Introduction

New Organizations and Roles

Critical Infrastructure Elements and Lead Agencies

Sources

In July 1996, President Clinton issued Executive Order 13010, which established the President’s Commission on Critical Infrastructure Protection (PCCIP). The PCCIP was created in order to examine the growing integrated dependencies of the US economy and way of life on critical aspects of the infrastructure. The PCCIP reported back to the President in November 1997, with a set of recommendations on what should be done. The President considered these recommendations and in May 1998, issued two Presidential Decision Directives (PDD) assigning responsibilities and actions associated with national level critical infrastructure protection. The two PDDs were PDD-62, Combating Terrorism, and PDD-63, Critical Infrastructure Protection.

Recognizing that the Federal Government has direct control over only a small percentage of what comprises the critical infrastructure, the framework chosen for national coordination of defensive and security activities focuses on leadership rather than management. PDD-63 specifies that each Department and Agency of the Federal Government will develop a plan for defending its part of the critical infrastructure. Initial plans were due to a National Coordinator 180 days after the PDD was issued, or on November 17, 1998. In two years, finalized plans are required. Those plans will be reconciled and organized into a national plan by the National Coordinator. Lead Agencies for Sector Liaison will develop relationships with industry and will encourage information sharing between government and private groups. The goal of the National Plan is to "present a model to the private sector on how to best protect critical infrastructure." {1} The following graphic presents the required actions and timetable for the Federal Government. (click to enlarge, use back button to get back here)

{2}

There are two areas that bear explanation in order to understand the probable future trajectory of growth and action. First, and most obvious, is the structure of the new organizations and their roles. The second is the manner in which the new elements will interact with already existing structures and organizations. This paper lays out the structures and intentions of the new organizations, highlighting areas where existing organizations have synergistic responsibilities. The information contained herein has been gleaned from multiple sources, including interviews with key personnel of the new organizations, but it must be pointed out that the organizations are just now being developed and staffed and therefore the information herein is subject to change as those organizations evolve and plans start to solidify.

PDD-63 explicitly creates these new organizations:

• A National Coordinator;
• The National Infrastructure Protection Center (NIPC);
• An Information Sharing and Analysis Center (ISAC);
• A National Infrastructure Assurance Council (NIAC);
• The Critical Infrastructure Assurance Office (CIAO).

Not specifically created by PDD-63, but referred to in the directive, are other organizations integral to the infrastructure assurance efforts. These include the following:

• The Critical Infrastructure Coordination Group (CICG);
• The Principals Committee.

Additionally, PDD-63 specifies that certain departments and agencies act as sector liaison leads and special function leads.

The following sections describe the functions and responsibilities ascribed to each.

As a Presidential Directive, PDD-63 directs the activities of elements of the Federal Government. These activities include all of the above mentioned roles with the exception of the NIAC and the ISAC. The NIAC will be a quasi-governmental organization, comprised of individuals appointed by the President, but those members will be representatives of the private sector and of state and local governments.

The full title of the office is "National Coordinator for Security, Infrastructure Protection and Counter-Terrorism." {3} The National Coordinator is the principal focal point within the Federal Government for infrastructure protection against all threats, ranging from foreign terrorism and domestic mass destruction to information warfare attacks. The National Coordinator oversees the execution of PDD-62 and PDD-63.

The National Coordinator is appointed by the Assistant to the President for National Security Affairs with the advice of the Assistant to the President for Economic Affair.

The National Coordinator has the following responsibilities:

• implement PDD-62 and PDD-63
• chair the CICG
• serve as Executive Director of the NIAC
• ensure interagency coordination for policy development and implementation
• review crisis activities concerning infrastructure elements with foreign involvement
• provide advice regarding budgetary issues and critical infrastructure protection
• consult with owners and operators of the critical infrastructure elements to strongly encourage their participation and cooperation
• identify possible methods for providing federal assistance to the ISAC startup
• commission studies on liability issues, legal issues, information classification issues, security issues, legislative issues, and foreign trade issues related to infrastructure protection
• provide oversight of the public outreach processes
• establish a program for infrastructure assurance simulations for public awareness purposes
• coordinate a review of existing federal, state and local bodies that perform information assurance tasks resulting in recommendations on how these organizations can cooperate most effectively
• propose ways to encourage the private sector to pay attention to security issues such as risk assessment. {5}

The CICG is the mechanism through which the various offices of the Federal Government coordinate their activities and prioritize the agenda associated with infrastructure protection. The National Coordinator chairs the CICG. {6} The CICG is the driving force behind the execution of PDD-63 within the diverse elements of the Federal Government.

