Industry Is Addressing the Risks of Using Foreign- Manufactured Equipment

		Companies Address Supply Chain Risk through Procurement and Testing Practices

The network providers and equipment manufacturers we met with told us  they address the potential security risks of using foreign-manufactured  equipment through voluntary risk management practices. Nonetheless, the companies we spoke with told us that security is a high  priority because their brand image and profitability depends, in part, on  avoiding any type of breach of security or disruption of service. Network providers and equipment manufacturers told us that their  voluntary risk management practices are in the areas of vendor selection,  vendor security requirements, and equipment testing and monitoring, as  described below and in figure 4. They said these practices are often a  part of their company’s overall security plans and procurement processes  and are applied throughout the entire life cycle of their equipment. Communications Sector  Coordinating Council (CSCC)
In accordance with Homeland Security Presidential Directive 7, the CSCC  is an industry-led group that represents the viewpoints from the U.S.  communications sector and facilitates coordination between industry and  the federal government on improving physical and cyber security of the  communications critical infrastructure., Representatives from the  CSCC told us that the CSCC began meeting with the federal government  in March 2011 to discuss supply chain security, which led to the creation  of a CSCC working group to facilitate dialogue, planning, and  coordination among the government and industry on supply chain risk  management. Federal Government Has Begun Efforts to Address the Risks of Using Foreign- Manufactured Equipment

The White House released an Executive Order in February 2013 that is  likely to have an impact on communications supply chain security. We  identified other federal efforts, such as the Interim Telecommunications  Sector Risk Management Task Force, that could impact communications  supply chain security, but the results of those efforts are considered  sensitive, so we do not include them here. Executive Order on Cybersecurity for Critical Infrastructure

An Executive Order released in February 2013 calls for NIST to develop a  framework to reduce cyber risks to critical infrastructure and for DHS and  others to spearhead increased information sharing between the federal  government and owners and operators of critical infrastructure including  communications networks. In February 2013, NIST published a request for information  (RFI) in which NIST stated it is conducting a comprehensive review to  develop the framework and is seeking stakeholder input. According to  NIST officials, the extent to which supply chain security of commercial  communications networks will be incorporated into the framework is  largely dependent on the input it receives from stakeholders. Other Approaches to Supply Chain Risk Management

		Risk Management Approaches from Selected Countries

			Australian Reform Proposal

The Australian government is considering a reform proposal to establish a  risk-based regulatory framework to better manage national security  challenges to Australia’s telecommunications infrastructure. Specifically, the  proposal requires carriers and carriage service providers to be able to  demonstrate competent supervision and effective controls over their  networks. The government would also have the authority to use  enforcement measures to address noncompliance, as described in   table 1. Under this framework, the government would provide guidance to inform  carriers and carriage service providers how they can maintain competent  supervision and effective control over their networks and educate carriers  and carriage service providers on national security risks. Potential Issues Related to Use of These Approaches

While these approaches are intended to improve supply chain security of  communications networks, they may also create the potential for trade  barriers, additional costs, and constraints on competition. We also  spoke with federal entities that have a role in addressing cybersecurity,  international trade, and the Committee on Foreign Investment in the U.S.  (CFIUS). We focused this work on the five wireless and five wireline network  providers with the highest revenue, the eight manufacturers of routers  and switches with the highest market shares in the U.S. market, and two  cable network providers. To identify how the federal government is addressing the potential risks of  foreign-manufactured equipment that is used in commercial  communications networks, we asked federal agencies to identify statutes  and regulations to identify potential sources of the federal government’s  legal and regulatory authority over how communications network  providers ensure the security of their U.S. commercial networks. To determine other approaches, including those of foreign countries, for  addressing the potential risks of using foreign-manufactured equipment in  commercial communications networks, we conducted a literature review  and interviewed stakeholders. We reviewed documents and interviewed officials from governmental  entities in Australia, India, and the UK to describe the approaches and  issues that could arise from using these approaches. DHS has not identified specific authorities that would permit it to take  action to ensure the security of the supply chain of commercial networks.
Why GAO Did This Study

The United States is increasingly reliant on commercial communications networks for matters of national and economic security. These networks, which are primarily owned by the private sector, are highly dependent on equipment manufactured in foreign countries. Certain entities in the federal government view this dependence as an emerging threat that introduces risks to the networks. GAO was requested to review actions taken to respond to security risks from foreign-manufactured equipment.
This testimony addresses (1) how network providers and equipment manufacturers help ensure the security of foreign-manufactured equipment used in commercial communications networks, (2) how the federal government is addressing the risks of such equipment, and (3) other approaches for addressing these risks and issues related to these approaches.
This is a public version of a sensitive report that GAO issued in May 2013. Information deemed sensitive has been omitted. For the May 2013 report, GAO reviewed laws and regulations and interviewed officials from federal entities with a role in addressing cybersecurity or international trade, the five wireless and five wireline network providers with the highest revenue, and the eight manufacturers of routers and switches with the highest U.S. market shares. GAO obtained documentary and testimonial evidence from governmental entities in Australia, India, and the United Kingdom, because of their actions to protect their networks from supply chain attacks

What GAO Found

The network providers and equipment manufacturers GAO spoke with reported taking steps in their security plans and procurement processes to ensure the integrity of parts and equipment obtained from foreign sources. Although these companies do not consider foreign-manufactured equipment to be their most pressing security threat, their brand image and profitability depend on providing secure, reliable service. In the absence of industry or government standards on the use of this equipment, companies have adopted a range of voluntary risk-management practices. These practices span the life cycle of equipment and cover areas such as selecting vendors, establishing vendor security requirements, and testing and monitoring equipment. Equipment that is considered critical to the functioning of the network is likely to be subject to more stringent security requirements, according to these companies. In addition to these efforts, companies are collaborating on the development of industry security standards and best practices and participating in information-sharing efforts within industry and with the federal government.
The federal government has begun efforts to address the security of the supply chain for commercial networks. In 2013, the President issued an Executive Order to create a framework to reduce cyber risks to critical infrastructure. The National Institute of Standards and Technology (NIST)--a component within the Department of Commerce--is responsible for leading the development of the cybersecurity framework, which is to provide technology-neutral guidance to critical infrastructure owners and operators. NIST published a request for information in which NIST stated it is conducting a comprehensive review to obtain stakeholder input and develop the framework. NIST officials said the extent to which supply chain security of commercial communications networks will be incorporated into the framework is dependent in part on the input it receives from stakeholders. GAO identified other federal efforts that could impact communications supply chain security, but the results of those efforts were considered sensitive.
There are a variety of other approaches for addressing the potential risks posed by foreign-manufactured equipment in commercial communications networks, including those approaches taken by foreign governments. For example, the Australian government is considering a proposal to establish a risk-based regulatory framework that requires network providers to be able to demonstrate competent supervision and effective controls over their networks. The government would also have the authority to use enforcement measures to address noncompliance. In the United Kingdom, the government requires network and service providers to manage risks to network security and can impose financial penalties for serious security breaches. While these approaches are intended to improve supply chain security of communications networks, they may also create the potential for trade barriers, additional costs, and constraints on competition, which the federal government would have to take into account if it chose to pursue such approaches.