Input:
	The Nature of the Threat Facing the United States

The United States and other nations face increasingly diffuse threats in the post-Cold War era. In the future, potential adversaries are more likely to strike vulnerable civilian or military targets in nontraditional ways to avoid direct confrontation with our military forces on the battlefield. The December 2000 national security strategy states that porous borders, rapid technological change, greater information flow, and the destructive power of weapons now within the reach of small states, groups, and individuals make such threats more viable and endanger our values, way of life, and the personal security of our citizens.
Hostile nations, terrorist groups, transnational criminals, and individuals may target American people, institutions, and infrastructure with cyber attacks, weapons of mass destruction, or bioterrorism.  International criminal activities such as money laundering, arms smuggling, and drug trafficking can undermine the stability of social and financial institutions and the health of our citizens. Other national emergencies may arise from naturally occurring or unintentional sources such as outbreaks of infectious disease. As we witnessed in the tragic events of September 11, 2001, some of the emerging threats can produce mass casualties. They can lead to mass disruption of critical infrastructure, involve the use of biological or chemical weapons, and can have serious implications for both our domestic and the global economy.  The integrity of our mail has already been compromised. Terrorists could also attempt to compromise the integrity or delivery of water or electricity to our citizens, compromise the safety of the traveling public, and undermine the soundness of government and commercial data systems supporting many activities.

	Key Elements to Improve Homeland Security

A fundamental role of the federal government under our Constitution is to protect America and its citizens from both foreign and domestic threats. The government must be able to prevent and deter threats to our homeland as well as detect impending danger before attacks or incidents occur. We also must be ready to manage the crises and consequences of an event, to treat casualties, reconstitute damaged infrastructure, and move the nation forward. Finally, the government must be prepared to retaliate against the responsible parties in the event of an attack.  To accomplish this role and address our new priority on homeland security, several critical elements must be put in place.  First, effective leadership is needed to guide our efforts as well as secure and direct related resources across the many boundaries within and outside of the federal government. Second, a comprehensive homeland security strategy is needed to prevent, deter, and mitigate terrorism and terrorist acts, including the means to measure effectiveness. Third, managing the risks of terrorism and prioritizing the application of resources will require a careful assessment of the threats we face, our vulnerabilities, and the most critical infrastructure within our borders.

		Leadership Provided by the Office of Homeland Security

On September 20, 2001, we issued a report that discussed a range of challenges confronting policymakers in the war on terrorism and offered a series of recommendations. We recommended that the government needs clearly defined and effective leadership to develop a comprehensive strategy for combating terrorism, to oversee development of a new national-threat and risk assessment, and to coordinate implementation among federal agencies.  In addition, we recommended that the government address the broader issue of homeland security.  We also noted that overall leadership and management efforts to combat terrorism are fragmented because no single focal point manages and oversees the many functions conducted by more than 40 different federal departments and agencies.
For example, we have reported that many leadership and coordination functions for combating terrorism were not given to the National Coordinator for Security, Infrastructure Protection and Counterterrorism within the Executive Office of the President.  Rather, these leadership and coordination functions are spread among several agencies, including the Department of Justice, the Federal Bureau of Investigation (FBI), the Federal Emergency Management Agency, and the Office of Management and Budget.  In addition, we reported that federal training programs on preparedness against weapons of mass destruction were not well coordinated among agencies resulting in inefficiencies and concerns among rescue crews in the first responder community. The Department of Defense, Department of Justice, and the Federal Emergency Management Agency have taken steps to reduce duplication and improve coordination. Despite these efforts, state and local officials and organizations representing first responders indicate that there is still confusion about these programs.  We made recommendations to consolidate certain activities, but have not received full agreement from the respective agencies on these matters.
In his September 20, 2001, address to the Congress, President Bush announced that he was appointing Pennsylvania Governor Thomas Ridge to provide a focus to homeland security.  As outlined in the President’s speech and confirmed in a recent executive order, the new Homeland Security Adviser will be responsible for coordinating federal, state, and local efforts and for leading, overseeing, and coordinating a comprehensive national strategy to safeguard the nation against terrorism and respond to any attacks that may occur.
Both the focus of the executive order and the appointment of a coordinator within the Executive Office of the President fit the need to act rapidly in response to the threats that surfaced in the events of September 11 and the anthrax issues we continue to face.  Although this was a good first step, a number of important questions related to institutionalizing and sustaining the effort over the long term remain, including:   What will be included in the definition of homeland security?  What are the specific homeland security goals and objectives?
How can the coordinator identify and prioritize programs that are spread across numerous agencies at all levels of government?  What criteria will be established to determine whether an activity does or does not qualify as related to homeland security?
How can the coordinator have a real impact in the budget and resource allocation process?
Should the coordinator’s roles and responsibilities be based on specific statutory authority? And if so, what functions should be under the coordinator’s control?
Depending on the basis, scope, structure, and organizational location of this new position and entity, what are the implications for the Congress and its ability to conduct effective oversight?
A similar approach was pursued to address the potential for computer failures at the start of the new millennium, an issue that came to be known as Y2K.  A massive mobilization, led by an assistant to the President, was undertaken.  This effort coordinated all federal, state, and local activities, and established public-private partnerships.  In addition, the Congress provided emergency funding to be allocated by the Office of Management and Budget after congressional consideration of the proposed allocations. Many of the lessons learned and practices used in this effort can be applied to the new homeland security effort.  At the same time, the Y2K effort was finite in nature and not nearly as extensive in scope or as important and visible to the general public as homeland security.   The long-term, expansive nature of the homeland security issue suggests the need for a more sustained and institutionalized approach.

		Developing a Comprehensive Homeland Security Strategy

I would like to discuss some elements that need to be included in the development of the national strategy for homeland security and a means to assign roles to federal, state, and local governments and the private sector. Our national preparedness related to homeland security starts with defense of our homeland but does not stop there.  Besides involving military, law enforcement, and intelligence agencies, it also entails all levels of government – federal, state, and local – and private individuals and businesses to coordinate efforts to protect the personal safety and financial interests of United States citizens, businesses, and allies, both at home and throughout the world.  To be comprehensive in nature, our strategy should include steps designed to reduce our vulnerability to threats;   use intelligence assets and other broad-based information sources to identify threats and share such information as appropriate;   stop incidents before they occur;   manage the consequences of an incident; and in the case of terrorist attacks, respond by all means available, including economic, diplomatic, and military actions that, when appropriate, are coordinated with other nations.
An effective homeland security strategy must involve all levels of government and the private sector. While the federal government can assign roles to federal agencies under the strategy, it will need to reach consensus with the other levels of government and with the private sector on their respective roles.  In pursuing all elements of the strategy, the federal government will also need to closely coordinate with the governments and financial institutions of other nations.  As the President has said, we will need their help.  This need is especially true with regard to the multi-dimensional approach to preventing, deterring, and responding to incidents, which crosses economic, diplomatic, and military lines and is global in nature.

		Managing Risks to Homeland Security

The United States does not currently have a comprehensive risk management approach to help guide federal programs for homeland security and apply our resources efficiently and to best effect.  “Risk management” is a systematic, analytical process to determine the likelihood that a threat will harm physical assets or individuals and then to identify actions to reduce risk and mitigate the consequences of an attack. The principles of risk management acknowledge that while risk generally cannot be eliminated, enhancing protection from known or potential threats can serve to significantly reduce risk.
We have identified a risk management approach used by the Department of Defense to defend against terrorism that might have relevance for the entire federal government to enhance levels of preparedness to respond to national emergencies whether man-made or unintentional in nature.  The approach is based on assessing threats, vulnerabilities, and the importance of assets (criticality).  The results of the assessments are used to balance threats and vulnerabilities and to define and prioritize related resource and operational requirements.
Threat assessments identify and evaluate potential threats on the basis of such factors as capabilities, intentions, and past activities. These assessments represent a systematic approach to identifying potential threats before they materialize. However, even if updated often, threat assessments might not adequately capture some emerging threats.  The risk management approach therefore uses the vulnerability and criticality assessments discussed below as additional input to the decision-making process.
Vulnerability assessments identify weaknesses that may be exploited by identified threats and suggest options that address those weaknesses.  For example, a vulnerability assessment might reveal weaknesses in an organization’s security systems, financial management processes, computer networks, or unprotected key infrastructure such as water supplies, bridges, and tunnels.  In general, teams of experts skilled in such areas as structural engineering, physical security, and other disciplines conduct these assessments.
Criticality assessments evaluate and prioritize important assets and functions in terms of such factors as mission and significance as a target. For example, certain power plants, bridges, computer networks, or population centers might be identified as important to national security, economic security, or public health and safety.  Criticality assessments provide a basis for identifying which assets and structures are relatively more important to protect from attack. In so doing, the assessments help determine operational requirements and provide information on where to prioritize and target resources while reducing the potential to target resources on lower priority assets.
We recognize that a national-level risk management approach that includes balanced assessments of threats, vulnerabilities, and criticality will not be a panacea for all the problems in providing homeland security. However, if applied conscientiously and consistently, a balanced approach— consistent with the elements I have described—could provide a framework for action.  It would also facilitate multidisciplinary and multi-organizational participation in planning, developing, and implementing programs and strategies to enhance the security of our homeland while applying the resources of the federal government in the most efficient and effective manner possible. Given the tragic events of Tuesday, September 11, 2001, a comprehensive risk management approach that addresses all threats has become an imperative.
As this nation implements a strategy for homeland security, we will encounter many of the long-standing performance and accountability challenges being faced throughout the federal government.  For example, we will be challenged to look across the federal government itself to bring more coherence to the operations of many agencies and programs.  We must also address human capital issues to determine if we have the right people with the right skills and knowledge in the right places. Coordination across all levels of government will be required as will adequately defining performance goals and measuring success.  In addressing these issues, we will also need to keep in mind that our homeland security priorities will have to be accomplished against the backdrop of the long-term fiscal challenges that loom just over the 10-year budget window.

