Information Security: FCC Made Significant Progress, but Needs to Address Remaining Control Deficiencies and Improve Its Program

FCC relies extensively on information systems to accomplish its mission of regulating interstate and international communications in the United States. FCC uses one such system, ECFS, to receive public comments about proposed changes in FCC regulations. In May 2017, a surge in comments caused a service disruption of ECFS during a public comment period.

GAO was requested to review ECFS and the reported disruption. In September 2019, GAO issued a limited official use only report on the actions FCC took to respond to the May 2017 event, and the extent to which FCC had effectively implemented security controls to protect the confidentiality, integrity, and availability of selected systems.

This current report is a public version of the September 2019 report with sensitive information removed. In addition, for this public report, GAO determined the extent to which FCC has taken corrective actions to address the previously identified security program and technical control deficiencies and related recommendations for improvement. In the prior report, GAO compared FCC's policies, procedures, and reports to federal cybersecurity laws and policies. GAO examined logical access controls and security management controls for three systems selected based on their significance to FCC. For this report, GAO examined supporting documents regarding FCC's actions on previously identified recommendations, observed controls in operation, and interviewed personnel at FCC.

As GAO reported in September 2019, the Federal Communications Commission (FCC) bolstered the capacity and performance of the Electronic Comment Filing System (ECFS) to reduce the risk of future service disruptions. FCC also implemented numerous information security program and technical controls for three systems that were intended to safeguard the confidentiality, integrity, and availability of its information systems and information.

systems from threats and vulnerabilities, detecting and responding to cyber security events, and recovering system operations. GAO made 136 recommendations to address these deficiencies (see table).

As of November 2019, FCC had made significant progress in resolving many security deficiencies by fully implementing 85 (about 63 percent) of the 136 recommendations GAO made in September 2019. FCC had also partially implemented 10, but had not started to implement the remaining 41 recommendations (see figure).

Additionally, FCC has created remedial action plans to implement the remaining recommendations by April 2021. Until FCC fully implements these recommendations and resolves the associated deficiencies, its information systems and information will remain at increased risk of misuse, improper disclosure or modification, and loss.

The security of federal information systems and data is critical to the  nation’s safety, prosperity, and well-being. To maintain that security,  federal laws, policies, and guidelines require agencies to implement  sufficient safeguards to protect the confidentiality, integrity, and  availability of their information and information systems. However, threats  to the federal information technology (IT) infrastructure continue to grow  in number and sophistication, posing a risk to the reliable functioning of  our government. Further, federal systems and networks are inherently at  risk because of their complexity, technological diversity, and geographic  dispersion.

The Federal Communications Commission (FCC) relies extensively on  information systems to perform its mission of regulating interstate and  international communications. One important information system is the  Electronic Comment Filing System (ECFS), which FCC uses to receive  public comments from interested parties (commenters) during rulemaking  proceedings.

In May 2017, ECFS experienced a surge in public comments that  disrupted the system and affected its availability during a public comment  period. Specifically, the commission received more than 22 million  comments through ECFS during the public comment period for FCC’s  2017 Restoring Internet Freedom Notice of Proposed Rulemaking. In  August 2018, an FCC Office of Inspector General (OIG) investigative  report attributed the disruption in ECFS’s service to a combination of  system capacity and performance issues.

Given FCC’s critical role in enabling the public to comment on its  rulemaking process, you asked us to review the reported disruption to  ECFS and the commission’s efforts to secure its information systems.  Specifically, our objectives were to determine: (1) the actions FCC took to  respond to the May 2017 event that affected ECFS; and (2) the extent to  which FCC implemented security controls to effectively protect the  confidentiality, integrity, and availability of selected systems.

In September 2019, we issued a report that addressed the two  objectives. In the report, we made nine recommendations to FCC to  improve its information security program and 127 additional  recommendations to resolve technical control deficiencies in the  information systems we reviewed. We designated that report as “limited  official use only” (LOUO) and did not release it to the general public  because of the sensitive information it contained about FCC systems’  operating environments and shortcomings that could potentially be  exploited.

This subsequent report publishes the findings discussed in our  September 2019 report, but we have removed all of the sensitive  information. Specifically, we deleted the names of the information system  software, network devices, and resource tools that we examined;  disassociated identified control deficiencies from named systems; deleted  certain details about information security controls and control deficiencies;  and omitted an appendix contained in the LOUO report. That appendix  contained sensitive details about the technical security control  deficiencies in FCC’s information systems and computer networks that we  reviewed, and the 127 recommendations we made to mitigate those  deficiencies. We also provided a draft of this report to FCC officials to  review and comment on the sensitivity of the information contained herein  and to affirm that the report can be made available to the public without  jeopardizing the security of the commission’s information systems and  networks.

In addition, this report addresses a third objective that was not included in  the September 2019 report. Specifically, this objective was to determine  the extent to which FCC has taken corrective actions to address the  previously identified information security program and technical control  deficiencies and related recommendations for improvement that we  identified in the earlier report.

As noted in the September 2019 report, to address the first objective—to  determine the actions FCC had taken to respond to the May 2017 event  that affected ECFS—we reviewed the commission’s security and incident  response policy and procedures, examined FCC and its Office of  Inspector General’s reports, reviewed system enhancement and  performance artifacts, and interviewed FCC officials, including the system  and security staff and OIG officials. We examined the aforementioned  documents to determine whether updated incident response policy and  procedures, along with system enhancement and performance artifacts,  were directly related to changes made subsequent to the May 2017  event.

To address the second objective, we selected three systems for our  review. We selected these systems because they (1) are essential to  FCC’s mission and (2) were assigned a Federal Information Processing  Standards (FIPS) Publication 199 rating of moderate or high impact. The  results of our review are not generalizable to the commission’s other  systems.

We examined the information security program-related activities  implemented for the three selected systems. For example, we analyzed  FCC’s information security policies; procedures; and artifacts associated with risk assessments, security plans, remedial action plans, and  contingency plans. Specifically, we compared the commission’s security  policies and procedures to National Institute of Standards and  Technology (NIST) special publications to assess the FCC documents’  consistency with federal guidelines. We also examined security-related  artifacts, plans, and reports.

Additionally, we examined technical security controls implemented for the  three systems. In this regard, we observed and analyzed controls in place  to determine if they were appropriately designed, operating as intended,  and effective. We supplemented our analysis with interviews of FCC  Information Technology Center personnel and other relevant officials. We  conducted our work at three FCC facilities located in Pennsylvania,  Washington, D.C., and West Virginia.

