The vulnerability of U.S. critical infrastructure to cyber-attack and catastrophic failure was brought to light in 1997 in the report of the President's Commission on Critical InfrastructureProtection. These systems were updated duringthe Y2K crisis, but their cyber-security generally has not been a high priority. These industriescould be significantly affected by a cyber-attack targeting industrial control systems such assupervisory control and data acquisition (SCADA) systems, distributed control systems, and others. Potential Consequences of a Terrorist Attack

The consequences of an attack on the industrial control systems of critical infrastructure couldvary widely. For example, a successful cyber-attack on the public telephoneswitching network might deprive customers of telephone service while technicians reset and repairedthe switching network. (53)

	Current Initiatives

		Department of Homeland Security

The creation of the Department of Homeland Security has centralized within the Directorate of Information Analysis and Infrastructure Protection a number of offices related to criticalinfrastructure control system security: the Critical Infrastructure Assurance Office (CIAO), theNational Infrastructure Protection Center, the National Infrastructure Simulation and Analysis Center(NISAC), and part of the Department of Energy's Office of Energy Assurance. Through their Critical InfrastructureProtection program, the National Institute of Standards and Technology is developing informationsecurity requirements, best-practice guidelines, and test methods for the process control sector. In this rule, critical energy infrastructure information (CEII) is defined as: 
... information about proposed or existing critical infrastructure that: (i) Relates to the production, generation, transportation, transmission, ordistribution of energy; (ii) Could be useful to a person in planning an attack on critical infrastructure;(iii) Is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. The FERC has also published a notice of public rulemaking which includes cyber-security standards for the electric industry. These include the development of standards, either voluntary or mandatory, forcybersecurity of control systems; identifying and addressing critical infrastructure interdependencies;developing encryption methods for control systems; identifying and establishing technologies toaddress existing vulnerabilities; funding long-term research into secure SCADA systems; providingfor free exchange of risk information between the federal government, private industry, and othercritical infrastructure sectors; and assessing federal activities in this area. Because of the national importance of critical infrastructure systems, a uniformstandard might be developed, with the input of advocates, industries and the federal government,which would include the functionality necessary to protect industrial control systems, whileproviding for more secure operation. This approach has been taken by researchers in both industry and federal government laboratories. Increasing Information Sharing

The new FOIA exemptions created in the Homeland Security Act of 2002 ( P.L. Oversight of Department of Homeland Security Coordination

Policymakers may also wish to assess the effectiveness of the Department of Homeland Security in coordinating security enhancements to control systems, promoting government/industrypartnerships, and performing risk and vulnerability assessments.
Much of the U.S. critical infrastructure is potentially vulnerable to cyber-attack. Industrial control computer systems involved in this infrastructure are specific points of vulnerability, as cyber-security forthese systems has not been previously perceived as a high priority. Industry sectorspotentially affected by a cyber-attack on process control systems include the electrical, telephone,water, chemical, and energy sectors.
The federal government has issued warnings regarding increases in terrorist interest in the cyber-security of industrial control systems, citing international terrorist organization interest incritical infrastructure and increases in cyber-attacks on critical infrastructure computer systems. Thepotential consequences of a successful cyber-attack on critical infrastructure industrial controlsystems range from a temporary loss of service to catastrophic infrastructure failure affectingmultiple states for an extended duration.
The National Strategy for Securing Cyberspace , released in February 2003, contains a number of suggestions regarding security measures for control systems. A focus on the further integrationof public/private partnerships and information sharing is described, along with suggestions thatstandards for securing control systems be developed and implemented.
The Homeland Security Act of 2002 ( P.L. 107-296 ) transferred and integrated several federal entities that play a role in cyber-security of control systems into the Department of HomelandSecurity. These entities include the Critical Infrastructure Assurance Office, the NationalInfrastructure Protection Center, the National Infrastructure Simulation and Analysis Center, andparts of the Department of Energy's Office of Energy Assurance. Additionally, the HomelandSecurity Act of 2002 created a new class of information, critical infrastructure information, whichcan be withheld from the public by the federal government.
Efforts in increasing the cyber-security of control systems occur both at federal government facilities and, in critical infrastructure sectors, through industry groups. The Department of EnergyNational Laboratories, the Department of Defense, and the National Institute of Standards andTechnology all have programs to assess and ameliorate the cyber-vulnerabilities of control systems. Industry-based research into standards, best practices, and control system encryption is ongoing inthe natural gas and electricity sector.
Possible policy options for congressional consideration include further development of uniform standards for infrastructure cyber-protection; growth in research into security methods for industrialcontrol systems; assessing the effectiveness of the new exemptions to the Freedom of InformationAct; and the integration of previous offices in the new Department of Homeland Security.
This report will be updated as events warrant.