In its June 2014  Energy Report, DOD reported 180 disruptions and a financial impact  that averaged about $220,000 per day for fiscal year 2013. Hazards Have Caused Utility Disruptions, with Operational and Fiscal Impacts, and Threats Have the Potential to Cause Such Impacts

Utility disruptions caused by hazards, such as mechanical failure and  extreme weather events, have resulted in a number of serious operational  and fiscal impacts. According to DOD  officials, this incident did not result in disruption of electrical service at  DOD installations. This is because a  cyber-physical incident could result in a loss of utility service or the  catastrophic destruction of utility infrastructure, such as an explosion. According to one of the officials, an example of a successful cyber- physical attack through ICS was the Stuxnet computer virus that was  used to attack Iranian centrifuges in 2010. This $4.63 million of  inaccurately reported indirect costs accounts for 66 percent of the  approximately $7 million in total costs reported by DOD for fiscal year  2012. DOD’s underreporting of some disruptions that met the criteria laid out in  DOD reporting instructions, and not including disruptions of DOD-owned  utility infrastructure in the Energy Reports, are likely due to two factors  related to instructions in DOD’s data collection template for installations. An OSD official and certain headquarters officials also explained that—in  their limited time to validate all of the data included in the Energy  Reports—they prioritize validation of other data types above their review  of the utilities disruption data. Military Services Have Taken Actions and Implemented DOD Guidance to Mitigate Utility Disruptions

Based on our review of DOD documents, and according to officials from  installations both inside and outside the continental United States that we  visited or contacted, installations have taken various actions to mitigate  the effects of disruptions in electrical, potable water, wastewater, and  natural gas utility service. The installations in our sample also are generally taking steps in  response to DOD guidance related to utility resilience and have taken  steps to mitigate the risk to installations posed by utility disruptions  caused by both threats and hazards.headquarters officials, there are several pieces of DOD-wide guidance  related to utility resilience. However, as of February 2015, none of the military services had a  complete inventory of existing ICS. Without overcoming challenges related to completing inventories,  acquiring and training personnel, and identifying and programming for  funding, all of which are required under DOD Instruction 8510.01, the  military services’ ICS may be vulnerable to cyber incidents that could  degrade operations and negatively impact missions. We  recognize that DOD is in the early stages of this effort and that it plans on  full implementation. Recommendations for Executive Action

In order to provide DOD and Congress with more comprehensive and  accurate information on all types of utility disruptions, we recommend that  the Secretary of Defense direct the Secretaries of the Army, Navy, and  Air Force; the Commandant of the Marine Corps; and the Assistant  Secretary of Defense for Energy, Installations and Environment to take  the following two actions to provide more consistent guidance to the  installations:
First, in guidance provided to their installations, the military services  should clearly state that all disruptions lasting 8 hours or longer  should be reported, regardless of the disruptions’ impact or mitigation. Also, in order to improve the comprehensiveness and accuracy of certain  data submitted by the military services to OSD and reported in the Energy  Reports—such as potentially underreported data on mitigation costs and  inaccurate data on both disruptions’ duration and cost—we recommend  that the Secretary of Defense direct the Secretaries of Army, Navy, and  Air Force, the Commandant of the Marine Corps, and the Assistant  Secretary of Defense for Energy, Installations and Environment to work  together to improve the effectiveness of data validation steps in DOD’s  process for collecting and reporting utilities disruption data. DOD also stated that it did not agree with GAO’s  analysis of the comprehensiveness and accuracy of the department’s  reporting on utility disruptions in the June 2013 and 2014 Energy Reports. However, as discussed in this report, DOD’s collection and reporting of  utilities disruption data are not comprehensive and some data are not  accurate. For example, the installations we visited or  contacted reported disruptions involving DOD infrastructure with  significant impacts, such as delayed satellite launches at Vandenberg Air  Force Base and almost $26 million in estimated repair costs at Naval  Weapons Station Earle. Appendix I: Scope and Methodology

To determine whether threats and hazards have caused utility disruptions  on Department of Defense (DOD) installations—and if so—what impacts  they have had, we reviewed various types of documents on utility  disruptions and resulting impacts on installation operations. To determine the extent to which DOD’s collection and reporting of  information on utility disruptions is comprehensive and accurate, we  reviewed the statutory reporting requirement for the Energy Reports,  compared the military services’ data submissions for fiscal years 2012  through 2014 with information we collected from the installations we  visited or contacted, and reviewed DOD’s process for collecting and  reporting on this data. To determine the extent to which DOD has taken actions and developed  and implemented guidance to mitigate risks to operations at its  installations in the event of utility disruption, we collected and reviewed  DOD documents related to actions taken to mitigate risks, utility resilience  guidance, and implementation efforts. We also reviewed documents describing installations’ plans  for situations in which utility service is disrupted, to include emergency  management plans. GAO-14-446. Critical Infrastructure Protection: Cybersecurity Guidance Is Available, but  More Can Be Done to Promote Its Use.
Why GAO Did This Study

