GPS Disruptions: Efforts to Assess Risks to Critical Infrastructure and Coordinate Agency Actions Should Be Enhanced

Global Positioning System (GPS) provides positioning, navigation, and timing data to users worldwide and is used extensively in many of the nation’s 16 critical infrastructure sectors, such as communications and transportation. GPS is also a key component in many of the modern conveniences that people rely on or interact with daily. However, sectors’ increasing dependency on GPS leaves them potentially vulnerable to disruptions. The U.S. Government Accountability Office (GAO) was asked to review the effects of GPS disruptions on the nation’s critical infrastructure. GAO examined (1) the extent to which the Department of Homeland Security (DHS) has assessed the risks and potential effects of GPS disruptions on critical infrastructure, (2) the extent to which the Department of Transportation (DOT), and DHS have developed backup strategies to mitigate GPS disruptions, and (3) what strategies, if any, selected critical infrastructure sectors employ to mitigate GPS disruptions and any remaining challenges. To assess the risks and potential effects from disruptions in GPS) on critical infrastructure, DHS published the GPS National Risk Estimate (NRE) in 2012. In doing so, DHS conducted a scenario-based risk assessment for four critical infrastructure sectors using subject matter experts from inside and outside of government. Risk assessments involve complex analysis, and conducting a risk assessment across multiple sectors with many unknowns and little data is challenging. DHS’s risk management guidance can be used to help address such challenges. However, GAO found the NRE lacks key characteristics of risk assessments outlined in DHS’s risk management guidance and, as a result, is incomplete and has limited usefulness to inform mitigation planning, priorities, and resource allocation. A plan to collect and assess additional data and subsequent efforts to ensure that the risk assessment is consistent with DHS guidance would contribute to more effective GPS risk management. A 2004 presidential directive requires the DOT, in coordination with DHS, to develop backup capabilities to mitigate GPS disruptions, and the agencies have initiated a variety of efforts that contribute to fulfilling the directive. For example, DOT is researching GPS alternatives for aviation, and DHS began efforts on GPS interference detection and mitigation and is researching possibilities for a nationwide backup to GPS timing, which is used widely in critical infrastructure. However, due to resource constraints and other reasons, the agencies have made limited progress in meeting the directive, and many tasks remain incomplete, including identifying GPS backup requirements and determining suitability of backup capabilities. Furthermore, the agencies’ efforts have been hampered by a lack of effective collaboration. In particular, DOT and DHS have not clearly defined their respective roles, responsibilities, and authorities or what outcomes would satisfy the presidential directive. Without clearly defining both roles and desired outcomes, DOT and DHS cannot ensure that they will satisfy mutual responsibilities. Implementing key elements of effective collaboration would allow the agencies to address many uncertainties regarding fulfillment of their presidential policy directive. Selected critical infrastructure sectors employ various strategies to mitigate GPS disruptions. For example, some sectors can rely on timing capabilities from other sources of precise time in the event of GPS signal loss. However, both the NRE and stakeholders GAO interviewed raised concerns about the sufficiency of the sectors’ mitigation strategies. Federal risk management guidance requires DHS to work with federal agencies and critical infrastructure sector partners to measure the nation’s ability to reduce risks to critical infrastructure by using a process that includes metrics. GAO found that DHS has not measured the effectiveness of sector mitigation efforts to GPS disruptions and that, as a result, DHS cannot ensure that the sectors could sustain essential operations during GPS disruptions. The lack of agreed-upon metrics to measure the effectiveness of sector mitigation efforts hinders DHS’s ability to objectively assess improvements, track progress, establish accountability, provide feedback mechanisms, or inform decision makers about the appropriateness of the mitigation activities. DHS should ensure that its GPS risk assessment approach is consistent with DHS guidance; develop a plan to measure the effectiveness of mitigation efforts; and DOT and DHS should improve collaboration.

Language

  • English

Media Info

  • Media Type: Digital/other
  • Features: Appendices; Figures; Tables;
  • Pagination: 58p

Subject/Index Terms

Filing Info

  • Accession Number: 01499277
  • Record Type: Publication
  • Report/Paper Numbers: GAO-14-15
  • Files: TRIS
  • Created Date: Nov 6 2013 3:51PM