To accomplish our third objective—our analysis of FCC’s actions to  address the previously identified information security program and  technical control deficiencies and related recommendations—we  requested that the agency provide a status report of its actions to  implement each recommendation we made in the September 2019  report. For each recommendation that FCC indicated it had  implemented as of November 2019, we examined supporting documents,  observed or tested the associated security control or procedure, and/or  interviewed the responsible FCC officials to assess the effectiveness of  the actions taken to implement the recommendation or otherwise resolve  the underlying control deficiency. Based on this assessment and the FCC  status reports, we categorized the status of each recommendation as  being “fully implemented,” “partially implemented,” or “not started.”  Additional details on our objectives, scope, and methodology are provided  in appendix I.

We conducted the performance audit for the first two objectives from  February 2018 through September 2019 in accordance with generally  accepted government auditing standards. We conducted work supporting  the third objective and, where applicable, included updates to our work in  the second objective from October 2019 through March 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Established by the Communications Act of 1934, FCC regulates interstate  and international communications by radio, television, wire, satellite, and  cable in all 50 states, the District of Columbia, and U.S. territories. FCC  is responsible for, among other things, making available nationwide  worldwide wire and radio communication service. More recently, it has  been responsible for promoting competition and reducing regulation of the  telecommunications industry in order to secure lower prices and higher  quality services for consumers.

FCC’s functions include:  issuing licenses for broadcast television and radio; overseeing licensing, enforcement, and regulatory functions of  carriers of cellular phones and other personal communication  services;  regulating the use of radio spectrum and conducting auctions of  licenses for spectrum;  investigating complaints and taking enforcement actions if it finds that  there have been violations of the various communications laws and  commission rules that are designed to protect consumers; addressing issues related to public safety, homeland security,  emergency management, and preparedness; educating and informing consumers about communications goods and  reviewing mergers of companies holding FCC-issued licenses.

FCC Relies on Information Technology to Support Its Operations

FCC relies extensively on computerized systems to support its mission- related operations, and on information security controls to protect the  commission’s data. FCC’s Information Technology Center, within the  Office of the Managing Director, uses IT to perform the commission’s  business operations. Through its computer network and systems, the  commission collects and maintains nonpublic information, including  proprietary information of businesses regulated by the commission, as  well as information available to the public through rulemaking  proceedings.

FCC Has Defined Organizational Roles and Responsibilities for Information Security

FCC’s Chairman, chief information officer (CIO), and chief information  security officer (CISO) each have specific responsibilities for information  security. Specifically, the FCC Chairman has responsibility for, among  other things:  1.  providing information security protections commensurate with the risk  and magnitude of harm resulting from unauthorized access, use,  disclosure, disruption, modification, or destruction of the commission’s  information systems and information;  2.  ensuring that senior officials provide security for the information and  systems that support the operations and assets under their control;  and  3.  delegating to the CIO the authority to ensure compliance with the  information security requirements imposed on the commission.

In addition, the CIO is responsible for establishing and enforcing policies  and procedures for protecting information resources. Toward this end, the  CIO has designated and assigned responsibilities to the CISO for  managing the cybersecurity program. The CISO, among other things, is  responsible for providing information security protections commensurate  with the risk and magnitude of the harm resulting from unauthorized  access, use, disclosure, disruption, modification, or destruction of  information and information systems that support the operations and  assets of the commission.

Federal Law and Guidance Establish Security Requirements to Protect Federal Information and Systems

The Federal Information Security Modernization Act of 2014 (FISMA)  provides a comprehensive framework for information security controls  over information resources that support federal operations and assets.  The law also requires each agency to develop, document, and implement  an agency-wide information security program to provide risk-based  protections for the information and information systems that support the  operations and assets of the agency.

Such a program should include assessing risks; developing and  implementing policies and procedures to cost-effectively reduce risks;  developing and implementing plans for providing adequate information  security for networks, facilities, and systems; and providing security  awareness and specialized training. Further, the program should include  testing and evaluating the effectiveness of controls; planning,  implementing, evaluating, and documenting remedial actions to address  information security deficiencies; developing and implementing  procedures for detecting, reporting, and responding to security incidents;  and ensuring continuity of operations.

FISMA requires agencies to comply with the federal information  processing standards (FIPS) publications issued by NIST and Office of  Management and Budget (OMB) Circular A-130 requires agencies to  comply with the information security guidelines prescribed in NIST special  publications. Consequently, NIST FIPS publications and special  publications contain many of the cybersecurity-related requirements for  federal agencies. For example, NIST FIPS Publication 199 requires  agencies to categorize their information and information systems  according to the potential harm and impact to agency assets, operations,  or individuals should the confidentiality, integrity, or availability of its  information and information systems be compromised through  unauthorized access, use, disclosure, disruption, modification, or  destruction.

In addition, NIST FIPS Publication 200 requires agencies to meet  minimum security requirements by selecting the appropriate security  controls, as described in NIST Special Publication 800-53. This special  publication provides a catalog of 18 security control areas for federal  information systems and a process for selecting controls to protect  organizational operations and assets. The publication provides baseline  security controls for low-, moderate-, and high-impact systems, and  agencies have the ability to tailor or supplement their security  requirements and policies based on agency mission, business  requirements, and operating environment.

Further, in May 2017, the President issued an executive order requiring  agencies to immediately begin using NIST’s cybersecurity framework for  managing their cybersecurity risks. The framework, which provides  guidance for cybersecurity activities, is based on five core security  functions:  Identify: Develop an organizational understanding to manage  cybersecurity risk to systems, people, assets, data, and capabilities.

Protect: Develop and implement the appropriate safeguards to ensure  delivery of critical infrastructure services.

Detect: Develop and implement the appropriate activities to identify  the occurrence of a cybersecurity event.

Respond: Develop and implement the appropriate activities to take  action regarding a detected cybersecurity incident.

Recover: Develop and implement the appropriate activities to maintain  plans for resilience and to restore any capabilities or services that  were impaired due to a cybersecurity incident.

According to NIST, these five functions occur concurrently and  continuously, and provide a strategic view of the life cycle of an  organization’s management of cybersecurity risk. Within the five functions  are 23 categories and 108 subcategories that include information security  program-related controls and technical controls for achieving the intent of  each function. Appendix II provides a description of the framework  categories and subcategories of controls.

FCC Experienced a Service Disruption in May 2017

On May 7 and 8, 2017, FCC experienced a dramatic surge in the number  of comments sent to the commission through its ECFS during a public  comment period. This surge led to a disruption of services, which  prevented the system from being able to accept additional comments for  a period of time. The FCC Office of Inspector General determined that the  system service disruption was likely due to a combination of the sudden  increase in traffic from commenters all trying to access the system’s  website over a short period of time and system design deficiencies that  negatively impacted the capacity and performance of the system to  collect and process the increase in traffic. Figure 1 presents a timeline  of the May 2017 ECFS service disruption and subsequent related events.  Additional details on the timeline are provided in appendix III.