	Short- and Long-Term Fiscal Implications

The challenges of combating terrorism and otherwise addressing homeland security have come to the fore as urgent claims on the federal budget. As figure 2 shows, our past history suggests that when our national security or the state of the nation’s economy was at issue, we have incurred sizable deficits.  Many would argue that today we are facing both these challenges.  We are fortunate to be facing them at a time when we have some near-term budgetary flexibility. The budgetary surpluses of recent years that were achieved by fiscal discipline and strong economic growth put us in a stronger position to respond both to the events of September 11 and to the economic slowdown than would otherwise have been the case. I ask you to recall the last recession in the early 1990s where our triple-digit deficits  limited us from considering a major fiscal stimulus to jump start the economy due to well- founded fears about the impact of such measures on interest rates that were already quite high.  In contrast, the fiscal restraint of recent years has given us the flexibility we need to both respond to the security crisis and consider short-term stimulus efforts.
As we respond to the urgent priorities of today, we need to do so with an eye to the significant long-term fiscal challenges we face just over the 10- year budget horizon.  I know that you and your counterparts in the Senate have given a great deal of thought to how the Congress and the President might balance today’s immediate needs against our long-term fiscal challenges.  This is an important note to sound—while some short-term actions are understandable and necessary, long-term fiscal discipline is still an essential need.
As we seek to meet today’s urgent needs, it is important to be mindful of the collective impact of our decisions on the overall short- and long-term fiscal position of the government. For the short term, we should be wary of building in large permanent structural deficits that may drive up interest rates, thereby offsetting the potential economic stimulus Congress provides. For the longer term, known demographic trends (e.g., the aging of our population) and rising health care costs will place increasing claims on future federal budgets–reclaiming the fiscal flexibility necessary to address these and other emerging challenges is a major task facing this generation.
None of the changes since September 11 have lessened these long-term pressures on the budget. In fact, the events of September 11 have served to increase our long-range challenges.  The baby boom generation is aging and is projected to enjoy greater life expectancy. As the share of the population over 65 climbs, federal spending on the elderly will absorb larger and ultimately unsustainable shares of the federal budget. Federal health and retirement spending are expected to surge as people live longer and spend more time in retirement.  In addition, advances in medical technology are likely to keep pushing up the cost of providing health care. Absent substantive change in related entitlement programs, we face the potential return of large deficits requiring unprecedented spending cuts in other areas or unprecedented tax increases.
As you know, the Director of the Congressional Budget Office (CBO) has recently suggested the possibility of a federal budget deficit in fiscal year 2002, and other budget analysts appear to be in agreement.  While we do not know today what the 10-year budget projections will be in the next updates by CBO and the Office of Management and Budget (OMB), we do know the direction: they will be considerably less optimistic than before September 11, and the long-term outlook will look correspondingly worse. For example, if we assume that the 10-year surpluses CBO projected in August are eliminated, by 2030 absent changes in the structure of Social Security and Medicare, there would be virtually no room for any other federal spending priorities, including national defense, education, and law enforcement.  (See fig. 3.)  The resource demands that come from the events of September 11—and the need to address the gaps these events surfaced—will demand tough choices.  Part of that response must be to deal with the threats to our long-term fiscal health.  Ultimately, restoring our long-term fiscal flexibility will involve both promoting higher long- term economic growth and reforming the federal entitlement programs. When Congress returns for its next session, these issues should be placed back on the national agenda.
With this long-term outlook as backdrop, an ideal fiscal response to a short-term economic downturn would be temporary and targeted, and avoid worsening the longer-term structural pressures on the budget. However, you have been called upon not merely to respond to a short-term economic downturn but also to the homeland security needs so tragically highlighted on September 11.  This response will appropriately consist of both temporary and longer-term commitments.  While we might all hope that the struggle against terrorism might be brought to a swift conclusion, prudence dictates that we plan for a longer-term horizon in this complex conflict.
Given the long-term fiscal challenge driven by the coming change in our demographics, you might think about the options you face in responding to short-term economic weakness in terms of a range or portfolio of fiscal actions balancing today’s urgent needs with tomorrow’s fiscal challenges. In my testimony last February before the Senate Budget Committee, I suggested that fiscal actions could be described as a continuum by the degree of long-term fiscal risk they present. At one end, debt reduction and entitlement reform actually increase future fiscal flexibility by freeing up resources.  One-time actions—either on the tax or spending side of the budget—may have limited impact on future flexibility.  At the other end of the fiscal risk spectrum, permanent or open-ended fiscal actions on the spending side  or tax side of the budget can reduce future fiscal flexibility—although they may have salutary effects on longer-term economic growth depending on their design and implementation.  I have suggested before that increasing entitlement spending arguably presents the highest risk to our long-range fiscal outlook. Whatever choices the Congress decides to make, approaches should be explored to mitigate risk to the long term.  For example, provisions with plausible expiration dates—on the spending and/or the tax side—may prompt re-examination taking into account any changes in fiscal circumstances.  In addition, a mix of temporary and permanent actions can also serve to reduce risk.
As we move beyond the immediate threats, it will be important for the Congress and the President to take a hard look at competing claims on the federal fisc.  I don’t need to remind this Committee that a big contributor to deficit reduction in the 1990s was the decline in defense spending. Given recent events, it is pretty clear that the defense budget is not a likely source for future budget reductions. (See fig. 4.)
Once the economy rebounds, returning to surpluses will take place against the backdrop of greater competition of claims within the budget. The new commitments that we need to undertake to protect this nation against the threats stemming from terrorism will compete with other priorities. Subjecting both new proposals and existing programs to scrutiny would increase the ability to accommodate any new needs.
A fundamental review of existing programs and operations can create much needed fiscal flexibility to address emerging needs by weeding out programs that have proven to be outdated, poorly targeted or inefficient in their design and management. Many programs were designed years ago to respond to earlier challenges.  Obviously many things have changed.  It should be the norm to reconsider the relevance or “fit” of any federal program or activity in today’s world and for the future.  In fact, we have a stewardship responsibility to both today’s taxpayers and tomorrow’s to reexamine and update our priorities, programs, and agency operations. Given the significant events since the last CBO 10-year budget projections, it is clear that the time has come to conduct a comprehensive review of existing agencies and programs—which are often considered to be “in the base”—while exercising continued prudence and fiscal discipline in connection with new initiatives.
In particular, agencies will need to reassess their strategic goals and priorities to enable them to better target available resources to address urgent national preparedness needs.  The terrorist attacks, in fact, may provide a window of opportunity for certain agencies to rethink approaches to longstanding problems and concerns.  For instance, the threat to air travel has already prompted attention to chronic problems with airport security that we and others have been pointing to for years. Moreover, the crisis might prompt a healthy reassessment of our broader transportation policy framework with an eye to improving the integration of air, rail, and highway systems to better move people and goods. Other longstanding problems also take on increased relevance in today’s world. Take, for example, food safety.   Problems such as overlapping and duplicative inspections, poor coordination and the inefficient allocation of resources are not new.  However, they take on a new meaning—and could receive increased attention—given increased awareness of bioterrorism issues.
GAO has identified a number of areas warranting reconsideration based on program performance, targeting, and costs. Every year, we issue a report identifying specific options, many scored by CBO, for congressional consideration stemming from our audit and evaluation work. This report provides opportunities for (1) reassessing objectives of specific federal programs, (2) improved targeting of benefits and (3) improving the efficiency and management of federal initiatives.
This same stewardship responsibility applies to our oversight of the funds recently provided to respond to the events of September 11.  Rapid action in response to an emergency does not eliminate the need for review of how the funds are used.  As you move ahead in the coming years, there will be proposals for new or expanded federal activities, but we must seek to distinguish the infinite variety of “wants” from those investments that have greater promise to effectively address more critical “needs.”
In sorting through these proposals, we might apply certain investment criteria in making our choices. Well-chosen enhancements to the nation’s infrastructure are an important part of our national preparedness strategy. Investments in human capital for certain areas such as intelligence, public health and airport security will also be necessary as well to foster and maintain the skill sets needed to respond to the threats facing us. As we have seen with the airline industry, we may even be called upon to provide targeted and temporary assistance to certain vital sectors of our economy affected by this crisis.  A variety of governmental tools will be proposed to address these challenges—grants, loans, tax expenditures, direct federal administration.  The involvement of a wide range of third parties—state and local governments, nonprofits, private corporations, and even other nations—will be a vital part of the national response as well.
In the short term, we have to do what is necessary to get this nation back on its feet and compassionately deal with the human tragedies left in its wake.  However, as we think about our longer-term preparedness and develop a comprehensive homeland security strategy, we can and should select those programs and tools that promise to provide the most cost- effective approaches to achieve our goals. Some of the key questions that should be asked include the following:   Does the proposed activity address a vital national preparedness mission and do the benefits of the proposal exceed its costs?
To what extent can the participation of other sectors of the economy, including state and local governments, be considered; and how can we select and design tools to best leverage and coordinate the efforts of numerous governmental and private entities? Is the proposal designed to prevent other sectors or governments from reducing their investments as a result of federal involvement?
How can we ensure that the various federal tools and programs addressing the objective are coherently designed and integrated so that they work in a synergistic rather than a fragmented fashion?
Do proposals to assist critical sectors in the recovery from terrorist attacks appropriately distinguish between temporary losses directly attributable to the crisis and longer-term costs stemming from broader and more enduring shifts in markets and other forces?
Are the proposal’s time frames, cost projections, and promises realistic in light of past experience and the capacity of administrators at all levels to implement?
We will face the challenge of sorting out these many claims on the federal budget without the fiscal benchmarks and rules that have guided us through the years of deficit reduction into surplus. Your job therefore has become much more difficult.
Ultimately, as this Committee recommended on October 4, we should attempt to return to a position of surplus as the economy returns to a higher growth path.  Although budget balance may have been the desired fiscal position in past decades, nothing short of surpluses are needed to promote the level of savings and investment necessary to help future generations better afford the commitments of an aging society.  As you seek to develop new fiscal benchmarks to guide policy, you may want to look at approaches taken by other countries.  Certain nations in the Organization for Economic Cooperation and Development, such as Sweden and Norway, have gone beyond a fiscal policy of balance to one of surplus over the business cycle.  Norway has adopted a policy of aiming for budget surpluses to help better prepare for the fiscal challenges stemming from an aging society.  Others have established a specific ratio of debt to gross domestic product as a fiscal target.