The National Coordinator, as chair of the CICG, reports "to the Deputies Committee (or at the call of its chair, the Principals Committee)." Each Department and Agency is required to appoint a senior official – Assistant Secretary level or higher – to regularly represent that organization at the CICG meetings. Sector Liaison Officials and Special Function Coordinators also attend CICG meetings. {7}

The CICG provides a forum for the Sector Liaison Officials and the Functional Coordinators of the Lead Agencies as well as senior representatives of other relevant federal agencies to coordinate the implementation of the required actions. The scope of action is quite large and in order to accomplish it, the CICG has established subcommittees to address specific issues. Following is a list of those subcommittees and the relevant lead organization:

National Plan Design	chaired by the National Security Council
R&D Priorities	Office of Science and Technology Policy
FY2000 Budget	OMB/National Security Council
Outreach & Sector Organization	National Security Council
Response Plan	FBI/Department of Defense
US Government as Model	OMB/National Security Council
Intelligence Collection	Director of Central Intelligence
Creation of ISAC	National Economic Council/FBI
Education & Awareness	Department of Commerce
International Cooperation	Department of State
Legal Issues & Authorities	Department of Justice
Personnel & Training	Department of Commerce
Standards	National Security Agency/Department of Commerce {8}

The Principals Committee was originally created by Executive Order 13010, the presidential order that created the PCCIP. {9} As created, it served as the mechanism to which the PCCIP reported, reviewing findings and recommendations before submitting them to the President. The members of the Principals Committee include:

• Secretary of the Treasury;
• Secretary of Defense;
• Attorney General;
• Secretary of Commerce;
• Secretary of Transportation;
• Secretary of Energy;
• Director of Central Intelligence;
• Director of the Office of Management and Budget;
• Director of the Federal Emergency Management Agency;
• Assistant to the President for National Security Affairs;
• Assistant to the Vice President for National Security Affairs;
• Assistant to the President for Economic Policy and Director of the National Economic Council; and
• Assistant to the President and Director of the Office of Science and Technology Policy. {10}

PDD-63 extends the concept of the Principals Committee, directing that the National Coordinator serve as a full member of both the Principals Committee or Deputies meetings. {11}

The comparison of the members of the Principals Committee and the designated lead agencies for sector liaison and special functions (delineated in a later part of this paper) reveals an almost complete overlap. Missing from the Principals Committee are the

• Environmental Protection Agency,
• Department of Health and Human Services, and
• Department of State.

One of the most confusing things about the new structures is the use of the term CIAO. PDD-63 directs every Department and Agency to appoint a Critical Infrastructure Assurance Officer – a CIAO. These CIAOs are responsible for the protection of all aspects of the department or agency’s critical infrastructure with the exception of the information infrastructure, for which the Chief Information Officer (CIO) is responsible. It is possible for the CIAO and the CIO to be the same person, responsible for both roles. {12}

PDD-63 also directs that a National Plan Coordination (NPC) staff be constituted, with members being "contributed on a non-reimbursable basis by the departments and agencies. … The NPC staff will integrate the various sector plans into a National Infrastructure Assurance Plan and coordinate analyses of the U.S. Government’s own dependencies on critical infrastructures." {13} This mandated NPC staff has been named the Critical Infrastructure Assurance Office (CIAO) and resides in the Department of Commerce, Bureau of Export Controls. {14}

The CIAO is essentially the staff that supports the National Coordinator in his designated roles and responsibilities. It will have the task of integrating the sector plans into a national level plan and will coordinate a national education and awareness program to raise the private sector’s awareness of the implications and requirements of infrastructure protection. {15} The first director of the CIAO is Dr. Jeffrey Hunker:

Prior to the issuance of the PDDs, the FBI hosted an interim Infrastructure Protection Task Force and the Computer Investigation and Infrastructure Threat Assessment Office. The FBI transformed that capability and experience into an integrated capability to support infrastructure protection. Three months prior to the issuance of PDD-62 and PDD-63, the NIPC was announced. "Established in February 1998, the NIPC's mission is to serve as the U.S. government's focal point for threat assessment, warning, investigation, and response for threats or attacks against our critical infrastructures." {17} Subsequently, PDD-63 affirmed the expanded role of the FBI in infrastructure protection: "As part of a national warning and information sharing system, the President immediately authorizes the FBI to expand its current organization to a full scale National Infrastructure Protection Center." {18} The FBI also retains a separate organization dedicated specifically to computer crime, the National Computer Crime Squad, whose mission it is to investigate violations of the Computer Fraud and Abuse Act of 1986. {19}