FCC Increased ECFS’s Capacity and Performance to Reduce Risk of Future Service Disruptions

In response to the ECFS service disruption that occurred on May 7 and 8,  2017, FCC Information Technology Center officials took four key actions  to reduce the risk of future service disruptions to the system.  1. Conducted Internal Assessments  In response to the service disruption, in early May 2017, the FCC CIO  initially stated that the cause was a cyberattack on the ECFS.  However, upon further assessment, FCC Information Technology  Center officials later determined that the disruption was caused by a  surge in comment traffic to the system and existing system  performance and capacity deficiencies.

In response to multiple congressional inquiries, in late July 2017, FCC  Information Technology Center officials assessed the extent to which  malicious intent was involved in causing the disruption based on  whether: (a) internet protocol (IP) addresses from foreign sources  were present on the commission’s network at the time of the May  2017 event; (b) comment submissions were denied (i.e., dropped)  from the commission’s network, (c) observable botnet traffic was  present; and (d) duplicate comment submissions were accepted into  ECFS. The assessment concluded that the commission did not have  sufficient information and tools to determine whether there was any  malicious intent.  2. Deployed Additional Virtual Hardware

Following the disruption, in early May 2017, FCC deployed additional  virtual hardware to address system performance issues and support  system stabilization efforts of ECFS during the period in which service  was disrupted.

In early July 2017, the commission installed security sensors and  forwarding agents on the ECFS virtual servers. These devices are  intended to provide additional layers of security capability for the  system.

In mid-July 2017, FCC automated the process for deploying virtual  hardware resources to support system availability subsequent to the  May 2017 service disruption.  3. Optimized and Acquired System Software

From late May 2017 to early June 2017, FCC acquired a diagnostic  tool to measure system performance. According to the commission,  this tool is used to determine the maximum amount of simultaneous  user capacity within ECFS during periods of high web traffic.

In early June 2017, the commission optimized the search functionality  within the ECFS database to reduce the system response time.

In mid-June 2017, FCC removed redundant internal processes for  ECFS web requests to increase the responsiveness of the system.

During late July 2017, the commission acquired a security information  and event management tool to collect and analyze security-related  events that may indicate a cybersecurity incident.

In late August 2017, FCC established rate control limits within ECFS  to safeguard against potential distributed denial-of-service attacks  aiming to flood one target with network traffic.  4. Updated Incident Response Policy and Procedures  In January 2018 and March 2018, during its annual policy review,  FCC Information Technology Center officials updated the  commission’s incident response and reporting policy and procedures  to incorporate lessons learned from the May 2017 ECFS service  disruption and clarify their processes. For example, FCC Information  Technology Center officials revised the commission’s incident  response procedures to document internal escalation time frames for  notifying management of potential security incidents and reporting the  incidents to the United States Computer Emergency Readiness Team  within 1 hour of identification of an incident.

Figure 2 shows a chronological sequence of the hardware and software  improvements that FCC officials implemented after the May 2017 event.

FCC provided evidence that indicated its actions to add additional  hardware and software resources increased ECFS’s capacity and  performance and demonstrated that the system was stable from June  2017 through December 2017. For example, FCC acquired a  performance diagnostic tool in late May 2017, which was designed to  determine the maximum number of potential simultaneous public users  within ECFS during periods of high web traffic. Using the diagnostic tool,  FCC Information Technology Center officials determined in June 2017,  that the system became unstable when the number of simultaneous  simulated public users reached 500. However, by December 2017, the  system had demonstrated that it could accept a capacity of over 3,000  simultaneous public users without a service disruption.

FCC data showed that the increased capacity and improved performance  of the ECFS prevented further service disruptions during periods of sharp  spikes in the volume of comments received. For example, on May 8,  2017, service was disrupted on the system when it received a peak of  about 249,000 comments in 1 day, whereas on July 12, 2017, the system  accepted and processed at least 1.4 million comments in 1 day without a  reported service disruption. Similar spikes in traffic volumes that occurred  through December 2017 also did not result in service disruptions. Figure  3 shows the daily comment submissions to ECFS from May 2017 through  December 2017 and demonstrates FCC’s ability to accept a higher  volume of comments without a service disruption.

FCC Did Not Consistently Implement Security Controls, Which Placed Selected Systems at Risk

We reported in September 2019 that FCC had implemented numerous  security controls for the three systems we reviewed, but it had not  consistently implemented the NIST cybersecurity framework’s five core  security functions to effectively protect the confidentiality, integrity, and  availability of these systems and the information maintained on them.  Deficiencies existed in the FCC information security program and  technical controls for the five core functions that were intended to (1)  identify risk, (2) protect systems from threats and vulnerabilities, (3)  detect cybersecurity events, (4) respond to these events, and (5) recover  system operations when disruptions occur. These deficiencies increased  the risk that sensitive information could be disclosed or modified without  authorization or be unavailable when needed.

As shown in table 1, deficiencies existed in all five core security functions  for the FCC systems we reviewed. Also shown are the numbers of  recommendations we made to FCC to rectify the deficiencies.

FCC Generally Identified Risks and Developed Security Plans for Selected Systems, but Shortcomings Remained

Activities associated with the identify core security function are intended  to help an agency to develop an understanding of its resources and  related cybersecurity risks to its organizational operations, systems, and  data. Essential elements of a FISMA-mandated information security  program include assessing risks, developing system security plans, and  authorizing information systems to operate. NIST guidance states that  agencies should assess risks and authorize systems on an ongoing  basis. Additionally, FCC requires that security plans, risk assessments,  and system authorizations be reviewed annually or whenever significant  changes occur to the information system, computing environment, or  business operations.

Consistent with its guidance, FCC had developed system security plans  for each of the three systems we reviewed and had updated the risk  assessments for two of the systems in 2017 and 2018, respectively.  However, as of March 2019, the commission had not reviewed or updated  the risk assessment for the third system reviewed since May 2017—a lag  of about 22 months. Commission officials stated that they had not  reviewed or updated the system’s risk assessment because the  commission had implemented a new risk assessment process and  officials had not yet had time to review and update documentation for this  system.

In addition, FCC continued to operate two of the three selected systems  on expired authorizations to operate. Although FCC granted a full  authorization to operate to one system in May 2018, the commission  allowed the authorizations for the other two systems we reviewed to  expire. Both of these systems had received a conditional authorization to  operate so that the systems could continue to operate while the  commission mitigated known system vulnerabilities. However, in  December 2018, the conditional authorizations for both systems expired  because, according to FCC officials, the commission had not mitigated  the vulnerabilities. Nevertheless, FCC continued to operate the systems.

By not regularly updating the risk assessment of one system and  continuing to operate another system without a current authorization to  operate, FCC unnecessarily exposed the information on these systems to  increased risks of unauthorized changes and access to information.