	Conclusion

The terrorist attack on September 11, 2001, was a defining moment for our nation, our government, and, in some respects, the world.  The initial response by the President and the Congress has shown the capacity of our government to act quickly.  However, it will be important to follow up on these initial steps to institutionalize and sustain our ability to deal with a threat that is widely recognized as a complex and longer-term challenge. As the President and the Congress—and the American people—recognize, the need to improve homeland security is not a short-term emergency. It will continue even if we are fortunate enough to have the threats moved off the front page of our daily papers.
As I noted earlier, implementing a successful homeland security strategy will encounter many of the same performance and accountability challenges that we have identified throughout the federal government. These include bringing more coherence to the operations of many agencies and programs, dealing with human capital issues, and adequately defining performance goals and measuring success.
The appointment of former Governor Ridge to head an Office of Homeland Security within the Executive Office of the President is a promising first step in marshalling the resources necessary to address our homeland security requirements.  It can be argued, however, that statutory underpinnings and effective congressional oversight are critical to sustaining broad scale initiatives over the long term.  Therefore, as we move beyond the immediate response to the design of a longer-lasting approach to homeland security, I urge you to consider the implications of different structures and statutory frameworks for accountability and your ability to conduct effective oversight.  Needless to say, I am also interested in the impact of various approaches on GAO’s ability to assist you in this task.
You are faced with a difficult challenge: to respond to legitimate short- term needs while remaining mindful of our significant and continuing long- term fiscal challenges.  While the Congress understandably needs to focus on the current urgent priorities of combating international terrorism, securing our homeland, and stimulating our economy, it ultimately needs to return to a variety of other challenges, including our long-range fiscal challenge.  Unfortunately, our long-range challenge has become more difficult, and our window of opportunity to address our entitlement challenges is narrowing.  As a result it will be important to return to these issues when the Congress reconvenes next year.  We in GAO stand ready to help you address these important issues both now and in the future.
I would be happy to answer any questions that you may have.

Appendix I: Prior GAO Work Related to Homeland Security

GAO has completed several congressionally requested efforts on numerous topics related to homeland security. Some of the work that we have done relates to the areas of combating terrorism, aviation security, transnational crime, protection of critical infrastructure, and public health. The summaries describe recommendations made before the President established the Office of Homeland Security.

	Combating Terrorism

Given concerns about the preparedness of the federal government and state and local emergency responders to cope with a large-scale terrorist attack involving the use of weapons of mass destruction, we reviewed the plans, policies, and programs for combating domestic terrorism involving weapons of mass destruction that were in place prior to the tragic events of September 11. Our report, Combating Terrorism: Selected Challenges and Related Recommendations, which was issued September 20, 2001, updates our extensive evaluations in recent years of federal programs to combat domestic terrorism and protect critical infrastructure.
Progress has been made since we first began looking at these issues in 1995. Interagency coordination has improved, and interagency and intergovernmental command and control now is regularly included in exercises. Agencies also have completed operational guidance and related plans. Federal assistance to state and local governments to prepare for terrorist incidents has resulted in training for thousands of first responders, many of whom went into action at the World Trade Center and at the Pentagon on September 11, 2001.
We also recommended that the President designate a single focal point with responsibility and authority for all critical functions necessary to provide overall leadership and coordination of federal programs to combat terrorism. The focal point should oversee a comprehensive national-level threat assessment on likely weapons, including weapons of mass destruction, that might be used by terrorists and should lead the development of a national strategy to combat terrorism and oversee its implementation. With the President’s appointment of the Homeland Security Adviser, that step has been taken.  Furthermore, we recommended that the Assistant to the President for Science and Technology complete a strategy to coordinate research and development to improve federal capabilities and avoid duplication.

	Aviation Security

Since 1996, we have presented numerous reports and testimonies and identified numerous weaknesses that we found in the commercial aviation security system. For example, we reported that airport passenger screeners do not perform well in detecting dangerous objects, and Federal Aviation Administration tests showed that as testing gets more realistic— that is, as tests more closely approximate how a terrorist might attempt to penetrate a checkpoint—screener performance declines significantly. In addition, we were able to penetrate airport security ourselves by having our investigators create fake credentials from the Internet and declare themselves law enforcement officers. They were then permitted to bypass security screening and go directly to waiting passenger aircraft. In 1996, we outlined a number of steps that required immediate action, including identifying vulnerabilities in the system; developing a short-term approach to correct significant security weaknesses; and developing a long-term, comprehensive national strategy that combines new technology, procedures, and better training for security personnel.

	Cyber Attacks on Critical Infrastructure

Federal critical infrastructure-protection initiatives have focused on preventing mass disruption that can occur when information systems are compromised because of computer-based attacks. Such attacks are of growing concern due to the nation’s increasing reliance on interconnected computer systems that can be accessed remotely and anonymously from virtually anywhere in the world. In accordance with Presidential Decision Directive 63, issued in 1998, and other information-security requirements outlined in laws and federal guidance, an array of efforts has been undertaken to address these risks. However, progress has been slow. For example, federal agencies have taken initial steps to develop critical infrastructure plans, but independent audits continue to identify persistent, significant information security weaknesses that place many major federal agencies’ operations at high risk of tampering and disruption. In addition, while federal outreach efforts have raised awareness and prompted information sharing among government and private sector entities, substantive analysis of infrastructure components to identify interdependencies and related vulnerabilities has been limited. An underlying deficiency impeding progress is the lack of a national plan that fully defines the roles and responsibilities of key participants and establishes interim objectives. Accordingly, we have recommended that the Assistant to the President for National Security Affairs ensure that the government’s critical infrastructure strategy clearly define specific roles and responsibilities, develop interim objectives and milestones for achieving adequate protection, and define performance measures for accountability. The administration has been reviewing and considering adjustments to the government’s critical infrastructure-protection strategy and last week, announced appointment of a Special Advisor to the President for Cyberspace Security.

	International Crime Control

On September 20, 2001, we publicly released a report on international crime control and reported that individual federal entities have developed strategies to address a variety of international crime issues, and for some crimes, integrated mechanisms exist to coordinate efforts across agencies. However, we found that without an up-to-date and integrated strategy and sustained top-level leadership to implement and monitor the strategy, the risk is high that scarce resources will be wasted, overall effectiveness will be limited or not known, and accountability will not be ensured. We recommended that the Assistant to the President for National Security Affairs take appropriate action to ensure sustained executive-level coordination and assessment of multi-agency federal efforts in connection with international crime, including efforts to combat money laundering. Some of the individual actions we recommended were to update the existing governmentwide international crime threat assessment, to update or develop a new International Crime Control Strategy to include prioritized goals as well as implementing objectives, and to designate responsibility for executing the strategy and resolving any jurisdictional issues.

	Public Health

The spread of infectious diseases is a growing concern. Whether a disease outbreak is intentional or naturally occurring, the public health response to determine its causes and contain its spread is largely the same. Because a bioterrorist event could look like a natural outbreak, bioterrorism preparedness rests in large part on public health preparedness.  We reported in September 2001 that concerns remain regarding preparedness at state and local levels and that coordination of federal terrorism research, preparedness, and response programs is fragmented.
In our review last year of the West Nile virus outbreak in New York, we also found problems related to communication and coordination among and between federal, state, and local authorities. Although this outbreak was relatively small in terms of the number of human cases, it taxed the resources of one of the nation’s largest local health departments. In 1999, we reported that surveillance for important emerging infectious diseases is not comprehensive in all states, leaving gaps in the nation’s surveillance network. Laboratory capacity could be inadequate in any large outbreak, with insufficient trained personnel to perform laboratory tests and insufficient computer systems to rapidly share information. Earlier this year, we reported that federal agencies have made progress in improving their management of the stockpiles of pharmaceutical and medical supplies that would be needed in a bioterrorist event, but that some problems still remained. There are also widespread concerns that hospital emergency departments generally are not prepared in an organized fashion to treat victims of biological terrorism and that hospital emergency capacity is already strained, with emergency rooms in major metropolitan areas routinely filled and unable to accept patients in need of urgent care. To improve the nation’s public health surveillance of infectious diseases and help ensure adequate public protection, we recommended that the Director of the Centers for Disease Control and Prevention lead an effort to help federal, state, and local public health officials achieve consensus on the core capacities needed at each level of government. We advised that consensus be reached on such matters as the number and qualifications of laboratory and epidemiological staff as well as laboratory and information technology resources.

