H.R. Removing barriers to information sharing between government and industry can similarly enhance critical infrastructure protection. The National Infrastructure Protection Center (NIPC), located in the Federal Bureau of Investigation, is charged with this mission, but it is not clear whether NIPC has the right tools and resources needed to successfully coordinate information collection efforts with the private sector and to effectively correlate and analyze information received. The second challenge to realizing the goals of H.R. 4246 is that, to truly engage the private sector, the federal government needs to be a model for computer security. Currently, the federal government is not a model. However, audits conducted by GAO and agency inspectors general show that 22 of the largest federal agencies have significant computer security weaknesses, ranging from poor controls over access to sensitive systems and data, to poor control over software development and changes, to nonexistent or weak continuity of service plans. In summary, by removing private sector concerns about sharing information on critical infrastructure threats, H.R. 4246 can facilitate private-public partnerships and help spark the dialogue needed to identify threats and vulnerabilities and to develop response strategies.
Why GAO Did This Study

Pursuant to a congressional request, GAO discussed the proposed Cyber Security Information Act of 2000 (H.R. 4246), focusing on how it can enhance critical infrastructure protection and the formidable challenges involved with achieving the goals of the bill.

What GAO Found

GAO noted that: (1) by removing key barriers that are precluding private industry from sharing information about infrastructure threats and vulnerabilities, H.R. 4246 can help build the meaningful private-public partnerships that are integral to protecting critical infrastructure assets; (2) however, to successfully engage the private sector, the federal government itself must be a model of good information security; (3) currently, it is not; (4) significant computer security weaknesses--ranging from poor controls over access to sensitive systems and data, to poor control over software development and changes, to nonexistent or weak continuity of service plans--pervade virtually every major agency; (5) and, as illustrated by the recent ILOVEYOU computer virus, mechanisms already in place to facilitate information sharing among federal agencies about impeding threats and vulnerabilities have not been working effectively; and (6) moreover, the federal government may not yet have the right tools for identifying, analyzing, coordinating, and disseminating the type of information that H.R. 4246 envisions collecting from the private sector.