This is the accessible text file for GAO report number GAO-08-36 
entitled 'Influenza Pandemic: Opportunities Exist to Address Critical 
Infrastructure' which was released on October 31, 2007. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to Congressional Requesters: 

United States Government Accountability Office: 

GAO: 

October 2007: 

Influenza Pandemic: 

Opportunities Exist to Address Critical Infrastructure Protection 
Challenges That Require Federal and Private Sector Coordination: 

Critical Infrastructure Protection for a Pandemic: 

GAO-08-36: 

GAO Highlights: 

Highlights of GAO-08-36, a report to congressional requesters. 

Why GAO Did This Study: 

An outbreak of pandemic flu would require close cooperation between the 
public and private sectors to ensure the protection of our nationís 
critical infrastructure, such as drinking water and electricity. 
Because over 85 percent of the nationís critical infrastructure is 
owned and operated by the private sector, it is vital that both sectors 
effectively coordinate to successfully protect these assets. The 
Department of Homeland Security (DHS) is responsible for coordinating a 
national protection strategy and government and private sector councils 
have been created as a collaborating tool. 

GAO was asked to assess how the federal and private sectors are working 
together at a national level to protect the nationís critical 
infrastructure in the event of a pandemic, the challenges they face, 
and opportunities for addressing these challenges. GAO reviewed 5 of 
the 17 critical infrastructure sectors. These 5 sectors are energy 
(electricity), food and agriculture, telecommunications, transportation 
(highway and motor carrier), and water. 

What GAO Found: 

Federal agencies and the private sector have worked together to (1) 
develop general pandemic preparedness guidance, such as checklists for 
continuity of business operations during a pandemic; (2) identify the 
number of critical workers essential to the critical infrastructure 
sectorsí operations during a pandemic; and (3) conduct pandemic 
preparedness presentations, workshops, forums, and some exercises. In 
some instances, the federal and private sectors are working together 
through sector-specific and cross-sector councils as the primary means 
of coordinating government and private sector efforts at the national 
level to protect critical infrastructure. Federal and private sector 
representatives from the councils in the five sectors reviewed told GAO 
that they have taken some initial pandemic preparedness actions within 
their respective sectors. Additionally, each of the sectors is 
collaborating with DHS and other sector-specific agencies, such as the 
Environmental Protection Agency, to develop sector-specific pandemic 
guidance. 

The federal government and the private sector face several challenges 
that may impede their efforts to protect the nationís critical 
infrastructure in the event of a pandemic. Maintaining a focus on 
pandemic planning efforts is difficult in the face of more immediate 
priorities, such as responding to outbreaks of foodborne illnesses. 
Private sector officials are concerned about the lack of clarity on the 
federal versus state roles in areas such as state border closures and 
pandemic vaccine distribution. They are also concerned about receiving 
consistent messages from various government entities providing pandemic-
related information. Another challenge is identifying and developing 
strategies for addressing crucial cross-sector interdependencies that 
will be important for the continued operation of the nationís economy 
and society during a pandemic, such as the transportation sector to 
deliver critical supplies. Obtaining needed investments for training 
and infrastructure and potential legal and regulatory issues also 
present challenges. 

Increased use of the critical infrastructure coordinating councils 
could help address issues relating to a pandemic. These councils bring 
together multiple sectors and levels of governments, linking activities 
between these entities. Despite their potential, the councilsí efforts 
thus far have focused mostly on the development of sector-specific 
plans to address all hazards. With regard to a pandemic specifically, 
DHS has used the councils primarily to share information across sectors 
and government levels rather than to address many of the identified 
challenges. Because an outbreak could begin at any time, there may be 
insufficient time and resources to adequately plan and prepare their 
members for changes in how their sectors may operate and continue to 
provide essential services during a pandemic. DHS officials acknowledge 
that they could encourage greater federal and private sector use of the 
councils and that the councils could be used to initiate and facilitate 
pandemic preparedness initiatives. DHS, because it is responsible for 
coordinating national critical infrastructure protection efforts, is 
well positioned to lead efforts to use these councils to help address 
these challenges. 

What GAO Recommends: 

GAO recommends that the Secretary of Homeland Security lead efforts to 
encourage the councils to consider and address the range of identified 
challenges for a potential influenza pandemic. DHS concurred with this 
recommendation and generally agreed with the report. 

To view the full product, including the scope and methodology, click on 
[hyperlink, http://www.GAO-08-36]. For more information, contact 
Bernice Steinhardt at (202) 512-6806 or steinhardtb@gao.gov. 

[End of section] 

Contents: 

Letter: 

Results in Brief: 

Background: 

Federal and Private Sectors Are Working Together on Initial Pandemic 
Preparedness Activities: 

Federal Government and Private Sector Face Challenges in Coordinating 
Preparedness for an Influenza Pandemic in Critical Infrastructure 
Sectors: 

Conclusions: 

Recommendation for Executive Action: 

Agency Comments: 

Appendix I: Objectives, Scope, and Methodology: 

Appendix II: Government Sector Council Membership by Selected Sector as 
of September 4, 2007: 

Appendix III: Private Sector Council Membership by Selected Sector as 
of September 4, 2007: 

Appendix IV Comments from the Department of Homeland Security: 

Appendix V: GAO Contact and Staff Acknowledgments: 

Related GAO Products: 

Abbreviations: 

BENS: Business Executives for National Security: 

CDC: Centers for Disease Control and Prevention: 

CIPAC: Critical Infrastructure Partnership Advisory Council: 

DHS: Department of Homeland Security: 

DOE: Department of Energy: 

DOT: Department of Transportation: 

EPA: Environmental Protection Agency: 

FDA: Food and Drug Administration: 

HHS: Department of Health and Human Services: 

HSC: Homeland Security Council: 

HSPD-7: Homeland Security Presidential Directive 7: 

NIAC: National Infrastructure Advisory Council: 

NIPP: National Infrastructure Protection Plan: 

PCIS: Partnership for Critical Infrastructure Security: 

Y2K: Year 2000 computer conversion: 

United States Government Accountability Office: 

Washington, DC 20548: 

October 31, 2007: 

The Honorable Judd Gregg: 
Ranking Member: 
Committee on the Budget: 
United States Senate: 

The Honorable Bennie G. Thompson: 
Chairman: 
Committee on Homeland Security: 
House of Representatives: 

The government's response to recent disasters, such as Hurricanes 
Katrina and Rita, and past national challenges, such as the Year 2000 
computer conversion (Y2K), which posed significant threats to the 
nation's critical infrastructure, have shown the importance of 
coordination and collaboration within and across both government and 
nongovernmental organizations to respond to catastrophic events such as 
an influenza pandemic. An influenza pandemic is a real and significant 
threat facing the United States and the world. There is widespread 
agreement that it is not a question of if but when such a pandemic will 
occur. The issues associated with the preparation for and responses to 
a pandemic flu are similar to those for any other type of disaster or 
hazard. However, a pandemic poses some unique challenges. Unlike many 
catastrophic events, an influenza pandemic will not damage power lines, 
banks, or computer networks; it will ultimately threaten all critical 
infrastructure by removing essential personnel from the workplace for 
weeks or months. In a severe pandemic, absences attributable to 
illness, the need to care for ill family members, and fear of infection 
may, according to the Centers for Disease Control and Prevention (CDC), 
reach 40 percent during the peak weeks of a community outbreak. 
Moreover, an influenza pandemic is likely to occur in several waves, 
each lasting months, with outbreaks occurring simultaneously across the 
country. 

An outbreak of influenza pandemic will require close cooperation 
between the private and public sectors at all levels of government to 
ensure the protection of our nation's critical infrastructure, such as 
drinking water, electricity, and telecommunications. Because over 85 
percent of the nation's critical infrastructure is owned and operated 
by the private sector, the federal government has a limited ability to 
directly influence appropriate preparedness and mitigation actions. 
Unless the private sector takes actions to prevent, protect against, 
respond to, and recover from an act of terrorism or natural disaster, 
such as a pandemic, the country will be poorly prepared to deal with 
these possibilities. Therefore, it is vital that the public and private 
sectors form effective partnerships to successfully protect the 
nation's critical infrastructure. Such partnerships will be key in 
helping ensure the continuing delivery of critical public and private 
services. 

A key player in these partnerships is the Department of Homeland 
Security (DHS). The Homeland Security Act of 2002 created DHS and gave 
it wide-ranging responsibilities for leading and coordinating the 
overall national critical infrastructure protection effort.[Footnote 1] 
Under the Homeland Security Presidential Directive 7 (HSPD-7), the 
Secretary of Homeland Security, among other responsibilities, is to 
establish uniform policies, approaches, guidelines, and methodologies 
to help ensure that critical infrastructures within and across the 17 
designated sectors are protected, and is to use a risk management 
approach to coordinate protection efforts.[Footnote 2] The Homeland 
Security Act also required DHS to develop a comprehensive national plan 
for securing the nation's critical infrastructure. In response, DHS 
developed a National Infrastructure Protection Plan (NIPP). The NIPP 
describes a set of sector-specific and cross-sector coordinating 
councils as the primary means of bringing together the government and 
private sectors to protect critical infrastructure. HSPD-7 further 
defines critical infrastructure protection responsibilities for DHS and 
those federal agencies given responsibility for particular industry 
sectors, such as transportation, energy, and telecommunications, known 
as sector-specific agencies. DHS serves as the sector-specific agency 
for 10 of the sectors: information technology; telecommunications; 
transportation systems; chemical; emergency services; commercial 
nuclear reactors, materials and waste; postal and shipping; dams; 
government facilities; and commercial facilities. 

In response to your interest in how the federal and private sectors are 
coordinating their efforts to prepare for an influenza pandemic, we 
assessed (1) how the federal government is working with the private 
sector to ensure protection of the nation's critical infrastructure in 
the event of an influenza pandemic, particularly in the transportation 
(highway and motor carrier), food and agriculture, water, energy 
(electricity), and telecommunications sectors, and (2) the challenges 
facing the federal government and private sector in coordinating 
protection of the nation's critical infrastructure in the event of an 
influenza pandemic, particularly in these same five sectors, and what 
the federal government could do to help to address these challenges. 

To address these objectives, we reviewed and analyzed critical 
infrastructure protection regulations, plans, and guidance, including 
the NIPP; the National Strategy for Pandemic Influenza (the National 
Strategy); the National Strategy for Pandemic Influenza Implementation 
Plan (the Implementation Plan); the Pandemic Influenza: Preparedness, 
Response, and Recovery Guide for Critical Infrastructure and Key 
Resources; and the Homeland Security Council's (HSC) 6-month and 1-year 
summary reports on the Implementation Plan. We also interviewed 
officials from DHS and the Department of Health and Human Services' 
(HHS) CDC with responsibility for leading and coordinating the overall 
national critical infrastructure protection effort and for working with 
the private sector to prepare for a possible pandemic. 