Subsequent to our September 2019 report, FCC reviewed and updated  the system’s risk assessment in accordance with its new risk assessment  process. In addition, FCC granted a full authorization to operate to one of  the systems in October 2019, but does not expect to grant a full  authorization to operate for the other system until later in 2020.

FCC’s Contract Provisions with Its Cloud Service Provider Did Not Reflect All Applicable Security Requirements

NIST SP 800-144, Guidelines on Security and Privacy in Public Cloud  Computing, states that a service-level agreement should define the terms  and conditions for access and use of the services offered by the cloud  service provider. In addition, FedRAMP Control Specific Contract  Clauses provides security control specifications that may need to be  included in the task order for the service and specified in the service level  agreement. These contract clauses include specifications related to  data jurisdiction, audit records storage, time frames for reporting security  incidents, and system boundary protection.

FCC’s task order and service level agreement with its cloud service  provider specified activities the provider was to perform, such as  providing access and support for products and services, and completing performance deliverables to ensure service availability. However, FCC  had not documented specific contract clauses associated with  implementing security control requirements related to retaining audit  records, meeting reporting incident time frames, and protecting system  boundaries in accordance with FedRAMP.

According to FCC’s associate chief information officer, the commission  relied on FedRAMP’s oversight to ensure that its cloud provider  implemented security controls that comply with federal data requirements.  However, FedRAMP assesses and monitors only the security controls  that the program and cloud service provider agree that the provider will  implement. These agreed-upon controls may not include an agency’s  specific security requirements. Thus, responsibility falls on FCC to ensure  that its information security requirements are being implemented in cloud  computing environments.

Nevertheless, by not specifying its specific control requirements when  procuring services from its cloud provider, FCC increased the risk that its  data and sensitive regulatory information will not be adequately protected  in the event that its cloud service provider experiences a security breach.

Subsequent to our September 2019 report, FCC developed a plan of  action and milestones (POA&M) for this deficiency and stated that it plans  to rectify the deficiency by May 2020.

FCC Did Not Consistently Implement Appropriate Safeguards to Protect Information on Selected Systems

Activities associated with the protect core security function are intended  to help agencies develop and implement appropriate system safeguards.  These activities include limiting access to computing resources to  authorized users, processes and devices; encrypting data to protect its  confidentiality and integrity; configuring devices securely; and updating  software to protect systems from known vulnerabilities.

FCC implemented activities that established multiple layers of technical  controls, including access controls and firewalls, encryption of sensitive  data, and system configuration management. However, we reported in  September 2019 that implementation of these technical controls were not  consistent. For example, 37 technical control deficiencies and an  information security program-related deficiency diminished the  effectiveness of the controls protecting the systems we reviewed. A brief  summary of the results of our tests of FCC’s controls for protecting the  three systems we reviewed follows.

FCC Did Not Consistently Implement Effective Access Controls

FCC policy states that, in accordance with NIST SP 800-53 guidelines,  users should not share the same identifier and the commission should  configure its information systems to require users to create complex  passwords. FCC’s policy also stipulates that the commission employ the  principle of “least privilege” and enforce approved authorizations for  controlling the flow of information within the system and between  interconnected systems.

However, FCC did not consistently implement technical controls to  effectively limit access to the systems we reviewed, as the following  examples illustrate.

Although FCC policy states that individual user accounts are not to be  shared, the commission allowed multiple users to share the  credentials of several privileged accounts.

While FCC policy established minimum requirements for password  complexity and account lock-out provisions, the commission did not  routinely enforce these requirements.

While FCC policy requires limiting access rights for users to only  those they need to perform their work, the commission inappropriately  granted excessive permissions to users to access server configuration  files.

Although FCC established a policy for monitoring and controlling  access between systems, it did not securely configure network  devices to effectively control access and communications between  systems.

Access control deficiencies existed primarily because FCC network  administrators did not adequately monitor configuration settings and did  not implement sufficient controls to enforce consistent authentication and  authorization across all of the commission’s systems that we reviewed.

However, until FCC fully implements those actions and remediates  related technical deficiencies, the commission remains at increased risk  that unauthorized individuals or attackers could obtain inappropriate  access to its network devices, firewalls, and servers, and compromise its  network.

As of November 2019, FCC had acted to address several technical  control deficiencies related to access control.

FCC Did Not Consistently Encrypt Sensitive Data

NIST SP 800-53 recommends that organizations employ cryptographic  mechanisms to prevent the unauthorized disclosure of information during  transmission and establish a trusted communications path between users  and security functions of information systems. NIST also requires that,  when agencies use encryption, they use an encryption algorithm that  complies with FIPS Publication 140-2. In addition, FCC’s System and  Communication Protection Policy states that confidentially sensitive data  must be encrypted before being transmitted using any nonprotected  communication method and that all passwords must be encrypted.

However, in seven instances, the commission did not consistently deploy  strong encryption capabilities to protect sensitive data or establish a  secure communications path between users and information systems. For  example, FCC sometimes sent data in clear text over the network and did  not enable FIPS 140-2 compliant encryption algorithms on certain  devices. These deficiencies existed primarily because commission  personnel did not adequately monitor configuration settings. By not  consistently deploying strong encryption capabilities, FCC limits its ability  to protect the confidentiality and integrity of its sensitive information.

According to Information Technology Center officials, as of November  2019, the commission was still working toward full compliance with  federal encryption standards.

FCC Did Not Consistently Configure Servers Securely or Update Software in a Timely Manner

NIST SP 800-53 states that agencies should configure security settings to  the most restrictive mode consistent with operational requirements and  disable services within the information system deemed to be unnecessary  or non-secure. FCC policy on risk assessment states that systems and  devices should be scanned periodically and software patches should be  applied for all known critical security vulnerabilities. In addition, OMB  Circular A-130 states that agencies are to implement current updates and  patches for all software components of information systems, and prohibit  the use of unsupported systems and system components.

Although FCC established policies for applying software patches on a  prescribed basis, it did not update software in a consistent or timely  manner to effectively protect the three systems we reviewed. For  example, FCC did not apply software patches in a timely manner to  resolve known security vulnerabilities, and used unsupported or out-of- date system software on multiple network devices, firewalls, and servers.

Patching control deficiencies existed because FCC did not adequately  monitor configuration settings of devices on its network. According to  Information Technology Center officials, as of February 2019, the  commission was in the process of (1) migrating and modernizing its  systems’ portfolio and (2) implementing an application monitoring and  testing tool to reduce patching times. However, until FCC applies  software patches in a timely manner, and replaces unsupported software  and devices, it will remain at increased risk that individuals could exploit  known vulnerabilities to gain unauthorized access to its computing  resources.

As of November 2019, FCC had taken corrective actions to address  certain technical control deficiencies related to configuring servers  securely and updating software in a timely manner.

