to have been working in coordination with foreign military organizations or (foreign) state intelligence services. Thus, like the changing nature of U.S. enemies in the post-9/11 environment, the nature of military and economic vulnerabilities has changed: intelligence-gathering battles in cyberspace now also play a crucial role in national security. In January 2008, the Bush Administration initiated the Comprehensive National Cybersecurity Initiative (the CNCI) to make the United States more secure against cyber threats. The Homeland Security Presidential Directive 23 and National Security Presidential Directive 54 establishing the CNCI are classified. Some details of the Initiative have been made public in Departmental press releases, speeches by executive branch leaders, and analysis and insight offered by individuals that follow cyber security and terrorism related issues. The CNCI "establishes the policy, strategy, and guidelines to secure federal systems." The CNCI also delineates "an approach that anticipates future cyber threats and technologies, and requires the federal government to integrate many of its technical and organizational capabilities to better address sophisticated threats and vulnerabilities." Subsequent to the issuance of the classified directives, congressional committees have held hearings regarding the CNCI and heard testimony from a commission established to address necessary cybersecurity reforms. In a speech during his presidential campaign, President Obama promised to "make cyber security the top priority that it should be in the 21st century ... and appoint a National Cyber Advisor who will report directly" to the President. Although the Obama Administration might craft a new approach to cybersecurity, some experts have urged the new administration to build on the CNCI, which they note is a "major step toward improving federal cybersecurity." On February 9, 2009, President Obama directed a 60-day interagency cybersecurity review to develop a strategic framework to ensure the CNCI is being appropriately integrated, resourced, and coordinated with Congress and the private sector. The new administration's focus on cybersecurity would continue recent emphasis on the issue by the executive and legislative branches. This recent focus emerged partly in response to events such as attacks by outside hackers against a Pentagon computer network and the CyberWar against Estonia, which garnered significant media attention. Agency reports of large numbers of attempts to infiltrate government cyberspace have also prompted action. Both the high-profile attacks and more routine infiltrations have shed light on the vulnerability of critical information infrastructures. For example, the Defense Science Board noted that the U.S. military's information infrastructure is the "Achilles' heel of our otherwise overwhelming military might." Threats to the U.S. cyber and telecommunications infrastructure are constantly increasing and evolving as are the entities that show interest in using a cyber-based capability to harm the nation's security interests. Concerns have been raised since the 1990s regarding the use of the internet and telecommunications components to cause harm to the nation's security interests. Activities producing undesirable results include unauthorized intrusion to gain access and view protected data, stealing or manipulating information contained in various databases, and attacks on telecommunications devices to corrupt data or cause infrastructure components to operate in an irregular manner. Of paramount concern to the national and homeland security communities is the threat of a cyber related attack against the nation's critical government infrastructures – "systems and assets, physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health and safety, or any combination of those matters." Early concerns noted attacks on components of the energy grid, infrastructure control systems, and military equipment as examples of telecommunications based threats to physical infrastructures. In response, the Department of Energy conducted an experiment in 2007 in which the control system of an unconnected generator, containing similar components as that of larger generators connected to many power grids in the nation supplying electricity, was damaged and became inoperable. While data from federal agencies demonstrate that the majority of attempted and successful cyber attacks to date have targeted virtual information resources rather than physical infrastructures, many security experts are concerned that the natural progression of those wishing to harm U.S. security interests will transition from stealing or manipulating data to undertaking action that temporarily or permanently disables or destroys the telecommunication network or affects infrastructure components. Many security observers agree that the United States currently faces a multi-faceted, technologically based vulnerability in that "our information systems are being exploited on an unprecedented scale by state and non-state actors [resulting in] a dangerous combination of known and unknown vulnerabilities, strong adversary capabilities, and weak situational awareness." This, coupled with security observers' contention that the United States lacks the capability to definitively ascertain perpetrators who might unlawfully access a database or cause