Three factors have hindered the NIPC’s ability to develop strategic analytical capabilities. Specifically, evaluating the NIPC’s progress in developing analysis and warning capabilities is difficult because the federal government’s strategy and related plans for protecting the nation’s critical infrastructures from computer-based attacks, including the NIPC’s role, are still evolving. Our report recommends that, as the administration proceeds, the Assistant to the President for National Security Affairs, in coordination with pertinent executive agencies, establish a capability for strategic analysis of computer-based threats, including developing related methodology, acquiring staff expertise, and obtaining infrastructure data; require development of a comprehensive data collection and analysis framework and ensure that national watch and warning operations for computer-based attacks are supported by sufficient staff and resources; and clearly define the role of the NIPC in relation to other government and private-sector entities. NIPC Coordination and Technical Support Have Benefited Investigative and Response Capabilities

PDD 63 directed the NIPC to provide the principal means of facilitating and coordinating the federal government’s response to computer-based incidents. Progress in Establishing Information-Sharing Relationships Has Been Mixed

Information sharing and coordination among private-sector and government organizations are essential to thoroughly understanding cyber threats and quickly identifying and mitigating attacks. The NIPC has been more successful in providing training on investigating computer crime to government entities, which is an effort that it considers an important component of its outreach efforts.
Why GAO Did This Study

To better protect the nation's critical computer-dependent infrastructures from computer-based attacks and disruption, the President issued a directive in 1998 that established the National Infrastructure Protection Center as a national focal point for gathering information on threats and facilitating the federal government's response to computer-based incidents. This testimony discusses the center's progress in (1) developing national capabilities for analyzing cyber threat and vulnerability data and issuing warnings, (2) enhancing its capabilities for responding to cyber attacks, and (3) developing outreach and information-sharing initiatives with government and private-sector entities.

What GAO Found

GAO found that although the center has taken some steps to develop analysis and warning capabilities, the strategic capabilities described in the presidential directive have not been achieved. By coordinating investigations and providing technical assistance the center has provided important support that has improved the Federal Bureau of Investigations' ability to investigate computer crimes. The center has also developed crisis management procedures and drafted an emergency law enforcement sector plan, which is now being reviewed by sector members. The center's information-sharing relationships are still evolving and will probably have limited effectiveness until reporting procedures and thresholds are defined and trust relationships are established. This testimony summarized an April 2001 report (GAO-01-323).