Although FCC Had Documented Security Policies, It Had Not Documented Operational Procedures

Developing, documenting, and implementing information security policies  and procedures are essential elements of an agency’s FISMA-mandated  information security program. FCC’s Policy for Information Security and  Privacy states that FCC shall implement procedures and controls at all  levels to protect the confidentiality and integrity of information stored and  processed on the commission’s systems, and to ensure that the systems  and information are available to authorized persons when required.

Although FCC developed and documented commission-wide policies  addressing the 18 control areas—such as access control, configuration  management, security awareness training, and contingency planning— identified in NIST SP 800-53, the commission had not fully developed or  documented the detailed operating procedures that are needed to  effectively implement its security policies. For example, FCC had not  documented detailed procedures for implementing the following NIST- specified control areas: (1) access control, (2) configuration management,  (3) identification and authentication, (4) system maintenance, (5) media  protection, (6) physical and environmental protection, (7) information  security program management, (8) risk assessment, (9) system and  services acquisition, (10) system and communication protection, and (11)  system and information integrity. The lack of detailed operating  procedures likely was an underlying cause for many of the technical  control deficiencies we identified.

According to the FCC CISO, as of February 2019, the commission was in  the process of reviewing and revising its information security policies and  had issued POA&Ms to develop and document the missing procedures.  Nevertheless, until FCC fully develops and documents detailed operating  procedures for implementing its security policies, the commission faces  increased risks that it will not effectively protect its information systems  and information from cyber threats.

FCC Had Not Effectively Implemented Controls Intended to Detect Cybersecurity Events or Deficiencies

The detect core security function is intended to allow for the timely  discovery of cybersecurity events and deficiencies. Controls associated  with this function include logging and monitoring system activities, and  assessing security controls in place. NIST SP 800-53 states that agencies  should enable system logging features and retain sufficient audit logs to  support the investigations of security incidents and monitoring of select  activities for significant security-related events. Additionally, NIST SP  800-53 and industry leading practices state that organizations should  increase their situational awareness through enhanced monitoring  capabilities to analyze network traffic data over an extended period of  time at external boundaries and inside their internal network to identify  anomalous, inappropriate, or unusual malicious activities. Lastly, FISMA  requires each agency to periodically test and evaluate the effectiveness  of its information security controls in place applicable to policies,  procedures, and practices.

In September 2019, we reported that FCC had implemented security  monitoring controls, such as performing regular vulnerability scanning and  deploying a system information and event management tool, to detect the  presence of potential malicious threats. However, six technical control  deficiencies in these capabilities diminished the effectiveness of the  controls to detect cybersecurity events in the systems we reviewed. For  example, FCC did not fully capture system log data on certain devices  and had limited network monitoring visibility into portions of its data center  environment.

According to Information Technology Center officials, FCC had  deficiencies in logging, retention, and monitoring because the commission  had not fully configured its security information and event monitoring tool  to capture and monitor sufficient system log and network traffic data to  adequately detect cybersecurity events. As a result, FCC may not be able  to detect or investigate anomalous activities inside its network.

In addition, although the commission established a process for assessing  the effectiveness of the security controls for its systems, its control tests  and evaluations were not sufficiently robust. For example, the  commission’s evaluations did not identify many of the security control  deficiencies we identified. Consequently, FCC had limited assurance that  the security controls were in place and operating as intended.

As of November 2019, FCC had acted to address several technical  control deficiencies, and associated recommendations, such as capturing  network traffic data and providing for real-time network monitoring;  however, other technical control deficiencies remain.

FCC Did Not Fully Implement Its Incident Response Controls and Remediate Deficiencies in a Timely Manner

The respond core security function is intended to support the ability to  contain the impact of a potential cybersecurity event. Controls associated  with this function include implementing an incident response capability  and remediating newly identified deficiencies.

We reported in September 2019 that, as part of its information security  program, FCC had implemented controls for incident response by  developing, documenting, and annually updating its incident handling  policy and procedures, along with its guidelines for remediating  deficiencies. However, two information security program-related  deficiencies and a technical control deficiency diminished the  effectiveness of the controls to respond to cybersecurity events for the  systems we reviewed. For example, the commission did not adequately  address security incidents and mitigate known deficiencies in a timely  manner.

FCC Had Developed and Documented an Incident Response Capability, but Did Not Report Several Incidents in a Timely Manner

NIST SP 800-53 and SP 800-61 state that agencies should develop,  document, and implement incident response policy and procedures, and  keep them updated according to agency requirements. FCC incident  response policy also states that all employees are required to report  suspected security incidents to the FCC Network Security Operations  Center (NSOC) group within 1 hour of discovery or detection, and all  other incidents within 24 hours of discovery. Further, FCC’s incident  response procedures require internal escalation and external notification  to the United States Computer Emergency Readiness Team (US-CERT)  within 1 hour.

FCC had developed, documented, and updated its incident response  policy and procedures on an annual basis to address security incidents.

The commission also established a NSOC group as the single point of  contact for potential security incidents.

However, FCC did not report internally to the NSOC group or externally to  US-CERT in a timely manner for three of 10 security incidents we  reviewed. Specifically,

A FCC employee took 2 days to report the existence of an information  spillage incident to the NSOC instead of the required 1-hour reporting  time frame.

The NSOC group took approximately 4 hours to report a December  2017 distributed denial-of-service attack incident and a February 2018  malicious attack incident to the US-CERT, instead of the 1 hour  required for each.

According to the FCC CISO, the commission plans to review its incident  response policy and procedures, as well as re-train its staff, to ensure that  staff consistently follow the commission’s policy and US-CERT incident  notification guidelines.

Subsequent to the issuance of our September 2019 report, FCC indicated  that it plans to address these matters by October 2020. Until it does so,  the commission may impede its ability to receive timely assistance from  appropriate federal agencies and mitigate any harm.

FCC Had Action Plans to Remedy Identified Deficiencies for Selected Systems, but Did Not Implement Them in a Timely Manner

NIST 800-53 states that agencies are to develop a POA&M for an  information system to document the agencies’ planned remedial actions  to correct identified deficiencies. FCC’s Plan of Action and Milestone  Guide also states that the maximum completion time frames for  implementing POA&M items related to critical and high severity level  deficiencies are 30 and 60 days, respectively.

Although FCC developed a remedial action process and maintained a  management system to document and track the status of POA&M items,  it did not complete remedial actions in a timely manner for the three  systems we reviewed. Specifically, FCC did not remedy critical and high  severity level deficiencies within the required time frames as stated in its  policy. For example,

FCC took an average of approximately 3 months to implement four  critical severity level POA&M items for one system.

FCC took an average of more than 1 year to remediate three critical  and nine high severity level POA&M items for another system.  Additionally, as of October 2018, this system had seven open critical  and four open high severity level POA&M items that exceeded the  remediation threshold on average by 1 year, 4 months, and 5 months,  respectively.

