Federal policy also recognizes  the need to be prepared for the possibility of debilitating disruptions in  cyberspace and, because the vast majority of the Internet infrastructure is  owned and operated by the private sector, tasks DHS with developing an  integrated public/private plan for Internet recovery. In the event of a major Internet disruption, multiple organizations could  help recover Internet service. Although Cyber and Physical Incidents Have Caused Disruptions, the Internet Has Not Yet Suffered a Catastrophic Failure

The Internet’s infrastructure is vulnerable to disruptions in service due to  terrorist and other malicious attacks, natural disasters, accidents,  technological problems, or a combination of these things. Disruptions to  Internet service can be caused by cyber and physical incidents—both  intentional and unintentional. Over the last few years, physical and cyber  incidents have caused localized or regional disruptions, highlighting the  importance of recovery planning. Existing Laws and Regulations Apply to the Internet, but Numerous Uncertainties Exist in Using Them for Internet Recovery

Several federal laws and regulations provide broad guidance that applies  to the Internet infrastructure, but it is not clear how useful these  authorities would be in helping to recover from a major Internet disruption  because some do not specifically address Internet recovery and others  have seldom been used. Pertinent laws and regulations address critical  infrastructure protection, federal disaster response, and the  telecommunications infrastructure. DHS Initiatives Supporting Internet Recovery Planning Are Under Way, but Much Remains to Be Done and the Relationships Among the Initiatives Are Not Evident

As of our June 2006 report, DHS had begun a variety of initiatives to fulfill  its responsibility to develop an integrated public/private plan for Internet  recovery, but these efforts were not complete or comprehensive. Specifically, DHS had developed high-level plans, including the National  Response Plan and the National Infrastructure Protection Plan, for  infrastructure protection and national disaster response, but the  components of these plans that address the Internet infrastructure were  not complete. As a result, the nation was not prepared to effectively coordinate  public/private plans for recovering from a major Internet disruption. Multiple Challenges Exist to Planning for Recovery from Internet Disruptions

Although DHS has various initiatives to improve Internet recovery  planning, there are key challenges in developing a public/private plan for  Internet recovery, including (1) innate characteristics of the Internet that  make planning for and responding to a disruption difficult, (2) lack of  consensus on DHS’s role and on when the department should get involved  in responding to a disruption, (3) legal issues affecting DHS’s ability to  provide assistance to restore Internet service, (4) reluctance of the private  sector to share information on Internet disruptions with DHS, and (5)  leadership and organizational uncertainties within DHS. Until these  challenges are addressed, DHS will have difficulty achieving results in its  role as a focal point for recovering the Internet from a major disruption. Additionally, to improve DHS’s ability to facilitate public/private efforts to  recover the Internet in case of a major disruption, we recommended that  the Secretary of the Department of Homeland Security implement nine  actions (see table 1). GAO-06-672. As a result, the exact  role of the government in helping to recover the Internet infrastructure  following a major disruption remains unclear. We also  made recommendations to DHS to establish clear milestones for  completing key plans, coordinate various Internet recovery-related  activities, and address key challenges to Internet recovery planning. While  DHS has made progress in implementing these recommendations, full  implementation could greatly enhance our nation’s ability to recover from  a major Internet disruption.
Why GAO Did This Study

Since the early 1990s, growth in the use of the Internet has revolutionized the way that our nation communicates and conducts business. While the Internet originated as a U.S. government-sponsored research project, the vast majority of its infrastructure is currently owned and operated by the private sector. Federal policy recognizes the need to prepare for debilitating Internet disruptions and tasks the Department of Homeland Security (DHS) with developing an integrated public/private plan for Internet recovery. GAO was asked to summarize its report on plans for recovering the Internet in case of a major disruption (GAO-06-672) and to provide an update on DHS's efforts to implement that report's recommendations. The report (1) identifies examples of major disruptions to the Internet, (2) identifies the primary laws and regulations governing recovery of the Internet in the event of a major disruption, (3) evaluates DHS plans for facilitating recovery from Internet disruptions, and (4) assesses challenges to such efforts.

What GAO Found

A major disruption to the Internet could be caused by a physical incident (such as a natural disaster or an attack that affects key facilities), a cyber incident (such as a software malfunction or a malicious virus), or a combination of both physical and cyber incidents. Recent physical and cyber incidents, such as Hurricane Katrina, have caused localized or regional disruptions but have not caused a catastrophic Internet failure. Federal laws and regulations that address critical infrastructure protection, disaster recovery, and the telecommunications infrastructure provide broad guidance that applies to the Internet, but it is not clear how useful these authorities would be in helping to recover from a major Internet disruption. Specifically, key legislation on critical infrastructure protection does not address roles and responsibilities in the event of an Internet disruption. Other laws and regulations governing disaster response and emergency communications have never been used for Internet recovery. As of 2006, DHS had begun a variety of initiatives to fulfill its responsibility to develop an integrated public/private plan for Internet recovery, but these efforts were not yet comprehensive or complete. For example, the department had developed high-level plans for infrastructure protection and incident response, but the components of these plans that address the Internet infrastructure were not complete. As a result, the risk remained that the government was not adequately prepared to effectively coordinate public/private plans for recovering from a major Internet disruption. Key challenges to establishing a plan for recovering from Internet disruptions include (1) innate characteristics of the Internet that make planning for and responding to disruptions difficult, (2) lack of consensus on DHS's role and when the department should get involved in responding to a disruption, (3) legal issues affecting DHS's ability to provide assistance to restore Internet service, (4) reluctance of many in the private sector to share information on Internet disruptions with DHS, and (5) leadership and organizational uncertainties within DHS. Until these challenges are addressed, DHS will have difficulty achieving results in its role as a focal point for helping the Internet to recover from a major disruption. DHS has made progress in implementing GAO's recommendations by revising key plans in coordination with private industry infrastructure stakeholders, coordinating various Internet recovery-related activities, and addressing key challenges to Internet recovery planning. However, further work remains to complete these activities, including finalizing recovery plans and defining the interdependencies among DHS's various working groups and initiatives. Full implementation of these recommendations should enhance the nation's ability to recover from a major Internet disruption.