The purpose of the NIPC is to provide full spectrum protection support to the infrastructure assurance efforts, including coordinating the Federal Government's response to an incident, mitigating attacks, investigating threats and monitoring reconstitution efforts. As such, the NIPC performs both intelligence activities and operational activities. The intelligence activities include monitoring threats, performing analysis of suspected attack activities, and identifying critical vulnerabilities. The operational activities include active protective mechanisms, with the priority activities being coordination, prevention and defense. The differentiation between the FBI role and FEMA’s role is that the FBI is focused on crisis management whereas FEMA is focused on consequence management. {20} The principal focus of efforts at this point in time are countering the cyberthreat. Later, as the organization matures and capabilities increase, expanded infrastructure protection efforts will be undertaken. {21}

NIPC activities include the following:

• provide timely warning of intentional threats
• issue attack warnings and alerts
• provide guidance on increasing protective posture
• provide comprehensive analyses
• provide law enforcement investigation and response
• collect information about threats, attack warnings, and actual attacks on critical government and private sector infrastructures
• perform computer investigations
• coordinate emergency response
• conduct training and outreach
• develop and apply technical tools {22}
• establish relationships with the private sector
• sanitize law enforcement and intelligence information for reports, after coordinating with the intelligence community
• provide reports to relevant federal, state and local agencies
• provide reports to relevant owners and operators of critical infrastructures
• provide reports to any private sector ISAC
• act as a focal point for gathering information on threats to infrastructures
• be the primary facilitator and coordinator of Federal Government response to attacks (including when the situation requires that the NIPC be place in a direct support role to the DoD or intelligence community) {23}

The NIPC as an organization is already well underway. It is resident at the FBI but is intended to incorporate representatives from the Department of Defense (DoD), the Department of Treasury (specifically the US Secret Service), the Department of Energy, the Department of Transportation, and the Intelligence Community, as well as the private sector. Staffing levels at this point in time are intended to be 85 full time personnel, who perform both intelligence and operational duties. Since it is recognized that a cyber-attack could occur very quickly and across multiple elements of the national infrastructure, the activities associated with detection and reaction and protection are integrated within the team structure to speed response times and capabilities. {24}

The purpose for identifying lead agencies for critical sectors is to have clearly identified focal points for liaison with the private sector as well as to have accountability within the Federal Government for specific sectors and roles. The responsible agencies and their areas of concern are identified here:

Information and Communications	Department of Commerce
Banking and Finance	Department of Treasury
Water Supply	Environmental Protection Agency
Aviation, Highways (including) trucking and intelligent transportation systems), Mass transit, Pipelines, Rail, and Waterborne commerce	Department of Transportation
Emergency Law Enforcement Services	Department of Justice/FBI
Emergency Fire Services and Continuity of Government	Federal Emergency Management Agency
Public Health Services, including prevention, surveillance, laboratory services, and personal health services	Department of Health and Human Services
Electric Power, Oil and Gas Production and Storage	Department of Energy

The responsibilities of these lead agencies include:

• designating one person of Assistant Secretary level or higher to function as the Sector Liaison Official;
• provide recommendations on membership of the National Infrastructure Assurance Council;
• cooperate with the private sector representatives in addressing sector problems;
• cooperate with private sector representatives to develop and recommend components to the National Infrastructure Assurance Plan; and
• cooperate with the private sector to develop and implement sector specific Vulnerability Awareness and Education. {26}

PDD-63 identifies several special functions that have significant roles in protecting the nation’s infrastructure separate from the infrastructure elements themselves. These special functions and their lead agencies are as follows:

Law Enforcement and Internal Security	Department of Justice/FBI
Foreign Intelligence	CIA
Foreign Affairs	Department of State
National Defense	Department of Defense
Research and Development Coordination through the National Science and Technology Council {27}	Office of Science and Technology Policy

With all this enumeration of memberships and roles, it is interesting to examine the organizations that are not explicitly tasked as well in order to understand the context. The following list delineates some of the myriad offices that are missing from direct tasking in PDD-63 (to keep the list from being exhausting, organizations such as the National Endowment for the Arts are not included in this list):

• Department of Agriculture (USDA)
• Department of Education
• Department of Housing and Urban Development (HUD)
• Department of the Interior (DOI)
• Department of Labor (DOL)
• Department of Veterans Affairs

INDEPENDENT AGENCIES

• Commodity Futures Trading Commission (CFTC)
• Consumer Product Safety Commission (CPSC)
• Export-Import Bank of the United States
• Federal Communications Commission (FCC)
• Federal Maritime Commission
• Federal Reserve System (FRS)
• National Aeronautics and Space Administration (NASA)
• National Archives and Records Administration (NARA)
• National Commission on Libraries and Information Science (NCLIS)
• National Railroad Passenger Corporation (AMTRAK)
• National Transportation Safety Board (NTSB)
• Nuclear Regulatory Commission (NRC)
• Securities and Exchange Commission (SEC)
• Social Security Administration (SSA)
• Tennessee Valley Authority (TVA)
• United States Postal Service (USPS)

The private sector is an important player in protecting the critical infrastructure. It owns and operates a very large percentage of the critical infrastructure and individually has insights into vulnerabilities and threats on an enormous scale. PDD-63 invites the private sector to harness that potential for the national good through two venues: first, a place to cooperatively share information that collectively can be used to protect the critical infrastructure elements; and second, a direct method to advise the President on activities and policy concerning the critical infrastructure.