FCC took an average of more than 3 years to implement two critical  and seven high severity level POA&M items for the third system.

FCC officials attributed these delays to operational priorities and resource  constraints, such as financial, personnel, and technological factors.  However, such longstanding delays in remediating weaknesses pose a  significant threat to the overall security posture of the commission, since  the delays could allow intruders to exploit critical and high severity level  deficiencies to gain access to FCC’s information resources.

As of November 2019, FCC stated that it planned to address security  program deficiencies related to remediating weaknesses in a timely  manner by October 2020.

FCC Developed Contingency Plans, but Had Not Developed Restoration Procedures or Conducted Annual Disaster Recovery Testing

The recover core security function is intended to support timely recovery  of system operations to reduce the impact from a cybersecurity event.  Controls associated with this function include developing and testing  contingency plans to ensure that, when unexpected events occur, critical  operations can continue without interruption or can be promptly resumed,  and that information resources are protected.

In September 2019, we reported that, as part of its information security  program, FCC had developed contingency plans for selected systems  and established priorities for application disaster recovery. However,  two information security program-related deficiencies diminished the  effectiveness of the controls to recover the systems we reviewed.  Specifically, the commission did not document detailed procedures for restoring two of the three systems  conduct an annual test of its disaster recovery plan for the three  selected systems in fiscal year 2018.

FCC Established Contingency Plan Restoration Procedures for One System, but Had Not Fully Documented Restoration Procedures for Two Other Systems Reviewed

NIST SP 800-34 Contingency Planning Guide for Federal Information  Systems states that an information system contingency plan should  provide detailed procedures to restore the information system or  components to a known state. In addition, FCC’s Policy for Contingency  Planning states that system contingency plans should reflect the  restoration activities required for information systems to recover after an  incident.

FCC developed and documented a contingency plan for one system that  specified detailed procedures for restoring system operations, data, and  supporting applications. However, FCC did not include detailed  procedures for restoring the other two systems we reviewed in their  respective contingency plans—both of which are major application  systems. For example, the contingency plans for these two systems did  not specify procedures for restoration activities such as restoring critical  operating system, application software, and system data to a known  state.

According to Information Technology Center officials, they did not  consider the two systems as supporting mission essential functions,  which would necessitate the inclusion of the applications in the detailed  restoration procedures. However, both of the systems are major  application systems and support mission essential functions at FCC.

Subsequent to our September 2019 report, FCC documented detailed  restoration procedures in the two other systems’ contingency plans that  included activities associated with restoring critical operating system,  application software, and system data to a known state. By doing so, FCC  increased the likelihood that it will be able to restore operations to its  mission essential functions in the event of a disaster.

FCC Had Not Tested Disaster Recovery Capabilities on an Annual Basis

NIST SP 800-84 states that a disaster recovery test should assess the  ability of an agency to restore IT processing capabilities in the event of a  disruption. Moreover, FCC’s policy for contingency planning states that  all information system and facility disaster recovery plans should be  tested annually to determine the effectiveness of the plan and the  organizational readiness to execute the plan.

In September 2019, we reported that FCC did not conduct test exercises  of the disaster recovery plans for the three systems we reviewed during  fiscal year 2018, nor did it test system backup, recovery, restoration, and  reconstitution procedures for these systems. According to FCC officials,  the test exercise did not take place in fiscal year 2018 because other  business operation activities took precedence over the exercise since the  test exercise requires all mission-essential function applications to be  unplugged.

As a result, FCC had limited assurance that it would be able to recover  from unexpected disruptions in a timely and efficient manner. While it did  not complete the exercise in fiscal year 2018, FCC did subsequently  conduct a disaster recovery exercise at the beginning of fiscal year 2019.  By doing so, FCC increased its assurance that it would be able to recover  use of its systems from unexpected disruptions in a timely and efficient  manner.

FCC Has Implemented Most Recommendations in Our September 2019 Report and Plans to Implement the Remainder

In our September 2019 report, we made 136 recommendations to FCC  to bolster its agency-wide information security program and strengthen its  technical security controls. Specifically, we recommended that FCC take  nine actions to improve its information security program by, among other  things, authorizing systems to operate, documenting operating  procedures, resolving known vulnerabilities and reporting security  incidents in a timely manner, and testing disaster recovery plans. We also  recommended that FCC take 127 actions to address technical control  deficiencies by implementing stronger access controls, encrypting  sensitive data, configuring network devices securely, strengthening  firewall rules, implementing audit and monitoring controls more  effectively, among other actions.

Since the issuance of our September 2019 report, FCC has made  significant progress in implementing the recommendations we made to  improve its information security program and resolve the technical control  deficiencies in the information systems we reviewed.

Specifically, as of November 2019, FCC had implemented 85 (63  percent) of the 136 recommendations we made in the September 2019  report and had effectively resolved the underlying deficiencies associated  with the recommendations. The commission also had partially, but not  fully, implemented 10 recommendations. In these instances, FCC  provided evidence that it had resolved a portion of the underlying control  deficiency, but had not completed all of the actions necessary to fully  resolve the underlying control deficiencies. FCC did not provide any  evidence that it had begun implementing the remaining 41 (30 percent)  recommendations. The status of our recommendations to FCC is  illustrated in figure 4.

Table 2 provides additional details on the status of FCC’s actions to  implement our recommendations to improve its information security  program and the technical controls for the systems we reviewed.

By implementing 85 recommendations, FCC (as of November 2019) had  reduced risks associated with certain key activities. Specifically, FCC’s  actions to implement four information security program-related  recommendations included conducting a disaster recovery test exercise,  documenting detailed system restoration procedures, and updating risk  assessments to reflect the commission’s current computing environment.

Regarding the technical controls, the commission had implemented 81 of  our recommendations to rectify technical control-related deficiencies. For  example, FCC strengthened firewall rules and access controls on its  information system servers and internal networks—that we highlighted in  our September 2019 report as being particularly vulnerable and requiring  the commission to take immediate corrective actions.

FCC also had developed a POA&M for each of the identified information  security program-related and technical control deficiencies that remained  open as of November 2019. The POA&M items contained required  elements, such as severity levels (i.e., high, medium, and low) for  identified weaknesses; identified estimated costs; designated points of  contact; and established time frames for resolving those weaknesses and  fully implementing the related recommendations. The commission’s plans  called for it to implement the majority of the remaining information security  program and technical control-related recommendations by May 1, 2020,  and all recommendations by April 30, 2021, as shown in figure 5.

Fully implementing the remaining recommendations is essential to  ensuring that the commission’s systems and sensitive information are  adequately protected from cyber threats. Key actions that remain include: documenting operational procedures, applying security patches and software updates, and enhancing network monitoring capabilities.

