Federal policy also recognizes  the need to be prepared for the possibility of debilitating disruptions in  cyberspace and, because the vast majority of the Internet infrastructure is  owned and operated by the private sector, tasks DHS with developing an  integrated public/private plan for Internet recovery. In the event of a major Internet disruption, multiple organizations could  help recover Internet service. Although Cyber and Physical Incidents Have Caused Disruptions, the Internet Has Not Yet Suffered a Catastrophic Failure

The Internet’s infrastructure is vulnerable to disruptions in service due to  terrorist and other malicious attacks, natural disasters, accidents,  technological problems, or a combination of the above. Recent physical and cyber incidents have  caused localized or regional disruptions, highlighting the importance of  recovery planning. Existing Laws and Regulations Apply to the Internet, but Numerous Uncertainties Exist in Using Them for Internet Recovery

Several federal laws and regulations provide broad guidance that applies  to the Internet infrastructure, but it is not clear how useful these  authorities would be in helping to recover from a major Internet disruption  because some do not specifically address Internet recovery and others  have seldom been used. Pertinent laws and regulations address critical  infrastructure protection, federal disaster response, and the  telecommunications infrastructure. However, this law and regulation do not  specifically address roles and responsibilities in the event of an Internet  disruption. DHS Initiatives Supporting Internet Recovery Planning Are under Way, but Much Remains to Be Done and the Relationship Between Initiatives Is Not Evident

DHS has begun a variety of initiatives to fulfill its responsibility to develop  an integrated public/private plan for Internet recovery, but these efforts  are not complete or comprehensive. Specifically, DHS has developed high- level plans for infrastructure protection and national disaster response,  but the components of these plans that address the Internet infrastructure  are not complete. In addition, DHS has started a variety of initiatives to  improve the nation’s ability to recover from Internet disruptions, including  working groups to facilitate coordination and exercises in which  government and private industry practice responding to cyber events. As a result, the nation  is not prepared to effectively coordinate public/private plans for  recovering from a major Internet disruption. Multiple Challenges Exist to Planning for Recovery from Internet Disruptions

Although DHS has various initiatives under way to improve Internet  recovery planning, it faces key challenges in developing a public/private  plan for Internet recovery, including (1) innate characteristics of the  Internet that make planning for and responding to a disruption difficult,  (2) lack of consensus on DHS’s role and on when the department should  get involved in responding to a disruption, (3) legal issues affecting DHS’s  ability to provide assistance to restore Internet service, (4) reluctance of  the private sector to share information on Internet disruptions with DHS,  and (5) leadership and organizational uncertainties within DHS. Until it  addresses these challenges, DHS will have difficulty achieving results in its  role as focal point for recovering the Internet from a major disruption. As a result,  the exact role of the government in helping to recover the Internet  infrastructure following a major disruption remains unclear.
Why GAO Did This Study

Since the early 1990s, growth in the use of the Internet has revolutionized the way that our nation communicates and conducts business. While the Internet originated as a U.S. government-sponsored research project, the vast majority of its infrastructure is currently owned and operated by the private sector. Federal policy recognizes the need to prepare for debilitating Internet disruptions and tasks the Department of Homeland Security (DHS) with developing an integrated public/private plan for Internet recovery. GAO was asked to summarize its report being released today--Internet Infrastructure: DHS Faces Challenges in Developing a Joint Public/Private Recovery Plan, GAO-06-672 (Washington, D.C.: June 16, 2006). This report (1) identifies examples of major disruptions to the Internet, (2) identifies the primary laws and regulations governing recovery of the Internet in the event of a major disruption, (3) evaluates DHS plans for facilitating recovery from Internet disruptions, and (4) assesses challenges to such efforts.

What GAO Found

A major disruption to the Internet could be caused by a physical incident (such as a natural disaster or an attack that affects key facilities), a cyber incident (such as a software malfunction or a malicious virus), or a combination of both physical and cyber incidents. Recent physical and cyber incidents, such as Hurricane Katrina, have caused localized or regional disruptions but have not caused a catastrophic Internet failure. Federal laws and regulations that address critical infrastructure protection, disaster recovery, and the telecommunications infrastructure provide broad guidance that applies to the Internet, but it is not clear how useful these authorities would be in helping to recover from a major Internet disruption. Specifically, key legislation on critical infrastructure protection does not address roles and responsibilities in the event of an Internet disruption. Other laws and regulations governing disaster response and emergency communications have never been used for Internet recovery. DHS has begun a variety of initiatives to fulfill its responsibility for developing an integrated public/private plan for Internet recovery, but these efforts are not complete or comprehensive. Specifically, DHS has developed high-level plans for infrastructure protection and incident response, but the components of these plans that address the Internet infrastructure are not complete. In addition, the department has started a variety of initiatives to improve the nation's ability to recover from Internet disruptions, including working groups to facilitate coordination and exercises in which government and private industry practice responding to cyber events. However, progress to date on these initiatives has been limited, and other initiatives lack time frames for completion. Also, the relationships among these initiatives are not evident. As a result, the government is not yet adequately prepared to effectively coordinate public/private plans for recovering from a major Internet disruption. Key challenges to establishing a plan for recovering from Internet disruptions include (1) innate characteristics of the Internet that make planning for and responding to disruptions difficult, (2) lack of consensus on DHS's role and when the department should get involved in responding to a disruption, (3) legal issues affecting DHS's ability to provide assistance to restore Internet service, (4) reluctance of many in the private sector to share information on Internet disruptions with DHS, and (5) leadership and organizational uncertainties within DHS. Until these challenges are addressed, DHS will have difficulty achieving results in its role as a focal point for helping the Internet to recover from a major disruption.