We reviewed 5 of the 17 critical infrastructure sectors in depth. (See 
app. II for government council membership by sector and app. III for 
private sector council membership by sector.) These sectors were 
selected because, in addition to the public health and healthcare 
sector,[Footnote 3] they would provide the services most basic to the 
continued operation of the economy and society during an emergency such 
as a pandemic. We also gathered documentation from and conducted 
interviews with representatives of each of the federal agencies with 
critical infrastructure protection responsibility for these 5 sectors: 
DHS's Transportation Security Administration (highway and motor 
carrier); the National Communications System (telecommunications); the 
Department of Agriculture and HHS's Food and Drug Administration (FDA) 
(food and agriculture); the Environmental Protection Agency (EPA) 
(water); and the Department of Energy (DOE) (electricity). In addition, 
we interviewed representatives from the Department of Transportation 
(DOT) (highway and motor carrier). We also gathered documentation from 
and interviewed representatives of companies and associations in each 
of the 5 sectors as well as representatives from business trade 
associations, such as the U.S. Chamber of Commerce (Chamber), the 
Business Executives for National Security (BENS), the Business 
Roundtable (Roundtable), and the Center for Health Transformation. 
Because the focus of our work was on the pandemic planning and 
coordinating efforts between the federal government and the private 
sector at a national level, we did not examine individual state, local, 
or private sector initiatives, such as private sector continuity of 
operations plans, unless they were connected with federal initiatives. 

We conducted our work from June 2006 through September 2007 in 
accordance with generally accepted government auditing standards. 
Detailed information on our objectives, scope, and methodology is in 
appendix I. A list of related GAO products is included at the end of 
this report. 

Results in Brief: 

The federal government and private sector are working together to 
protect the nation's critical infrastructure in the event of an 
influenza pandemic. Federal agencies--particularly DHS and CDC--and the 
private sector have worked together at the national level to (1) 
develop general pandemic preparedness guidance, such as checklists for 
continuity of business operations during a pandemic; (2) identify the 
number of critical workers essential to the critical infrastructure 
sectors' operations during a pandemic; and (3) conduct pandemic 
preparedness presentations, workshops, forums, and some exercises. In 
some instances the federal and private sectors are working together 
through a set of councils as the primary means of coordinating 
government and private sector efforts to protect critical 
infrastructure. These councils are part of DHS's framework for a 
coordinated national approach to address the full range of physical, 
cyber, and human threats and vulnerabilities, including a potential 
pandemic, that pose risks to the nation's critical infrastructure. 
Federal and private officials from the councils in the five sectors we 
reviewed told us that while their efforts within these councils have 
mostly been focused on information sharing and developing sector- 
specific plans required by the NIPP to enhance protection and 
resiliency in an all-hazards environment, they have also taken some 
initial pandemic preparedness actions within their respective sectors. 
For example, the Communications Sector Coordinating Council has 
established a working group to identify and address telecommuting 
issues for a pandemic. In addition, the sectors are collaborating with 
DHS and other sector-specific agencies, such as EPA, to develop 
additional pandemic planning guidelines for each sector. 

The federal and private sector representatives we interviewed 
identified several key challenges they face in working together and 
coordinating federal and private sector efforts to protect the nation's 
critical infrastructure in the event of an influenza pandemic. The 
following challenges extend across the critical infrastructure sectors 
and addressing them will require coordinated federal and private sector 
efforts. 

* Maintaining a focus on pandemic planning efforts due to the 
uncertainty of when a pandemic may occur and the emergence of other 
more immediate sector priorities, such as responding to outbreaks of 
foodborne illnesses. 

* Lack of clarity on the federal and state roles and responsibilities 
in areas such as state border closures and pandemic influenza vaccine 
distribution. 

* Multiple and potentially confusing or conflicting messages coming 
from the many agencies, at all levels of government, that are 
responsible for providing current and ongoing pandemic communications 
and information. 

* Identifying and developing strategies for addressing the crucial 
cross-sector interdependencies that will be important for the continued 
operation of our nation's economy and the free flow of goods and 
services during a pandemic, such as the electricity and 
telecommunications capabilities that are necessary to support all the 
other sectors. 

* Additional investments for training and infrastructure and potential 
legal and regulatory issues--which the federal government and the 
private sector have not yet fully addressed. 

While some discussion has occurred, there are opportunities to further 
address these issues through the increased federal and private sector 
use of the sector-specific and cross-sector coordinating councils. 
Despite the potential of these entities, the councils have mostly 
focused their efforts to date on the development of sector-specific 
plans to address all hazards rather than on pandemic-specific 
activities. With regard to pandemic activities, DHS has used the 
councils primarily to share information across sectors and government 
levels, but not to address many of the challenges presented above 
because DHS needs to more fully involve the federal and private sectors 
to reach over and beyond traditional sector boundaries to help solve 
problems that may affect multiple as well as individual sectors. The 
sector-specific and cross-sector council structure would provide a 
useful vehicle for accomplishing such a goal. Because an outbreak could 
begin at any time, there may be insufficient time and resources to 
adequately plan and prepare their members for changes in how their 
sectors may operate during a pandemic unless these discussions take 
place now. Since DHS is responsible for coordinating national critical 
infrastructure protection efforts and is the lead agency for over half 
of the critical infrastructure sectors, it is well positioned to lead 
federal and private sector efforts, using these existing coordinating 
mechanisms, to help identify and address the challenges involved in 
preparing for a potential influenza pandemic. 

To help the nation better protect critical infrastructure in the event 
of an influenza pandemic and to build on the progress made thus far, we 
recommend that the Secretary of Homeland Security, working with sector- 
specific agencies, lead efforts to encourage the government and private 
sector members of the councils to consider and help address the 
challenges that will require coordination between the federal and 
private sectors involved with critical infrastructure and within the 
various sectors in advance of, as well as during, a pandemic. 

We provided a draft of this report to DHS for its review and comment. 
DHS provided written comments, which are reprinted in appendix IV. In 
commenting on the draft report, DHS generally agreed with the contents 
of the report and concurred with our recommendation. We also provided a 
draft of this report to federal and private sector representatives of 
the five sectors we reviewed. FDA (HHS); DOE; DOT; and representatives 
of the Partnership for Critical Infrastructure Security (PCIS) and the 
Electricity and Highway and Motor Carrier Sector Coordinating Council 
provided technical comments, which we incorporated as appropriate. 
Representatives of the Food and Agriculture Coordinating Council and 
TSA informed us that they had no comments on the draft report. 

Background: 

Sector-Specific Agencies Are to Coordinate Protection Efforts and 
Develop Plans: 

The protection of the nation's critical infrastructure against natural 
and man-made catastrophic events has been a concern of the federal 
government for over a decade. Several federal policies address the 
importance of coordination between the government and the private 
sector in critical infrastructure protection. HSPD-7, issued in 
December 2003, defined responsibilities for DHS, the sector-specific 
federal agencies that are responsible for overseeing the 17 specific 
critical infrastructure sectors, and other departments and agencies. 
HSPD-7 makes DHS responsible for, among other things, coordinating 
national critical infrastructure protection efforts and establishing 
uniform policies, approaches, guidelines, and methodologies for 
integrating federal infrastructure protection and risk management 
activities within and across sectors. Sector-specific agencies are 
responsible for infrastructure protection activities in their assigned 
sectors, which include coordinating and collaborating with relevant 
federal agencies, state and local governments, and the private sector 
to carry out sector protection responsibilities. DHS developed and 
issued its NIPP in June 2006. The NIPP--along with more detailed 
guidance issued by DHS--required the individual sector-specific 
agencies, working with relevant government and private sector 
representatives, to submit sector-specific plans to DHS by the end of 
December 2006 detailing the application of the NIPP's core elements to 
each of their respective sectors. These individual plans, which DHS 
released on May 21, 2007, are to establish the means by which the 
sectors will identify critical assets within the sector, assess risks 
of terrorist attacks or other hazards, assess and prioritize those 
which have national significance, and develop protective measures for 
the sector. 

Sector-Specific and Cross-Sector Councils Govern Federal and Private 
Sector Critical Infrastructure Protection Efforts: 

The NIPP relies on a set of sector-specific and cross-sector councils 
as the primary means of coordinating government and private sector 
critical infrastructure protection efforts, as seen in figure 1. 

Figure 1: Cross-Sector and Sector-Specific Councils for Critical 
Infrastructure Protection: 

This figure is an illustration of cross-sector and sector-specific 
councils for critical infrastructure protection. 

[See PDF for image] 

Source: GAO analysis of DHS information. 

[A] Each of the 17 critical infrastructure sectors has a government 
coordinating council and a sector coordinating council. 

[End of figure] 

Under this framework, each of the 17 critical infrastructure sectors 
has both a government council and a private sector council to address 
sector-specific planning and coordination. DHS provides guidance, 
tools, and support to enable these groups to work together to carry out 
their respective roles and responsibilities. The councils are to work 
in tandem to create the context, framework, and support for 
coordination and information-sharing activities required to implement 
and sustain that sector's critical infrastructure protection efforts. 
These councils create the structure through which representative groups 
from all levels of government and the private sector can collaborate in 
planning and implementing efforts to protect critical infrastructure. 

