GPS is used extensively and in various ways in many critical  infrastructure sectors for PNT information. In developing the NRE, DHS conducted a  scenario-based risk assessment for critical infrastructure using subject  matter experts from inside and outside government. The NRE Did Not Fully Follow Risk Assessment Guidance or Fully Assess GPS Risks

Risk assessments, such as the NRE, involve complex analysis;  conducting a risk assessment across multiple sectors of systems with  many unknowns and little data is particularly challenging. DOT and DHS Have Initiated Mitigation Efforts, but Have Not Met All Requirements

		DOT and DHS Are Required to Develop Backup Capabilities to Mitigate GPS Disruptions but Have Made Limited Progress

According to a presidential directive, DOT, in coordination with DHS, is  required to develop, acquire, operate, and maintain backup capabilities  that can support critical civilian and commercial infrastructure in the event  of a GPS disruption. DOT and DHS have initiated a variety of ongoing mitigation  efforts that contribute to fulfilling their presidential directive, such as (1)  developing plans and strategies for the nation’s PNT architecture, (2)  researching GPS alternatives for aviation, (3) developing plans and  strategies for GPS interference detection, (4) researching possibilities for  a nationwide timing backup, and (5) conducting other studies. In 2007, DHS began efforts on GPS interference detection and  mitigation (IDM) to improve the federal government’s ability to detect,  locate, and mitigate sources of GPS interference. Other activities remain incomplete, including those related to  identifying GPS backup-system requirements and determining suitability  of backup capabilities. In prior work, we  have identified key elements of effective collaboration that can help  enhance and sustain collaboration among federal agencies, thereby  maximizing performance and results. Without clearly defining both roles and desired outcomes for efforts that  require collaboration, DOT and DHS cannot ensure that they will satisfy  mutual responsibilities. Select Critical Infrastructure Sectors Employ Various Mitigation Strategies, but DHS Has Not Measured the Effectiveness of These Efforts

		Sector-Specific Strategies to Mitigate GPS Disruptions Vary

Agency officials and industry representatives from the four critical  infrastructure sectors we contacted said their sectors would generally be  able to withstand short-term GPS disruptions and provided examples of  strategies to mitigate GPS disruptions for aspects of sector operations, as  follows. Increasing dependency. Although DHS attempted to overcome these challenges, the NRE also  lacks some of the key characteristics of risk assessments outlined in the  NIPP and, as a result, is incomplete. As such, the NRE is limited in its  usefulness to inform mitigation planning, priorities, and resource  allocation. Federal  risk management policy requires DHS to work with SSAs and sector  partners to measure the nation’s ability to manage and reduce risks to  critical infrastructure by using a metrics and analysis process. However,  we found DHS has not measured the effectiveness of sector mitigation  efforts to GPS disruptions. As a result, DHS cannot ensure that critical  infrastructure sectors could sustain essential operations during GPS  disruptions. The lack of agreed-upon metrics to measure the actual  effectiveness of sector mitigation efforts hinders DHS’s ability to  objectively assess improvements, track progress, establish accountability,  provide feedback mechanisms, or inform decision makers about the  appropriateness of—or need for additional—mitigation activities. Nevertheless, DOT and  DHS have not defined their respective roles, responsibilities, and  authorities or what agreed-upon outcome would satisfy the presidential  directive. Recommendations for Executive Action

To ensure that the increasing risks of GPS disruptions to the nation’s  critical infrastructure are effectively managed, we recommend that the  Secretary of Homeland Security take the following two actions:  Increase the reliability and usefulness of the GPS risk assessment by  developing a plan and time frame to collect relevant threat,  vulnerability, and consequence data for the various critical  infrastructure sectors, and periodically review the readiness of data to  conduct a more data-driven risk assessment while ensuring that  DHS’s assessment approach is more consistent with the NIPP. Appendix I: Objectives, Scope, and Methodology

We reviewed (1) the extent to which the Department of Homeland  Security (DHS) has assessed the risks of Global Positioning System  (GPS) disruptions and their potential effects on the nation’s critical  infrastructure, (2) the extent to which the Department of Transportation  (DOT) and DHS have planned or developed backup capabilities or other  strategies to mitigate the effects of GPS disruptions, and (3) what  strategies, if any, selected critical infrastructure sectors employ to mitigate  the effects of GPS disruptions, and any remaining challenges they face. To review the extent to which DHS has assessed the risks of GPS  disruptions and their potential effects on the nation’s critical infrastructure,  we compared DHS’s efforts to established risk assessment criteria and  contacted GPS stakeholders.
Why GAO Did This Study

