Identified Federal Agencies Have Had Limited Coordination with State and Local Governments Regarding Cybersecurity at Public Safety Entities

The five identified federal agencies have, to varying degrees, coordinated  cybersecurity-related activities with state and local governments. However, except for supporting critical infrastructure planning,  federal activities were generally not targeted towards or focused on public  safety entities. However,  federal agencies performed some coordination-related activities directed  to public safety entities, including issuing alerts about cyber-based  attacks to public safety entities, performing risk assessments, providing  technical assistance through education and awareness efforts, and  administering grants that allowed for expenditures for IT equipment and  cybersecurity tools. The plan is intended to serve as a guide for the sector,  including the public safety entities, to set protective program goals and  objectives, identify assets, assess risks, prioritize infrastructure  components and programs to enhance risk mitigation, implement  protective programs, measure program effectiveness, and incorporate  research and development of technology initiatives into sector planning  efforts. While DHS and the Emergency Services Sector Coordinating Council  addressed in the 2010 Emergency Services Sector-Specific Plan aspects  of cybersecurity of the current environment, they did not address the  development and implementation of NG 911 and the FirstNet network in  public safety entities. According to DHS officials, the  process for updating the sector-specific plans will begin after the revised  NIPP has been released. A revised NIPP was released in December  2013, and, according to DHS, a new sector-specific plan is estimated to  be completed in December 2014. Until DHS, in collaboration with  stakeholders, develops the next iteration of the sector-specific plan, it is  unclear if the cybersecurity implications of implementing these  technologies will be considered. Without such planning, information systems are at  an increased risk of failure or being unavailable at critical moments. Although Identified Federal Agencies Provided Grants to State and Local Governments, These Grants Did Not Specifically Target Cybersecurity of Public Safety Entities

Federal grant programs have been used to fund technology  enhancements so that public safety entities could address the evolution in  communications technology and for technology enhancements at state  and local public safety entities to include allocations for cybersecurity  enhancements at the grantee’s option. The National Highway Traffic  Safety Administration and the NTIA allocated $43.5 million in grants to  states over a 3-year period, starting in September 2009, to help  implement enhancements to 911 system functionality to address the  increase in 911 calls from cell phones and the future plans for PSAPs to  handle text and other message formats. While cybersecurity was not specified as a  requirement in a grant program’s eligible use of funds, it was not  precluded from the allowed use of the funds. Recommendation

We recommend that the Secretary of Homeland Security, in collaboration  with emergency service sector stakeholders, address the cybersecurity  implications of implementing NG 911 and the FirstNet network in the next  iteration of sector plans. In its comments, DHS  concurred with our recommendation. Appendix I: Objective, Scope, and Methodology

Our objective was to determine the extent to which federal agencies  coordinated with state and local governments regarding cybersecurity  efforts at emergency operations centers, public safety answering points,  and first responder agencies involved in handling emergency calls. To identify the roles of federal agencies and select the organizations  responsible for coordinating cybersecurity efforts with state and local  government for public safety entities, we reviewed relevant federal law,  policy, regulation, and critical infrastructure protection-related strategies,  including the following:
Homeland Security Act of 2002;
Middle Class Tax Relief and Job Creation Act of 2012;
Implementing Recommendations of the 9/11 Commission Act of 2007;
2009 National Infrastructure Protection Plan;
2010 Emergency Services Sector-Specific Plan;
2012 Emergency Services Sector Cyber Risk Assessment;
2003 National Strategy to Secure Cyberspace;
Department of Homeland Security’s Information Sharing Strategy,
Presidential Policy Directive 21—Critical Infrastructure Security and  Resilience, February 12, 2013;
Executive Order 13618—Assignment of National Security and  Emergency Preparedness Communications Functions, July 6, 2012;
Executive Order 13636—Improving Critical Infrastructure  Cybersecurity, February 19, 2013; and
Title 47, Code of Federal Regulations sections 4.5, 4.9, 12.3, and Part  400. Based on our analysis, we determined that the  Departments of Homeland Security, Commerce, Justice, and  Transportation and the Federal Communications Commission were key  federal entities relevant to our objective and identified five key activities  related to cybersecurity coordination, to evaluate the federal entities  against: (1) supporting critical infrastructure protection-related planning,  (2) issuing grants, (3) sharing information, (4) providing technical  assistance, and (5) regulating and overseeing essential functions.
Why GAO Did This Study

Individuals can contact fire, medical, and police first responders in an emergency by dialing 911. To provide effective emergency services, public safety entities such as 911 call centers use technology including databases that identifies phone number and location data of callers. Because these critical systems are becoming more interconnected, they are also increasingly susceptible to cyber-based threats that accompany the use of Internet-based services. This, in turn, could impact the availability of 911 services.
GAO was asked to review federal coordination with state and local governments regarding cybersecurity at public safety entities. The objective was to determine the extent to which federal agencies coordinated with state and local governments regarding cybersecurity efforts at emergency operations centers, public safety answering points, and first responder organizations involved in handling 911 emergency calls. To do so, GAO analyzed relevant plans and reports and interviewed officials at (1) five agencies that were identified based on their roles and responsibilities established in federal law, policy, and plans and (2) selected industry associations and state and local governments.

What GAO Found

The five identified federal agencies (Departments of Homeland Security, Commerce, Justice, and Transportation and Federal Communications Commission (FCC)) have to varying degrees, coordinated cybersecurity-related activities with state and local governments. These activities included (1) supporting critical infrastructure protection-related planning, (2) issuing grants, (3) sharing information, (4) providing technical assistance, and (5) regulating and overseeing essential functions. However, except for supporting critical infrastructure planning, federal coordination of these activities was generally not targeted towards or focused on the cybersecurity of state and local public safety entities involved in handling 911 emergency calls.
Under the critical infrastructure protection planning activity, the Department of Homeland Security (DHS) coordinated with state and local governments and other federal stakeholders to complete the Emergency Services Sector-Specific Plan. The plan is to guide the sector, including the public safety entities, in setting protective program goals and objectives, identifying assets, assessing risks, prioritizing infrastructure components and programs to enhance risk mitigation, implementing protective programs, measuring program effectiveness, and incorporating research and development of technology initiatives into sector planning efforts. It also addressed aspects of cybersecurity of the current environment. However, the plan did not address the development and implementation of more interconnected, Internet-based planned information technologies, such as the next generation of 911 services. According to DHS officials, the plan did not address these technologies, in part, because the process for updating the sector-specific plan will begin after the release of the revised National Infrastructure Protection Plan--a unifying framework to enhance the safety of the nation's critical infrastructure. A revised plan was released in December 2013, and, according to DHS, a new sector-specific plan is estimated to be completed in December 2014. Until DHS, in collaboration with stakeholders, addresses the cybersecurity implications of the emerging technologies in planning activities, information systems are at an increased risk of failure or being unavailable at critical moments.
Under the other four activities, federal agencies performed some coordination related activities for public safety entities including administering grants for information technology enhancements, sharing information about cyber-based attacks, and providing technical assistance through education and awareness efforts. For example, the Departments of Transportation and Commerce allocated $43.5 million in grants to states over a 3-year period, starting in September 2009, to help implement enhancements to 911 system functionality. While these grants were not targeted towards the cybersecurity of these systems, cybersecurity was not precluded from the allowed use of the funds.

What GAO Recommends

GAO recommends that the Secretary of Homeland Security collaborate with emergency services sector stakeholders to address the cybersecurity implications of implementing technology initiatives in related plans. DHS concurred with GAO's recommendation.