Government coordinating councils are to coordinate strategies, 
activities, policies, and communications across government entities 
within each sector. DHS chairs the government council for sectors where 
it is the sector-specific agency. In the other sectors, DHS serves as 
co-chair with the designated sector-specific agency. Private sector 
councils are encouraged under the NIPP to be the principal entities for 
coordinating with the government on a wide range of critical 
infrastructure protection activities and issues. Under the NIPP, 
critical asset owners and operators are encouraged to be involved in 
the creation of private sector councils that are self-organized and 
self-governed, with a spokesperson designated by the sector 
membership.[Footnote 4] Specific membership can vary from sector to 
sector, but is supposed to be representative of a broad base of owners, 
operators, associations, and other entities--both large and small-- 
within the sector.[Footnote 5] We reported in October 2006 on the 
extent to which these councils have been established, and we noted that 
one of the factors assisting the formation of the government and sector 
councils was the existence of long-standing working relationships 
within the sectors and with the federal agencies that regulate them. We 
found that the more mature councils, such as banking and finance and 
telecommunications, were able to focus on strategic issues, such as 
recovering after disasters, while the newer councils--including public 
health and healthcare and commercial facilities--were focusing on 
getting organized.[Footnote 6] 

The NIPP also identified cross-sector councils that are to promote 
coordination, communications, and the sharing of key practices across 
sectors. On the government side, the government cross-sector council is 
composed of two subcouncils: (1) the NIPP Federal Senior Leadership 
Council, composed of representatives of each of the sector-specific 
agencies, that is to enhance communication and coordination between and 
among these agencies and (2) the State, Local, and Tribal Government 
Coordinating Council--composed of state, local, and tribal homeland 
security advisors--that is to serve as a forum for coordination across 
these jurisdictions on protection guidance, strategies, and programs. 
On the private sector side, the PCIS, composed of one or more members 
and alternates from each of the sector councils, is to, among other 
things, provide senior-level, cross-sector strategic coordination 
through partnership with DHS and the sector-specific agencies and to 
identify and disseminate protection best practices across the sectors. 
Another cross-sector council, the Critical Infrastructure Partnership 
Advisory Council (CIPAC), created in 2006 by DHS, provides the 
framework for members of the government and private sector councils to 
engage in intragovernmental and public-private cooperation, information 
sharing, and engagement across the entire range of critical 
infrastructure protection activities. CIPAC, which has been exempted 
from the requirements of the Federal Advisory Committee Act,[Footnote 
7] is a nondecisional body and includes both private sector and 
government members drawn from both the government and private sector- 
specific councils. An additional council, the National Infrastructure 
Advisory Council (NIAC), was created by the President in 2001 to 
support a coordinated effort by the public and private sectors to 
advise the President through the Secretary of Homeland Security on 
issues related to security of the nation's critical infrastructure. 
NIAC, whose members are appointed by the President from the private 
sector as well as from state and local government, is also tasked with 
advising the federal government lead agencies that have critical 
infrastructure responsibilities. 

National Strategy and Implementation Plan Articulate Importance of 
Federal Coordination with the Private Sector and Others: 

Government pandemic planning efforts are part of an all-hazards 
preparedness strategy that recognizes that emergency prevention, 
protection, response, and recovery can be applied to numerous disaster 
scenarios, both natural and man-made. However, an influenza pandemic 
has unique features that may require additional or different 
preparedness and planning processes since it would affect the workforce 
rather than physical assets and could come in waves, each lasting weeks 
or months. To address the threat of an influenza pandemic, the 
President's HSC issued two planning documents. The first of these, the 
National Strategy, was issued in November 2005 and is intended to 
provide a high-level overview of the approach that the federal 
government will take to prepare for and respond to an influenza 
pandemic. The National Strategy recognizes that preparing for and 
responding to a pandemic cannot be viewed as a purely federal 
responsibility, stating that in addition to the federal government, 
states and communities, the private sector, individual citizens, and 
global partnerships all play a role in addressing the pandemic threat. 
Among other things, it calls for the federal government to provide 
guidance to the private sector and critical infrastructure entities in 
their role in a pandemic response, and considerations necessary to 
maintain essential services and operations. According to the National 
Strategy, movement of essential personnel, goods, and services and 
maintenance of critical infrastructure are necessary during an outbreak 
of influenza pandemic that could span months in any given community. It 
also states that the private sector and critical infrastructure 
entities must respond in a manner that allows them to maintain the 
essential elements of their operations for a prolonged period of time, 
in order to prevent severe disruption of life in U.S. communities. To 
ensure this, the National Strategy calls for (1) the development of 
coordination mechanisms across American industries to support 
activities during a pandemic; (2) guidance to activate contingency 
plans to ensure that personnel are protected, the delivery of goods and 
services is maintained, and sectors remain functional despite 
significant and sustained worker absenteeism; and (3) the establishment 
of partnerships within sectors to provide mutual support and 
maintenance of essential services during a pandemic. 

The Implementation Plan was issued in May 2006. It is intended to 
support the broad framework and goals articulated in the National 
Strategy by outlining specific steps that federal departments and 
agencies should take to achieve these goals. According to the 
Implementation Plan, federal, state, and local governments; tribal 
nations; and the private sector have important and interdependent roles 
in preparing for, responding to, and recovering from a pandemic and 
ensuring that critical infrastructure is protected and sustained. The 
Implementation Plan includes 324 action items related to these 
requirements, responsibilities, and expectations. Since then, HSC has 
issued two progress reports on the implementation of the plan--a 6- 
month and a 1-year summary report.[Footnote 8] 

Federal and Private Sectors Are Working Together on Initial Pandemic 
Preparedness Activities: 

To protect the nation's critical infrastructure in the event of an 
influenza pandemic, the federal and private sectors are working 
together to prepare for a pandemic. Multiple organizations, federal and 
private, have collaborated to develop guidance, identify critical 
employees, and hold workshops and training. To some extent, they have 
been working through sector-specific and cross-sector councils--that 
were created to bring together the government and private sector to 
coordinate and collaborate for critical infrastructure protection--for 
pandemic preparedness. The five critical infrastructure sectors we 
reviewed--transportation (highway and motor carrier), food and 
agriculture, water, energy (electricity), and telecommunications--have 
also taken initial preparedness steps within their respective sectors. 
In addition, they are working with DHS and the sector-specific agencies 
to develop sector-specific pandemic planning guidance. 

Federal Government and Private Sector Have Taken Preliminary Actions to 
Prepare for a Pandemic: 

The federal government--particularly DHS and CDC--and the private 
sector have worked together, to some extent through the councils, to 
develop pandemic preparedness guidance and also to conduct 
presentations and workshops on pandemic preparedness. DHS, working 
collaboratively with partners in the public and private sectors, 
released a Pandemic Influenza: Preparedness, Response, and Recovery 
Guide for Critical Infrastructure and Key Resources. According to HSC's 
1-year summary issued in July 2007, this business continuity guidance, 
tailored to national goals and capabilities and to the specific needs 
identified by the private sector, represented an important first step 
in working with the owners and operators of critical infrastructure to 
prepare for a potential severe pandemic outbreak. HSC's summary stated 
that the guide supports private sector planning by "complementing and 
enhancing, not replacing" existing continuity planning efforts and that 
DHS developed the guide to assist businesses, whose existing continuity 
plans generally did not include strategies to protect human health 
during emergencies, such as those caused by pandemic influenza. HSC's 
summary further explained that the guide was designed to enhance the 
existing private sector business continuity planning already in place. 
In addition to this guidance, the federal government has produced 
several tools for businesses of all types and sizes to assist them in 
planning for a pandemic. For example, CDC has issued planning guidance, 
including a "Business Pandemic Influenza Planning Checklist" and also a 
community strategy for pandemic influenza mitigation.[Footnote 9] The 
community guide introduces the pandemic severity index that assigns 
response actions for a pandemic based on expected levels of severity. 
All of this pandemic guidance has been made available on [hyperlink, 
http://www.pandemicflu.gov]. Additional federal government pandemic 
planning efforts and related guidance for business continuity can be 
found at [hyperlink, http://www.ready.gov]. 

According to HSC's summary and documents received from DHS, multiple 
workshops and forums, attended by more than 30 stakeholders with 
critical infrastructure entities, were held in 2006. During these 
events, essential functions and critical planning elements were 
identified and continuity of business operations during a pandemic were 
discussed. DHS officials told us that these information-sharing 
sessions were intended to provide practical action-oriented information 
to identify essential functions and critical planning elements and to 
assist businesses in protecting the health of employees and maintaining 
continuity of business operations during a pandemic. HSC's 1-year 
summary also states that the federal government has conducted a number 
of pandemic preparedness exercises that included financial institution 
officials, public health officials, and other relevant federal, state, 
and local officials. 

A number of business trade associations are working to advance pandemic 
preparedness and response initiatives with the federal sector to 
protect the nation's critical infrastructure. For example, the 
Executive Director of the Chamber's Homeland Security Policy Division 
told us that the Chamber has hosted several regional business pandemic 
roundtables with DHS and CDC to discuss the role of business in 
pandemic planning and response. In addition, the Chamber has convened a 
pandemic planning work group to address pandemic policy issues and to 
provide private sector input into government strategies, and is 
planning legal-and human-capital-related pandemic seminars in 
conjunction with DHS. The Center for Health Transformation, which is a 
collaboration of public and private sector leaders, led a simulation 
with almost 100 leaders from the private and public sectors to work 
through an influenza pandemic exercise in March 2006. According to a 
center project director, the exercise looked at the consequences of 
such a disaster for the United States and the strategies that might 
best mitigate these impacts. According to documentation from the 
exercise, simulation participants concluded that the effects would 
overwhelm the efforts of any one agency or sector and that the 
government will need to drive the national response strategy and engage 
all sectors early. 

While not directed specifically toward a pandemic outbreak, two major 
business entities have taken steps to enhance public-private disaster 
response efforts. BENS is a nationwide, nonpartisan organization 
composed of senior business executives working together to help enhance 
the nation's security. In January 2007, a BENS-chartered task force 
issued recommendations on better integrating business resources and 
capabilities with those of the government's disaster response plans. 
According to the BENS task force chairperson, BENS did so primarily in 
response to the federal government's recognition of a pressing need for 
an integrated response capability in the aftermath of Hurricane 
Katrina. The report used lessons learned from Hurricane Katrina and 
other disasters to highlight its recommendations in three broad 
categories: (1) public-private collaboration, (2) public-private 
resource coordination, and (3) legal and regulatory environment. A BENS 
representative told us that its report and recommendations represent an 
action plan for public-private disaster response coordination, 
including a pandemic.[Footnote 10] Further, a representative of the 
Roundtable, an association of chief executive officers of leading U.S. 
companies, told us that the organization, frustrated with the lack of 
good government logistics to coordinate assistance during the Katrina 
disaster relief effort, is attempting to leverage existing capabilities 
of the private sector to create a more effective response to natural 
disasters, including an influenza pandemic. The Roundtable has created 
a task force to promote coordination of disaster response and recovery 
efforts, as well as long-term rebuilding initiatives, and also to 
provide tools and guides for businesses to develop a comprehensive 
disaster response program. In December 2006, members of the task force 
met with HSC and DHS officials, including the Secretary of Homeland 
Security, to discuss improving private-public collaboration to 
strengthen the nation's system for disaster preparedness and response. 
According to the Roundtable, the federal government and private sector 
representatives identified several areas for better collaboration, 
including the identification of needs for private sector resources, 
increased private sector representation in state emergency management 
operations, and collaboration on improved communication, technology, 
and supply chain logistics. 

