To accomplish this mission, the act established specific homeland security  responsibilities for the department and directed it to coordinate its efforts  and share information within DHS and with other federal agencies, state  and local governments, the private sector, and other entities. Also, sharing information on terrorists and  criminals can help to secure our nation’s borders. The Homeland Security Act of 2002 created DHS with the primary  responsibility of preventing terrorist attacks in the United States, reducing  the vulnerability of the United States to terrorist attacks, and minimizing  damage and assisting in recovery from attacks that do occur. Other DHS responsibilities related to information  sharing include   requesting and receiving information from other federal agencies, state  and local government agencies, and the private sector relating to threats of  terrorism in the United States; distributing or, as appropriate, coordinating the distribution of warnings  and information with other federal agencies, state and local governments  and authorities, and the public; creating and fostering communications with the private sector; promoting existing public/private partnerships and developing new  public/private partnerships to provide for collaboration and mutual  support; and coordinating and, as appropriate, consolidating the federal government’s  communications and systems of communications relating to homeland  security with state and local governments and authorities, the private  sector, other entities, and the public. Information Analysis and Infrastructure Protection Directorate

The Information Analysis and Infrastructure Protection Directorate (IAIP)  is responsible for accessing, receiving, and analyzing law enforcement  information, intelligence information, and other threat and incident  information from respective agencies of federal, state, and local  governments and the private sector, and for combining and analyzing such  information to identify and assess the nature and scope of terrorist threats. Although improvements have been made in protecting our nation’s  critical infrastructures and continuing efforts are in progress, further  efforts are needed to address the following critical CIP challenges that we  have identified: developing a comprehensive and coordinated national plan to facilitate  CIP information sharing, which clearly delineates the roles and  responsibilities of federal and nonfederal CIP entities, defines interim  objectives and milestones, sets timeframes for achieving objectives, and  establishes performance measures; developing fully productive information sharing relationships within the  federal government and between the federal government and state and  local governments and the private sector;  improving the federal government’s capabilities to analyze incident, threat,  and vulnerability information obtained from numerous sources and share  appropriate timely, useful warnings and other information concerning both  cyber and physical threats to federal entities, state and local governments,  and the private sector; and providing appropriate incentives for nonfederal entities to increase  information sharing with the federal government. We have identified critical success factors to information  sharing that DHS should consider. Also, in addition to the need to develop  technological solutions, key management issues that DHS must overcome  to achieve success include  integrating existing IT resources of 22 different agencies, making new IT investments, ensuring that sensitive information is secured, developing secure communications networks, developing a performance focus,   integrating staff from different organizations and ensuring that the  department has properly skilled staff, and ensuring effective oversight. We found that these practices include: establishing trust relationships with a wide variety of federal and  nonfederal entities that may be in a position to provide potentially useful  information and advice on vulnerabilities and incidents; developing standards and agreements on how shared information will be establishing effective and appropriately secure communications  taking steps to ensure that sensitive information is not inappropriately  disseminated. DHS should develop and implement an enterprise  architecture, or corporate blueprint, to integrate the many existing  systems and processes required to support its mission. This architecture  will also guide the department’s investments in new systems to effectively  support homeland security in the coming years. As such, information sharing is an essential part of  DHS’s responsibilities and is critical to achieving its mission.
Why GAO Did This Study

The Homeland Security Act of 2002, which created the Department of Homeland Security (DHS), brought together 22 diverse organizations to help prevent terrorist attacks in the United States, reduce the vulnerability of the United States to terrorist attacks, and minimize damage and assist in recovery from attacks that do occur. To accomplish this mission, the act established specific homeland security responsibilities for the department, which included sharing information among its own entities and with other federal agencies, state and local governments, the private sector, and others. GAO was asked to discuss the significance of information sharing in fulfilling DHS's responsibilities, emphasizing GAO's related prior analyses and recommendations for improving the federal government's information sharing efforts.

What GAO Found

DHS's responsibilities include coordinating and sharing information related to threats of domestic terrorism within the department and with and between other federal agencies, state and local governments, the private sector, and other entities. To accomplish its missions, DHS must, for example, access, receive, and analyze law enforcement information, intelligence information, and other threat, incident, and vulnerability information from federal and nonfederal sources and analyze such information to identify and assess the nature and scope of terrorist threats. DHS must also share information both internally and externally with agencies and law enforcement on such things as goods and passengers inbound to the United States and individuals who are known or suspected terrorists and criminals.

What GAO Recommends

GAO has made numerous recommendations related to information sharing particularly as they relate to fulfilling DHS's critical infrastructure protection responsibilities. Although improvements have been made, more efforts are needed to address the following challenges, among others, that GAO has identified: (1) developing a comprehensive and coordinated national plan to facilitate information sharing on critical infrastructure protection; (2) developing productive information sharing relationships between the federal government and state and local governments and the private sector; and (3) providing appropriate incentives for nonfederal entities to increase information sharing with the federal government and enhance other critical infrastructure protection efforts. Through our prior work, we have identified critical success factors and other key management issues that DHS should consider as it establishes systems and processes to facilitate information sharing among and between government entities and the private sector. These success factors include establishing trust relationships with a wide variety of federal and nonfederal entities that may be in a position to provide potentially useful information and advice on vulnerabilities and incidents. Further, as part of its information technology management, DHS should continue to develop and implement an enterprise architecture to integrate the many existing systems and processes required to support its mission and to guide the department's investments in new systems to effectively support homeland security in the coming years. Other key management issues include ensuring that sensitive information is secured, developing secure communications networks, integrating staff from different organizations, and ensuring that the department has properly skilled staff.