The policy  review also recommended that the President establish a cybersecurity  coordinator position to integrate the government’s cybersecurity policies. Several Key Entities and Efforts Address Global Cyberspace Security and Governance

There are a number of key entities and efforts whose international  activities significantly influence the security and governance of  cyberspace. The organizations range from information-sharing forums  that are nondecision-making gatherings of experts to private organizations  to treaty-based, decision-making bodies founded by countries. Their  efforts include those to address topics such as incident response, technical  standards, and law enforcement cooperation. ISO is a nongovernmental organization that develops and publishes  international standards through a consensus-based process involving a  network of the national standards institutes of 162 countries with a  Central Secretariat in Geneva, Switzerland, supporting the process. ITU members include delegations from 191  nations, as well as more than 700 members from the private sector. Federal entities’ involvement in these efforts ranges from engaging in  bilateral and multilateral relationships with foreign countries to providing  personnel to foreign agencies to leading or being a member of a U.S.  delegation to attending meetings. It is responsible for developing and coordinating U.S.  international trade policy and has the responsibility for trade negotiations  with other countries. The U.S. Government Faces Challenges in Addressing the Global Aspects of Cyberspace

The U.S. government faces a number of challenges that impede its ability  to formulate and implement a coherent approach to addressing the global  aspects of cyberspace, including (1) providing top-level leadership,   (2) developing a coherent and comprehensive strategy, (3) coordinating  across all relevant federal entities, (4) ensuring cyberspace-related  technical standards and policies do not pose unnecessary barriers to U.S.  trade, (5) participating in international cyber incident response,   (6) differing legal systems and enforcing U.S. criminal and civil laws, and  (7) defining international norms for cyberspace. Although the Departments of Commerce, Homeland Security, Justice, and  State have served in leadership roles for the specific activities of the key  entities and efforts identified, federal agencies have not provided top-level  leadership for the U.S. on these issues. Until these challenges are addressed, the United States will be at  a disadvantage in promoting its national interests in the realm of  cyberspace. Agency Comments and Our Evaluation

In oral comments on a draft of this report, the national Cybersecurity  Coordinator and his staff generally concurred with our recommendations  and stated that actions are already being taken to address them. Appendix I: Objectives, Scope, and Methodology

Our objectives were to identify (1) significant entities and efforts  addressing global cyberspace security and governance issues, (2) U.S.  entities responsible for addressing cyberspace security and governance  and the extent of their involvement at the international level, and   (3) challenges to effective U.S. involvement in global cyberspace security  and governance efforts.
Why GAO Did This Study

Recent foreign-based intrusions on the computer systems of U.S. federal agencies and commercial companies highlight the vulnerabilities of the interconnected networks that comprise the Internet, as well as the need to adequately address the global security and governance of cyberspace. Federal law and policy give a number of federal entities responsibilities for representing U.S. cyberspace interests abroad, in collaboration with the private sector. More recently, the President appointed a national Cybersecurity Coordinator charged with improving the nation's cybersecurity leadership. GAO was asked to identify (1) significant entities and efforts addressing global cyberspace security and governance issues, (2) U.S. entities responsible for addressing these issues and the extent of their involvement at the international level, and (3) challenges to effective U.S. involvement in global cyberspace security and governance efforts. To do this, GAO analyzed policies, reports, and other documents and interviewed U.S. government and international officials and experts from over 30 organizations.

What GAO Found

There are a number of key entities and efforts with significant influence on international cyberspace security and governance. The organizations range from information-sharing forums that are nondecision-making gatherings of experts to private organizations to treaty-based, decision-making bodies founded by countries. Their efforts include those to address topics such as incident response, technical standards, and law enforcement cooperation. For example, the International Organization for Standardization is a nongovernmental organization that develops and publishes international standards, including those related to cybersecurity, through a consensus-based process involving a network of the national standards bodies of 162 countries. A number of U.S. federal entities have responsibilities for, and are involved in, international cyberspace governance and security efforts. Specifically, the Departments of Commerce, Defense, Homeland Security, Justice, and State, among others, are involved in efforts to develop international standards, formulate cyber-defense policy, facilitate overseas investigations and law enforcement, and represent U.S. interests in international forums. Federal entities have varying roles among organizations and efforts with international influence over cyberspace security and governance, including engaging in bilateral and multilateral relationships with foreign countries, providing personnel to foreign agencies, leading or being a member of a U.S. delegation, coordinating U.S. policy with other U.S. entities through the interagency process, or attending meetings. The global aspects of cyberspace present key challenges to U.S. policy. Until these challenges are addressed, the United States will be at a disadvantage in promoting its national interests in the realm of cyberspace.

What GAO Recommends

GAO recommends that the national Cybersecurity Coordinator address challenges including developing a comprehensive national global cyberspace strategy. The national Cybersecurity Coordinator and his staff generally concurred with the recommendations and stated that actions are already being taken.