The same speed and accessibility that create the enormous benefits of the computer age can, if not properly controlled, allow individuals and organizations to inexpensively eavesdrop on or interfere with computer operations from remote locations for mischievous or malicious purposes, including fraud or sabotage. In recent years, the sophistication and effectiveness of cyberattacks have steadily advanced. These attacks often take advantage of flaws in software code, circumvent signature-based tools that commonly identify and prevent known threats, and use social engineering techniques designed to trick the unsuspecting user into divulging sensitive information or propagating attacks. Government officials are increasingly concerned about attacks from individuals and groups with malicious intent, such as crime, terrorism, foreign intelligence-gathering, and acts of war. As greater amounts of money are transferred through computer systems, as more sensitive economic and commercial information is exchanged electronically, and as the nation's defense and intelligence communities increasingly rely on commercially available information technology, the likelihood increases that information attacks will threaten vital national interests. Recent attacks and threats have further underscored the need to bolster the cybersecurity of our government's and our nation's computer systems and, more importantly, of the critical operations and infrastructures they support. Recent examples of attacks include the following: In March 2005, security consultants within the electric industry reported that hackers were targeting the U.S. electric power grid and had gained access to U.S. utilities' electronic control systems. Computer security specialists reported that, in a few cases, these intrusions had "caused an impact." While officials stated that hackers had not caused serious damage to the systems that feed the nation's power grid, the constant threat of intrusion has heightened concerns that electric companies may not have adequately fortified their defenses against a potential catastrophic strike. In January 2005, a major university reported that a hacker had broken into a database containing 32,000 student and employee social security numbers, potentially compromising their identities and finances. In similar incidents during 2003 and 2004, it was reported that hackers had attacked the systems of other universities, exposing the personal information of over 1.8 million people. In June 2003, the U.S. government issued a warning concerning a virus that specifically targeted financial institutions. Experts said the BugBear.b virus was programmed to determine whether a victim had used an e-mail address for any of the roughly 1,300 financial institutions listed in the virus's code. If a match were found, the software attempted to collect and document user input by logging keystrokes and then provided this information to a hacker, who could use it in attempts to break into the banks' networks. In January 2003, the Slammer worm infected more than 90 percent of vulnerable computers worldwide within 10 minutes of its release on the Internet by exploiting a known vulnerability for which a patch had been available for 6 months. Slammer caused network outages, canceled airline flights, and automated teller machine failures. In addition, the Nuclear Regulatory Commission confirmed that the Slammer worm had infected a private computer network at a nuclear power plant, disabling a safety monitoring system for nearly 5 hours and causing the plant’s process computer to fail. The worm reportedly also affected communication on the control networks of at least five utilities by propagating so quickly that control system traffic was blocked. Cost estimates on the impact of the work range from $1.05 billion to $1.25 billion. In May 2005, we reported that federal agencies were facing a set of emerging cybersecurity threats as a result of increasingly sophisticated methods of attack and the blending of once distinct types of attack into more complex and damaging forms. Examples of these threats include spam (unsolicited commercial e-mail), phishing (fraudulent messages used to obtain personal or sensitive data), and spyware (software that monitors user activity without the user's knowledge or consent). Spam consumes significant resources and is used as a delivery mechanism for other types of cyberattacks; phishing can lead to identity theft, loss of sensitive information, and reduced trust and use of electronic government services; and spyware can capture and release sensitive data, make unauthorized changes, and decrease system performance. These attacks are also becoming increasingly automated with the use of botnets— compromised computers that can be remotely controlled by attackers to automatically launch attacks. Bots (short for robots) have become a key automation tool that is used to speed the infection of vulnerable systems. Federal law and regulation call for critical infrastructure protection activities that are intended to enhance the cyber and physical security of both the public and private infrastructures that are essential to national security, national economic security, and national public health and safety. Federal regulation also establishes DHS as the focal point for the security of cyberspace— including analysis, warning, information sharing, vulnerability reduction, mitigation, and recovery efforts for public and private critical infrastructure information systems. To accomplish this mission, DHS is to work with other federal agencies, state and local governments, and the private sector. Federal policy further recognizes the need to prepare for debilitating Internet disruptions and—because the vast majority of the Internet