Five Sectors Reviewed Are Working through Councils and Have Taken Some 
Actions to Prepare for a Pandemic: 

DHS officials from the agency's Office of Infrastructure Protection 
within the Directorate for National Protection and Programs, as well as 
federal and private sector representatives from the five critical 
infrastructure sector councils we interviewed, told us that they are 
using DHS's sector partnership framework, which consists of sector- 
specific and cross-sector councils, to coordinate critical 
infrastructure pandemic preparedness efforts. DHS's Director of the 
Infrastructure Programs Office, Partnership and Outreach Division, told 
us that the agency's role is to convene and facilitate interaction with 
the private sector through these councils. 

The five sectors we reviewed have taken initial pandemic preparedness 
actions within their respective councils. According to HSC, movement of 
essential personnel, goods, and services and maintenance of critical 
infrastructure are necessary during an event that spans months in any 
given community, and critical infrastructure entities that provide 
essential services, such as food, water, electricity, and 
telecommunications, have a special responsibility to prepare and plan 
for continued operation during a pandemic. The National Strategy states 
that the private sector and critical infrastructure entities must 
respond in a manner that allows them to maintain the essential elements 
of their operations for a prolonged period of time, in order to prevent 
severe disruption of life in our communities. Much of the recent 
efforts of councils in the sectors we reviewed have focused on 
completing the sector-specific plans required by the NIPP, which are 
not pandemic specific. All of the five sector councils we reviewed 
reported that preparing these plans was their overriding priority and 
took a majority of their time but that they have also initiated 
pandemic planning efforts in their sectors. 

In recognition of the pandemic threat, the five sectors we reviewed all 
were conducting activities to help them plan and prepare for a 
potential pandemic. For example, Communications Sector Coordinating 
Council members told us the council has established a working group to 
identify and address issues related to the resilience of the 
telecommunications sector during a pandemic (i.e., strengthening the 
telecommunications sector's ability to function in the event of a 
disaster or incident). According to the Chairperson of the 
Communications Sector Coordinating Council, the group is working with 
the National Communications System, the sector-specific agency for the 
telecommunications sector, to review the potential consequences of 
predicted, extraordinarily high telecommuting levels during an 
influenza pandemic.[Footnote 11] Specifically, the group is attempting 
to gauge telecommuting requirements in the event of a pandemic and has 
developed models to represent how users would behave in accessing the 
Internet, as well as models of how network infrastructure users would 
behave during a pandemic. As part of this effort, the National 
Communications System is working with industry and other sectors to 
develop a set of best practices for businesses regarding preparedness- 
related telework, as well as developing a list of preparedness 
activities, also for businesses, that may be useful to mitigate 
potential telecommunications challenges. Examples of such activities 
include staggering work schedules for optimal capacity and potentially 
providing temporary work centers where businesses could conduct 
operations during contingency situations. 

The Electricity Sector Coordinating Council Chairperson said that the 
council began its pandemic planning effort in early November 2005. 
Shortly thereafter, the council formed a pandemic planning committee 
and proceeded to develop a two-page electricity sector influenza 
pandemic threat summary that introduced the threat, framed it for 
discussion, and provided general information, and an eight-page 
electricity sector pandemic planning, preparation, and response 
reference guide that it has distributed to its members. EPA officials 
said that EPA's Water Security Division gave a presentation on EPA's 
Pandemic Preparedness for the Water Sector at a meeting of the Water 
Sector Government Coordinating Council, which highlighted EPA's actions 
in response to the pandemic threat and also provided information on 
pandemic preparedness tools and guidance. According to the Water Sector 
Coordinating Council Chairperson, a number of individual utilities have 
developed their own pandemic planning and response guides. The Food and 
Agriculture Sector Coordinating Council developed a pandemic 
preparedness plan, which it distributed throughout the sector. 
Representatives from the Highway and Motor Carrier Sector Coordinating 
Council, which is part of the Transportation Sector Coordinating 
Council and one of the last private sector coordinating councils to 
form, said that they have recently formed a pandemic working group. 

As directed by the Implementation Plan, DHS, in collaboration with the 
appropriate representatives from the sector-specific councils, such as 
EPA, has taken steps to develop sector-specific pandemic planning 
guidelines. According to a DHS official with responsibility for 
overseeing this activity, DHS is collaborating with the appropriate 
government and private sector representatives to develop, evaluate, 
enhance, and support their respective sector's pandemic planning 
guidelines. The DHS official explained that these guidelines, developed 
jointly by the government and private sectors, extend beyond the 
general pandemic guidance already available and are intended to be a 
tactical checklist specific to each sector for pandemic planning 
purposes. For example, with the water sector-specific guidance, any 
waste water manager in the country would have the necessary information 
to make his or her own pandemic plan as comprehensive as possible. 
Documentation from DHS indicates that by September 2007, the agency had 
engaged 13 sectors in the development of the guidance and had draft 
guidelines in various phases of development. 

Federal Government and Private Sector Face Challenges in Coordinating 
Preparedness for an Influenza Pandemic in Critical Infrastructure 
Sectors: 

A number of challenges face the federal and private sectors as they 
attempt to coordinate efforts to plan and prepare for a potential 
influenza pandemic in the critical infrastructure sectors. These 
include continuity of attention on pandemic preparedness and response, 
lack of clearly defined federal and state roles, need for consistent 
messages from the federal government and adequate information-sharing 
mechanisms within sectors, need to consider cross-sector 
interdependencies for a pandemic, needed investments in training and 
additional infrastructure capabilities, and potential legal and 
regulatory issues. 

Federal and Private Sector Acknowledge Challenge of Sustaining 
Attention on the Pandemic Threat: 

According to federal and private sector representatives, sustaining 
preparedness and readiness efforts for an influenza pandemic is a major 
challenge. Federal and private sector officials with responsibility for 
pandemic planning and preparedness efforts in their sectors said they 
are challenged to continue and maintain these efforts primarily because 
of the uncertainty associated with a pandemic, limited financial and 
human resources, and the need to balance pandemic preparedness with 
other priorities. 

The federal government has communicated the importance of remaining 
vigilant and sustaining pandemic preparedness. For example, the HSC 1- 
year summary states that although the visibility of avian influenza 
pandemic preparedness has waned in the media, the threat of avian 
influenza and the potential for an influenza pandemic are still 
imminent. While acknowledging the uncertainty of a potential pandemic, 
the report reaffirms the inevitable occurrence of a pandemic at some 
point in the future and states that it is everyone's responsibility to 
remain vigilant and to continue to take the threat of a pandemic very 
seriously. 

According to DHS's Director of the Infrastructure Programs Office, 
Infrastructure Partnerships Division, the critical infrastructure 
sector councils have not designated pandemic planning as a priority. 
The current Chairperson of the Food and Agriculture Sector Government 
Coordinating Council told us that pandemic preparedness has not been a 
major focus of the council, and that the council has been working on 
addressing issues related to the contamination of the food and 
agricultural system and supply. He further explained that the food and 
agriculture sector's all-hazards approach to emergency planning, which 
encompasses threats posed by terrorism as well as natural disasters, 
would ensure its ability to effectively meet the challenges posed by a 
potential pandemic. Similarly, representatives of the Communications 
Sector Government Coordinating Council cited the difficulty with 
funding pandemic preparedness efforts versus other, more immediate, 
organizational priorities, such as protecting against cyberattacks and 
their consequences. An electricity sector representative said that it 
is very difficult to maintain up-to-date plans and preparedness 
materials over time as people move, information becomes out of date, 
and circumstances change. 

The Chairperson of the Food and Agriculture Sector Coordinating Council 
recognized that even though the public's interest in pandemic influenza 
may have waned, the private sector has fiduciary and ethical 
responsibilities that require continued maintenance of pandemic 
planning efforts even though pandemic influenza may not be a current 
priority of the public. Private sector representatives from the 
transportation (highway and motor carrier) sector said they do not see 
a sense of urgency in the federal government's interaction with 
businesses in their sector regarding pandemic preparedness efforts. 
They explained that they had met with officials from DOT 1 year earlier 
to discuss legal and regulatory concerns related to interstate 
transportation that could facilitate pandemic response activities, but 
that there have not been further discussions or resolution of the 
issues raised. 

Private Sector Perceives a Lack of Clarity on Federal and State Roles 
and Responsibilities: 

According to the private sector council chairpersons and other 
representatives we interviewed, the roles and responsibilities of the 
federal and state governments are unclear on issues such as pandemic 
vaccine distribution and state border closures. Given the multitude of 
organizations within the federal, state, and local governments, and in 
the private sector, that are involved in planning and preparing for a 
potential influenza pandemic, it is important to ensure that the 
leadership, roles, responsibilities, and authorities are clear. 

The National Strategy emphasizes the need for coordination across 
different government and private sector organizations. The 
Implementation Plan contains a number of critical infrastructure- 
related action items that involve coordinating roles and 
responsibilities for various government and private sector 
organizations, a number of which have been reported as completed by 
HSC. In its 1-year summary, HSC reported that at the beginning of a 
pandemic, the scarcity of vaccine will require the limited supply to be 
prioritized for distribution and administration and noted that the 
federal government has begun a process to revise previous interim 
guidance for federal, state, local, tribal, and territorial planning 
about which groups to target for earlier access to pandemic vaccines. 

In August 2007, we reported that the National Strategy and the 
Implementation Plan do not specify how the leadership roles and 
responsibilities will work in addressing the unique characteristics of 
an influenza pandemic.[Footnote 12] According to the Chairperson of the 
President's Council on the Year 2000 Conversion, one lesson learned in 
the government's response to the Y2K computer challenge was that the 
federal "facilitative" or "convener" role is key in supporting the 
necessary government and private sector coordination related to 
preparedness, and that clearly defining the government role in 
interacting with the private sector is necessary. We have previously 
reported that in a catastrophic disaster, the leadership roles, 
responsibilities, and lines of authority for the response at all levels 
must be clearly defined and effectively communicated to facilitate 
rapid and effective decision making, especially in preparing for and in 
the early hours and days after the event.[Footnote 13] 

The private sector council representatives from the sectors we reviewed 
told us that they were unclear regarding federal, state, and local 
coordination efforts related to vaccine distribution. An Electricity 
Sector Coordinating Council member described the federal-state 
coordination in this area as potentially "falling between the cracks." 
A January 2007 report by NIAC on vaccine pandemic prioritization 
revealed that critical infrastructure owners and operators involved in 
its study were confused about the roles of the multiple federal, state, 
and local officials both now and in the future.[Footnote 14] NIAC's 
report recommended that the federal government continue to work with 
critical infrastructure owners and operators to educate them on the 
framework detailing how, when, and in what capacity state, local, and 
private-sector response participants will engage the federal government 
before, during, and after a pandemic. The NIAC report also recommended 
that the federal government continue developing a clearly defined 
vaccine and antiviral medication distribution strategy. According to 
minutes from a NIAC meeting held in July 2007, the Assistant Secretary 
for Preparedness and Response at HHS stated that NIAC's report and 
recommendations will help HHS guide vaccine and antiviral distribution 
plans for all 50 states and 5 United States territories. 

