Critical Infrastructure Protection

The nation's computer-based critical infrastructures are at increasing risk of severe disruption. Interconnectivity increases the risk that problems affecting one system will also affect other interconnected systems. Although these problems could be caused by natural disasters, such as earthquakes, and system-inducted problems, such as the Year 2000 conversion problem, government officials are increasingly concerned about attacks from individuals and groups with malicious intentions, such as terrorists and nations engaged in information warfare. Critical systems could be disrupted, sensitive data could be read or copied, and data or processes could be tampered with. A significant concern is that terrorists or hostile foreign states could target critical systems, such as those supporting energy distribution, telecommunications, and financial services, in order to harm the public welfare. The need to strengthen computer security in both government and the private sector has been recognized over the past several years by many groups, including GAO, and several steps have been taken to address the problem. During 1996 and 1997, federal information security was addressed by the President's Commission on Critical Infrastructure Protection, which had been created to investigate the country's vulnerability to both "cyber" and physical threats. A 1998 Presidential directive recognizes that overcoming computer-based threats to the country's critical infrastructures requires new approach involving coordination and cooperation across federal agencies and among public and private sector groups and other nations.

GAO noted that: (1) the nation's computer-based critical infrastructures are at increasing risk of severe disruption; (2) interconnectivity increases the risk that problems affecting one system will also affect other interconnected systems; (3) massive computer networks provide pathways among systems that, if not properly secured, can be used to gain unauthorized access to data and operations from remote locations; (4) while the threats or sources of these problems can include natural disasters and system-induced problems, government officials are increasingly concerned about attacks from individuals and groups with malicious intentions, such as terrorists and nations engaging in information warfare; (5) the resultant damage can vary, depending on the threat; (6) critical system operations can be disrupted or otherwise sabotaged, sensitive data can be read and copied, and data or processes can be tampered with; (7) a significant concern is that terrorists or hostile foreign states could launch computer-based attacks on critical systems, such as those supporting energy distribution, telecommunications, and financial services, to severely damage or disrupt national defense or other operations, resulting in harm to the public welfare; (8) the need to strengthen the computer security in both government and the private sector has been recognized over the past few years by a number of entities, and several initial steps have been taken to address the problem; (9) since 1994, GAO has issued dozens of reports on individual agency computer security weaknesses and made scores of related recommendations; (10) during 1996 and 1997, federal information security was addressed by the President's Commission on Critical Infrastructure Protection, which had been established to investigate the nation's vulnerability to both cyber and physical threats; (11) in May 1998, Presidential Decision Directive (PDD) 63 recognized that addressing computer-based risks to the nation's critical infrastructures requires a new approach that involves coordination and cooperation across federal agencies and among public and private-sector entities and other nations; (12) PDD 63 created several new entities for developing and implementing a strategy for critical infrastructure protection; (13) the details of an approach for implementing PDD 63 are still being developed; and (14) a number of issues will need to be resolved, including those regarding the federal government's role in critical infrastructure protection and how best to balance potentially competing demands for security versus privacy.