Related GAO Products

Homeland Security: A Risk Management Approach Can Guide Preparedness Efforts (GAO-02-208T, Oct. 31, 2001).
Homeland Security: Need to Consider VA’s Role in Strengthening Federal Preparedness (GAO-02-145T, Oct. 15, 2001).
Homeland Security: Key Elements of a Risk Management Approach (GAO-02-150T, Oct. 12, 2001).
Homeland Security: A Framework for Addressing the Nation’s Efforts, (GAO-01-1158T, Sept. 21, 2001).

	Combating Terrorism

Combating Terrorism: Considerations for Investing Resources in Chemical and Biological Preparedness (GAO-02-162T, Oct. 17, 2001).
Combating Terrorism:  Selected Challenges and Related Recommendations  (GAO-01-822, Sept. 20, 2001).
Combating Terrorism:  Actions Needed to Improve DOD’s Antiterrorism Program Implementation and Management (GAO-01-909, Sept. 19, 2001).
Combating Terrorism:  Comments on H.R. 525 to Create a President’s Council on Domestic Preparedness (GAO-01-555T, May 9, 2001).
Combating Terrorism:  Observations on Options to Improve the Federal Response (GAO-01-660T, Apr. 24, 2001).
Combating Terrorism:  Accountability Over Medical Supplies Needs Further Improvement (GAO-01-463, Mar. 30, 2001).
Combating Terrorism:  Comments on Counterterrorism Leadership and National Strategy (GAO-01-556T, Mar. 27, 2001).
Combating Terrorism:  FEMA Continues to Make Progress in Coordinating Preparedness and Response (GAO-01-15, Mar. 20, 2001).
Combating Terrorism:  Federal Response Teams Provide Varied Capabilities; Opportunities Remain to Improve Coordination (GAO-01- 14, Nov. 30, 2000).
Combating Terrorism:  Linking Threats to Strategies and Resources (GAO/T-NSIAD-00-218, July 26, 2000).
Combating Terrorism:  Action Taken but Considerable Risks Remain for Forces Overseas (GAO/NSIAD-00-181, July 19, 2000).
Weapons of Mass Destruction:  DOD’s Actions to Combat Weapons Use Should Be More Integrated and Focused (GAO/NSIAD-00-97, May 26, 2000).
Combating Terrorism:  Comments on Bill H.R. 4210 to Manage Selected Counterterrorist Programs (GAO/T-NSIAD-00-172, May 4, 2000).
Combating Terrorism:  How Five Foreign Countries Are Organized to Combat Terrorism (GAO/NSIAD-00-85, Apr. 7, 2000).
Combating Terrorism:  Issues in Managing Counterterrorist Programs (GAO/T-NSIAD-00-145, Apr. 6, 2000).
Combating Terrorism:  Need to Eliminate Duplicate Federal Weapons of Mass Destruction Training (GAO/NSIAD-00-64, Mar. 21, 2000).
Combating Terrorism:  Chemical and Biological Medical Supplies are Poorly Managed (GAO/HEHS/AIMD-00-36, Oct. 29, 1999).
Combating Terrorism:  Observations on the Threat of Chemical and Biological Terrorism (GAO/T-NSIAD-00-50, Oct. 20, 1999).
Combating Terrorism:  Need for Comprehensive Threat and Risk Assessments of Chemical and Biological Attack (GAO/NSIAD-99-163, Sept. 7, 1999).
Combating Terrorism:  Analysis of Federal Counterterrorist Exercises (GAO/NSIAD-99-157BR, June 25, 1999).
Combating Terrorism: Observations on Growth in Federal Programs (GAO/T-NSIAD-99-181, June 9, 1999).
Combating Terrorism: Analysis of Potential Emergency Response Equipment and Sustainment Costs (GAO/NSIAD-99-151, June 9, 1999).
Combating Terrorism:  Use of National Guard Response Teams Is Unclear (GAO/NSIAD-99-110, May 21, 1999).
Combating Terrorism:  Issues to Be Resolved to Improve Counterterrorist Operations (GAO/NSIAD-99-135, May 13, 1999).
Combating Terrorism:  Observations on Biological Terrorism and Public Health Initiatives (GAO/T-NSIAD-99-112, Mar. 16, 1999).
Combating Terrorism:  Observations on Federal Spending to Combat Terrorism (GAO/T-NSIAD/GGD-99-107, Mar. 11, 1999).
Combating Terrorism:  FBI's Use of Federal Funds for Counterterrorism-Related Activities (FYs 1995-98) (GAO/GGD-99-7, Nov. 20, 1998).
Combating Terrorism:  Opportunities to Improve Domestic Preparedness Program Focus and Efficiency (GAO/NSIAD-99-3, Nov. 12, 1998).
Combating Terrorism:  Observations on the Nunn-Lugar-Domenici Domestic Preparedness Program (GAO/T-NSIAD-99-16, Oct. 2, 1998).
Combating Terrorism:  Observations on Crosscutting Issues (GAO/T- NSIAD-98-164, Apr. 23, 1998).
Combating Terrorism:  Threat and Risk Assessments Can Help Prioritize and Target Program Investments (GAO/NSIAD-98-74, Apr. 9, 1998).
Combating Terrorism:  Spending on Governmentwide Programs Requires Better Management and Coordination (GAO/NSIAD-98-39, Dec. 1, 1997).
Combating Terrorism:  Federal Agencies' Efforts to Implement National Policy and Strategy (GAO/NSIAD-97-254, Sept. 26, 1997).
Combating Terrorism:  Status of DOD Efforts to Protect Its Forces Overseas (GAO/NSIAD-97-207, July 21, 1997).
Terrorism and Drug Trafficking:  Responsibilities for Developing Explosives and Narcotics Detection Technologies (GAO/NSIAD-97-95, Apr. 15, 1997). Federal Law Enforcement:  Investigative Authority and Personnel at 13 Agencies (GAO/GGD-96-154, Sept. 30, 1996).
Terrorism and Drug Trafficking:  Technologies for Detecting Explosives and Narcotics (GAO/NSIAD/RCED-96-252, Sept. 4, 1996).
Terrorism and Drug Trafficking: Threats and Roles of Explosives and Narcotics Detection Technology (GAO/NSIAD/RCED-96-76BR, Mar. 27, 1996).

	Aviation Security

Aviation Security: Vulnerabilities in, and Alternatives for, Preboard Screening Security Operations, (GAO-01-1171T, Sept. 25, 2001).
Aviation Security: Weaknesses in Airport Security and Options for Assigning Screening Responsibilities, (GAO-01-1165T, Sept. 21, 2001).
Aviation Security: Terrorist Acts Demonstrate Urgent Need to Improve Security at the Nation’s Airports (GAO-01-1162T, Sept. 20, 2001).
Responses of Federal Agencies and Airports We Surveyed About Access Security Improvements (GAO-01-1069R, Aug. 31, 2001).
Aviation Security: Additional Controls Needed to Address Weaknesses in Carriage of Weapons Regulations (GAO/RCED-00-181, Sept. 29, 2000).
Aviation Security:  Long-Standing Problems Impair Airport Screeners’ Performance (GAO/RCED-00-75, June 28, 2000).
Aviation Security: Breaches at Federal Agencies and Airports (GAO/T- OSI-00-10, May 25, 2000).
Aviation Security: Vulnerabilities Still Exist in the Aviation Security System (GAO/T-RCED/AIMD-00-142, Apr. 6, 2000).
Aviation Security: Slow Progress in Addressing Long-Standing Screener Performance Problems (GAO/T-RCED-00-125, Mar. 16, 2000).
Aviation Security: FAA’s Actions to Study Responsibilities and Funding for Airport Security and to Certify Screening Companies (GAO/RCED- 99-53, Feb. 25, 1999).
Aviation Security: Progress Being Made, but Long-term Attention Is Needed (GAO/T-RCED-98-190, May 14, 1998).
Aviation Security:  FAA's Procurement of Explosives Detection Devices (GAO/RCED-97-111R, May 1, 1997).
Aviation Safety and Security: Challenges to Implementing the Recommendations of the White House Commission on Aviation Safety and Security (GAO/T-RCED-97-90, Mar. 5, 1997).
Aviation Security: Technology’s Role in Addressing Vulnerabilities (GAO/T-RCED/NSIAD-96-262, Sept. 19, 1996).
Aviation Security:  Urgent Issues Need to Be Addressed (GAO/T- RCED/NSIAD-96-151, Sept. 11, 1996).
Aviation Security:  Immediate Action Needed to Improve Security (GAO/T-RCED/NSIAD-96-237, Aug. 1, 1996).
Aviation Security: Development of New Security Technology Has Not Met Expectations (GAO/RCED-94-142, May 19, 1994).
Aviation Security:  Additional Actions Needed to Meet Domestic and International Challenges (GAO/RCED-94-38, Jan. 27, 1994).

