For example, the  Defense Science Board Task Force reported that the commercial power  grid is “brittle, increasingly centralized, capacity-strained, and largely  unprotected from physical attack, with little stockpiling of critical  hardware.” Similarly, according to the May 2007 Infrastructure Resiliency  Guide for DOD’s Defense Critical Infrastructure Program, “the electric  power network is a complex system of interconnected components that  can fail and cause massive service disruptions.” Factors that contribute to  the grid’s vulnerability include (1) increasing national demand for  electricity; (2) an aging electrical power infrastructure; (3) increased  reliance on automated control systems that are susceptible to  cyberattacks; (4) the attractiveness of electrical power infrastructure as  targets for physical or terrorist attacks; (5) long lead times (of several  months to several years) for replacing high-voltage transformers—which  cost several millions of dollars and are manufactured only in foreign  countries—if attacked or destroyed; and (6) more frequent interruptions in  fuel supplies to electricity-generating plants. On October  14, 2008, DOD designated 34 assets through DCIP as its most critical  assets—assets of such extraordinary importance to DOD operations that  according to DOD, their incapacitation or destruction would have a very  serious, debilitating effect on the ability of the department to fulfill its  missions. Other Risk Management Programs and Activities in DOD

In addition to using DCIP, DOD also identifies vulnerabilities and manages  the risks of its most critical assets, including those related to electrical  power, through other DOD mission assurance programs or activities,  including those related to force protection; antiterrorism; information  assurance; continuity of operations; chemical, biological, radiological,  nuclear, and high-explosive defense; readiness; and installation  preparedness. Department of Energy. DOD’s Most Critical Assets Are Vulnerable to Electrical Power Disruptions, but DOD Lacks Sufficient Information to Determine the Full Extent of Their Vulnerability

		DOD’s Most Critical Assets Rely on Electrical Power and Depend Overwhelmingly on Commercial Electrical Power Grids as Their Primary Supply

DOD’s most critical assets and the missions they support are vulnerable to  disruptions in electrical power supplies because of the extent of their  reliance on electricity, particularly from the commercial electrical power  grid. These  vulnerability assessments—most of which the Defense Threat Reduction  Agency has been conducting for DOD—include specific reviews of the  critical assets’ supporting electrical power networks “to ensure that the  distribution network at a given location and supporting offsite [electrical  power] system has the capacity, redundancy, path diversity, security,  survivability, and reliability to properly support a given mission.”
DOD Instruction 3020.45 requires DOD to conduct DCIP vulnerability  assessments on all of its most critical assets at least once every 3 years. DOD Lacks Additional Guidance for Conducting DCIP Vulnerability Assessments on Its Non- DOD-Owned Most Critical Assets

DOD has not yet conducted or scheduled DCIP vulnerability assessments,  including assessments of electrical power vulnerabilities, on any of its  non-DOD-owned most critical assets—both those located in the United  States and in foreign countries—and has not yet developed guidance  addressing the unique challenges related to conducting the assessments on  such assets. The Defense Infrastructure Sector Lead Agent for Public Works Has Not Completed Its Technical Analysis of Public Works Infrastructure (Including Electricity) Supporting DOD Critical Assets

The U.S. Army Corps of Engineers (Corps)—which serves as DCIP’s  DISLA for Public Works (including electricity)—has not completed  preliminary technical analyses of DOD installation infrastructure. According to a Corps  official, the Corps has been unable to begin these analyses because it has  not received infrastructure-related information that it requires from the  military services. Conclusions

DOD relies on commercial electrical power grids for secure, uninterrupted  electrical power supplies to support its most critical assets—those whose  incapacitation or destruction would have a very serious, debilitating effect  on the department’s ability to fulfill its missions. However, according to  the Defense Science Board Task Force on DOD Energy Strategy, the  commercial electrical power grids have become increasingly fragile and  vulnerable to extended power disruptions that could severely impact  DOD’s most critical assets, their supporting infrastructure, and the  missions they support, and disruptions to the electrical power grid have  occurred. With more comprehensive knowledge of DOD’s most critical assets’ risks  and vulnerabilities to electrical power disruptions and more effective  coordination with electricity providers, DOD can better avoid  compromising crucial DOD-wide missions during electrical power  disruptions. This additional information may also improve DOD’s ability to  effectively prioritize funding needed to address identified risks and  vulnerabilities of its most critical assets to electrical power disruptions. Recommendations for Executive Action

To ensure that DOD has sufficient information to determine the full extent  of the risks and vulnerabilities to electrical power disruptions of its most  critical assets, we recommend that the Secretary of Defense direct the  Assistant Secretary of Defense for Homeland Defense and Americas’  Security Affairs, in collaboration with the Joint Staff’s Directorate for  Antiterrorism and Homeland Defense, combatant commands, military  services, and other Defense Critical Infrastructure Program stakeholders,  as appropriate, to take the following five actions:    Complete Defense Critical Infrastructure Program vulnerability  assessments, as required by DOD Instruction 3020.45, on all of DOD’s  most critical assets by October 2011. Develop additional guidelines, an implementation plan, and a schedule  for conducting Defense Critical Infrastructure Program vulnerability  assessments on all non-DOD-owned most critical assets located in the  United States and abroad in conjunction with other federal agencies, as  appropriate, that have a capability to implement the plan. Finalize guidelines currently being developed to coordinate Defense  Critical Infrastructure Program assessment criteria and processes more  systematically with those of other DOD mission assurance programs. Develop explicit Defense Critical Infrastructure Program guidelines for  assessing the critical assets’ vulnerabilities to long-term electrical  power disruptions. As we reported, as of June 2009, DOD had  conducted DCIP assessments on 14 of the 34 most critical assets. 18. e.  Single points of failure within commercial/DOD electrical power  infrastructures. Is this asset located within the United States? 10. 31. 34.
Why GAO Did This Study

