Financial market organizations also have received  consolidated information through other sources. According to a DHS study and Internet providers, this additional  pandemic-related traffic is likely to exceed the capacity of Internet  providers’ network infrastructure in metropolitan residential Internet  access networks. DHS has undertaken several pandemic planning activities. Although DHS staff identified a list of potential  authorities that may or may not apply, they told us they were not able to  specify whether their agency had clear or specific authority to require  telecommunications providers to take actions to address congestion, such  as reducing customer transmission speeds or blocking entertainment Web  sites. Key Securities Market Participants Have Prepared Response Plans, but Not All Have Documented Staffing Analyses or Plans for Alternatives to Teleworking

We reviewed seven organizations whose operations are critical to the  overall functioning of U.S. securities markets and found that all have  developed formal plans that address key elements of pandemic  preparedness. Although congestion during a pandemic could  interfere with individuals’ ability, including teleworkers and others, to  access the Internet, the primary communications of the critical markets  organizations would not be affected because these organizations and their  participants communicate via high-capacity, proprietary networks that do  not traverse the public Internet infrastructure. However, the organization has not made adequate preparations for some  critical staff in another geographic area to telework during a pandemic. These organizations have also  not developed and assessed the feasibility of alternatives to teleworking in  their plans. To assess the extent to which securities  exchanges, electronic markets, and clearing organizations are adequately  managing risks to their operations, staff from SEC’s Division of Trading  and Markets regularly conduct examinations through its Automation  Review Program (ARP). However, whether DHS, FCC, or others have sufficient existing authorities  to direct private sector Internet providers to take the actions necessary to  relieve congestion is not clear. Recommendations for Executive Action

To better ensure that securities market participants as well as  organizations in other critical sectors of the economy will continue to have  access to the Internet during a pandemic, we recommend that the  Secretary of Homeland Security take the following four actions:    develop a strategy outlining actions that could be taken to address    coordinate with other relevant federal and private sector entities about  actions that could potentially reduce Internet congestion,   work with other federal partners to determine if sufficient authority exists  for one or more relevant agencies to take any contemplated actions to  address Internet congestion, and   assess the effectiveness and feasibility, and undertake if warranted, a  public education campaign to reduce such congestion. In  evaluating these organizations’ pandemic readiness, we attempted to  determine whether these organizations’ pandemic plans adequately  address the five elements required by the regulators, including: (1) a  process for monitoring the pandemic’s progress and a plan that escalates  response steps as various pandemic phases are reached; (2) a preventive  program to minimize, to the extent possible, illness among employees,  including social distancing of employees by curtailing meetings; (3) a  documented strategy of facilities or procedures designed to allow the  organization to continue its critical operations in the event that large  numbers of its staff are unavailable for prolonged periods, including an  analysis of staffing levels needed for critical functions and, as applicable,  an alternative to teleworking; (4) a testing program to ensure that the  practices and capabilities will be effective and allow it to continue its  critical operations; and (5) an oversight program to ensure ongoing review  and updates to the pandemic plan. In  addition to oversight by the Securities and Exchange Commission (SEC),  FINRA oversees broker-dealers conducting business domestically in the  United States.
Why GAO Did This Study

Concerns exist that a more severe pandemic outbreak than 2009's could cause large numbers of people staying home to increase their Internet use and overwhelm Internet providers' network capacities. Such network congestion could prevent staff from broker-dealers and other securities market participants from teleworking during a pandemic. The Department of Homeland Security (DHS) is responsible for ensuring that critical telecommunications infrastructure is protected. GAO was asked to examine a pandemic's impact on Internet congestion and what actions can be and are being taken to address it, the adequacy of securities market organizations' pandemic plans, and the Securities and Exchange Commission's (SEC) oversight of these efforts. GAO reviewed relevant studies, regulatory guidance and examinations, interviewed telecommunications providers and financial market participants, and analyzed pandemic plans for seven critical market organizations.

What GAO Found

Increased demand during a severe pandemic could exceed the capacities of Internet providers' access networks for residential users and interfere with teleworkers in the securities market and other sectors, according to a DHS study and providers. Private Internet providers have limited ability to prioritize traffic or take other actions that could assist critical teleworkers. Some actions, such as reducing customers' transmission speeds or blocking popular Web sites, could negatively impact e-commerce and require government authorization. However, DHS has not developed a strategy to address potential Internet congestion or worked with federal partners to ensure that sufficient authorities to act exist. It also has not assessed the feasibility of conducting a campaign to obtain public cooperation to reduce nonessential Internet use to relieve congestion. DHS also has not begun coordinating with other federal and private sector entities to assess other actions that could be taken or determine what authorities may be needed to act. Because the key securities exchanges and clearing organizations generally use proprietary networks that bypass the public Internet, their ability to execute and process trades should not be affected by any congestion. In analyzing seven critical market organizations, GAO found they had prepared pandemic plans that addressed key regulatory elements, including hygiene programs to minimize staff illness and continuing operations by spreading staff across geographic areas. However, not all had completed or documented analyses of whether they would have sufficient staff capable of carrying out critical activities if many of their employees were ill. Also, not all had developed alternatives to teleworking if congestion arises. SEC staff have been regularly examining market organizations' readiness, but could further reduce risk of disruptions by ensuring that these organizations prepare complete staffing analyses and teleworking alternatives.