Recognizing both the reliance of the Federal Government on privately-owned infrastructure elements and the inability to defend the infrastructure as a whole without cooperation and coordination with the private sector, PDD-63 calls for the establishment of a mechanism where threat and vulnerability information could be shared without liability. Recognizing as well that short of legislation it would be impossible to compel compliance with that desire, PDD-63 specifically leaves the development of the design and functions of the ISAC to the private sector. However, PDD-63 also directs the National Coordinator, the Sector Coordinators, the Sector Liaison Officials and the National Economic Council to "consult with owners and operators of the critical infrastructures to strongly encourage the creation of a private sector information sharing and analysis center." Additionally, the PDD directs that, "[w]ithin 180 days of issuance of this directive, the National Coordinator, with the assistance of the CICG including the National Economic Council, shall identify possible methods of providing federal assistance to facilitate the startup of an ISAC." {28}

There are clearly substantial problems associated with the concept of an ISAC. The ISAC is intended to become a focal point for sharing information about vulnerabilities and threats associated with infrastructure protection. The corporations that own and operate parts of the infrastructure have significant reasons associated with liability, negligence, competitiveness, and transnational operations not to disclose vulnerabilities or even threats. The lesson from the Citibank hacking episode {29} illustrates the reluctance and the penalties associated with divulging information about problems and vulnerabilities.

Further, the postulated relationship with the NIPC, where the NIPC would receive all information from the ISAC but only provide information to the ISAC that the NIPC had declassified and/or deemed appropriate, could strike some participants as being a trifle unfair. There has been some discussion about passing legislation limiting liability related to disclosure of vulnerabilities but to date no specific format has been agreed upon. {30}

There are, however, some industry organizations that have expressed interest in serving in ISAC-like roles, including the Information Technology Association of America (ITAA) {31}, which is a trade organization with over 9000 members associated with the information technology sector. {32} Whether or not an industry organization can coerce cooperation on sensitive business matters remains to be seen.

The NIAC will be a council of advisors, composed of representatives from infrastructure sector providers and state and local government, who will be appointed by the President. The NIAC will provide input from the private sector and state and local governments to the National Information Assurance Plan. As of this point in time, the NIAC is not further defined. When it is constituted, the President will appoint members from amongst major infrastructure providers and state and local governments. Additionally, the President will designate a Chairperson. The National Coordinator will serve as the Executive Director for the NIAC and senior Federal Government officials will participate in the meetings, as appropriate. {33}

A challenge associated with constituting a meaningful NIAC is formulating it in such a way as to account for revolutionary technologies and the rapid evolutionary growth of the information and communications infrastructure. The World Wide Web emerged in the early 1990s as a new capability (albeit built on an existing backbone of technologies and physical plant) and since then has engendered a revolution in commerce and information sharing. Corporations like Netscape and UUNet Technologies rose from oblivion to dominance in a relative blink of an eye. Many of the emerging powerhouses of the information age are too busy growing to pay much attention to politics – picking the right membership for a relevant NIAC may well turn out to be extremely tricky.

Another challenge associated with constituting a meaningful NIAC is the present Administration’s stance on encryption. Particularly in the infrastructure area of information and communication, the subject of restricted access to strong encryption is contentious. There are those who see the entire critical infrastructure protection exercise as yet another attempt to limit freedoms in the name of emerging threats, as noted in this extract from a report by the Electronic Privacy Information Center (EPIC):

The Cato Institute agrees, having analyzed the issues associated with key escrow in its November 1998 policy paper Encryption Policy For The 21st Century: A Future without Government-Prescribed Key Recovery:

It remains to be seen, therefore, whether or not a relevant NIAC can be constituted and, if so, how long it can remain relevant.

The following graphic shows how these organizations relate, with dashed lines depicting advisory relationships: (click to enlarge, use back button to get back here)

Another view of the organizational relationship is presented in the following graphic, which comes from a briefing by Jeffrey Hunker, Director of the CIAO, and shows the delineation of the public private partnership envisioned by PDD-63: (click to enlarge, use back button to get back here)

{36}

By definition, the critical infrastructure efforts mandated by PDD-63 are limited to the Federal Government. As such, the two PDDs direct the Departments and Agencies of the Federal Government to do certain things. PDD-62, Combating Terrorism, directs activities related to countering the threats of unconventional attacks against the US. PDD-63, Critical Infrastructure Protection, directs activities relating to protecting the critical elements of the national infrastructure.

