Since the early 1990s, the unprecedented growth in computer interconnectivity, most notably growth in use of the Internet, has revolutionized the way our government, our nation, and much of the world communicate and conduct business. The benefits have been enormous in terms of facilitating communications, business processes, and access to information. However, without proper safeguards, this widespread interconnectivity poses enormous risks to our computer systems and, more importantly, to the critical operations and infrastructures they support. While attacks to date have not caused widespread or devastating disruptions, the potential for more catastrophic damage is significant. Official estimates show that over 100 countries already have or are developing computer attack capabilities. Hostile nations or terrorists could use cyber-based tools and techniques to disrupt military operations, communications networks, and other information systems or networks. The National Security Agency has determined that potential adversaries are developing a body of knowledge about U.S. systems and about methods to attack these systems. According to Defense officials, these methods, which include sophisticated computer viruses and automated attack routines, allow adversaries to launch untraceable attacks from anywhere in the world. According to a leading security software designer, viruses in particular are becoming more disruptive for computer users. In 1993 only about 10 percent of known viruses were considered destructive, harming files and hard drives. But now about 35 percent are regarded as harmful. Information sharing and coordination among organizations are central to producing comprehensive and practical approaches and solutions to these threats. First, having information on threats and on actual incidents experienced by others can help an organization better understand the risks it faces and determine what preventative measures should be implemented. Second, more urgent, real-time warnings can help an organization take immediate steps to mitigate an imminent attack. Lastly, information sharing and coordination are important after an attack has occurred to facilitate criminal investigations, which may cross jurisdictional boundaries. Such after-the-fact coordination could also be useful in recovering from a devastating attack, should such an attack ever occur. The recent episode of the ILOVEYOU computer virus in May 2000, which affected governments, corporations, media outlets, and other institutions worldwide, highlighted the need for greater information sharing and coordination. Because information sharing mechanisms were not able to provide timely enough warnings against the impending attack, many entities were caught off guard and forced to take their networks off-line for hours. Getting the word out within some federal agencies themselves also proved difficult. At the Department of Defense, for example, the lack of teleconferencing capability slowed the response effort because Defense components had to be called individually. The National Aeronautics and Space Administration (NASA) had difficulty communicating warnings when e-mail services disappeared, and while backup communication mechanisms are in place, NASA officials told us that they are rarely tested. We also found that the few federal components that either discovered or were alerted to the virus early did not effectively warn others. For example, officials at the Department of the Treasury told us that the U.S. Customs Service received an Air Force Computer Emergency Response Team (AFCERT) advisory early in the morning of May 4, but that Customs did not share this information with other Treasury bureaus. The federal government recognized several years ago that addressing computer-based risks to our nation’s critical infrastructures required coordination and cooperation across federal agencies and among public- and private-sector entities and other nations. In May 1998, following a report by the President’s Commission on Critical Infrastructure Protection that described the potential devastating implications of poor information security from a national perspective, the government issued Presidential Decision Directive (PDD) 63. Among other things, this directive tasked federal agencies with developing critical infrastructure protection plans and establishing related links with private industry sectors. It also required that certain executive branch agencies assess the cyber vulnerabilities of the nation’s critical infrastructures—information and communications; energy; banking and finance; transportation; water supply; emergency services; law enforcement; and public health, as well as those authorities responsible for continuity of federal, state, and local governments. A variety of activities have been undertaken in response to PDD 63, including development and review of individual agency critical infrastructure protection plans, identification and evaluation of information security standards and best practices, and efforts to build communication links. In January 2000 the White House released its NationalPlanforInformationSystemsProtectionas a first major element of a more comprehensive effort to protect the nation’s information systems and critical assets from future attacks. The plan focuses largely on federal efforts being undertaken to protect the nation’s critical cyber- based infrastructure. Subsequent versions are to address protecting other elements of the nation’s infrastructure, including those pertaining to the physical infrastructure and specific roles and responsibilities of state and local governments and the private sector. Moreover, a number of government and private sector organizations have already been established to facilitate information sharing and coordination. These range from groups that disseminate information on immediate threats and vulnerabilities, to those that seek to facilitate public-private sector information sharing on threats pertaining to individual infrastructure sectors, and those that promote