infrastructure is owned and operated by the private sector—tasks the DHS with developing an integrated public/private plan for Internet recovery. As the focal point for critical infrastructure protection, the Department of Homeland Security (DHS) has many cybersecurity- related roles and responsibilities that are called for in law and policy. These responsibilities include developing plans, building partnerships, and improving information sharing, as well as implementing activities related to the five priorities in the National Strategy to Secure Cyberspace. These priorities are (1) developing and enhancing national cyber analysis and warning, (2) reducing cyberspace threats and vulnerabilities, (3) promoting awareness of and training in security issues, (4) securing governments’ cyberspace, and (5) strengthening national security and international cyberspace security cooperation. See table 1 for a list of DHS’s 13 key cybersecurity responsibilities. These responsibilities are described in more detail in appendix I. To fulfill its cybersecurity role, in June 2003, DHS established the National Cyber Security Division to take the lead in addressing the cybersecurity of critical infrastructures. In our 2005 report and testimony, we noted that while DHS initiated multiple efforts to fulfill its responsibilities, it had not fully addressed any of the 13 responsibilities, and much work remained to fulfill them. For example, the department established the United States Computer Emergency Readiness Team as a public/private partnership to make cybersecurity a coordinated national effort, and it established forums to build greater trust and information sharing among federal officials with information security responsibilities and law enforcement entities. However, DHS had not yet developed national cyber threat and vulnerability assessments or government/industry contingency recovery plans for cybersecurity. Since that report was issued, DHS has made progress on its responsibilities, but none have been completely addressed. For example, in June 2006, the agency released the National Infrastructure Protection Plan; however, supplemental sector- specific plans have not yet been finalized. Further, DHS reported that it has expanded the use of a situational awareness tool that supports cyber analysis and warning from one to seven federal agencies. However, this does not yet comprise a national analysis and warning capability. In our 2006 report and testimony, we focused particularly on one of DHS’s key cybersecurity responsibilities—facilitating Internet recovery. We reported that DHS had begun a variety of initiatives to fulfill its responsibility for developing an integrated public/private plan for Internet recovery, but that these efforts were not comprehensive or complete. For example, DHS had developed high- level plans for infrastructure protection and incident response; however, the components of these plans that address the Internet infrastructure were not complete. Further, several representatives of private-sector firms supporting the Internet infrastructure expressed concerns about the plans, noting that the plans would be difficult to execute in times of crisis. The department had also started a variety of initiatives to improve the nation’s ability to recover from Internet disruptions, including establishing working groups to facilitate coordination and exercises in which government and private industry practice responding to cyber events. However, progress to date on these initiatives had been limited, and other initiatives lacked time frames for completion. Also, the relationships among these initiatives were not evident. As a result, we reported that the government was not yet adequately prepared to effectively coordinate public/private plans for recovering from a major Internet disruption. A private-sector organization subsequently reported that our nation was unprepared to reconstitute the Internet after a massive disruption, noting that there were significant gaps in government response plans and that the responsibilities of the multiple organizations that would plan a role in recovery were unclear. DHS faces numerous challenges in fulfilling its cybersecurity-related CIP responsibilities. Key challenges in fulfilling DHS’s broad responsibilities include increasing awareness about cybersecurity roles and capabilities, establishing effective partnerships with stakeholders, achieving two-way information sharing with these stakeholders, and demonstrating the value it can provide to private sector infrastructure owners. Key challenges to establishing a plan for recovering from Internet disruptions include addressing innate characteristics of the Internet that make planning for and responding to disruptions difficult, achieving consensus on DHS’s role and on when the department should get involved in responding to a disruption, addressing legal issues affecting DHS’s ability to provide assistance to restore Internet service, and overcoming reluctance of many in the private sector to share information on Internet disruptions with DHS. Further, the department faces a particular challenge in attaining the organizational stability and leadership it needs to gain the trust of other stakeholders in the cybersecurity world—including other government agencies as well as the private sector. In May 2005, we reported that multiple senior DHS cybersecurity officials had recently left the department. These officials included the NCSD Director, the Deputy Director responsible for Outreach and Awareness, the Director of the US-CERT Control Systems Security Center, the Under Secretary for the Information Analysis and Infrastructure Protection Directorate and the Assistant Secretary responsible for the Information Protection Office.