A key point to note here is that the Federal Government owns very little of what is considered to be the critical infrastructure. The following sections describe the infrastructure elements as described in Appendix A of the report of the PCCIP, Critical Foundations: Thinking Differently. These definitions were used as the basis for developing the recommendations that resulted in PDD-63. As delineated here, there are five critical elements of the infrastructure. However, three later differentiated elements – emergency services, water supply and government services – are all covered here as "vital services." Additionally, here all energy is considered together, whereas in the responsibilities allocated in PDD-63, energy is divided between Electrical Power Systems and Gas And Oil Production, Storage And Transport.

Because the PCCIP report summarized the infrastructure elements concisely and appropriately, the descriptions are reproduced here. The report itself contains very detailed commentary on existing problems and vulnerabilities as well.

1. A water source, either surface waters in impoundments such as lakes and reservoirs or flowing waters in rivers or ground water in aquifers.
2. Treatment facilities in which particulates are filtered out and disinfectants are added.
3. A system of aqueducts, tunnels, reservoirs, and/or pumping facilities to convey water from the source through the rest of the system and to provide storage and the means to balance flows.
4. A distribution system carrying finished water to users through a system of water mains and subsidiary pipes.
5. A waste water collection and treatment system.

The following table identifies the critical infrastructure elements, the role the Federal Government plays in each element, and the role that other entities, such as private industry and State Government, play in each element (acronyms delineated at end of table). The appropriate FEMA emergency support functions are identified in the last column annotated with the lead agency for that function.

Acronym and Shortname List:

Description of FEMA Emergency Support Functions (ESFs):

The critical infrastructure protection plans are going to be, when fully developed, enormously complex. As a management tool for dividing the work, the Lead Agencies for Sector Liaison develop the plans for their sectors. The individual plans are then aggregated by the National Coordinator and his staff into a coherent national level plan. This process is shown in the following graphic: (click to enlarge, use back button to get back here)

{46}

Each plan will address all elements of the sector operations, including information systems. The Critical Infrastructure Segment called "Information and Communications" will not include the information systems that are organic to the other segments. The interfaces between segments and segment plans will be addressed when the plans are rationalized by the National Coordinator and staff. {47}

The Lead Agency for Sector Coordination is responsible for coordinating with non-Federal Government elements in each sector to develop specific plans and processes for inclusion in the National Plan. (click to enlarge, use back button to get back here)

{48}

Initial operational capability (IOC) for the National Plan is targeted for the year 2000, with final operational capability achieved by the year 2003. Following IOC in 2000, the National Coordinator is required to conduct a zero-based review. {49}

The following were sources for the information contained in this report:

Personal Interviews

Electronically Published Documents

Conference and Meeting Attendance

Learn more about the President's Commission on Critical Infrastructure Protection at http://www.pccip.gov/.  The following information is taken from that site for ease of reference. 

The PCCIP was formed to advise and assist the President of the United States by recommending a national strategy for protecting and assuring critical infrastructures from physical and cyber threats. [The critical sectors of the infrastructure are:]

• Information and Communications
• Electrical Power Systems
• Gas and Oil Transportation and Storage
• Banking and Finance
• Transportation
• Water Supply Systems
• Emergency Services
• Government Services {50}

Electronic E-mail Bombs... Computer Hijacking... Logic Bombs... Data Service Attacks...

An unidentified person sending millions of e-mail messages causes unexplained outages in phone services and a shut-down in the 911 service of a major metropolitan city....

A computer hacker "hijacks" a password in the air traffic control system by waiting for someone manning a computer station to take a coffee break without exiting the program....

A program hidden within a computer and set to activate at some point in the future cleans out millions of bank accounts....

Could these possibilities and other forms of digitized assaults halt the operations of electric power grids, natural gas pipelines, air traffic control systems, railroad switching facilities or the stock exchange?

The President's Commission on Critical Infrastructure Protection was the first national effort to address the vulnerabilities created in the new information age. The Commission, established in July, 1996, by Presidential Executive Order 13010, was tasked to formulate a comprehensive national strategy for protecting the infrastructures we all depend on from physical and "cyber" threats.

Critical Infrastructures are systems whose incapacity or destruction would have a debilitating impact on the defense or economic security of the nation. They include telecommunications, electrical power systems, gas and oil, banking and finance, transportation, water supply systems, government services and emergency services.

The Commission, chaired by aerospace industry leader Robert "Tom" Marsh, included senior representatives from private industry, government and academia. An Advisory Committee consisting of industry leaders provided counsel to the Commission and a Steering Committee, made up of cabinet-level officials, reviewed the Commission's report before forwarding it to the President.