coordination on an international scale. At the federal level, for example, the National Infrastructure Protection Center (NIPC), located at the Federal Bureau of Investigation (FBI), is to serve as a focal point in the federal government for gathering information on threats as well as facilitating and coordinating the federal government’s response to incidents impacting key infrastructures. It is also charged with issuing attack warnings to private sector and government entities as well as alerts to increases in threat conditions. The Federal Computer Incident Response Capability (FedCIRC) is a collaborative partnership of computer security and law enforcement professionals established to handle computer security incidents and to provide both proactive and reactive security services for the federal government. In addition, the National Institute of Standards and Technology (NIST) is working to facilitate information sharing in the security community by building a database containing detailed information on computer attacks and the Critical Infrastructure Assurance Office (CIAO) is working to coordinate private sector participation in information gathering in the area of cyber assurance. The Administration is also undertaking efforts to facilitate information sharing with other nations. Examples of other organizations focusing on information sharing and coordination include the following: Carnegie Mellon University’s CERT Coordination Center,which is charged with establishing a capability to quickly and effectively coordinate communication among experts in order to limit damage, respond to incidents, build awareness of security issues across the Internet community. The System Administration, Networking, and Security (SANS) Institute, which is a cooperative research and education organization through which more than 96,000 system administrators, security professionals, and network administrators share the lessons they are learning and find solutions for challenges they face. The National Coordinating Center for Telecommunications, which is a joint industry/government organization that is focusing on facilitating information sharing between the telecommunications industry and government. The Financial Services Information Sharing and Analysis Center, which is a similar organization that exclusively serves the banking, securities, and insurance industries. Agora, which is a forum that is composed more than 300 people from approximately 100 companies and 45 government agencies, including Microsoft, Blue Shield, the FBI, U.S. Secret Service, U.S. Customs Service agents, and the Royal Canadian Mounted Police as well as local police, county prosecutors, and computer professionals from the Pacific Northwest. Members voluntarily share information on common computer security problems, best practices to counter them, protecting electronic infrastructures, and educational opportunities. The Forum of Incident Response and Security Teams (FIRST), which provides a closed forum for incident response and security teams from 19 countries to share experiences, exchange information related to incidents, and promote preventative activities. The International Organization on Computer Evidence, which provides an international forum for law enforcement agencies to exchange information concerning computer crime investigation and related forensic issues. Developing the information sharing and coordination capabilities needed to effectively deal with computer threats and actual incidents is complex and challenging but essential. Data on possible threats–ranging from viruses, to hoaxes, to random threats, to news events, and computer intrusions–must be continually collected and analyzed from a wide spectrum of globally distributed sources. Moreover, once an imminent threat is identified, appropriate warnings and response actions must be effectively coordinated among government agencies, the private sector, and, when appropriate, other nations. It is important that this function be carried out as effectively, efficiently, and quickly as possible in order to ensure continuity of operations as well as minimize disruptions. At the same time, it is not possible to build an overall, comprehensive picture of activity on the global information infrastructure. Networks themselves are too big, they are growing too quickly, and they are continually being reconfigured and reengineered. As a result, it is essential that strong partnerships be developed between a wide range of stakeholders in order to ensure that the right data are at the right place at the right time. Creating partnerships for information sharing and coordination is a formidable task. Trust needs to be established among a broad range of parties with varying interests and expectations, procedures for gathering and sharing information need to be developed, and technical issues need to be addressed. Moreover, if the federal government itself is going to be a credible player in response coordination, it needs to have its own systems and assets well protected. This means overcoming significant and pervasive security weaknesses at each of the major federal agencies and instituting governmentwide controls and mechanisms needed to provide effective oversight, guidance, and leadership. Perhaps most importantly, this activity needs to be guided by a comprehensive strategy to ensure that it is effective, to avoid unnecessary duplication of effort, and to maintain continuity. I would like to discuss each of these challenges in more detail as successfully addressing them is essential to getting the most from information sharing mechanisms currently operating as well as establishing new ones. A key element to the success of information sharing partnerships is developing trusted relationships among the broad range of stakeholders involved with critical infrastructure protection. (See figure 1 for examples of these stakeholders). Jointly-designed, built, and staffed mechanisms among involved parties is most likely to obtain critical buy-in and acceptance by industry and others.