	Cyber Attacks on Critical Infrastructure

Information Sharing: Practices That Can Benefit Critical Infrastructure Protection (GAO-02-24, Oct. 15, 2001).
Critical Infrastructure Protection: Significant Challenges in Safeguarding Government and Privately-Controlled Systems from Computer-Based Attacks, (GAO-01-1168T, Sept. 26, 2001).
Critical Infrastructure Protection:  Significant Challenges in Protecting Federal Systems and Developing Analysis and Warning Capabilities (GAO-01-1132T, Sept. 12, 2001).
Information Security: Serious and Widespread Weaknesses Persist at Federal Agencies (GAO/AIMD-00-295, Sept. 6, 2000).
Critical Infrastructure Protection:  Significant Challenges in Developing Analysis, Warning, and Response Capabilities (GAO-01-769T, May 22, 2001).
Critical Infrastructure Protection:  Significant Challenges in Developing National Capabilities (GAO-01-232, Apr. 25, 2001).
Critical Infrastructure Protection:  Challenges to Building a Comprehensive Strategy for Information Sharing and Coordination (GAO/T-AIMD-00-268, July 26, 2000).
Security Protection:  Standardization Issues Regarding Protection of Executive Branch Officials (GAO/GGD/OSI-00-139, July 11, 2000 and GAO/T-GGD/OSI-00-177, July 27, 2000).
Critical Infrastructure Protection:  Comments on the Proposed Cyber Security Information Act of 2000 (GAO/T-AIMD-00-229, June 22, 2000).
Critical Infrastructure Protection:  “I LOVE YOU” Computer Virus Highlights Need for Improved Alert and Coordination Capabilities (GAO/T-AIMD-00-181, May 18, 2000).
Critical Infrastructure Protection:  National Plan for Information Systems Protection (GAO/AIMD-00-90R, Feb. 11, 2000).
Critical Infrastructure Protection:  Comments on the National Plan for Information Systems Protection (GAO/T-AIMD-00-72, Feb. 1, 2000).
Critical Infrastructure Protection:  Fundamental Improvements Needed to Assure Security of Federal Operations (GAO/T-AIMD-00-7, Oct. 6, 1999).
Critical Infrastructure Protection:  The Status of Computer Security at the Department of Veterans Affairs (GAO/AIMD-00-5, Oct. 4, 1999).
Critical Infrastructure Protection:  Comprehensive Strategy Can Draw on Year 2000 Experiences (GAO/AIMD-00-1, Oct. 1, 1999).
Information Security:  The Proposed Computer Security Enhancement Act of 1999 (GAO/T-AIMD-99-302, Sept. 30, 1999).
Information Security:  NRC’s Computer Intrusion Detection Capabilities (GAO/AIMD-99-273R, Aug. 27, 1999).
Electricity Supply: Efforts Underway to Improve Federal Electrical Disruption Preparedness (GAO/RCED-92-125, Apr. 20, 1992)

	Public Health

Anthrax Vaccine: Changes to the Manufacturing Process (GAO-02-181T, Oct. 23, 2001).
Bioterrorism: Public Health and Medical Preparedness, (GAO-02-141T, Oct. 9, 2001).
Bioterrorism: Coordination and Preparedness, (GAO-02-129T, Oct. 5, 2001).
Bioterrorism: Federal Research and Preparedness Activities (GAO-01- 915, Sept. 28, 2001).
West Nile Virus Outbreak:  Lessons for Public Health Preparedness (GAO/HEHS-00-180, Sept. 11, 2000).
Food Safety:  Agencies Should Further Test Plans for Responding to Deliberate Contamination (GAO/RCED-00-3, Oct. 27, 1999).
Emerging Infectious Diseases: Consensus on Needed Laboratory Capacity Could Strengthen Surveillance (GAO/HEHS-99-26, Feb. 5, 1999).

	International Crime Control

International Crime Controls: Sustained Executive Level Coordination of Federal Response Needed (GAO-01-629, Sept. 20, 2001).
Alien Smuggling: Management and Operational Improvements Needed to Address Growing Problem (GAO/GGD-00-103, May 1, 2000).
Criminal Aliens: INS Efforts to Identify and Remove Imprisoned Aliens Continue to Need Improvement (GAO/T-GGD-99-47, Feb. 25, 1999).
Criminal Aliens: INS Efforts to Remove Imprisoned Aliens Continue to Need Improvement (GAO/GGD-99-3, Oct. 16, 1998).

	Immigration and Naturalization

Immigration and Naturalization Service: Overview of Management and Program Challenges (GAO/T-GGD-99-148, July 29, 1999).
Illegal Immigration: Status of Southwest Border Strategy Implementation (GAO/GGD-99-44, May 19, 1999).
Illegal Immigration: Southwest Border Strategy Results Inconclusive; More Evaluation Needed (GAO/GGD-98-21, Dec. 11, 1997).

Output:
What GAO Found

The United States now confronts a range of diffuse threats that put increased destructive power into the hands of small states, groups, and individuals. These threats include terrorist attacks on critical infrastructure and computer systems, the potential use of weapons of mass destruction, and the spread of infectious diseases. Addressing these challenges will require leadership to develop and implement a homeland security strategy in coordination with all relevant partners, and to marshal and direct the necessary resources. The recent establishment of the Office of Homeland Security is a good first step, but questions remain about how this office will be structured, what authority its Director will have, and how this effort can be institutionalized and sustained over time. Although homeland security is an urgent and vital national priority, the United States still must address short-term and long-term fiscal challenges that were present before September 11.


Input:
T he Internet of Things (IoT) is a complex, often poorly understood phenomenon. The term is more than a decade old, but interest has grown considerably over the last few years as applications have increased. The impacts of the IoT on the economy and society more generally are expected by many to grow substantially. This report was developed to assist Congress in responding to some commonly asked questions about it:
" What Is the Internet of Things (IoT)? " " How Does the IoT Work? " " What Impacts Will the IoT Have? " " What Is the Current Federal Role? " " What Issues Might Affect the Development and Implementation of the IoT? " " What Actions Has Congress Taken? " " Where Can I Find Additional Resources on This Topic? "

	What Is the Internet of Things (IoT)?

When people talk about the Internet, they are usually referring to the electronic network that permits computers around the world to communicate with each other. What, then, is the IoT? There is no universally agreed-upon definition, but generally, the term is used to describe networks of objects that are not themselves computers but that have embedded components that connect to the Internet. "Things" may include, for example, smart meters, fitness trackers, personal vehicles, home appliances, medical devices, and even clothing used by individual consumers. They may also include embedded devices in roadways and in other components of infrastructure such as electric grids, manufacturing plants and other buildings, farms, and virtually any other object, element, or system for which remote communications, control, or data collection and processing might be useful.
While fixed and mobile computing devices such as desktop computers, smartphones, and tablets are generally not considered to be IoT objects, smartphones in particular have features such as motion and position sensors that blur the distinctions. Some smartphone applications, for example, enable them to be used in fitness tracking and other health monitoring.
In other words, the IoT potentially includes huge numbers and kinds of interconnected objects. In practice, IoT refers not to a simple or uniform network of objects but rather to a complex collection of objects and networks. Specific dimensions of the IoT may be referred to by terms such as smart grid, connected cities, and Industrial Internet. Other terms may also be used in the context of IoT to denote related concepts such as cyber-physical systems and the Internet of Everything.
The IoT is often considered the next major stage in the evolution of cyberspace. The first electronic computers were developed in the 1940s, but 40 years passed before connecting computers through wired devices began to spread in the 1980s. The first decade of the 21 st century saw the next stage, marked by the rapid spread of smartphones and other mobile devices that use wireless communications, as well as social media, big-data analytics, and cloud computing. Building on those advances, connections between two or more machines (M2M) and between machines and people are expected by many observers to lead to huge growth in the IoT by 2020.

	How Does the IoT Work?

The IoT is not separate from the Internet, but rather, a potentially huge extension and expansion of it. The "things" that form the basis of the IoT are objects. They could be virtually anything—streetlights, thermostats, electric meters, fitness trackers, factory equipment, automobiles, unmanned aircraft systems (UASs or drones), or even cows or sheep in a field. What makes an object part of the IoT is embedded or attached computer chips or similar components that give the object both a unique identifier and Internet connectivity. Objects with such components are often called "smart"—such as smart meters and smart cars.
Internet connectivity allows a smart object to communicate with computers and with other smart objects. Connections of smart objects to the Internet can be wired, such as through Ethernet cables, or wireless, such as via a Wi-Fi or cellular network.
To enable precise communications, each IoT object must be uniquely identifiable. That is accomplished through an Internet Protocol (IP) address, a number assigned to each Internet-connected device, whether a desktop computer, a mobile phone, a printer, or an IoT object. Those IP addresses ensure that the device or object sending or receiving information is correctly identified.
What kinds of information do IoT objects communicate? The answer depends on the nature of the object, and it can be simple or complex. For example, a smart thermometer might have only one sensor, used to communicate ambient temperature to a remote weather-monitoring center. A wireless medical device might, in contrast, use various sensors to communicate a person's body temperature, pulse, blood pressure, and other variables to a medical service provider via a computer or mobile phone.
Smart objects can also be involved in command networks. For example, industrial control systems can adjust manufacturing processes based on input from both other IoT objects and human operators. Network connectivity can permit such operations to be performed in "real time"—that is, almost instantaneously.
Smart objects can form systems that communicate information and commands among themselves, usually in concert with computers they connect to. This kind of communication enables the use of smart systems in homes, vehicles, factories, and even entire cities.
Smart systems allow for automated and remote control of many processes. A smart home can permit remote control of lighting, security, HVAC (heating, ventilating, and air conditioning), and appliances. In a smart city, an intelligent transportation system (ITS) may permit vehicles to communicate with other vehicles and roadways to determine the fastest route to a destination, avoiding traffic jams, and traffic signals can be adjusted based on congestion information received from cameras and other sensors. Buildings might automatically adjust electric usage, based on information sent from remote thermometers and other sensors. An Industrial Internet application can permit companies to monitor production systems and adjust processes, remotely control and synchronize machinery operations, track inventory and supply chains, and perform other tasks.
IoT connections and communications can be created across a broad range of objects and networks and can transform previously independent processes into integrated systems. These integrated systems can potentially have substantial effects on homes and communities, factories and cities, and every sector of the economy, both domestically and globally.