Highway and Motor Carrier Sector Coordinating Council representatives 
expressed concerns to us that state governments, during an influenza 
pandemic, could potentially close their borders, which would have a 
great impact on the national highway system and hinder the delivery of 
essential goods and services. They explained that the federal 
government has yet to address these and related issues that may be 
relevant during the potential panic that may occur following an 
influenza pandemic outbreak. 

Private Sector Concerned about Receiving Consistent Messages and the 
Adequacy of Information-Sharing Mechanisms: 

According to several private sector representatives we interviewed, 
receiving consistent messages and having adequate information-sharing 
mechanisms remains a major challenge for federal and private sector 
coordination efforts. Effective communications between the federal and 
private sectors will be vital during a pandemic. It is essential for 
the federal government to be a trusted source of information, and 
communicating accurately and often will be necessary. Pandemic 
preparedness involves information sharing across all critical 
infrastructure sectors, government agencies, private businesses, and 
federal and state information sources. Because an influenza pandemic is 
expected to occur in multiple waves over a span of several months, 
effective communications networks must be sustained over time despite 
complications presented by a reduced workforce. 

The Implementation Plan emphasizes the importance of and the need for 
timely, accurate, credible, and consistent information that is tailored 
to specific audiences. According to the Implementation Plan, this 
requires coordinated messaging by spokespersons across government at 
the local, state, tribal, and federal levels, and by our international 
partners. The Implementation Plan includes a number of action items 
directed toward enhancing communications, and in its 1-year summary, 
HSC reported that several of these actions have been completed. The 
summary states that over 150 information-sharing workshops were held 
with industry over the last year, particularly with stakeholders from 
critical infrastructure sectors. According to the HSC 1-year summary, 
these information-sharing sessions have provided practical, action- 
oriented information for identifying essential functions and critical 
planning elements and assisting businesses in protecting the health of 
employees and in maintaining continuity of businesses operating during 
a pandemic. 

Despite these actions, the Food and Agriculture Sector Coordinating 
Council Chairperson stated that there remains a great need to establish 
viable communication links between the federal and private sectors to 
ensure that accurate and consistent messages are provided and received. 
He explained that because a potential pandemic will involve public 
health agencies as well as agencies with critical infrastructure 
responsibilities, information will be coming from numerous sources and 
coordination among those providing the information will be vital to 
ensure the consistency of information provided. The Chairperson of the 
Electricity Sector Coordinating Council told us that working toward a 
strong, single pandemic preparedness message across federal, state, and 
local levels of government was and would continue to be a top challenge 
and priority. We reported in our 2007 biennial high-risk update that 
the federal government still faces formidable challenges in analyzing 
and disseminating key information among federal, state, local, and 
private partners in a timely, accurate, and useful manner.[Footnote 15] 

Several private sector representatives from the five sectors we 
reviewed also expressed concerns regarding the effectiveness of the 
councils as a medium for sharing information. Although the critical 
infrastructure coordinating councils are designed to allow members to 
freely share sensitive information, a member of the Electricity Sector 
Coordinating Council said that much of the information that the council 
members receive comes from DHS and not from the council. 
Representatives from DOT voiced a similar concern. They stated that the 
Highway and Motor Carrier Sector Coordinating Council's information- 
sharing efforts may not include all of the many small trucking 
companies that exist. They explained that as a result, small trucking 
companies may not be aware of pandemic planning and preparedness 
requirements, and that this could represent a major problem in the 
trucking industry because more than 90 percent of businesses in the 
industry are small-scale operators (fewer than 10 trucks). DHS's 
Director of the Partnership and Outreach Division, Office of 
Infrastructure Protection, agreed that effective communications with 
small trucking companies is a challenge. DHS officials in this office 
explained that there is a substantial role for outreach, communication, 
and education by state and local governments to keep smaller companies, 
in particular, properly informed. They further stated that many of the 
sector councils, to be truly representational, include trade 
associations consisting of smaller companies as members. According to 
the Highway and Motor Carrier Coordinating Council, the combined small 
carrier membership of just three of the council's member associations 
represent nearly 200,000 of the nation's smallest trucking companies. 
These trade associations are expected to act as channels of 
communication from the sector councils to smaller businesses, 
complementing the communication and information provided by general 
business and state and local government information and coordination. 

Federal and Private Sector Consideration of Cross-Sector 
Interdependencies for an Influenza Pandemic Is a Continuing Challenge: 

Private sector and federal representatives cited consideration of cross-
sector interdependencies as a key challenge for pandemic preparedness 
efforts. Crucial interdependencies exist among the five sectors that we 
reviewed. For example, because nearly every sector of the economy 
depends on telecommunications and electricity, how well those sectors 
can continue to provide services will affect every other critical 
sector. Lessons from Hurricane Katrina demonstrate how overwhelmed 
critical resources can become when agencies fail to adequately plan for 
requirements in goods and services, and to clearly communicate 
predisaster responsibilities to ensure that these goods and services 
are available when needed. Due to the interconnected nature of critical 
infrastructure sectors and the comprehensive challenge posed by an 
influenza pandemic, failing to address cross-sector interdependencies 
effectively could place all sectors of the nation's critical 
infrastructure at risk. 

The Implementation Plan includes an action item that instructs DHS to 
map and model critical infrastructure interdependencies across and 
within sectors to share critical information with sectors and identify 
national challenges during a pandemic. The HSC 6-month status report 
showed this action item as complete and stated that DHS maintains a 
critical infrastructure modeling capability and that this capability 
drives the mapping of critical infrastructure interdependencies. The 
report also noted that an ongoing effort using these capabilities is 
examining the potential impact of a pandemic. HSC's 1-year summary 
explained that one large business invited more than 300 of its top 
suppliers to a pandemic preparedness workshop so it could pass along 
pandemic planning information and encourage each one of the attending 
companies to start to prepare. The summary also highlights a financial 
institution that "is assessing all of its vendors to determine whether 
or not they have pandemic plans that can support the organization's 
supply chain during a pandemic" and also notes that the Financial 
Services Sector Coordinating Council has established working groups and 
convenes regular meetings to discuss preparations and identify 
interdependencies in other critical sectors. 

Coordinating councils in several sectors we reviewed identified cross- 
sector interdependencies, although not pandemic specific, in their 
sector-specific plans required by the NIPP. However, we recently 
reported that given the disparity in the plans, it is unclear the 
extent to which DHS will be able to use the plans to identify security 
gaps and critical interdependencies across the sectors in order to plan 
future protective measures.[Footnote 16] As previously mentioned, DHS 
officials also held workshops with business and government continuity 
planners, operations center operators, and retail and distribution hub 
owners/operators where they discussed issues that cut across sectors, 
as well as supply chains. DHS officials also said that the planned 
sector-specific pandemic planning guides are expected to include a 
section on cross-sector dependencies to consider for a pandemic. 

Additionally, federal and private sector representatives told us that 
some preliminary and limited discussions regarding interdependencies 
had occurred within sector-specific and cross-sector councils and some 
had taken place in other forums. For example, the Electricity Sector 
Coordinating Council Chairperson stated that he had participated in 
limited discussions in coordinating council meetings about the 
electricity sector's interdependencies with representatives from other 
sectors, such as water, telecommunications, and healthcare. 
Communications Government Coordinating Council representatives said 
that they had participated in several collaborative cross-sector 
meetings that considered interdependencies. On the other hand, Highway 
and Motor Carrier Sector Coordinating Council representatives told us 
that they had been involved in cross-sector discussions with the 
pharmaceutical industry and food and grocery representatives, but 
stated that they had initiated these talks through their own contacts 
and that they had not participated in significant discussions of cross- 
sector interdependencies through the sector-specific and cross-sector 
coordinating council structure. 

Federal and Private Sector Identified Needed Investments in Training 
and Infrastructure: 

According to federal and private sector representatives in the five 
sectors that we reviewed, investment in private sector capabilities is 
necessary for businesses to prepare for and respond to an influenza 
pandemic. According to Communications Sector Coordinating Council 
members, the amount of resources required to address these issues and 
the inability of some businesses--particularly those that are smaller 
in size--to meet these needs present a challenge to pandemic 
preparedness. They explained that if the resource requirements for 
private sector preparedness are not clearly identified and addressed, 
businesses in the critical infrastructure sectors studied could 
potentially lack the staffing, skills, and other assets to effectively 
deal with an influenza pandemic. 

Private and federal sector council representatives that we interviewed 
identified a number of areas where additional investment in private 
sector capabilities may be needed to prepare for and respond to a 
potential pandemic. The government has recognized the need for 
investment in private sector critical infrastructure preparedness 
efforts. HSC's 1-year summary states that "The scale and scope of a 
pandemic necessitate a dedicated effort and investment beyond typical 
business continuity planning." Representatives from the Electricity 
Sector Coordinating Council explained that additional investments in 
coal stockpiles might be needed to ensure that electricity producers 
have sufficient fuel if current supplies are exhausted during a 
pandemic. Federal and private sector representatives from both the 
Electricity and Food and Agriculture Sector Coordinating Councils told 
us that companies and agencies, anticipating significant workforce 
absenteeism in the event of pandemic, were cross-training employees to 
better ensure continuity of operations. Electricity sector 
representatives also described other types of investment. For example, 
one company established redundant physical facilities where multiple 
shifts of workers could continue operations at a temporary location 
during a pandemic. 

DHS officials we spoke with from the National Communications System 
described challenges related to adequate investment in network 
infrastructure required to support the needs of the large telecommuting 
workforce and other demands that would occur during an influenza 
pandemic. The officials suggested that telecommunications companies 
have little incentive for investing in excess capacity for a pandemic 
that may not occur. They explained that small businesses that lack the 
resources and staff face even greater challenges, as they are more 
limited in their ability to allocate resources toward business 
continuity investments. 

Federal and Private Sector Noted That Potential Legal and Regulatory 
Issues Should Be Considered in Advance of a Pandemic: 

Federal and private sector officials also identified potential legal 
and regulatory issues that could hinder the private sector's ability to 
adequately respond to a pandemic outbreak and provide essential 
services, and suggested that these issues should be considered in 
advance of a pandemic. Past lessons and current industry views indicate 
that if key legal and regulatory issues are not identified and 
addressed in advance of an emergency, businesses in critical 
infrastructure sectors may be unable to effectively prepare for and 
respond to an influenza pandemic. 