The Department of Defense (DOD) relies on a global network of defense critical infrastructure so essential that the incapacitation, exploitation, or destruction of an asset within this network could severely affect DOD's ability to deploy, support, and sustain its forces and operations worldwide and to implement its core missions, including those in Iraq and Afghanistan as well as its homeland defense and strategic missions. In October 2008, DOD identified its 34 most critical assets in this network--assets of such extraordinary importance to DOD operations that according to DOD, their incapacitation or destruction would have a very serious, debilitating effect on the ability of the department to fulfill its missions. Located both within the United States and abroad, DOD's most critical assets include both DOD- and non-DOD-owned assets. DOD relies overwhelmingly on commercial electrical power grids for secure, uninterrupted electrical power supplies to support its critical assets. DOD is the single largest consumer of energy in the United States, as we have noted in previous work. According to a 2008 report by the Defense Science Board Task Force on DOD's Energy Strategy, DOD has traditionally assumed that commercial electrical power grids are highly reliable and subject to only infrequent (generally weather-related), short-term disruptions. For backup supplies of electricity, DOD has depended primarily on diesel generators with short-term fuel supplies. In 2008, however, the Defense Science Board reported that "[c]ritical national security and homeland defense missions are at an unacceptably high risk of extended outage from failure of the [commercial electrical power] grid" upon which DOD overwhelmingly relies for its electrical power supplies. Specifically, the reliability and security of commercial electrical power grids are increasingly threatened by a convergence of challenges, including increased user demand, an aging electrical power infrastructure, increased reliance on automated control systems that are susceptible to cyberattack, the attractiveness of electrical power infrastructure for terrorist attacks, long lead times for replacing key electrical power equipment, and more frequent interruptions in fuel supplies to electricity-generating plants. As a result, commercial electrical power grids have become increasingly fragile and vulnerable to extended disruptions that could severely impact DOD's most critical assets, their supporting infrastructure, and ultimately the missions they support.

What GAO Found

DOD's most critical assets are vulnerable to disruptions in electrical power supplies, but DOD lacks sufficient information to determine the full extent of the risks and vulnerabilities these assets face. All 34 of these most critical assets require electricity continuously to support their military missions, and 31 of them rely on commercial power grids--which the Defense Science Board Task Force on DOD Energy Strategy has characterized as increasingly fragile and vulnerable--as their primary source of electricity. DOD Instruction 3020.45 requires DOD to conduct vulnerability assessments on all its most critical assets at least once every 3 years. Also, the Office of the Assistant Secretary of Defense for Homeland Defense and Americas' Security Affairs ASD(HD&ASA) has requested the U.S. Army Corps of Engineers--which serves as the Defense Critical Infrastructure Program's Defense Infrastructure Sector Lead Agent for Public Works--to conduct preliminary technical analyses of DOD installation infrastructure (including electrical power infrastructure) to support the teams conducting Defense Critical Infrastructure Program vulnerability assessments on the most critical assets. (1) As of June 2009, and according to ASD(HD&ASA) and the Joint Staff, DOD had conducted Defense Critical Infrastructure Program vulnerability assessments on 14 of the 34 most critical assets.18 DOD has not conducted the remaining assessments because it did not identify the most critical assets until October 2008. To comply with the instruction, DOD would have to complete Defense Critical Infrastructure Program vulnerability assessments on all most critical assets by October 2011. (2) DOD has neither conducted, nor developed additional guidelines and time frames for conducting, these vulnerability assessments on any of the five non-DOD-owned most critical assets located in the United States or foreign countries, citing security concerns and political sensitivities. (3) The U.S. Army Corps of Engineers has not completed the preliminary technical analyses requested because it has not yet received infrastructure-related information regarding the networks, assets, points of service, and inter- and intradependencies related to electrical power systems that it requires from the military services. (4) Although DOD is in the process of developing guidelines, it does not systematically coordinate Defense Critical Infrastructure Program vulnerability assessment processes and guidelines with those of other, complementary DOD mission assurance programs--including force protection; antiterrorism; information assurance; continuity of operations; chemical, biological, radiological, nuclear, and high-explosive defense; readiness; and installation preparedness--that also examine electrical power vulnerabilities of the most critical assets, because DOD has not established specific guidelines for such systematic coordination. (5) The 10 Defense Critical Infrastructure Program vulnerability assessments we reviewed did not explicitly consider assets' vulnerabilities to longer-term (i.e., of up to several weeks' duration) electrical power disruptions19 on a mission-specific basis, as DOD has not developed explicit Defense Critical Infrastructure Program benchmarks for assessing electrical power vulnerabilities associated with longer-term electrical power disruptions. With more comprehensive knowledge of the most critical assets' risks and vulnerabilities to electrical power disruptions, DOD can better avoid compromising crucial DOD-wide missions during electrical power disruptions. This additional information may also improve DOD's ability to effectively prioritize funding needed to address identified risks and vulnerabilities of its most critical assets to electrical power disruptions.