	What Impacts Will the IoT Have?

The IoT may significantly affect many aspects of the economy and society, although the full extent and nature of its eventual impacts remains uncertain. Many observers predict that the growth of the IoT will bring positive benefits through enhanced integration, efficiency, and productivity across many sectors of the U.S. and global economies. Among those commonly mentioned are agriculture, energy, health care, manufacturing, and transportation. Significant impacts may also be felt more broadly on economic growth, infrastructure and cities, and individual consumers. However, both policy and technical challenges, including security and privacy issues, might inhibit the growth and impact of IoT innovations.

		Economic Growth

Several economic analyses have predicted that the IoT will contribute significantly to economic growth over the next decade, but the predictions vary substantially in magnitude. The current global IoT market has been valued at about $2 trillion, with estimates of its predicted value over the next 5 to 10 years varying from $4 trillion to $11 trillion. Such variability demonstrates the difficulty of making economic forecasts in the face of various uncertainties, including a lack of consensus among researchers about exactly what the IoT is and how it will develop.

		Economic Sectors

			Agriculture

The IoT can be leveraged by the agriculture industry through precision agriculture, with the goal of optimizing production and efficiency while reducing costs and environmental impacts. For farming operations, it involves analysis of detailed, often real-time data on weather, soil and air quality, water supply, pest populations, crop maturity, and other factors such as the cost and availability of equipment and labor. Field sensors test soil moisture and chemical balance, which can be coupled with location technologies to enable precise irrigation and fertilization. Drones and satellites can be used to take detailed images of fields, giving farmers information about crop yield, nutrient deficiencies, and weed locations. For ranching and animal operations, radio frequency identification (RFID) chips and electronic identification readers (EID) help monitor animal movements, feeding patterns, and breeding capabilities, while maintaining detailed records on individual animals.

			Energy

Within the energy sector, the IoT may impact both production and delivery, for example through facilitating monitoring of oil wellheads and pipelines. When IoT components are embedded into parts of the electrical grid, the resulting infrastructure is commonly referred to as the "smart grid." This use of IoT enables greater control by utilities over the flow of electricity and can enhance the efficiency of grid operations. It can also expedite the integration of microgenerators into the grid.
Smart-grid technology can also provide consumers with greater knowledge and control of their energy usage through the use of smart meters in the home or office. Connection of smart meters to a building's HVAC, lighting, and other systems can result in "smart buildings" that integrate the operation of those systems. Smart buildings use sensors and other data to automatically adjust room temperatures, lighting, and overall energy usage, resulting in greater efficiency and lower energy cost. Information from adjacent buildings may be further integrated to provide additional efficiencies in a neighborhood or larger division in a city.

			Health Care

The IoT has many applications in the health care field, in both health monitoring and treatment, including telemedicine and telehealth. Applications may involve the use of medical technology and the Internet to provide long-distance health care and education. Medical devices—which can be wearable or nonwearable, or even implantable, injectable, or ingestible —can permit remote tracking of a patient's vital signs, chronic conditions, or other indicators of health and wellness. Wireless medical devices may be used not only in hospital settings but also in remote monitoring and care, freeing patients from sustained or recurring hospital visits. Some experts have stated that advances in healthcare IoT applications will be important for providing affordable, quality care to the aging U.S. population.

			Manufacturing

Integration of IoT technologies into manufacturing and supply chain logistics is predicted to have a transformative effect on the sector. The biggest impact may be realized in optimization of operations, making manufacturing processes more efficient. Efficiencies can be achieved by connecting components of factories to optimize production, but also by connecting components of inventory and shipping for supply chain optimization. Another application is predictive maintenance, which uses sensors to monitor machinery and factory infrastructure for damage. Resulting data can enable maintenance crews to replace parts before potentially dangerous and/or costly malfunctions occur.

			Transportation

Transportation systems are becoming increasingly connected. New motor vehicles are equipped with features such as global positioning systems (GPS) and in-vehicle entertainment, as well as advanced driver assistance systems (ADAS), which utilize sensors in the vehicle to assist the driver, for example with parking and emergency braking. Further connection of vehicle systems enables fully autonomous or self-driving automobiles, which are predicted to be commercialized in the next 5-20 years.
Additionally, IoT technologies can allow vehicles within and across modes—including cars, buses, trains, airplanes, and unmanned aerial vehicles (drones)—to "talk" to one another and to components of the IoT infrastructure, creating intelligent transportation systems (ITS). Potential benefits of ITS may include increased safety and collision avoidance, optimized traffic flows, and energy savings, among others.

			Infrastructure and Smart Cities

The capabilities of the smart grid, smart buildings, and ITS combined with IoT components in other public utilities—such as roadways, sewage and water transport and treatment, public transportation, and waste removal—can contribute to more integrated and functional infrastructure, especially in cities. For example, traffic authorities can use cameras and embedded sensors to manage traffic flow and help reduce congestion. IoT components embedded in street lights or other infrastructure elements can provide functions such as advanced lighting control, environmental monitoring, and even assistance for drivers in finding parking spaces. Smart garbage cans can signal waste removal teams when they are full, streamlining the routes that garbage trucks take.
This integration of infrastructure and service components is increasingly referred to as smart cities, or other terms such as connected, digital, or intelligent cities or communities. A number of cities in the United States and elsewhere have developed smart-city initiatives.
As with IoT and other popular technology terms, there is no established consensus definition or set of criteria for characterizing what a smart city is. Specific characterizations vary widely, but in general they involve the use of IoT and related technologies to improve energy, transportation, governance, and other municipal services for specified goals such as sustainability or improved quality of life. The related technologies include
social media (such as Facebook and Twitter), mobile computing (such as smartphones and wearable devices), data analytics (big data—the processing and use of very large data sets; and open data—databases that are publicly accessible), and cloud computing (the delivery of computing services from a remote location, analogous to the way utilities such as electricity are provided).
Together, these are sometimes called SMAC.

		Social and Cultural Impacts

The IoT may create webs of connections that will fundamentally transform the way people and things interact with each other. The emerging cyberspace platform created by the IoT and SMAC has been described as potentially making cities "like 'computers' in open air," where citizens engage with the city "in a real-time and ongoing loop of information."
Some observers have proposed that the growth of IoT will result in a hyperconnected world in which the seamless integration of objects and people will cause the Internet to disappear as a separate phenomenon. In such a world, cyberspace and human space would seem to effectively merge into a single environment, with unpredictable but potentially substantial societal and cultural impacts.

	What Is the Current Federal Role?

There is no single federal agency that has overall responsibility for the IoT, just as there is no one agency with overall responsibility for cyberspace. Federal agencies may find the IoT useful in helping them fulfill their missions through a variety of applications such as those discussed in this report and elsewhere. Each agency is responsible under various laws and regulations for the functioning and security of its own IoT, although some technologies, such as drones, may also fall under some aspects of the jurisdiction of other agencies.
Various agencies have regulatory, sector-specific, and other mission-related responsibilities that involve aspects of IoT. For example, entities that use wireless communications for their IoT devices will be subject to allocation rules for the portions of the electromagnetic spectrum that they use.
The Federal Communications Commission (FCC) allocates and assigns spectrum for nonfederal entities. In the Department of Commerce , the National Telecommunications and Information Administration (NTIA) fulfills that function for federal entities, and the National Institute of Standards and Technology (NIST) creates standards, develops new technologies, and provides best practices for the Internet and Internet-enabled devices. The Federal Trade Commission (FTC) regulates and enforces consumer protection policies, including for privacy and security of consumer IoT devices. The Department of Homeland Security (DHS) is responsible for coordinating security for the 16 critical infrastructure sectors. Many of those sectors use industrial control systems (ICS), which are often connected to the Internet, and the DHS National Cybersecurity and Communications Integration Center (NCCIC) has an ICS Cyber Emergency Response Team (ICS-CERT) to help critical-infrastructure entities address ICS cybersecurity issues. The Food and Drug Administration (FDA) also has responsibilities with respect to the cybersecurity of Internet-connected medical devices. The Department of Justice (DOJ) addresses law-enforcement aspects of IoT, including cyberattacks, unlawful exfiltration of data from devices and/or networks, and investigation and prosecution of other computer and intellectual property crimes. Relevant activities at the Department of Energy (DOE) include those associated with developing high-performance and green buildings, and other energy-related programs, including those related to smart electrical grids. The Department of Transportation (DOT) has established an Intelligent Transportation Systems Joint Program Office (ITS JPO) to coordinate various programs and activities throughout DOT relating to the development and deployment of connected vehicles and systems, involving all modes of surface transportation. DOT mode-specific agencies also engage in ITS activities. The Federal Aviation Administration (FAA) is involved in regulation and other activities relating to unmanned aerial vehicles (UAVs) and commercial systems (UAS). The Department of Defense was a pioneer in the development of much of the foundational technology for the IoT. Most of its IoT deployment has related to its combat mission, both directly and for logistical and other support.
In addition to the activities described above, several agencies are engaged in research and development (R&D) related to the IoT.
Like NIST, the National Science Foundation (NSF) engages in cyber-physical systems research and other activities that cut across various IoT applications. The Networking and Information Technology Research and Development Program (NITRD), under the Office of Science and Technology Policy (OSTP) coordinates federal agency R&D in networking and information technology. The NITRD Cyber Physical Systems Senior Steering Group "coordinates programs, budgets and policy recommendations" for IoT R&D. Other agencies involved in such R&D include the Food and Drug Administration (FDA), the National Aeronautics and Space Administration (NASA), the National Institutes of Health (NIH), the Department of Veterans Affairs (VA), and several DOD agencies. The White House has also announced a smart-cities initiative focusing on the development of a research infrastructure, demonstration projects, and other R&D activities.