Until FCC fully implements all of our recommendations and resolves the  associated deficiencies, its information systems and information will  remain at increased risk of misuse, improper disclosure or modification,  and loss.

We received written comments on a draft of this report from FCC. In its  comments, which are reprinted in appendix IV, the commission expressed  its commitment to protecting the confidentiality, integrity, and availability  of its information systems. FCC noted our evaluation of its efforts to  implement 85 of the 136 recommendations made in our September 2019  report and stated that it had also addressed nine additional  recommendations. The commission further stated that it plans to address  the remaining recommendations over the next 14 months with full  mitigation anticipated by April 2021.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  appropriate congressional committees. We are sending copies of this  report to the appropriate congressional committees, the Federal  Communications Commission, the commission’s Office of the Inspector  General, and interested congressional parties. In addition, the report will  be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, our primary point  of contact is Vijay A. D’Souza at (202) 512-6240 or dsouzav@gao.gov.  You may also contact Seto J. Bagdoyan at (202) 512-4749 or  bagdoyans@gao.gov. GAO staff who made key contributions to this  report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine 1) the actions FCC took to respond to  the May 2017 event that affected the Electronic Comment Filing System  (ECFS), and 2) the extent to which FCC implemented security controls to  effectively protect the confidentiality, integrity, and availability of selected  systems. In September 2019, we issued a report which detailed the  findings from our work in response to these two objectives. In the report,  we made 127 recommendations to FCC to resolve the technical security  control deficiencies in the information systems we reviewed and nine  additional recommendations to improve its information security program.  We designated that report as “limited official use only” (LOUO) and did  not release it to the general public because of the sensitive information it  contained.

This report publishes the findings discussed in our September 2019  report, but we have removed all references to the sensitive information.  Specifically, we deleted the names of the information system software,  network devices, and resource tools that we examined, disassociated  identified control deficiencies from named systems, deleted certain details  about information security controls and control deficiencies, and omitted  an appendix that was contained in the LOUO report. The appendix  contained sensitive details about the technical security control  deficiencies in the FCC’s information systems and computer networks  that we reviewed, and the 127 recommendations we made to mitigate  those deficiencies. We also provided a draft of this report to FCC officials  to review and comment on the sensitivity of the information contained  herein and to affirm that the report can be made available to the public  without jeopardizing the security of the commission’s information systems  and networks.

In addition, this report addresses a third objective that was not included in  the September 2019 report. Specifically, this objective was to determine  the extent to which FCC had taken corrective actions to address the  previously identified security program and technical control deficiencies  and related recommendations for improvement that we identified in the  earlier report.

To address the first objective, we reviewed FCC’s security and incident  response policies and procedures, examined related reports prepared by  the commission and its Office of Inspector General, reviewed an internal  assessment of the May 2017 event that was performed by the FCC  Information Technology Center, and reviewed artifacts associated with  system enhancement and performance such as change requests and  email. We also extracted comment submission data derived from the  data.gov application programming interface between May 1, 2017 and  December 31, 2017 to identify the peak periods of increased comment  submissions during and after the May 2017 event.

In addition, we examined the aforementioned documents to assess  whether the updated incident response policy and procedures, along with  system enhancement and performance artifacts, were directly related to  changes made subsequent to the May 2017 event. Lastly, we interviewed  FCC Information Technology Center officials, including system and  security staff, and Office of Inspector General officials to identify FCC’s  actions to respond to the May 2017 event.

To address the second objective, we reviewed FCC’s overall network  environment, identified interconnectivity and control points, and examined  controls for the commission’s networks and facilities. We performed this  work at FCC facilities located in West Virginia, Pennsylvania, and  Washington, D.C.

As noted in our September 2019 report, we determined the extent to  which FCC had implemented security controls to effectively protect the  confidentiality, integrity, and availability of selected systems. To do so,  we selected three of the commission’s information systems for review.  We selected these systems because they (1) are essential to FCC’s  mission and (2) were assigned a Federal Information Processing  Standards Publication 199 rating of moderate or high impact. The results  of our review of these systems is not generalizable to the commission’s  other systems.

To evaluate FCC’s controls for its information systems, we used GAO’s  Federal Information System Controls Audit Manual, which contains  guidance for reviewing information system controls that affect the  confidentiality, integrity, and availability of computerized information. We  based our assessment of controls on requirements of the Federal  Information Security Modernization Act of 2014 (FISMA), which  establishes key elements for an effective agency-wide information  security program; National Institute of Standards and Technology (NIST)  guidelines and standards; FCC policies and procedures; and standards  and guidelines from relevant security organizations, such as the National  Security Agency, and the Center for Internet Security.

For reporting purposes, we categorized the security controls that we  assessed into the five core security functions described in the NIST  cybersecurity framework. The five core security functions are:  Identify: Develop the organizational understanding to manage  cybersecurity risk to systems, assets, data, and capabilities.

Protect: Develop and implement the appropriate safeguards to ensure  delivery of critical infrastructure services.

Detect: Develop and implement the appropriate activities to identify  the occurrence of a cybersecurity event.

Respond: Develop and implement the appropriate activities to take  action regarding a detected cybersecurity event.

Recover: Develop and implement the appropriate activities to maintain  plans for resilience and to restore any capabilities or services that  were impaired due to a cybersecurity event.

These core security functions are described in more detail in appendix II.

For each of the five core security functions, we examined selected FCC  security controls and related documentation:

For the identify core security function, we examined FCC’s reporting  for its hardware and software assets; analyzed risk assessments for  the three selected systems to determine whether threats and  vulnerabilities were being identified; analyzed FCC policies and  procedures to determine their effectiveness in providing guidance to  personnel responsible for securing information and information  systems; and analyzed security plans for the three selected systems  to determine if those plans had been documented and updated  according to federal guidance.

For the protect core security function, we examined access controls  for the three systems. These controls included the password  complexity and settings to determine if password management was  being enforced; administrative users’ system access permissions to  determine whether their authorizations exceeded the access  necessary to perform their assigned duties; and firewall  configurations, among other things, to determine whether system  boundaries had been adequately protected. We also examined  configurations for providing secure data transmissions across the  network to determine whether sensitive data were being encrypted. In  addition, we examined configuration settings for routers, network  management servers, switches, and firewalls to determine if settings  adhered to configuration standards, and we inspected key servers  and network devices to determine if critical patches had been installed  and/or were up to date.

For the detect core security function, we analyzed security control  assessments, and centralized logging and network traffic monitoring  capabilities for key assets connected to the network.

For the respond core security function, we reviewed FCC’s  implementation of incident response practices, including an  examination of incident tickets for 10 incidents the commission  considered most significant from January 1, 2017 to May 29, 2018;  and examined the commission’s process for correcting identified  deficiencies for the three selected systems.

For the recover core security function, we examined contingency and  disaster recovery plans for the three selected systems to determine  whether those plans had been developed and tested.

