Federal regulation recognizes the need to protect critical infrastructures. Although Both Cyber and Physical Incidents Have Caused Disruptions, the Internet Has Not Yet Suffered a Catastrophic Failure

The Internet’s infrastructure is vulnerable to disruptions in service due to  terrorist and other malicious attacks, natural disasters, accidents,  technological problems, or a combination of the above. Recent cyber and physical  incidents have caused localized or regional disruptions, highlighting the  importance of recovery planning. These incidents can be intentional (such as a cyber  attack or a terrorist attack on our nation’s physical infrastructure) or  unintentional (such as a software malfunction or a natural disaster). A physical incident could be caused by an intentional attack, a natural  disaster, or an accident. Existing Laws and Regulations Apply to the Internet, but Numerous Uncertainties Exist in Using Them for Internet Recovery

Several federal laws and regulations provide broad guidance that applies to  the Internet infrastructure, but it is not clear how useful these authorities  would be in helping to recover from a major Internet disruption, because  some do not specifically address Internet recovery and others have seldom  been used. However, this law and regulation do not  specifically address roles and responsibilities in the event of an Internet  disruption. Although certain  policies direct DHS to work with the private sector to ensure infrastructure protection, DHS  does not have the authority to direct Internet owners and operators in their recovery  efforts.”

	DHS Initiatives Supporting Internet Recovery Planning Are under Way, but Much Remains to Be Done and the Relationships among Initiatives Are Not Evident

DHS has begun a variety of initiatives to fulfill its responsibility for  developing an integrated public/private plan for Internet recovery, but  these efforts are not complete or comprehensive. Specifically, DHS has  developed high-level plans for infrastructure protection and national  disaster response, but the components of these plans that address the  Internet infrastructure are not complete. In addition, DHS has started a  variety of initiatives to improve the nation’s ability to recover from Internet  disruptions, including working groups to facilitate coordination and  exercises in which government and private industry practice responding to  cyber events. As a result, the nation  is not prepared to effectively coordinate public/private plans for recovering  from a major Internet disruption. Multiple Challenges Exist to Planning for Recovery from Internet Disruptions

Although DHS has various initiatives under way to improve Internet  recovery planning, it faces key challenges in developing a public/private  plan for Internet recovery, including (1) innate characteristics of the  Internet that make planning for and responding to a disruption difficult,   (2) a lack of consensus on DHS’s role and on when the department should  get involved in responding to a disruption, (3) legal issues affecting DHS’s  ability to provide assistance to restore Internet service, (4) reluctance of  the private-sector to share information on Internet disruptions with DHS,  and (5) leadership and organizational uncertainties within DHS. Until it  addresses these challenges, DHS will have difficulty achieving results in its  role as the focal point for recovering the Internet from a major disruption. However, the vast majority of the  Internet is owned and operated by the private sector. Objectives, Scope, and Methodology

Our objectives were to (1) identify examples of major disruptions to the  Internet, (2) identify the primary laws and regulations governing recovery  of the Internet in the event of a major disruption, (3) evaluate the  Department of Homeland Security’s (DHS) plans for facilitating recovery  from Internet disruptions, and (4) assess challenges to such efforts.
Why GAO Did This Study

Since the early 1990s, growth in the use of the Internet has revolutionized the way that our nation communicates and conducts business. While the Internet was originally developed by the Department of Defense, the vast majority of its infrastructure is currently owned and operated by the private sector. Federal policy recognizes the need to prepare for debilitating Internet disruptions and tasks the Department of Homeland Security (DHS) with developing an integrated public/private plan for Internet recovery. GAO was asked to (1) identify examples of major disruptions to the Internet, (2) identify the primary laws and regulations governing recovery of the Internet in the event of a major disruption, (3) evaluate DHS plans for facilitating recovery from Internet disruptions, and (4) assess challenges to such efforts.

What GAO Found

A major disruption to the Internet could be caused by a cyber incident (such as a software malfunction or a malicious virus), a physical incident (such as a natural disaster or an attack that affects key facilities), or a combination of both cyber and physical incidents. Recent cyber and physical incidents have caused localized or regional disruptions but have not caused a catastrophic Internet failure. Federal laws and regulations addressing critical infrastructure protection, disaster recovery, and the telecommunications infrastructure provide broad guidance that applies to the Internet, but it is not clear how useful these authorities would be in helping to recover from a major Internet disruption. Specifically, key legislation on critical infrastructure protection does not address roles and responsibilities in the event of an Internet disruption. Other laws and regulations governing disaster response and emergency communications have never been used for Internet recovery. DHS has begun a variety of initiatives to fulfill its responsibility for developing an integrated public/private plan for Internet recovery, but these efforts are not complete or comprehensive. Specifically, DHS has developed high-level plans for infrastructure protection and incident response, but the components of these plans that address the Internet infrastructure are not complete. In addition, the department has started a variety of initiatives to improve the nation's ability to recover from Internet disruptions, including working groups to facilitate coordination and exercises in which government and private industry practice responding to cyber events. However, progress to date on these initiatives has been limited, and other initiatives lack time frames for completion. Also, the relationships among these initiatives are not evident. As a result, the government is not yet adequately prepared to effectively coordinate public/private plans for recovering from a major Internet disruption. Key challenges to establishing a plan for recovering from Internet disruptions include (1) innate characteristics of the Internet (such as the diffuse control of the many networks making up the Internet and private sector ownership of core components) that make planning for and responding to disruptions difficult, (2) a lack of consensus on DHS's role and when the department should get involved in responding to a disruption, (3) legal issues affecting DHS's ability to provide assistance to restore Internet service, (4) reluctance of many in the private sector to share information on Internet disruptions with DHS, and (5) leadership and organizational uncertainties within DHS. Until these challenges are addressed, DHS will have difficulty achieving results in its role as a focal point for helping to recover the Internet from a major disruption.