Lessons learned from previous emergency response challenges involving 
critical infrastructure have highlighted the importance of addressing 
legal and regulatory challenges in advance of emergency response 
efforts as was done in the case of the Y2K challenge. For example, 
according to the Chairperson of the President's Council on the Year 
2000 Conversion, an important aspect of the government's successful 
preparation for the Y2K computing challenge was the passage of 
legislation limiting the liability of companies engaged in preparedness 
actions.[Footnote 17] BENS reported in January 2007 that a key 
challenge in prior disasters, such as Hurricane Katrina involved 
"significant regulatory barriers" that hindered businesses' ability to 
execute their own continuity plans and assist in supporting their 
communities. For example, nearly all businesses included in the BENS 
study reported the permitting and credentialing process imposed by 
public authorities in the aftermath of Katrina as a major impediment to 
restoring business continuity. They said that resolving the 
restrictions on professionals licensed in one state from practicing in 
another and granting access into the disaster area for owners and 
businesses to inspect, repair, and reestablish their services were the 
key issues. The BENS report recommends that agencies with oversight and 
regulatory authority over the private sector need to clarify and 
promulgate procedures that allow the agencies to quickly implement 
discretionary authorities for the relaxation of regulations in the 
event of an emergency. The Implementation Plan contains an action item 
that directs DHS to "coordinate federal, state, local, and tribal 
efforts, including legislative and regulatory additions/changes and 
waivers, to develop and implement tailored support packages to address 
critical infrastructure systems and essential operational requirements 
at each phase of the pandemic." Although this action item is due to be 
completed in May 2007, the July 2007 HSC summary did not provide a 
summary of progress for this action item. 

In March 2007, we reported that financial market participants are 
collecting information on the types of and circumstances under which 
regulatory relief may be needed during an outbreak of pandemic 
influenza. Although willing to consider regulatory relief, Securities 
and Exchange Commission staff indicated that market participants should 
not expect wide-scale waivers of important securities regulatory 
requirements. They said that although some form of regulatory relief 
would most likely be part of the process for enabling the financial 
system to keep operating during a pandemic, such relief should be one 
of the last stages in continuity planning and preparation, not the 
first.[Footnote 18] DHS's Director of the Partnership and Outreach 
Division, Office of Infrastructure Protection, told us that predisaster 
agreement on terms of relief was unreasonable, due to potentially 
diverse circumstances that could be encountered at the time of a 
crisis. The official suggested that companies that were interested in 
regulatory relief should discuss these issues directly with their 
specific regulatory agencies. 

Sector council representatives in the transportation (highway and motor 
carrier), food and agriculture, electricity, and water sectors all 
expressed concerns related to legal and regulatory issues in their 
respective sectors. Transportation (highway and motor carrier) sector 
representatives stated that to facilitate response efforts, regulatory 
waivers related to hours of service, oversized weight restrictions, and 
types of fuel mix were issued during the Hurricane Katrina emergency. 
They said that they had previously met, post-Katrina, with officials 
from DOT to discuss how these types of regulatory relief could be 
applied in the future, but to date DOT had not responded regarding the 
issues. Although DOT officials noted that existing regulations already 
provide for relief during emergencies, sector council representatives 
said that there are issues that remain unaddressed by these regulatory 
relief provisions which they believe require further 
discussion.[Footnote 19] Representatives from the food and agriculture 
and water sectors told us that they may be unable to provide needed 
services during a pandemic outbreak while adhering to regulations 
requiring certified plant operators and food inspectors if, as 
estimated, up to 40 percent of their workforces are unable to work 
during a pandemic. For example, representatives from the Water Sector 
Coordinating Council told us that in the event of a pandemic there may 
not be enough certified equipment operators available. Similarly, the 
Food and Agriculture Sector Coordinating Council's Chairperson told us 
that the number of certified food inspectors may be limited during a 
pandemic. 

Sector-Specific and Cross-Sector Coordinating Councils Could Be Used 
More to Address These Challenges: 

There are opportunities to build on the actions already taken to 
further address the identified challenges through increased federal and 
private sector use of the sector-specific and cross-sector coordinating 
councils. DHS recognized that critical infrastructure owners and 
operators should be involved in the critical infrastructure decision- 
making processes and that a real partnership between these individuals 
and the federal government was needed. As a result, DHS created a 
framework for the federal and private sectors to interact and to 
establish the necessary level of public-private cooperation needed to 
protect the nation's critical infrastructure. Although DHS has 
established this structure for collaboration among the federal and 
private sectors involved with critical infrastructure, to date its 
activities have had a limited focus on pandemic preparedness. 

PCIS, which is composed of private sector leaders, and CIPAC, which is 
composed of government and private sector leaders, provide a framework 
for owner and operator members of the government and private sector 
councils to engage in intragovernmental and public-private cooperation 
across the entire range of critical infrastructure protection 
activities. According to DHS, these councils have been used primarily 
to distribute information across sectors and government levels but not 
to address many of the identified challenges related to an influenza 
pandemic. We reported in October 2006 that the councils could utilize 
their existing relationships to help develop a strategic focus, such as 
planning for an influenza pandemic.[Footnote 20] In particular, because 
they bring together public and private sector critical infrastructure 
leaders across the various sectors and levels of government, PCIS and 
CIPAC can aid in addressing identified federal and private sector 
challenges related to pandemic planning. 

According to the outgoing chair of PCIS, its members are actively 
involved in pandemic planning within their sectors, but have only 
recently begun to share their pandemic planning assumptions, 
approaches, and issues with each other. During their April 2007 
meeting, PCIS members held a roundtable discussion of the status of 
their pandemic planning efforts. The outgoing PCIS Chair told us that 
PCIS members believe that these discussions were helpful in identifying 
common issues and sharing effective approaches for pandemic planning, 
and that the PCIS membership is interested in exploring in greater 
detail items of cross-sector importance, in particular, influencing 
government policy matters such as social distancing strategies[Footnote 
21] and antiviral availability and distribution. 

CIPAC provides the framework for the public and private sectors to 
jointly discuss relevant critical infrastructure issues such as a 
potential pandemic and allows the various sector participants to reach 
over and beyond traditional sector boundaries. According to DHS's 
Director of the Infrastructure Programs Office, Partnership and 
Outreach Division, CIPAC's focus over the last year has been on 
completing and issuing the sector-specific plans required by the NIPP. 
Although the consequences and vulnerabilities of a pandemic may have 
been discussed to a limited extent at CIPAC meetings, the Director 
acknowledged that the sectors need to work together on 
interdependencies and cross-sector issues related to the pandemic 
threat. Our review of CIPAC meeting agendas showed that 8 of the 49 
CIPAC meetings held since the spring of 2006, when CIPAC was created, 
included "influenza pandemic" as an agenda item, and only one agenda 
included a joint discussion of cross-sector interdependencies. 

DHS, because it is responsible for coordinating national critical 
infrastructure protection efforts and is the sector-specific agency for 
over half of the critical infrastructure sectors, is well positioned to 
help ensure that federal entities take advantage of these existing 
coordinating mechanisms to further plan and prepare for a potential 
influenza pandemic. DHS could develop and specify agenda items for the 
government and cross-sector councils that address many of the 
challenges that cut across the sectors and levels of government we 
identified. DHS, along with other sector-specific agencies, could 
encourage the private sector councils to do likewise. These 
organizations can discuss issues, make and test realistic plans, and 
develop workable solutions to potential challenges before an outbreak 
occurs. Otherwise, there may be insufficient time and resources to 
adequately prepare their members for changes in how their sectors may 
operate during a pandemic. 

DHS, sector-specific agencies, and their counterparts among the 
critical infrastructure sectors are responsible for convening CIPAC 
meetings, typically upon request from sector members, but DHS's 
Director of the Infrastructure Programs Office, Partnership and 
Outreach Division, acknowledged that the department could encourage 
greater appropriate federal and sector utilization of CIPAC. According 
to this official, DHS has responsibility for communicating the 
structure, process, and purpose of CIPAC for public and private 
collaboration. DHS is encouraging appropriate use of CIPAC by (1) 
developing an internal DHS management directive that highlights the 
benefits of and requirements for using the current council framework, 
(2) highlighting relevant NIPP guidance that encourages the use of the 
various councils through a NIPP outreach and awareness program, and (3) 
creating a critical infrastructure/key resources annex to the draft 
revised National Response Plan, now called the National Response 
Framework,[Footnote 22] that discusses use of the councils. 

Conclusions: 

Protecting the nation's critical infrastructure in the event of an 
influenza pandemic requires an increased amount of coordination, 
collaboration, and in some cases, partnerships, between the federal and 
private sectors. Private sector planning must be well coordinated 
across the interdependent critical infrastructures in the nation and 
between all appropriate public and private entities. The federal 
government encourages critical asset owners and operators to be 
involved in private sector councils that are self-organized, self-run, 
and self-governed. The critical infrastructure's coordinating and 
advisory committees, along with the National Strategy and 
Implementation Plan, bring together government and business owners and 
operators of critical infrastructure to plan and prepare for all 
disasters, including a potential influenza pandemic. Because a pandemic 
may last for weeks or months, these public and private sector 
relationships must be developed and sustained over extended periods of 
time. A pandemic will likely reduce dramatically the number of 
available workers in all sectors, and significantly disrupt the 
movement of people and goods, which will threaten essential services 
and operations within and across the nation's critical infrastructure. 
Without working effectively together, the public and private sectors 
risk being insufficiently prepared to sustain the operations of 
critical infrastructure during an outbreak of influenza pandemic. 

Although the federal and private sectors have taken initial steps to 
prepare for a pandemic, they face several key challenges that require 
coordination among multiple sectors and all levels of government. 
Opportunities exist to help address these challenges through increased 
use of the critical infrastructure sector-specific and cross-sector 
councils. These councils and their members are important because they 
provide a structure and forum for the public and private sectors to 
collaborate on appropriate planning and preparedness activities to 
prepare and respond to a pandemic, particularly for those issues that 
require cross-sector discussions and involvement of government at all 
levels. 

To date, these councils have been used primarily for information 
sharing among members, to develop the sector-specific plans for all 
hazards, and are developing sector-specific plans for a pandemic. 
However, they could be better utilized to have a more strategic focus 
and to initiate and facilitate pandemic preparedness activities. Now is 
the time, before a pandemic emerges, to leverage these coordinating 
mechanisms to ensure that challenges and solutions are identified and 
cross-sector capabilities are well understood by all. Discussing and 
addressing relevant pandemic concerns and challenges prior to an 
outbreak would allow critical infrastructure sectors and their 
organizations to provide training to their employees and conduct tests 
and exercises that could provide valuable insights into how to further 
improve their readiness. DHS acknowledges that it could encourage 
greater appropriate federal and private sector utilization of the 
councils to help address coordination challenges and solve common 
problems for pandemic and other hazards. DHS is well positioned to 
encourage federal and private entities to take advantage of these 
coordinating mechanisms to further plan and prepare for a potential 
influenza pandemic before an outbreak may occur. 

