Federal policy calls for critical infrastructure protection activities that are intended to enhance the cyber and physical security of private infrastructures, such as telecommunication networks, that are essential to national and economic security. DHS, Commerce, and FCC have critical infrastructure protection responsibilities over issues related to the security of communications networks. Appendix IV provides additional information on these agencies’ legal authority related to supply chain security for commercial communication networks. In addition, some executive actions have focused on supply chain risk management issues related to cybersecurity, which are described below. The Homeland Security Act of 2002 established DHS and assigned it the following critical infrastructure protection responsibilities: develop a comprehensive national plan for securing the key resources and critical infrastructure of the United States and disseminate, as appropriate, information to assist in the deterrence, prevention, and pre-emption of or response to terrorist attacks. Commerce is responsible under Presidential Policy Directive 21 (PPD- 21), in coordination with other federal and nonfederal entities, for improving security for technology and tools related to cyber-based systems, and promoting the development of other efforts related to critical infrastructure to enable the timely availability of industrial products, materials, and services to meet homeland security requirements. Within Commerce, the National Institute of Standards and Technology (NIST) has responsibility for, among other things, cooperating with other federal agencies, industry, and other private organizations in establishing standard practices, codes, specifications, and voluntary consensus standards. Under PPD-21, FCC is responsible for exercising its authority and expertise to partner with other federal agencies on: identifying and prioritizing communications infrastructure; identifying communications sector vulnerabilities and working with industry and other stakeholders to address those vulnerabilities; and working with stakeholders, including industry, and engaging foreign governments and international organizations to increase the security and resilience of critical infrastructure within the communications sector and facilitating the development and implementation of best practices promoting the security and resilience of the nation’s critical communications infrastructure. Supply chain risk management has been the focus of executive actions; for example, in January 2008, the President directed the development of a multi-pronged approach for addressing global supply chain risk management as part of the Comprehensive National Cybersecurity Initiative (CNCI), an ongoing effort. More recently, at the direction of the President, a report on the federal government’s cybersecurity-related activities was released, which discussed, among other things, the importance of prevention and response against threats to the supply chains used to build and maintain the nation’s infrastructure. Additionally, in response to one of the report’s recommendations, the President appointed a national cybersecurity coordinator in December 2009. The United States has several nationwide voice and data networks that along with comparable communications networks in other countries, enable people around the world to connect to each other, access information instantly, and communicate from remote areas. These networks consist of core networks, which transport a high volume of aggregated voice and data traffic over significant distances, and access networks, which are more localized and connect end users to the core network or directly to each other. Multiple network providers in the United States operate distinct core and access networks that interconnect to form a national communications infrastructure (see fig. 1). Routers and switches send traffic, in the form of data packets, through core and access networks. These pieces of equipment read the address information located in the data packet, determine its destination, and direct it through the network. Routers connect users between networks, while switches connect users within a network. The evolved packet core is the mobile core network used for long-term evolution (LTE) systems, a standard for commercial wireless technologies. LTE is widely accepted as the foundation for future mobile communications. Several major network equipment manufacturers are competing to provide equipment to wireless network providers that are upgrading their networks to deploy LTE. Communications infrastructure is increasingly composed of components that are designed, developed, and manufactured by foreign companies or by U.S. companies that rely on suppliers that integrate foreign components into their products. Furthermore, we have previously reported that according to NIST, today’s complex global economy and manufacturing practices make corporate ownership and control more ambiguous when assessing supply chain vulnerabilities, as companies may conduct business under different names in multiple countries. For example, foreign-based companies sometimes manufacture and assemble products and components in the United States, and U.S.