Continuity of operations at DOD installations is vital to supporting the department's missions, and the disruption of utility services—such as electricity and potable water, among others—can threaten this support. House Report 113-446 included a provision that GAO review DOD's and the military services' actions to ensure mission capability in the event of disruptions to utility services. This report addresses (1) whether threats and hazards have caused utility disruptions on DOD installations and, if so, what impacts they have had; (2) the extent to which DOD's collection and reporting on utility disruptions is comprehensive and accurate; and (3) the extent to which DOD has taken actions and developed and implemented guidance to mitigate risks to operations at its installations in the event of utility disruption. For this review, GAO evaluated DOD guidance and policies, interviewed appropriate officials, and visited or contacted 20 installations within and outside the continental United States, selected based on criteria to include those experiencing multiple disruptions, disruptions of more than one type of utility, and each military service.

What GAO Found

Department of Defense (DOD) installations have experienced utility disruptions resulting in operational and fiscal impacts due to hazards such as mechanical failure and extreme weather. Threats, such as cyber attacks, also have the potential to cause disruptions. In its June 2014 Annual Energy Management Report (Energy Report) to Congress, DOD reported 180 utility disruptions lasting 8 hours or longer, with an average financial impact of about $220,000 per day, for fiscal year 2013. Installation officials provided specific examples to GAO, such as at Naval Weapons Station Earle, New Jersey, where in 2012, Hurricane Sandy's storm surge destroyed utility infrastructure, disrupting potable and wastewater service and resulting in almost $26 million in estimated repair costs. DOD officials also cited examples of physical and cyber threats, such as the “Stuxnet” computer virus that attacked the Iranian nuclear program in 2010 by destroying centrifuges, noting that similar threats could affect DOD installations.
DOD's collection and reporting of utility disruption data is not comprehensive and contains inaccuracies, because not all types and instances of utility disruptions have been reported and there are inaccuracies in reporting of disruptions' duration and cost. Specifically, in the data call for the Energy Reports, officials stated that DOD installations are not reporting all disruptions that meet the DOD criteria of commercial utility service disruptions lasting 8 hours or longer. This is likely due, in part, to military service guidance that differs from instructions for DOD's data collection template. In its Energy Reports, DOD is also not including information on disruptions to DOD-owned utility infrastructure. There also were inaccuracies in the reported data. For instance, $4.63 million of the $7 million in costs reported by DOD in its June 2013 Energy Report were indirect costs, such as lost productivity, although DOD has directed that such costs not be reported. Officials responsible for compiling the Energy Report noted that utility disruption data constitutes a small part of the report and they have limited time to validate data. However, without collecting and reporting complete and accurate data, decision makers in DOD may be hindered in their ability to plan effectively for mitigating against utility disruptions and enhance utility resilience, and Congress may have limited oversight of the challenges these disruptions pose.
Military services have taken actions to mitigate risks posed by utility disruptions and are generally taking steps in response to DOD guidance related to utility resilience. For example, installations have backup generators and have conducted vulnerability assessments of their utility systems. Also, DOD is in the planning stages of implementing new cybersecurity guidance, by March 2018, to protect its industrial control systems (ICS), which are computer-controlled systems that monitor or operate physical utility infrastructure. Each of the military services has working groups in place to plan for implementing this guidance. However, the services face three implementation challenges: inventorying their installations' ICS, ensuring personnel with expertise in both ICS and cybersecurity are trained and in place, and programming and identifying funding for implementation. For example, as of February 2015, none of the services had a complete inventory of ICS on their installations. Without overcoming these challenges, DOD's ICS may be vulnerable to cyber incidents that could degrade operations and negatively impact missions.

What GAO Recommends

GAO recommends that DOD work with the services to clarify utility disruption reporting guidance, improve data validation steps, and address challenges to addressing cybersecurity ICS guidance. DOD concurred or partially concurred with all but one recommendation and disagreed with some of GAO's analysis. GAO believes the recommendations and analysis are valid as discussed in the report.