GPS provides positioning, navigation, and timing data to users worldwide and is used extensively in many of the nation's 16 critical infrastructure sectors, such as communications and transportation. GPS is also a key component in many of the modern conveniences that people rely on or interact with daily. However, sectors' increasing dependency on GPS leaves them potentially vulnerable to disruptions. GAO was asked to review the effects of GPS disruptions on the nation's critical infrastructure. GAO examined (1) the extent to which DHS has assessed the risks and potential effects of GPS disruptions on critical infrastructure, (2) the extent to which DOT and DHS have developed backup strategies to mitigate GPS disruptions, and (3) what strategies, if any, selected critical infrastructure sectors employ to mitigate GPS disruptions and any remaining challenges. GAO reviewed documents, compared them to relevant federal guidance, and interviewed representatives and experts from federal and state governments, industry, and academia. The focus of this review was on civilian GPS uses within four critical infrastructure sectors.

What GAO Found

To assess the risks and potential effects from disruptions in the Global Positioning System (GPS) on critical infrastructure, the Department of Homeland Security (DHS) published the GPS National Risk Estimate (NRE) in 2012. In doing so, DHS conducted a scenario-based risk assessment for four critical infrastructure sectors using subject matter experts from inside and outside of government. Risk assessments involve complex analysis, and conducting a risk assessment across multiple sectors with many unknowns and little data is challenging. DHS's risk management guidance can be used to help address such challenges. However, we found the NRE lacks key characteristics of risk assessments outlined in DHS's risk management guidance and, as a result, is incomplete and has limited usefulness to inform mitigation planning, priorities, and resource allocation. A plan to collect and assess additional data and subsequent efforts to ensure that the risk assessment is consistent with DHS guidance would contribute to more effective GPS risk management.
A 2004 presidential directive requires the Department of Transportation (DOT), in coordination with DHS, to develop backup capabilities to mitigate GPS disruptions, and the agencies have initiated a variety of efforts that contribute to fulfilling the directive. For example, DOT is researching GPS alternatives for aviation, and DHS began efforts on GPS interference detection and mitigation and is researching possibilities for a nationwide backup to GPS timing, which is used widely in critical infrastructure. However, due to resource constraints and other reasons, the agencies have made limited progress in meeting the directive, and many tasks remain incomplete, including identifying GPS backup requirements and determining suitability of backup capabilities. Furthermore, the agencies' efforts have been hampered by a lack of effective collaboration. In particular, DOT and DHS have not clearly defined their respective roles, responsibilities, and authorities or what outcomes would satisfy the presidential directive. Without clearly defining both roles and desired outcomes, DOT and DHS cannot ensure that they will satisfy mutual responsibilities. Implementing key elements of effective collaboration would allow the agencies to address many uncertainties regarding fulfillment of their presidential policy directive.
Selected critical infrastructure sectors employ various strategies to mitigate GPS disruptions. For example, some sectors can rely on timing capabilities from other sources of precise time in the event of GPS signal loss. However, both the NRE and stakeholders we interviewed raised concerns about the sufficiency of the sectors' mitigation strategies. Federal risk management guidance requires DHS to work with federal agencies and critical infrastructure sector partners to measure the nation's ability to reduce risks to critical infrastructure by using a process that includes metrics. We found that DHS has not measured the effectiveness of sector mitigation efforts to GPS disruptions and that, as a result, DHS cannot ensure that the sectors could sustain essential operations during GPS disruptions. The lack of agreed-upon metrics to measure the effectiveness of sector mitigation efforts hinders DHS's ability to objectively assess improvements, track progress, establish accountability, provide feedback mechanisms, or inform decision makers about the appropriateness of the mitigation activities.

What GAO Recommends

DHS should ensure that its GPS risk assessment approach is consistent with DHS guidance; develop a plan to measure the effectiveness of mitigation efforts; and DOT and DHS should improve collaboration. DHS concurred with the latter two recommendations but did not concur with the first. GAO continues to believe that improving the risk assessment approach will capitalize on progress DHS has made and will improve future efforts.