NIAC Intelligence Information Sharing Study
Total Page:16
File Type:pdf, Size:1020Kb
National Infrastructure Advisory Council Intelligence Information Sharing Final Report and Recommendations January 10, 2012 Alfred R. Berkeley, III Wesley Bush Philip G. Heasley Former Chairman Chairman, President and President and Chief Pipeline Trading Systems, LLC Chief Executive Officer Executive Officer Northrop Grumman ACI Worldwide James B. Nicholson James A. Reid Michael J. Wallace President and Chief President Former Vice-Chairman and Executive Officer CBRE Group, LLC Chief Operating Officer PVS Chemicals, Inc. Eastern Division Constellation Energy Table of Contents Executive Summary ........................................................................................................... ES-1 1.0 Study Overview: Challenges and Approach ..................................................................... 1 1.1 The Challenge of Sharing Intelligence in Complex Systems .......................................................... 2 1.2 Study Approach ............................................................................................................................. 3 2.0 Study Context ................................................................................................................. 6 2.1 Federal Authority and Policy ......................................................................................................... 7 2.2 Critical Infrastructure: Now a Customer and Provider of Intelligence Information ................... 10 3.0 Findings ........................................................................................................................ 15 3.1 Five Concerns about Current Public-Private Information Sharing .............................................. 15 3.2 Specific Findings .......................................................................................................................... 16 3.2.1 Authority and Policy ........................................................................................................ 21 3.2.2 Implementation of Authority .......................................................................................... 23 3.2.3 Leveraging the Capability of the Private Sector to Reduce Risk ..................................... 29 3.2.4 Information Content ....................................................................................................... 32 3.2.5 Information Delivery ....................................................................................................... 35 3.2.6 Counterintelligence/Counterterrorism ........................................................................... 39 3.2.7 Fusion Centers ................................................................................................................. 41 4.0 Recommendations ....................................................................................................... 43 4.1 Assert the Priority of Infrastructure Protection and Resilience in National Security ................. 44 4.2 Improve the Implementation and Accountability of Existing Authorities .................................. 44 4.3 Improve Information Content by Leveraging Partner Capabilities ............................................. 46 4.4 Improve the Value of Information Products to Industry Risk-Management Practices .............. 48 4.5 Build Accepted Practices for Timely Information Delivery ......................................................... 48 4.6 Capitalize on Private Sector Capabilities for Counterterrorism Solutions .................................. 49 4.7 Enhance Fusion Center Capabilities as One Alternative Mechanism for Sharing ....................... 49 4.8 Develop an Action Plan to Implement Accepted Recommendations ......................................... 50 Appendix A. Acknowledgements ........................................................................................ A-1 Appendix B. Case Study: Banking and Finance Sector .......................................................... B-1 Appendix C. Case Study: Chemical Sector ............................................................................ C-1 Appendix D. Case Study: Commercial Facilities Sector ......................................................... D-1 Appendix E. Case Study: Healthcare and Public Health Sector ............................................. E-1 Appendix F. Case Study: Oil and Natural Gas Sector ............................................................ F-1 Appendix G. Other Pertinent Studies on Information Sharing .............................................. G-1 Appendix H. DHS Authorities in Intelligence Information Sharing ........................................ H-1 Intelligence Information Sharing i Appendix I. The Federal Structure for Intelligence Information Sharing ................................ I-1 Appendix J. The DHS Structure for Infrastructure Protection ................................................ J-1 Appendix K. Federal Programs and Processes ..................................................................... K-1 Appendix L. Homeland Security Information Network – Critical Sectors .............................. L-1 Appendix M. Fusion Centers and their Role in Intelligence Sharing with the Private Sector ................................................................................................................................ M-1 Appendix N. Examples of Effective Practices Cited in Case Studies....................................... N-1 Appendix O. Sources...........................................................................................................O-1 Intelligence Information Sharing ii About the NIAC The National Infrastructure Advisory Council (NIAC) provides the President of the United States with advice on the security and resilience of the 18 Critical Infrastructure and Key Resources (CIKR) sectors and their supporting information systems. These critical infrastructure sectors span the U.S. economy and include the Food and Agriculture, Banking and Finance, Transportation, Commercial Facilities, Critical Manufacturing, Dams, Defense Industrial Base, Nuclear, Government Facilities, Postal and Shipping, Communications, Information Technology, Healthcare and Public Health, Water, Energy, and Emergency Services Sectors. The NIAC also advises the lead Federal agencies that have critical infrastructure responsibilities. Specifically, the Council has been charged with making recommendations to: • Enhance cooperation between the public and private sectors in protecting critical infrastructures and their information systems, which includes security and their resilience, and providing reports on this issue to the President through the Secretary of Homeland Security, as appropriate; • Propose and develop ways to encourage private industry to perform periodic risk assessments; • Monitor the development and operations of private sector coordinating councils and their information sharing mechanisms and provide recommendations to the President through the Secretary of Homeland Security on how these organizations can best foster improved cooperation among the sectors, the Department of Homeland Security, and other Federal Government entities; • Report to the President through the Secretary of Homeland Security who shall ensure appropriate coordination with the Assistant to the President for Homeland Security and Counterterrorism, the Assistant to the President for Economic Policy, and the Assistant to the President for National Security Affairs; and • Advise sector specific agencies with critical infrastructure responsibilities, to include issues pertaining to sector and government coordinating councils and their information sharing mechanisms. Intelligence Information Sharing iii Executive Summary The National Infrastructure Advisory Council (NIAC) set out to determine whether the right people are receiving the right intelligence information at the right time to support robust protection and resilience of the Nation’s critical infrastructure. More than 200 interviews and extensive open-source research uncovered a wealth of insights on this complex problem. First, there have been marked improvements in the sharing of intelligence information within the Federal Intelligence Community, and between the Federal Government and regions, States, and municipalities. However, this level of improvement has not been matched in the sharing of intelligence information between the Federal Government and private sector owners and operators of critical infrastructure. Despite some notable successes, this bi- directional sharing is still relatively immature, leaving a large gap between current practices and an optimal system of effective public-private intelligence information sharing. We observe that trust is the essential glue to make this public-private system work. Trust results when partner capabilities are understood and valued, processes are tailored to leverage these capabilities, and these processes are tested and proven valuable to all partners. When breakdowns in information sharing occur, it erodes trust and is counterproductive to risk management. Information sharing is perhaps the most important factor in the protection and resilience of critical infrastructure. Information on threats to infrastructure and their likely impact underlies nearly every security decision made by owners and operators, including which assets to protect, how to make operations more resilient, how to plan for potential disasters, when to ramp up to higher