Federal law and policy related to critical infrastructure  protection activities recognize the importance of sharing information about  threats, vulnerabilities, and incidents and call for related initiatives. As Required by the CII Act, DHS Has Established Procedures, Organized a Program Office, and Received and Shared Information

In February 2004, DHS issued an interim rule that established procedures,  as required by the CII Act, and created a Program Office to administer the  program. The office has developed and maintained processes for accepting,  protecting, and sharing CII; received about 290 submissions from critical  infrastructure owners; begun some outreach with potential submitters to  increase information flow; shared PCII on a limited basis with users in DHS  and several other federal entities; and trained approximately 750 potential  users at DHS, other federal, state, and local government entities and, at  least 16 state and local officials how to establish their own programs. The interim rule includes mechanisms specified by the act regarding  acknowledging to the submitter that the Program Office has received  the voluntarily submitted CII;  maintaining the identification of this information as voluntarily  submitted to the government under the act;  receiving, handling, storing, and properly marking information as PCII,  including reviewing submitted information, determining that it meets  the requirements for protection (a process known as validation), and  protecting it;  safeguarding and maintaining the confidentiality of the submitter of the  information, but permitting the sharing of the information, as  determined by the Program Manager; and  protecting and maintaining the confidentiality of the information, so as  to permit (1) the sharing of it within the federal government and with  state and local governments and (2) the issuance of notices and  warnings related to the protection of critical infrastructure and  protected systems, in such a manner as to protect from public  disclosure the identity of the submitting person or entity or information  that is proprietary, is business-sensitive, relates specifically to the  submitting person or entity, and is otherwise not appropriately in the  public domain. To increase submissions, the Program Office has initiated outreach efforts  to publicize the PCII program to the public and private sectors. For example, the  Program Office gave DHS’s National Cyber Security Division (NCSD)  limited authority to receive recurring submissions. These challenges include better defining specific government  needs for CII, determining how the information will be used, assuring the  private sector that the information will be protected and who will be  authorized to have access to it, and demonstrating to critical infrastructure  owners the benefits of sharing the information. Without this knowledge, the private sector will continue to be  hesitant to provide information to DHS. If DHS were able to surmount these challenges,  it and other government users may begin to overcome the lack of trust  critical infrastructure owners have in the government’s ability to use and  protect their sensitive information. Objectives, Scope, and Methodology

In response to your request that we review the implementation of the  Critical Infrastructure Information (CII) Act of 2002, we determined (1) the  status of the Department of Homeland Security’s (DHS) implementation  efforts and (2) the challenges DHS faces in implementing the act.
Why GAO Did This Study

A wide array of cyber and physical assets is critical to America's national security, economic well-being, and public health and safety. Information related to threats, vulnerabilities, incidents, and security techniques is instrumental to guarding these critical infrastructures against attacks and mitigating the impact of attacks that may occur. The ability to share security-related information can unify the efforts of federal, state, and local government as well as the private sector, as appropriate, in preventing and minimizing terrorist attacks. The Critical Infrastructure Information Act of 2002 was enacted to encourage nonfederal entities to voluntarily share critical infrastructure information and established protections for it. The Department of Homeland Security (DHS) has a lead role in implementing the act. GAO was asked to determine (1) the status of DHS's efforts to implement the act and (2) the challenges it faces in carrying out the act.

What GAO Found

DHS has issued interim operating procedures and created a Program Office to administer the critical infrastructure protection program called for by the Critical Infrastructure Information Act. The interim procedures designate the responsibilities and authority of the Program Manager, and establish requirements related to accepting, protecting, sharing, and using critical infrastructure information as required by the act. The Program Office has begun to accept and safeguard critical infrastructure information submitted voluntarily by infrastructure owners and is sharing it with other DHS entities and, on a limited basis, with other government entities. For example, as of January 2006, the Program Office had received about 290 submissions of critical infrastructure information from various sectors. The Program Office also has initiated outreach efforts to publicize the program to the public and private sectors. In addition, it has trained approximately 750 potential users in DHS and other federal, state, and local government entities how to handle protected critical infrastructure information. This training is a prerequisite to being allowed to view the information. The Program Office has also trained at least 16 federal and state officials how to establish programs in their own entities so they can receive protected critical infrastructure information from DHS and then be authorized to store and share it. DHS faces challenges that impede the private sector's willingness to share sensitive information. Key challenges include defining specific government needs for critical infrastructure information, determining how the information will be used, assuring the private sector that the information will be protected and who will be authorized to have access to the information, and demonstrating to critical infrastructure owners the benefits of sharing the information. If DHS were able to surmount these challenges, it and other government users may begin to overcome the lack of trust that critical infrastructure owners have in the government's ability to use and protect their sensitive information.