Recommendation for Executive Action: 

To help the nation better protect critical infrastructure in the event 
of an influenza pandemic and to build on the progress made thus far, we 
recommend that the Secretary of Homeland Security, working with sector- 
specific agencies, lead efforts to encourage the government and private 
sector members of the councils to consider and help address the 
challenges that will require coordination between the federal and 
private sectors involved with critical infrastructure and within the 
various sectors in advance of, as well as during, a pandemic. 

Agency Comments: 

We provided a draft of this report to DHS for its review and comment. 
DHS provided written comments, which are reprinted in appendix IV. In 
commenting on the draft report, DHS generally agreed with the contents 
of the report and concurred with our recommendation. We also provided a 
draft of this report to federal and private sector representatives of 
the five sectors we reviewed. FDA (HHS); DOE; DOT; and representatives 
of PCIS and the Electricity and Highway and Motor Carrier Sector 
Coordinating Council provided technical comments, which we incorporated 
as appropriate. Representatives of the Food and Agriculture 
Coordinating Council and TSA informed us that they had no comments on 
the draft report. 

We are sending copies of this report to the Secretary of Homeland 
Security, appropriate congressional committees, and other interested 
parties. We will also make copies available to others upon request. In 
addition, this report will be available at no charge on the GAO Web 
site at [hyperlink, http://www.gao.gov]. 

If you or your staffs have any questions regarding this report, please 
contact me at (202) 512-6806 or steinhardtb@gao.gov. Contact points for 
our Offices of Congressional Relations and Public Affairs may be found 
on the last page of this report. GAO staff who made major contributions 
to this report are listed in appendix V. 

Signed by: 

Bernice Steinhardt: 

Director, Strategic Issues: 

[End of section] 

Appendix I: Objectives, Scope, and Methodology: 

The objectives of this engagement are to identify (1) how the federal 
government is working with the private sector to ensure protection of 
the nation's critical infrastructure in the event of an influenza 
pandemic, particularly in the transportation (highway and motor 
carrier), food and agriculture, water, energy (electricity), and 
telecommunications sectors, and (2) the challenges facing the federal 
government and private sector to coordinate protection of the nation's 
critical infrastructure in the event of an influenza pandemic, 
particularly in these same five sectors, and what the federal 
government could do to help to address these challenges. 

To address both of our objectives, we reviewed and analyzed critical 
infrastructure protection regulations, plans, and guidance, including 
the National Infrastructure Protection Plan, the National Strategy for 
Pandemic Influenza, the National Strategy for Pandemic Influenza 
Implementation Plan, and the Pandemic Influenza: Preparedness, 
Response, and Recovery Guide for Critical Infrastructure and Key 
Resources. We assessed the status of the action items in the 
implementation plan related to critical infrastructure protection, and 
specifically to the challenges that were identified by the federal and 
private sector representatives we interviewed. In order to do this, we 
reviewed the Homeland Security Council's 6-month and 1-year progress 
reports on the implementation plan, and received updates from 
Department of Homeland Security (DHS) officials on the status of these 
action items. We also interviewed officials from DHS and the Department 
of Health and Human Services' Centers for Disease Control and 
Prevention (CDC) with responsibility for leading and coordinating the 
overall national critical infrastructure protection effort and for 
working with the private sector to prepare for a possible pandemic. 
Within DHS, we met with the Chief Medical Officer; the Assistant 
Secretary for the Private Sector Office, Office of Policy; the Director 
of the Infrastructure Programs Office, Partnership and Outreach 
Division; and the Director of the Partnership and Outreach Division, 
Office of Infrastructure Protection, and their staff. Within CDC, we 
interviewed the Director, Business Partnerships and Chief of the 
Private and Public Partners Branch, Division of Partnerships, and other 
CDC staff. We also interviewed representatives from business trade 
associations, such as the U.S. Chamber of Commerce, the Business 
Executives for National Security, the Business Roundtable, and the 
Center for Health Transformation. 

We reviewed 5 of the 17 critical infrastructure sectors for our study. 
The sectors are energy (electricity), food and agriculture, 
telecommunications, transportation (highway and motor carrier), and 
water. These sectors were selected because, in addition to the public 
health and healthcare sector, they will provide the services most basic 
to the continued operation of the economy and society during an 
emergency such as a pandemic. We reviewed sector-specific plans and 
guidance for the 5 sectors we studied in depth. We also interviewed 
representatives of each of the sector-specific federal agencies with 
critical infrastructure protection responsibility for the 5 sectors we 
reviewed: DHS's Transportation Security Administration (highway and 
motor carrier) and National Communications System Agency 
(telecommunications); the Department of Agriculture and the Food and 
Drug Administration (FDA) (food and agriculture); the Environmental 
Protection Agency (water); and the Department of Energy (electricity). 
The membership of the 5 government sector coordinating councils is 
provided in appendix II. In addition, we also interviewed 
representatives from the Department of Transportation (highway and 
motor carrier). We interviewed private sector representatives for each 
of the 5 sectors, including the chairpersons of the respective sector 
coordinating councils. These representatives presented their views on 
how their respective councils are working with the federal government 
to protect the nation's critical infrastructure in the event of a 
pandemic, the challenges they face, and opportunities for addressing 
those challenges; but they did not necessarily represent the views of 
each member of their respective councils. The membership of the 5 
private sector coordinating councils is provided in appendix III. 

In addition to these interviews, and to address both objectives, we 
reviewed charters, meeting agendas and minutes, and other planning 
documents and guides for the various coordinating councils. We also 
gathered relevant documentation from the officials and representatives 
we interviewed. In addition, we attended pandemic planning workshops 
and conferences sponsored by the U.S. Chamber of Commerce. As part of 
our effort to identify possible challenges in the critical 
infrastructure area, we reviewed the following sources: 

* prior GAO work on critical infrastructure protection, Year 2000 
computer conversion, emergency response, federal collaboration 
practices, and public and private partnerships; 

* related studies and reports by other government, nonprofit, and 
private sector organizations; and: 

* business consulting, practitioner, and academic literature and 
studies in the areas of emergency management and governance. 

The results of our review of these five sectors cannot be generalized 
to the other critical infrastructure sectors given the limited number 
of sectors we reviewed and their nonprobabilistic selection. However, 
our general review of related literature suggests that the other 
sectors face similar challenges in how the federal and private sectors 
are coordinating their efforts to prepare for an influenza pandemic. 
Because the focus of our work was on the pandemic planning and 
coordinating efforts between the federal government and the private 
sector at a national level, we did not examine individual state, local, 
or private sector initiatives on their own, such as private sector 
continuity of operations plans, except in the case where these efforts 
were connected with federal initiatives. 

We conducted our work from June 2006 through September 2007 in 
accordance with generally accepted government auditing standards. 

[End of section] 

Appendix II: Government Sector Council Membership by Selected Sector as 
of September 4, 2007: 

Table: Government Sector Council Membership by Selected Sector as of 
September 4, 2007: 

Council and sector: Energy; 
Government council members: U.S. Department of Energy, Chair; 
Federal Energy Regulatory Commission; 
National Association of Regulatory Utility Commissioners; 
National Association of State Energy Officials; 
U.S. Department of Agriculture; 
U.S. Department of Defense; 
U.S. Department of Homeland Security; 
U.S. Department of the Interior; 
U.S. Department of State; 
U.S. Department of Transportation; 
U.S. Environmental Protection Agency. 

Council and sector: Food and Agriculture; 
Government council members: U.S. Department of Health and Human 
Services, Food and Drug Administration, Chair[A]; 
U.S. Department of Agriculture; 
U.S. Department of Homeland Security; 
Association of State and Territorial Health Officials; 
Intertribal Agriculture Council; 
National Assembly of State Animal Health Officials; 
National Association of County and City Health Officials; 
National Association of State Departments of Agriculture; 
National Science Foundation; 
U.S. Department of Commerce; 
U.S. Department of Defense; 
U.S. Department of Health and Human Services; 
U.S. Department of the Interior; 
U.S. Department of Justice; 
U.S. Environmental Protection Agency. 

Council and sector: Communications (Telecommunications); 
Government council members: U.S. Department of Homeland Security, 
National Communications Center, Chair; 
Federal Communications Commission; 
General Services Administration; 
National Association of Regulatory Utility Commissioners; 
U.S. Department of Commerce; 
U.S. Department of Defense; 
U.S. Department of Justice. 

Council and sector: Transportation; 
Government council members: U.S. Department of Homeland Security, 
Transportation Security Administration, Chair; 
U.S. Department of Defense; 
U.S. Department of Energy; 
U.S. Department of Transportation. 

Council and sector: Water; 
Government council members: U.S. Environmental Protection Agency, 
Chair; 
Association of State & Interstate Water Pollution Control; 
Administrators; 
Association of State Drinking Water Administrators; 
U.S. Army Corps of Engineers; 
U.S. Department of Agriculture; 
U.S. Department of Defense; 
U.S. Department of Health and Human Services; 
U.S. Department of Homeland Security; 
U.S. Department of State; 
U.S. Department of the Interior. 

Sources: Government council representatives and DHS. 

[A] FDA is the current Chair. Chair position rotates on a yearly basis 
among FDA, DHS, and USDA. 

[End of table] 

[End of section] 

Appendix III: Private Sector Council Membership by Selected Sector as 
of September 4, 2007: 

Table: Private Sector Council Membership by Selected Sector as of 
September 4, 2007: 

Council and sector: Electricity (Energy); 
Sector council members: Independent Electricity System Operator, 
Ontario Canada, Chair; 
Arizona Public Service Company; 
Exelon Corporation; 
National Rural Electric Cooperative Association; 
New York Independent System Operator; 
North American Electric Reliability Corporation,; 
Reliability First Corporation; 
Southern Company Services, Inc. 

Council and sector: Food and Agriculture; 
Sector council members: International Dairy Foods Association, Chair; 
Agricultural Retailers Association; 
American Farm Bureau Federation; 
CF Industries, Inc; 
CropLife America; 
Food Marketing Institute; 
Food Processors Association; 
International Association of Refrigerated Warehouses; 
International Food Service Distributors Association; 
International In- flight Food Service Association; 
International Warehouse Logistics Association; 
McCormick & Company, Inc; 
National Association of Convenience Stores; 
National Cattlemen's Beef Association; 
National Corn Growers Association; 
National Milk Producers Federation; 
National Pork Producers Association; 
National Restaurant Association; 
National Retail Federation; 
National Food Service Security Council; 
United Fresh Fruit & Vegetable Association. 

