The National Guard Has Developed Cyber Capabilities That Could Support Civil Authorities, but DOD Does Not Have Full Visibility of National Guard Units’ Capabilities

		The National Guard Has Cyber Capabilities That Could Support Civil Authorities

The National Guard in the 50 states, three territories, and the District of  Columbia have capabilities that could be used—if requested and  approved—to perform DOD or state missions to support civil authorities in  a cyber incident. DOD does not have visibility into all National Guard units’  cyber capabilities because the department has not maintained a database  that identifies National Guard cyber capabilities that could support civil  authorities during a cyber incident. Without such a database,  DOD may not have timely access to these capabilities when requested by  civil authorities during a cyber incident. DOD Has Conducted and Participated in Exercises to Support Civil Authorities in a Cyber Incident, but Has Not Addressed Challenges with the Exercises

		DOD Has Conducted and Participated in Exercises to Prepare to Support Civil Authorities During or After a Cyber Incident

From fiscal years 2013 through 2015, DOD conducted or participated in 9  exercises that were designed to explore the application of policies for  supporting civil authorities or to test the response to simulated attacks on  cyber infrastructure owned by civil authorities. DOD Has Experienced Challenges in Its Civil- Support Exercises and Has Not Conducted a Tier 1 Exercise That Could Address Challenges

We identified three types of challenges with DOD’s exercises that could  limit the extent to which DOD is prepared to support civil authorities in a  cyber incident; DOD has not addressed the challenges. Specifically,
Limited access because of classified exercise environments:  According to documents we reviewed and officials we interviewed, DOD’s  tendency to exercise in a classified environment limited the ability of  other federal agencies and critical infrastructure owners to participate in  DSCA exercises. In addition to these challenges, we also observed that DOD has not  addressed its goals by conducting a tier 1 exercise involving various  partners in highly complex environments. Similarly,  U.S. Northern Command and ODASD for Cyber Policy officials told us  that the department needs to conduct a tier 1 exercise to explore a  disaster with physical and cyber effects. DOD’s Cyber Strategy planning  document states and officials agree that the department needs to conduct  such an exercise to prepare its forces to support civil authorities during or  after a cyber incident. Until DOD identifies and conducts a tier 1 exercise,  DOD will miss an opportunity to fully test response plans, evaluate  response capabilities, assess the clarity of established roles and  responsibilities, and improve proficiency in supporting DHS, other federal  agencies, and state and local authorities, if directed, in an emergency. For example, while National Guard  computer network defense teams could serve as first responders for  states for cyber emergencies and may provide surge capacity to national  capabilities, the readiness system will not include these teams. Because the Defense Readiness Reporting System and the  National Guard report do not currently enable DOD leaders to identify  National Guard cyber capabilities that could facilitate a quick response in  a cyber incident, we continue to believe that DOD should maintain a  database—as required by law—that can fully and quickly identify the  cyber capabilities that the National Guard possesses. Appendix I: Scope and Methodology

To examine the extent to which the National Guard has developed cyber  capabilities that could support civil authorities in response to a cyber  incident and the Department of Defense (DOD) has visibility over those  capabilities, we reviewed DOD policies and guidance to identify the  National Guard’s role in providing Defense Support of Civil Authorities,  National Guard cyber capabilities, and the mechanisms used to identify  National Guard capabilities.
Why GAO Did This Study

The DOD 2015 Cyber Strategy reported that a cyber attack could present a significant risk to U.S. national security. House Report 114-102 included a provision that GAO assess DOD's plans for providing support to civil authorities for a domestic cyber incident.
This report assesses whether (1) the National Guard has developed and DOD has visibility over capabilities that could support civil authorities in a cyber incident; and (2) DOD has conducted and participated in exercises to support civil authorities in cyber incidents and any challenges it faced. To conduct this review, GAO examined DOD and National Guard reports, policies, and guidance and interviewed officials about the National Guard's capabilities in defense support to civil authorities. GAO also reviewed after-action reports and interviewed DOD officials about exercise planning.

What GAO Found

National Guard units have developed capabilities that could be used, if requested and approved, to support civil authorities in a cyber incident; however, the Department of Defense (DOD) does not have visibility of all National Guard units' capabilities for this support. GAO found three types of cyber capabilities that exist in National Guard units:
Communications directorates : These organizations operate and maintain the National Guard's information network.
Computer network defense teams : These teams protect National Guard information systems, could serve as first responders for states' cyber emergencies, and provide surge capacity to national capabilities.
Cyber units : These teams are to conduct cyberspace operations.
However, DOD does not have visibility of all National Guard units' cyber capabilities because the department has not maintained a database that identifies the National Guard units' cyber-related emergency response capabilities, as required by law. Without such a database to fully and quickly identify National Guard cyber capabilities, DOD may not have timely access to these capabilities when requested by civil authorities during a cyber incident.
DOD has conducted or participated in exercises to support civil authorities in a cyber incident or to test the responses to simulated attacks on cyber infrastructure owned by civil authorities, but has experienced several challenges that it has not addressed. These challenges include limited participant access because of a classified exercise environment, limited inclusion of other federal agencies and critical infrastructure owners, and inadequate incorporation of joint physical-cyber scenarios. In addition to these challenges, DOD has not identified and conducted a “tier 1” exercise—an exercise involving national-level organizations and combatant commanders and staff in highly complex environments. A DOD cyber strategy planning document states, and DOD officials agreed, that such an exercise is needed to help prepare forces in the event of a disaster with physical and cyber effects. Until DOD identifies and conducts a tier 1 exercise, DOD will miss an opportunity to fully test response plans, evaluate response capabilities, assess the clarity of established roles and responsibilities, and address the challenges DOD has experienced in prior exercises. The table below shows selected DOD-conducted exercises.

What GAO Recommends

GAO recommends that DOD maintain a database that identifies National Guard cyber capabilities, conduct a tier 1 exercise to prepare its forces in the event of a disaster with cyber effects, and address challenges from prior exercises. DOD partially concurred with the recommendations, stating that current mechanisms and exercises are sufficient to address the issues highlighted in the report. GAO believes that the mechanisms and exercises, in their current formats, are not sufficient and continues to believe the recommendations are valid, as described in the report.