Anyone with the capability, technology, opportunity, and intent to do harm. Potential threats can be foreign or domestic, internal or external, state-sponsored or a single rogue element. Terrorists, insiders, disgruntled employees, and hackers are included in this profile.

The fact that most of the nation's vital services are delivered by private companies creates a significant challenge in determining where the responsibility of protecting our critical infrastructures falls. This Commission addressed this challenge by bringing the private and public sectors together to assess infrastructure vulnerabilities and develop assurance strategies for the future. The Commission consulted with over 6,000 representatives from the private and public sectors including industry executives, security experts, government agencies and private citizens.

The Commission was divided into five teams, representing the eight critical infrastructures.

Each team evaluated the growing risk, threats, and vulnerabilities within its sector. The sector teams and their industries include:

• Information & Communications - telecommunications, computers & software, Internet, satellites, fiber optics
• Physical Distribution - railroads, air traffic, maritime, intermodal, pipelines
• Energy - electrical power, natural gas, petroleum, production, distribution & storage
• Banking & Finance - financial transactions, stock & bond markets, federal reserve
• Vital Human Services - water, emergency services, government services

The Commission submitted its report, Critical Foundations, to the White House in October, 1997. {51}

Information and Communications: Computing and telecommunications equipment, software, processes, and people that support the processing, storage, and transmission of data and information; the processes and people that convert data into information and information into knowledge; and the data and information themselves.

Electrical Power Systems: The generation stations, transmission and distribution networks that create and supply electricity to end-users so that end-users achieve and maintain nominal functionality, including the transportation and storage of fuel essential to that system.

Gas and Oil Production, Storage and Transportation: The production and holding facilities for natural gas, crude and refined petroleum, and petroleum-derived fuels, the refining and processing facilities for these fuels and the pipelines, ships, trucks, and rail systems that transport these commodities from their source to systems that are dependent upon gas and oil in one of their useful forms.

Banking and Finance: The retail and commercial organizations, investment institutions, exchange boards, trading houses, and reserve systems, and associated operational organizations, government operations, and support entities, that are involved in all manner of monetary transactions, including its storage for saving purposes, its investment for income purposes, its exchange for payment purposes, and its disbursement in the form of loans and other financial instruments.

Transportation: The nation's physical distribution system critical to supporting the national security and economic well-being of this nation, including the national airspace system, airlines and aircraft, and airports; roads and highways, trucking and personal vehicles; ports and waterways and the vessels operating thereon; mass transit, both rail and bus; pipelines, including natural gas, petroleum, and other hazardous materials; freight and long haul passenger rail; and delivery services.

Water Supply Systems: The sources of water, reservoirs and holding facilities, aqueducts and other transport systems, the filtration, cleaning and treatment systems, the pipelines, the cooling systems and other delivery mechanisms that provide for domestic and industrial applications, including systems for dealing with water runoff, waste water, and firefighting.

Emergency Services: The medical, police, fire, and rescue systems and personnel that are called upon when an individual or community is responding to emergencies. These services are typically provided at the local level (county or metropolitan area). In addition, state and Federal response plans define emergency support functions to assist in response and recovery.

Government Services: Sufficient capabilities at the Federal, state and local levels of government are required to meet the needs for essential services to the public. {52}

This report summary is also available in a formatted Acrobat version (30k). The report itself is also available at this Web site. [http://www.pccip.gov/report_index.html]

"Our responsibility is to build the world of tomorrow by embarking on a period of construction -- one based on current realities but enduring American values and interests..."

President William J. Clinton National Security Strategy

The United States is in the midst of a tremendous cultural change -- a change that affects every aspect of our lives. The cyber dimension promotes accelerating reliance on our infrastructures and offers access to them from all over the world, blurring traditional boundaries and jurisdictions. National defense is not just about government anymore, and economic security is not just about business. The critical infrastructures are central to our national defense and our economic power, and we must lay the foundations for their future security on a new form of cooperation between the private sector and the federal government.

The federal government has an important role to play in defense against cyber threats -- collecting information about tools that can do harm, conducting research into defensive technologies, and sharing defensive techniques and best practices. Government also must lead and energize its own protection efforts, and engage the private sector by offering expertise to facilitate protection of privately owned infrastructures.

In the private sector, the defenses and responsibilities naturally encouraged and expected as prudent business practice for owners and operators of our infrastructures are the very same measures needed to protect against the cyber tools available to terrorists and other threats to national security.

Terrorist bombings of US forces in Saudi Arabia, the World Trade Center in New York City, and the federal building in Oklahoma City remind us that the end of the Cold War has not eliminated threats of hostile action against the United States.