For the core security functions, as appropriate, we evaluated elements of  FCC’s information security program. For example, we analyzed risk  assessments, security plans, remedial action plans, and contingency  plans for each of the three selected systems. We also evaluated FCC’s  security policies and procedures. In assessing FCC’s controls associated  with these core functions, we interviewed FCC’s Information Technology  Center personnel, chief information officer, chief information security  officer, general counsel, inspector general, and Public Safety and  Homeland Security Bureau officials, as needed.

To determine the reliability of FCC’s computer-processed data for incident  response records, we evaluated the materiality of the data to our audit  objective and assessed the data by various means, including reviewing  related documents, interviewing knowledgeable FCC officials, and  reviewing internal controls. Through a combination of these methods, we  concluded that the data were sufficiently reliable for the purposes of our  work.

To accomplish our third objective—on FCC’s actions to address the  previously identified security program and technical control deficiencies  and related recommendations—we requested that the commission  provide a status report of its actions to implement each of the  recommendations. For each recommendation that FCC indicated it had  implemented as of November 2019, we examined supporting documents,  observed or tested the associated security control or procedure, and/or  interviewed the responsible agency officials to assess the effectiveness of  the actions taken to implement the recommendation or otherwise resolve  the underlying control deficiency. Based on this assessment and FCC  status reports, we defined the status of each recommendation according  to three categories:  fully implemented—FCC had implemented the recommendation (i.e.,  the commission provided evidence showing that it had effectively  resolved the underlying control deficiency); partially implemented—FCC had made progress toward, but had not  completed implementing the recommendation (i.e., the commission  provided evidence showing that it had effectively resolved a portion of  the underlying control deficiency); and not started—FCC did not provide evidence that it had acted to  implement the recommendation (i.e., the commission provided no  evidence showing that it had effectively resolved the underlying  control deficiency).

We conducted the performance audit for the first two objectives from  February 2018 through September 2019 in accordance with generally  accepted government auditing standards. We conducted work supporting  the third objective and, where applicable, included updates to our work in  the second objective, from October 2019 through March 2020 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings.

Appendix II: National Institute of Standards and Technology’s Cybersecurity Framework

The National Institute of Standards and Technology’s cybersecurity  framework consists of five core functions: identify, protect, detect,  respond, and recover. Within the five functions are 23 categories and  108 subcategories of security-related controls (see table 3).

Appendix III: Timeline of May 2017 Event Involving the FCC Electronic Comment Filing System

Below is a timeline of the Federal Communications Commission’s (FCC)  May 2017 Electronic Comment Filing System (ECFS) event and  subsequent related events:

On April 27, 2017, FCC issued the Restoring Internet Freedom Notice  of Proposed Rulemaking in the Federal Register. The notice directed  interested parties to submit comments via FCC’s ECFS.

On the evening of May 7, 2017, a late night talk show aired a segment  on the Restoring Internet Freedom notice and encouraged viewers to  submit comments via ECFS.

On the evening of May 7, 2017, according to a report by the FCC  Office of Inspector General (IG), ECFS experienced a significant  increase in the level of comment traffic attempting to access the  system, resulting in the disruption of system availability. A contractor  providing web performance and cloud security solutions to FCC  identified a 3,116 percent increase in traffic to ECFS between May 7  and May 8, 2017.

In the early morning of May 8, 2017, ECFS became unavailable to  commenters. FCC’s vendor sent automated alerts indicating a spike in  network traffic, in addition to preliminary network statistical data, to  FCC.

During the mid-morning of May 8, 2017, FCC’s Information  Technology Center responded to the alerts from the vendor and  initiated stabilization efforts to ECFS.

During the afternoon of May 8, 2017, FCC issued a press release in  which FCC’s chief information officer (CIO) at that time provided a  statement about the cause of delays experienced by commenters  trying to file comments on the ECFS. The CIO’s statement said that  FCC was subjected to multiple distributed denial-of-service attacks.  He further stated that, “these were deliberate attempts by external  actors to bombard the FCC’s comment system with a high amount of  traffic.”

During May 9-10, 2017, FCC restored ECFS but still experienced  response-time problems relating to system performance.

On May 10, 2017, FCC’s Information Technology Center responded  to inquiries from the Federal Bureau of Investigations and FCC OIG  via email and phone.

On June 21, 2017, the FCC OIG opened a full investigation into the  event because of, according to the OIG, the importance of FCC’s  cybersecurity posture and the possibility that cybercrimes had been  committed that had the potential of being ongoing threats to the  integrity of FCC’s computer systems.

On January 4, 2018, FCC OIG referred the investigation to the Justice  Department.

On August 7, 2018, the FCC OIG published an investigative report on the  ECFS event. According to the OIG report, the allegations of multiple  distributed denial-of-service attacks alleged by the FCC CIO at that time  were not substantiated. The FCC OIG concluded that the spikes in web  traffic to ECFS had coincided exactly with the timing of the late night  television show where the host discussed the FCC’s Restoring Internet  Freedom proceeding and encouraged viewers to visit the commission’s  website and file comments. The FCC OIG’s report also indicated that the  commission did not define the event (i.e., any observable occurrence in a  network or system) as a cybersecurity incident (i.e., an imminent threat or  violation of computer security policies, or security practices). Therefore,  according to the OIG report, FCC did not take actions to:  refer the matter to the United States Computer Emergency Readiness  Team (US-CERT) in accordance with federal policy,  implement internal incident handling procedures in accordance with its  incident handling policy, or  conduct a thorough analysis before or after the event to determine if it  was an incident.

On August 16, 2018, the FCC Chairman testified at a Senate Committee  on Commerce, Science and Transportation oversight hearing on the  conclusions of the FCC OIG investigative report on the ECFS event.

Appendix IV: Comments from the Federal Communications Commission

Appendix V: GAO Contacts and Staff Acknowledgments

In addition to the contacts named above, Gary Austin, David Bruno,  Tammi Kalugdan, Duc Ngo, and Christopher Warweg (assistant  directors); David Hong (analyst-in-charge); Breanne Cave; Chris  Businsky, Jr.; Saar Dagani; Marshall Williams, Jr.; Corey Evans; Andrew  Howard; Elizabeth Kowalewski; Priscilla Smith; Henry Sutanto; and April  Yeaney made significant contributions to this report.

The Federal Communications Commission uses the Electronic Comment Filing System to receive public comments about proposed regulation changes.

In May 2017, a surge of more than 22 million comments disrupted the system making it unavailable. We issued a September 2019 report with 136 recommendations for improvements in this and other FCC systems. The report was not publically released because it contains security information.

This is the public version of that report—with the sensitive information removed. This report also examines the extent of FCC’s corrective actions. As of November 2019, FCC had implemented about 63% of our recommendations.