	What Issues Might Affect the Development and Implementation of the IoT?

The Internet of Things is often lauded for its potentially revolutionary applications. Indeed, IoT devices are today being implemented in many different sectors for a vast array of purposes. However, it is still unclear how IoT will progress due to challenges associated with both technical and policy issues .

		Technical Issues

Prominent technical limitations that may affect the growth and use of the IoT include a lack of new Internet addresses under the most widely used protocol, the availability of high-speed and wireless communications, and lack of consensus on technical standards.

			Internet Addresses

A potential barrier to the development of IoT is the technical limitations of the version of the Internet Protocol (IP) that is used most widely. IP is the set of rules that computers use to send and receive information via the Internet, including the unique address that each connected device or object must have to communicate . Version 4 (IPv4) is current ly in widest use. It can accommodate about 4 billion addresses, and it is close to saturation, with few new addresses available in many parts of the world.
Some observers predict that Internet traffic will grow faster for IoT objects than any other kind of device over the next five years, with more than 25 billion IoT objects in use by 2020 , and perhaps 50 billion devices altogether. I Pv4 appears unlikely to meet that growing demand, even with the use of workarounds such as methods for sharing IP addresses.
Version 6 (IPv6) allows for a huge increase in the number IP addresses . With IPv4 , the maximum number of unique addresses , 4.2 billion, is not enough to provide even one address for each of the 7.3 billion people on Earth. IPv6 , in contrast, will accommodate over 10 38 addresses—more than a trillion trillion per person .
It is highly likely that to accommodate the anticipated growth in the numbers of Internet-connected objects, IPv6 will have to be implemented broadly. It has been available since 1999 but was not formal ly launched until 2012. In most countries, fewer than 10% of IP addresses were in IPv6 as of September 2015 . Adoption is highest in some European countries and in the United States , where adoption has doubled in the past year to about 20% . Globally, adoption has doubled annually since 2011, to about 7% of addresses in mid-201 5 . While growth in adoption is expected to continue, it is not yet clear whether the rate of growth will be sufficient to accommodate the expected growth in the IoT. That will depend on a number of factors, including replacement of some older systems and applications that cannot handle IPv6 addresses , resolution of security issues associated with the transition, and availability of sufficient resources for deployment .
Efforts to transition federal systems to IPv6 began more than a decade ago. According to estimates by NIST, adoption for public-facing services has been much greater within the federal government th an within industry or academia. However, adoption varies substantially among agencies, and some data suggest that federal adoption plateaued in 2012. Data were not available for this report on domains that are not public-facing, and it is not clear whether adoption of IPv6 by federal agencies will affect their deployment of IoT applications.

			High-Speed Internet

Use and growth of the IoT can also be limited by the availability of access to high-speed Internet and advanced telecommunications services, commonly known as broadband, on which it depends. While many urban and suburban areas have access, that is not the case for many rural areas, for which private-sector providers may not find establishment of the required infrastructure profitable, and government programs may be limited.

			Wireless Communications

Many observers believe that issues relating to access to the electromagnetic spectrum will need to be resolved to ensure the functionality and interoperability of IoT devices. Access to spectrum, both licensed and unlicensed, is essential for devices and objects to communicate wirelessly. IoT devices are being developed and deployed for new purposes and industries, and some argue that the current framework for spectrum allocation may not serve these new industries well .

			Standards

Current ly, there is no single universal ly recognized set of technical standard s for the IoT, especially with respect to communication s , or even a commonly accepted definition among the various organizations that have produced IoT standards or related documents . Many observers agree that a common set of standard s will be essential for interoperability and scalability of devices and systems. However, other s have expressed pessimism that a universal standard is feasible or even desirable , given the diversity of objects that the IoT potentially encompasses. Several different sets of de facto standard s have been in development, and some observers do not expect formal standards to appear before 2017. Whether conflicts between standards will affect growth of the sector as they did for some other technologies i s not clear.

			Other Technical Issues

Several other technical issues might impact the development and adoption of IoT. For example, if an object's software cannot be readily updated in a secure manner, that could affect both function and security. Some observers have therefore recommended that smart objects have remote updating capabilities. However, such capabilities could have undesirable effects such as increasing power requirements of IoT objects or requiring additional security features to counter the risk of exploitation by hackers of the update features.
Energy consumption can also be an issue. IoT objects need energy for sensing, processing, and communicating information. If objects isolated from the electric grid must rely on batteries, replacement can be a problem, even if energy consumption is highly efficient. That is especially the case for applications using large numbers of objects or placements that are difficult to access. Therefore, alternative approaches such as energy harvesting, whether from solar or other sources, are being developed.

		Cybersecurity

The security of devices and the data they acquire, process, and transmit is often cited as a top concern in cyberspace. Cyberattacks can result in theft of data and sometimes even physical destruction. Some sources estimate losses from cyberattacks in general to be very large—in the hundreds of billions or even trillions of dollars. As the number of connected objects in the IoT grows, so will the potential risk of successful intrusions and increases in costs from those incidents.
Cybersecurity involves protecting information systems, their components and contents, and the networks that connect them from intrusions or attacks involving theft, disruption, damage, or other unauthorized or wrongful actions. IoT objects are potentially vulnerable targets for hackers. Economic and other factors may reduce the degree to which such objects are designed with adequate cybersecurity capabilities built in. IoT devices are small, are often built to be disposable, and may have limited capacity for software updates to address vulnerabilities that come to light after deployment.
The interconnectivity of IoT devices may also provide entry points through which hackers can access other parts of a network. For example, a hacker might gain access first to a building thermostat, and subsequently to security cameras or computers connected to the same network, permitting access to and exfiltration or modification of surveillance footage or other information. Control of a set of smart objects could permit hackers to use their computing power in malicious networks called botnets to perform various kinds of cyberattacks.
Access could also be used for destruction, such as by modifying the operation of industrial control systems, as with the Stuxnet malware that caused centrifuges to self-destruct at Iranian nuclear plants. Among other things, Stuxnet showed that smart objects can be hacked even if they are not connected to the Internet. The growth of smart weapons and other connected objects within DOD has led to growing concerns about their vulnerabilities to cyberattack and increasing attempts to prevent and mitigate such attacks, including improved design of IoT objects. Cybersecurity for the IoT may be complicated by factors such as the complexity of networks and the need to automate many functions that can affect security, such as authentication. Consequently, new approaches to security may be needed for the IoT.
IoT cybersecurity will also likely vary among economic sectors and subsectors, given their different characteristics and requirements. Each sector will have a role in developing cybersecurity best practices, unique to its needs. The federal government has a role in securing federal information systems, as well as assisting with security of nonfederal systems, especially critical infrastructure. Cybersecurity legislation considered in the 114 th Congress, while not focusing specifically on the IoT, would address several issues that are potentially relevant to IoT applications, such as information sharing and notification of data breaches.

		Safety

Given that smart objects can be used both to monitor conditions and to control machinery, the IoT has broad implications for safety, with respect to both improvements and risks. For example, objects embedded in pipelines can monitor both the condition of the equipment and the flow of contents. Among other benefits, that can help both to expedite shutoffs in the event of leaks and to prevent them through predictive maintenance. Connected vehicles can help reduce vehicle collisions through crash avoidance technologies and other applications. Wireless medical devices can improve patient safety by permitting remote monitoring and facilitating adjustments in care.
However, given the complexities involved in some applications of IoT, malfunctions might in some instances result in catastrophic system failures, creating significant safety risks, such as flooding from dams or levees. In addition, hackers could potentially cause malfunctions of devices such as insulin pumps or automobiles, potentially creating significant safety risks.