In recognition of comparable threats to our national infrastructures, President Clinton signed Executive Order 13010 on July 15, 1996, establishing the President's Commission on Critical Infrastructure Protection. The Commission was chartered to conduct a comprehensive review and recommend a national policy for protecting critical infrastructures and assuring their continued operation.

This was an unusually large commission with broad representation from federal departments and agencies and from the private sector. An Advisory Committee of industry leaders appointed by the President provided the perspective of the infrastructure owners and operators. A Steering Committee, composed of the Commission's Chairman and four top government officials, oversaw the Commission's work on behalf of the Principals Committee, which included Cabinet Officers, heads of agencies, and senior White House staff members.

The Commission generally operated by consensus. Every recommendation was discussed at length with the full Commission and most were revised several times before final approval. No Commissioner agreed completely with all of the recommendations. Nevertheless, each accepted the final report as a reasonable and balanced recommendation to the President.

The Commission divided its work into five "sectors" based on the common characteristics of the included industries. The sectors are:

• 1. Information and Communications
• 2. Banking and Finance
• 3. Energy, Including Electrical Power, Oil and Gas
• 4. Physical Distribution
• 5. Vital Human Services

The Commission characterized the sectors, studied their vulnerabilities, and looked for solutions.

We prepared comprehensive working papers for each of the five sectors providing specific recommendations. Other work contains the results of deliberations on issues that are not sector specific. Among them is a paper on Research and Development Recommendations, which outlines a comprehensive set of topics regarding the long term needs of infrastructure protection. The paper on National Structures contains our conclusions and recommendations about the functions and responsibilities for infrastructure assurance and the creation of new units in the federal government and the private sector, and some that are jointly staffed by government employees and representatives of the infrastructure owners and operators. The paper on Shared Infrastructures: Shared Threats is our collected analysis of the vulnerabilities and threats facing the critical infrastructures. We recognize the enormous significance of physical threats, but we have a significant amount of experience in dealing with them. It is the cyber threat that is new. Cyber issues dominate this analysis because networked information systems present fundamentally new security challenges.

We conducted extensive meetings with a range of professional and trade associations concerned with the infrastructures, private sector infrastructure users and providers, academia, different state and local government agencies, consumers, federal agencies, and numerous others. Of special interest were five public meetings in major cities.

We attended dozens of conferences and roundtables with a variety of groups, and we arranged two strategic simulations with participants drawn from across the infrastructures and from all levels of government. We encouraged questions and comments by anyone, and established a World Wide Web site to facilitate contact. Several meetings with Congressional Members and their staffs added a very useful perspective to our research.

During the preparation of the sector papers we identified several dozen issues for which recommendations might be appropriate. Each issue was described, relevant observations, findings, and conclusions were collected, and several alternative recommendations were prepared. The Commission then deliberated each issue and selected one of the alternative recommendations.

The development of the computer and its astonishingly rapid improvements have ushered in the Information Age that affects almost all aspects of American commerce and society. Our security, economy, way of life, and perhaps even survival, are now dependent on the interrelated trio of electrical energy, communications, and computers.

Classical physical disruptions. A satchel of dynamite or a truckload of fertilizer and diesel fuel have been frequent terrorist tools. The explosion and the damage are so certain to draw attention that these kinds of attacks continue to be among the probable threats to our infrastructures.

New, cyber threats. Today, the right command sent over a network to a power generating station's control computer could be just as effective as a backpack full of explosives, and the perpetrator would be harder to identify and apprehend.

The rapid growth of a computer-literate population ensures that increasing millions of people possess the skills necessary to consider such an attack. The wide adoption of public protocols for system interconnection and the availability of "hacker tool" libraries make their task easier.

While the resources needed to conduct a physical attack have not changed much recently, the resources necessary to conduct a cyber attack are now commonplace. A personal computer and a simple telephone connection to an Internet Service Provider anywhere in the world are enough to cause a great deal of harm.

System complexities and interdependencies. The energy and communications infrastructures especially are growing in complexity and operating closer to their designed capacity. This creates an increased possibility of cascading effects that begin with a rather minor and routine disturbance and end only after a large regional outage. Because of their technical complexity, some of these dependencies may be unrecognized until a major failure occurs.

Of the many people with the necessary skills and resources, some may have the motivation to cause substantial disruption in services or destruction of the equipment used to provide the service.

This list of the kinds of threats we considered shows the scope of activity with potentially adverse consequences for the infrastructures, and the diversity of people who might engage in that activity. It may not be possible to categorize the threat until the perpetrator is identified -- for example, we may not be able to distinguish industrial espionage from national intelligence collection.

Natural events and accidents. Storm-driven wind and water regularly cause service outages, but the effects are well known, the providers are experienced in dealing with these situations, and the effects are limited in time and geography.