-based companies sometimes manufacture products and components overseas or employ foreign workers domestically. Figure 2 depicts some of the locations that major network equipment manufacturers we spoke with use for different steps in the production process. From 2007 through 2011, communications network equipment imported for the U.S. market came from over 100 foreign countries. While the import data do not distinguish whether the imports are from U.S. or foreign-based companies, according to International Trade Commission staff, many of the imports are from U.S. companies manufacturing abroad. Imports of network equipment to the United States grew about $10 billion (about 76 percent) over a 5-year period, from $13.5 billion in 2007 to $23.8 billion in 2011, as shown in figure 3. During this same period, imports from China, which was the leading source country, grew by $4.9 billion (112 percent). In 2011, the top five sources of U.S. imports of networking equipment were China ($9.3 billion), Mexico ($5.2 billion), Malaysia ($2.6 billion), Thailand ($1.9 billion), and Canada ($713 million). While there is no comprehensive unclassified compilation of attacks to core networks that originated in the supply chain, reliance on a global supply chain introduces some degree of risk. Risks include threats posed by actors such as foreign intelligence services or counterfeiters that may exploit vulnerabilities in the supply chain, thus compromising the availability, security, and resilience of the networks. Multiple points in the supply chain may present vulnerabilities that threat actors could exploit. For example, a lack of adequate testing for software patches and updates could leave a communications network vulnerable to the insertion of code intended to allow unauthorized access to information on the network. Routers and switches can present points of vulnerability because they connect to the core network and are used to aggregate data, according to an FCC official with whom we spoke. For example if a threat actor gained control of a router, that actor could disrupt data traffic to and inside core networks. Supply chain threats and vulnerabilities are discussed in more depth in appendixes II and III, respectively. The network providers and equipment manufacturers we met with told us they address the potential security risks of using foreign-manufactured equipment through voluntary risk management practices. Officials from the companies and industry groups that we spoke with said that they consider the level of risk to be affected not by where equipment and components are made, but how they are made, particularly the security procedures implemented by manufacturers. Many of these officials also said they were not aware of any intentional attacks originating in the supply chain, and some said that they consider the risk of this type of attack to be low. Officials from four industry groups and one research institution we spoke with told us that supply chain attacks are harder to carry out and require more resources than other modes of attacks, such as malicious software uploaded to equipment through the Internet, and, therefore, are the less likely vehicle to be used by potential attackers. Three network providers told us the most common anomalies found in equipment are caused by erroneous coding in the software, anomalies that are unintentional. Such anomalies could, however, lead to exploitable vulnerabilities, according to officials from a third-party testing firm. Nonetheless, the companies we spoke with told us that security is a high priority because their brand image and profitability depends, in part, on avoiding any type of breach of security or disruption of service. Network providers and equipment manufacturers told us that their voluntary risk management practices are in the areas of vendor selection, vendor security requirements, and equipment testing and monitoring, as described below and in figure 4. They said these practices are often a part of their company’s overall security plans and procurement processes and are applied throughout the entire life cycle of their equipment. The network providers and equipment manufacturers we spoke with said that ensuring the security and reliability of their equipment requires them to carefully select their vendors. In addition to the typical considerations when selecting vendors—prices and product performance, the vendor’s financial stability, and maintenance and service options offered—the providers and manufacturers told us that they consider security-related factors, such as the vendor’s security practices, the industry standards related to security the vendors follow, and past security performance or reputation. Another consideration for some network providers when selecting vendors is how critical the equipment being procured is to network operations. Components that will be used in the core network, for example, are typically purchased from vendors that network providers consider most trustworthy. Some network providers told us they also value having long-term relationships with equipment manufacturers, because they are able to develop trust over time that the manufacturer will provide them with reliable and secure equipment and services. While network providers said that they are aware of security concerns about vendors from certain countries, they do not exclude vendors from consideration that have manufacturing locations in those countries, in part, because the global nature of the supply chain would make excluding all vendors located in a particular country difficult. Some network providers told us they may exclude or avoid vendors based on factors such as the ownership of the company or concerns about the security of the vendor’s product, and two told us that federal government officials had advised against using specific vendors for national security reasons, as discussed in the following section of this testimony. Network providers and equipment manufacturers told us that once vendor selections are made, they might require vendors to follow certain security practices, often as part of their contracts. Network providers told us that the security practices they require are typically based on the criticality or perceived risk of the project and the role of the vendor. For example, one network provider we spoke with generates a vendor risk profile for purchases that it considers critical or high risk or if it does not have an established relationship with the vendor.