harm to a network, leaves the nation increasingly at risk. It also causes acts or discussions related to deterring cyberattacks to be ignored or negated by entities exploiting known or newly found vulnerabilities. Prominent national security experts have emphasized the vulnerability of U.S. infrastructures. As recently as January 2009, former Director of National Intelligence (DNI) Mike McConnell equated "cyber weapons" with weapons of mass destruction when he expressed concern about terrorists' use of technology to degrade the nation's infrastructure. In distinguishing between individuals gaining access to U.S. national security systems or corporate data for purposes of exploitation for purposes of competitive advantage, former Director McConnell noted that terrorists aim to damage infrastructure and that the "time is not too far off when the level of sophistication reaches a point that there could be strategic damage to the United States." Similarly, in elaborating on the potential consequences of a cyber attack, newly confirmed DNI Dennis Blair offered the following statement during the Annual Threat Assessment of the Intelligence Community for the Senate Select Committee on Intelligence: Growing connectivity between information systems, the Internet, and other infrastructures creates opportunities for attackers to disrupt telecommunications, electrical power, energy pipelines, refineries, financial networks, and other critical infrastructures. Over the past several years we have seen cyber attacks against critical infrastructure abroad, and many of our own infrastructures are as vulnerable as their foreign counterparts. A successful attack against a major financial service provider could severely impact the national economy, while cyber attacks against physical infrastructure computer systems such as this that control power grids or oil refineries have the potential to disrupt services for hours to weeks. Also describing the evolving threat to U.S. security interests from a cyber-facilitated incident, Melissa Hathaway, Senior Advisor to the DNI and Chair of the Nation Cyber Study Group and President Obama's appointee to lead the 60-day interagency strategic cyber review, wrote that "both state and non-state adversaries are targeting our information systems and infrastructure for exploitation and potential disruption or destruction." During the question and answer period of the most recent DNI Annual Threat Assessment of the Intelligence Community, Director Blair stated that a "cyber capability is not one in which I feel [terrorists] have the skills for the greatest destruction. I think that they have other terrible things they can do to us that they are working on harder, they're better able to do, and they seem to be more motivated to do. So [a cyber terrorist attack is] possible, but I don't think the combination of terror and cyber is the nexus that we are most worried about." However, threats could originate from foreign military or intelligence operatives rather than from terrorist groups. In response to reports of the increasing pace and volume of cyber intrusions and a recognition that recent cyber-based threats have compelled the U.S. government to take security related actions that may negatively affect an agency's ability to perform its national security duties, legislators and analysts have expressed concerns that the current statutory framework inadequately addresses modern cybersecurity threats. One prominent voice is the Center for Strategic and International Studies' (CSIS) Commission on Cybersecurity for the 44 th President, whose members testified before House and Senate committees and released its formal recommendations in fall 2008. The Commission recommended that federal cyber-crime provisions should be reexamined and that the "President should propose legislation that eliminates the current legal distinction between technical standards for national security systems and civilian agency systems and adopt a risk-based approach to federal computer security." In addition, it characterized the current statutory framework, particularly the Federal Information Security Management Act, enacted in 2002 to establish agency-level defenses against cyber threats, as too weak to effectively prevent cyber intrusions. Legislators made some attempts during the 110 th Congress to strengthen or "modernize" the existing statutory framework. For instance, a bill introduced by Senator Carper, the Federal Information Security Management Act of 2008, would have added a "Chief Information Security Officer" position to supplement the Chief Information Officer position required in each federal agency under the Federal Information Security Management Act of 2002 and the Clinger-Cohen Act of 1996. However, analysts have argued that ultimately, no change to the existing statutory scheme will adequately equip executive agencies to prevent infiltrations into U.S. cyberspace. They argue that "only the White House has the necessary authority and oversight for cybersecurity." As of the date of this report, unclassified versions of the January 2008 directives establishing the CNCI have yet to be released. While the Initiative has yet to be legislatively recognized, presidential directives, sometimes considered types of executive orders and visa versa, have the force of law if they are supported by constitutional or statutory authority.