Accidental physical damage to facilities is known to cause a large fraction of system incidents. Common examples are fires and floods at central facilities and the ubiquitous backhoe that unintentionally severs pipes or cables.

Blunders, errors, and omissions. By most accounts, incompetent, inquisitive, or unintentional human actions (or omissions) cause a large fraction of the system incidents that are not explained by natural events and accidents. Since these usually only affect local areas, service is quickly restored; but there is potential for a nationally significant event.

Insiders. Normal operation demands that a large number of people have authorized access to the facilities or to the associated information and communications systems. If motivated by a perception of unfair treatment by management, or if suborned by an outsider, an "insider" could use authorized access for unauthorized disruptive purposes.

Recreational hackers. For an unknown number of people, gaining unauthorized electronic access to information and communication systems is a most fascinating and challenging game. Often they deliberately arrange for their activities to be noticed even while hiding their specific identities. While their motivations do not include actual disruption of service, the tools and techniques they perfect among their community are available to those with hostile intent.

Criminal activity. Some are interested in personal financial gain through manipulation of financial or credit accounts or stealing services. In contrast to some hackers, these criminals typically hope their activities will never be noticed, much less attributed to them. Organized crime groups may be interested in direct financial gain, or in covering their activity in other areas.

Industrial espionage. Some firms can find reasons to discover the proprietary activities of their competitors, by open means if possible or by criminal means if necessary. Often these are international activities conducted on a global scale.

Terrorism. A variety of groups around the world would like to influence US policy and are willing to use disruptive tactics if they think that will help.

National intelligence. Most, if not all, nations have at least some interest in discovering what would otherwise be secrets of other nations for a variety of economic, political, or military purposes.

Information warfare. Both physical and cyber attacks on our infrastructures could be part of a broad, orchestrated attempt to disrupt a major US military operation or a significant economic activity.

We have observed that the general public seems unaware of the extent of the vulnerabilities in the services that we all take for granted, and that within government and among industry decision-makers, awareness is limited. Several have told us that there has not yet been a cause for concern sufficient to demand action.

We do acknowledge that this situation seems to be changing for the better. The public news media seem to be carrying relevant articles more frequently; attendance at conferences of security professionals is up; and vendors are actively introducing new security products.

The Commission believes that the actions recommended in this report will increase sensitivity to these problems and reduce our vulnerabilities at all levels.

Related to the lack of awareness is the need for a national focus or advocate for infrastructure protection. Following up on our report to the President, we need to build a framework of effective deterrence and prevention.

This is not simply the usual study group's lament that "no one is in charge." These infrastructures are so varied, and form such a large part of this nation's economic activity, that no one person or organization can be in charge. We do not need, and probably could not stand, the appointment of a Director of Infrastructures. We do need, and recommend, several more modest ways to create and maintain a national focus on the issues.

Protection of our infrastructures will not be accomplished by a big federal project. It will require continuous attention and incremental improvement for the foreseeable future.

Life on the information superhighway isn't much different from life on the streets; the good guys have to hustle to keep the bad guys from getting ahead.

It is not surprising that infrastructures have always been attractive targets for those who would do us harm. In the past we have been protected from hostile attacks on the infrastructures by broad oceans and friendly neighbors. Today, the evolution of cyber threats has changed the situation dramatically. In cyberspace, national borders are no longer relevant. Electrons don't stop to show passports.

Potentially serious cyber attacks can be conceived and planned without detectable logistic preparation. They can be invisibly reconnoitered, clandestinely rehearsed, and then mounted in a matter of minutes or even seconds without revealing the identity and location of the attacker.

Formulas that carefully divide responsibility between foreign defense and domestic law enforcement no longer apply as clearly as they used to. "With the existing rules, you may have to solve the crime before you can decide who has the authority to investigate it." [Senator Sam Nunn, remarks to the PCCIP Advisory Committee. Washington, DC, September 7, 1997]

The Commission has not discovered an imminent attack or a credible threat sufficient to warrant a sense of immediate national crisis. However, we are quite convinced that our vulnerabilities are increasing steadily while the costs associated with an effective attack continue to drop. What is more, the investments required to improve the situation are still relatively modest, but will rise if we procrastinate.

We should attend to our critical foundations before the storm arrives, not after: Waiting for disaster will prove as expensive as it is irresponsible.

National security requires much more than military strength. Our world position, our ability to influence others, our standard of living, and our own self-image depend on economic prosperity and public confidence. Clear distinctions between foreign and domestic policy no longer serve our interests well.

At the same time, the effective operation of our military forces depends more and more on the continuous availability of infrastructures, especially communications and transportation, that are not dedicated to military use.

While no nation state is likely to attack our territory or our armed fo