		Privacy

Cyberattacks may also compromise privacy, resulting in access to and exfiltration of identifying or other sensitive information about an individual. For example, an intrusion into a wearable device might permit exfiltration of information about the location, activities, or even the health of the wearer.
In addition to the question of whether security measures are adequate to prevent such intrusions, privacy concerns also include questions about the ownership, processing, and use of such data. With an increasing number of IoT objects being deployed, large amounts of information about individuals and organizations may be created and stored by both private entities and governments.
With respect to government data collection, the U.S. Supreme Court has been reticent about making broad pronouncements concerning society's expectations of privacy under the Fourth Amendment of the Constitution while new technologies are in flux, as reflected in opinions over the last five years. Congress may also update certain laws, such as the Electronic Communications Privacy Act of 1986, given the ways that privacy expectations of the public are evolving in response to IoT and other new technologies. IoT applications may also create challenges for interpretation of other laws relating to privacy, such as the Health Insurance Portability and Accountability Act and various state laws, as well as established practices such as those arising from norms such as the Fair Information Practice Principles.

		Other Policy Issues

			Federal Role

As described in the section, " What Is the Current Federal Role? " many federal agencies are involved in different aspects of the IoT. Some business representatives and others have stressed the role of effective public/private partnerships in the development of this technology space. However, observers have also expressed concerns about the role of government regulations and policy, as discussed further in sections below, and about the degree and effectiveness of coordination among the involved federal agencies. Concerns of some extend beyond the federal role to that of state, local, and foreign governments.
Given the eclectic nature of the IoT, overall coordination of federal efforts may be challenging with respect to identification of both the goals of coordination and the methods for achieving them. Nevertheless, several observers have argued in favor of a national strategy for the IoT, including in resolutions considered in the 114 th Congress (see " What Actions Has Congress Taken? ").
Some interagency initiatives have been established with respect to specific aspects of the IoT. For example, in addition to the R&D coordination activities for cyber-physical systems under the NITRD program, a specific framework has been developed for smart cities as part of the overall White House initiative involving several federal agencies, local governments, and the private sector.

			Spectrum Access

Radio frequency (electromagnetic) spectrum is widely regarded as a critical link in IoT communications, with reliable and affordable access to it required to accommodate the billions of new IoT devices projected to go online over the next decade. New technology for mobile communications is predicted to allow devices to operate on any available radio frequency and potentially permit communications technologies and cyber-physical systems to converge further. Concerns have been raised that current spectrum policy may favor consumer-oriented mobile services and the wireless industry, rather than emerging markets for IoT devices, such as transportation and manufacturing. Congress may therefore be faced with decisions about whether the current policy needs to be revised.

			Net Neutrality

The concept of "net neutrality" includes the two general principles that owners of the networks that comprise and provide access to the Internet should not control how end users lawfully use that network, and that they should not be able to discriminate against content provider access to that network. The FCC adopted an order in February 2015 that established regulatory guidelines to protect the marketplace from potential abuses that could threaten the net neutrality concept. The order bans broadband Internet access providers (both fixed and wireless) from blocking and throttling lawful content, and it prohibits paid prioritization of affiliated or proprietary content. The order also creates a general conduct standard that Internet service providers cannot harm consumers or providers of applications, content, and services. These rules went into effect, with limited exceptions, on June 12, 2015, but have been challenged in the U.S. Court of Appeals for the D.C. Circuit.
It remains unclear how the FCC order will affect IoT devices and services. Some observers view the implementation of FCC regulations as a positive development. They believe that it will ensure openness and nondiscrimination for service providers, leading to the growth of new services and consumer demand. Others have expressed concerns that the regulations will stifle investment and innovation to the detriment of the expansion and growth of Internet deployment and services. Furthermore, the rules are subject to "reasonable network management," as defined by the FCC, and a category of "specialized services" defined as those that "do not provide access to the Internet generally" are exempt from the rules established by the order. Depending on how individual IoT services and devices are categorized and the degree of network management such specialized services may need, the order could also affect IoT applications on a case-by-case basis.

	What Actions Has Congress Taken?

		Legislation

			Bills

No bills have been introduced in the last two Congresses relating specifically to the IoT. However, many bills have been introduced with provisions related to aspects of the IoT such as connected vehicles, cyber-physical systems, smart cities, and the smart grid. None of those bills were enacted as of September 2015, although some bills with provisions on applications and appropriations relating to telehealth and telemedicine were enacted in both the 113 th and 114 th Congresses. Several bills in the 114 th Congress would address issues that are potentially relevant to IoT applications, such as information sharing in cybersecurity, privacy, and notification of data breaches.

			Resolutions

Two similar resolutions on the IoT have been submitted in the 114 th Congress, one in the House ( H.Res. 195 /Lance, introduced April 13, 2015) and one in the Senate ( S.Res. 110 /Fischer, introduced and passed March 24). Both call for
a U.S. strategy for development of the IoT to improve social well-being while allowing for innovation and protecting against misuse, recognition of the importance of a consensus-based approach and the role of businesses in that development, federal government commitment to use the IoT, and a U.S. commitment to use the IoT for developing new technologies to address challenging societal issues.
The House version also calls for the use of cost-benefit analysis to determine when federal action is needed to address "discrete harms" in the marketplace. It also refers explicitly to energy optimization and the need for cybersecurity.

		Hearings

Both the House and the Senate have held hearings on the IoT in 2015. In the Senate, the Committee on Commerce, Science, and Transportation held a hearing on February 11. In the House, one was held by the Energy and Commerce Committee on March 24, and another by the Subcommittee on Courts, Intellectual Property, and the Internet of the Committee on the Judiciary on July 29. The hearings featured witnesses from businesses and associations who discussed the growth, uses, and economic potential of the IoT, as well as some of the issues described in this report, such as privacy, regulation, security, spectrum management, and standards.

		Caucuses

There are several congressional caucuses that may consider issues associated with the IoT. Among them are caucuses on cloud computing, cybersecurity, the Internet, and high-performance buildings. In addition, new caucuses announced in this session included one expressly on the Internet of Things, and one on smart transportation.

	Where Can I Find Additional Resources on This Topic?

For additional assistance on the IoT and related topics, see CRS Report R44225, The Internet of Things: CRS Experts , by [author name scrubbed] and [author name scrubbed]. Congressional offices may also contact CRS by placing a request via telephone or online through the CRS website (see http://www.crs.gov/AboutCRS/Contact-Us ).

Output:
"Internet of Things" (IoT) refers to networks of objects that communicate with other objects and with computers through the Internet. "Things" may include virtually any object for which remote communication, data collection, or control might be useful, such as vehicles, appliances, medical devices, electric grids, transportation infrastructure, manufacturing equipment, or building systems.
In other words, the IoT potentially includes huge numbers and kinds of interconnected objects. It is often considered the next major stage in the evolution of cyberspace. Some observers believe it might even lead to a world where cyberspace and human space would seem to effectively merge, with unpredictable but potentially momentous societal and cultural impacts.
Two features make objects part of the IoT—a unique identifier and Internet connectivity. Such "smart" objects each have a unique Internet Protocol (IP) address to identify the object sending and receiving information. Smart objects can form systems that communicate among themselves, usually in concert with computers, allowing automated and remote control of many independent processes and potentially transforming them into integrated systems.
Those systems can potentially impact homes and communities, factories and cities, and every sector of the economy, both domestically and globally. Although the full extent and nature of the IoT's impacts remain uncertain, economic analyses predict that it will contribute trillions of dollars to economic growth over the next decade. Sectors that may be particularly affected include agriculture, energy, government, health care, manufacturing, and transportation.
The IoT can contribute to more integrated and functional infrastructure, especially in "smart cities," with projected improvements in transportation, utilities, and other municipal services. The Obama Administration announced a smart-cities initiative in September 2015.
There is no single federal agency that has overall responsibility for the IoT. Agencies may find IoT applications useful in helping them fulfill their missions. Each is responsible for the functioning and security of its own IoT, although some technologies, such as drones, may fall under the jurisdiction of other agencies as well. Various agencies also have relevant regulatory, sector-specific, and other mission-related responsibilities, such as the Departments of Commerce, Energy, and Transportation, the Federal Communications Commission, and the Federal Trade Commission.
Security and privacy are often cited as major issues for the IoT, given the perceived difficulties of providing adequate cybersecurity for it, the increasing role of smart objects in controlling components of infrastructure, and the enormous increase in potential points of attack posed by the proliferation of such objects. The IoT may also pose increased risks to privacy, with cyberattacks potentially resulting in exfiltration of identifying or other sensitive information about an individual. With an increasing number of IoT objects in use, privacy concerns also include questions about the ownership, processing, and use of the data they generate.
Several other issues might affect the continued development and implementation of the IoT. Among them are
the lack of consensus standards for the IoT, especially with respect to connectivity; the transition to a new Internet Protocol (IPv6) that can handle the exponential increase in the number of IP addresses that the IoT will require; methods for updating the software used by IoT objects in response to security and other needs; energy management for IoT objects, especially those not connected to the electric grid; and the role of the federal government, including investment, regulation of applications, access to wireless communications, and the impact of federal rules regarding "net neutrality."
No bills specifically on the IoT have been introduced in the 114th Congress, although S.Res. 110 was agreed to in March 2015, and H.Res. 195 was introduced in April. Both call for a U.S. IoT strategy, a focus on a consensus-based approach to IoT development, commitment to federal use of the IoT, and its application in addressing challenging societal issues. House and Senate hearings have been held on the IoT, and several congressional caucuses may consider associated issues. Moreover, bills affecting privacy, cybersecurity, and other aspects of communication could affect IoT applications.