Council and sector: Communications (Telecommunications); 
Sector council members: Verizon, Chair; 
Alcatel-Lucent; 
Americom-GS; 
Association of Public Television Stations; 
AT&T; 
BellSouth Corporation; 
Boeing; 
Cellular Telecommunications & Internet Association; 
Cincinnati Bell; 
Cingular; 
Cisco; 
Comcast; 
Computer Sciences Corporation; 
Hughes Network Systems; 
Internet Security Alliance; 
Intrado; 
Level 3; 
Nortel; 
Qwest; 
Rural Cellular Association; 
SAVVIS; 
Satellite Industry Association; 
Sprint-Nextel; 
Telcordia; 
Telecommunications Industry Association; 
United Telecom Council; 
U.S. Telecom Association; 
U.S. Internet Service Provider Association; 
VeriSign. 

Council and sector: Highway and Motor Carrier (Transportation); 
Sector council members: American Trucking Associations, Chair; 
American Bus Association; 
American Chemistry Council; 
American Petroleum Institute; 
American Road and Transportation Builders Association; 
Border Trade Alliance; 
Chemtron Corporation; 
Con-Way, Inc; 
Detroit-Windsor Truck Ferry; 
Institute of Makers of Explosives; 
Intelligent Transportation Society of America; 
Intermodal Association of North America; 
International Bridge Tunnel and Turnpike Association; 
Kenan Advantage Group; 
Laidlaw Education Services; 
Mid-States Express, Inc; 
National Association of Small Trucking; 
National Association of Truck Stop Operators; 
National Industrial Transportation League; 
National School Transportation Association; 
National Tank Truck Carriers, Inc; 
Owner- Operator Independent Drivers Association; 
Schneider National, Inc; 
Taxicab, Limousine and Paratransit Association; 
The BusBank; 
Tri-State Motor Transit Company; 
Truck Manufacturers Association; 
Truck Rental and Leasing Association; 
United Motorcoach Association. 

Council and sector: Water; 
Sector council members: Columbus Water Works, Chair; 
Alexandria Sanitation Authority; 
American Water; 
American Water Works Association; 
Association of Metropolitan Water Agencies; 
AWWA Research Foundation; 
Bean Blossom Patricksburg Water Corporation; 
Boston Water and Sewer Commission; 
Breezy Hill Water and Sewer Company; 
City of Portland Bureau of Environmental Services; 
Fairfax Water; 
Greenville Water System; 
Los Angeles Department of Water and Power; 
Manchester Water Works; 
Milwaukee Water Works; 
National Association of Clean Water Agencies; 
National Association of Water Companies, National Rural; 
Water Association; 
New York City Department of Environmental Protection; 
Pima County Wastewater Management Department; 
United Water; 
Water Environment Federation; 
Water Environment Research Foundation. 

Sources: Sector council representatives and DHS. 

[End of table] 

[End of section] 

Appendix IV: Comments from the Department of Homeland Security: 

U.S. Department of Homeland Security: 
Washington, DC 20528: 
[hyperlink, http://www.dhs.gov]

October 15, 2007: 

Mr. Norman J. Rabkin: 
Director: 
Homeland Security and Justice: 
U. S. Government Accountability Office: 
441 G Street, NW: 
Washington, DC 20548: 

Dear Mr. Rabkin: 

The Department of Homeland Security (DHS) appreciates the opportunity 
to review and comment on the Government Accountability Office's (GAO) 
draft report GAO-08-36 entitled Influenza Pandemic: Opportunities Exist 
to Address Critical Infrastructure Protection Challenges that Require 
Federal and Private Sector Coordination (GAO Job Code 450489). We 
generally agree with the contents of the report. 

We concur with the recommendation that to help the nation better 
protect critical infrastructure in the event of an influenza pandemic, 
the Secretary of Homeland Security, working with sector-specific 
agencies, build on the progress made thus far and use the coordinating 
councils as a mechanism to help ensure that critical infrastructure 
stakeholders are adequately prepared for a pandemic outbreak. 
Specifically, the Secretary should encourage the government and private 
sector members of the councils to consider and help address the 
challenges that will require coordination between the federal and 
private sectors involved with critical infrastructure and within the 
various sectors in advance of, as well as during, a pandemic. 

As a Government entity, DHS is unable to "ensure" private sector 
preparedness. We believe the appropriate language is that DHS continue 
to support and facilitate private sector preparedness. We believe that 
a strong architectural framework and multiple initiatives are in place 
and in progress to facilitate that goal. Further strengthening and 
utilization of the security partnership model will support the overall 
achievement of the Department of Homeland Security's objectives for 
pandemic preparedness. 

Thank you again for the opportunity to comment on this draft report and 
we look forward to working with you on future strategic issues. 

Sincerely, 

Signed by: 

Steven J. Pecinovsky: 

Director: 

Departmental GAO/OIG Liaison Office: 

[End of section] 

Appendix V: GAO Contact and Staff Acknowledgments: 

GAO Contact: 

Bernice Steinhardt, (202) 512-6806 or steinhardtb@gao.gov: 

Acknowledgments: 

In addition to the contact named above, Sarah Veale, Assistant 
Director; Clifton G. Douglas, Jr; Gwyneth Blevins; S. Mike Davis; David 
Dornisch; Karin Fangman; Carolyn Samuels; and members of GAO's Pandemic 
Working Group made key contributions to this report. 

[End of section] 

Related GAO Products: 

Collaboration: 

Results-Oriented Government: Practices That Can Help Enhance and 
Sustain Collaboration among Federal Agencies. GAO-06-15. Washington, 
D.C.: October 21, 2005. 

Critical Infrastructure: 

Critical Infrastructure Protection: Sector Plans and Sector Councils 
Continue to Evolve. GAO-07-706R. Washington, D.C.: July 10, 2007. 

Critical Infrastructure Protection: Progress Coordinating Government 
and Private Sector Efforts Varies by Sectors Characteristics. GAO-07- 
39. Washington, D.C.: October 16, 2006. 

Emergency Response: 

Homeland Security: Observations on DHS and FEMA Efforts to Prepare for 
and Respond to Major and Catastrophic Disasters and Address Related 
Recommendations and Legislation. GAO-07-1142T. Washington, D.C.: July 
31, 2007. 

Homeland Security: Observations on DHS and FEMA Efforts to Prepare for 
and Respond to Major and Catastrophic Disasters and Address Related 
Recommendations and Legislation. GAO-07-835T. Washington, D.C.: May 15, 
2007. 

Homeland Security: Preparing for and Responding to Disasters. GAO-07- 
395T. Washington, D.C.: March 9, 2007. 

Continuity of Operations: Agencies Could Improve Planning for Telework 
during Disruptions. GAO-06-740T. Washington, D.C.: May 11, 2006. 

Hurricane Katrina: GAO's Preliminary Observations Regarding 
Preparedness, Response, and Recovery. GAO-06-442T. Washington, D.C.: 
March 8, 2006. 

Emergency Preparedness and Response: Some Issues and Challenges 
Associated with Major Emergency Incidents. GAO-06-467T. Washington, 
D.C.: February 23, 2006. 

Statement by Comptroller General David M. Walker on GAO's Preliminary 
Observations Regarding Preparedness and Response to Hurricanes Katrina 
and Rita. GAO-06-365R. Washington, D.C.: February 1, 2006. 

Influenza Pandemic: 

Influenza Pandemic: Further Efforts Are Needed to Ensure Clearer 
Federal Leadership Roles and an Effective National Strategy. GAO-07- 
781. Washington, D.C.: August 14, 2007. 

Influenza Pandemic: DOD Combatant Commands' Preparedness Efforts Could 
Benefit from More Clearly Defined Roles, Resources, and Risk 
Mitigation. GAO-07-696. Washington, D.C.: June 20, 2007. 

Avian Influenza: USDA Has Taken Important Steps to Prepare for 
Outbreaks, but Better Planning Could Improve Response. GAO-07-652. 
Washington, D.C.: June 11, 2007. 

Financial Market Preparedness: Significant Progress Has Been Made, but 
Pandemic Planning and Other Challenges Remain. GAO-07-399. Washington, 
D.C.: March 29, 2007. 

Influenza Pandemic: DOD Has Taken Important Actions to Prepare, but 
Accountability, Funding, and Communications Need to be Clearer and 
Focused Departmentwide. GAO-06-1042. Washington, D.C.: September 21, 
2006. 

Y2K: 

Year 2000 Computing Challenge: Lessons Learned Can Be Applied to Other 
Management Challenges. GAO/AIMD-00-290. Washington, D.C.: September 12, 
2000. 

Year 2000 Computing Crisis: Potential Widespread Disruption Calls for 
Strong Leadership and Partnerships. GAO/AIMD-98-85. Washington, D.C.: 
April 30, 1998. 

[End of section] 

Footnotes: 

[1] Pub. L. No. 107-296, 116 Stat. 2135 (Nov. 25, 2002). 

[2] The 17 critical infrastructure and key resource sectors are: food 
and agriculture; banking and finance; chemical; commercial facilities; 
commercial nuclear reactors, materials and water; dams; defense 
industrial base; drinking water and water treatment systems; emergency 
services; energy; government facilities; information technology; 
national monuments and icons; postal and shipping; public health and 
healthcare; telecommunications; and transportation systems. Critical 
infrastructure are systems and assets, whether physical or virtual, so 
vital to the United States that their incapacity or destruction would 
have a debilitating impact on national security, national economic 
security, and national public health or safety, or any combination of 
those matters. Key resources are publicly or privately controlled 
resources essential to minimal operations of the economy or government, 
including individual targets whose destruction would not endanger vital 
systems but could create a local disaster or profoundly damage the 
nation's morale or confidence. For purposes of this report, we will use 
the term critical infrastructure to also include key resources. 

[3] GAO has engagements under way to examine the public health and 
healthcare aspects of preparing for and responding to a pandemic, 
including efforts looking at (1) global strategies to forestall 
pandemic influenza, (2) HHS's pandemic influenza planning efforts, and 
(3) medical surge capacity and capability for emergency preparedness. 

[4] Owners and operators of these assets include private sector 
entities and, in some cases, state and local governments. 

[5] According to DHS guidance, government agencies may suggest the 
inclusion of various parts of a sector but it is the responsibility of 
each private sector coordinating council to identify the sector's 
boundaries, establish the criteria for membership, seek broad 
participation and representation of the diversity of the sector, and 
establish the governance, business case, and work process of the 
sector's coordinating council. 

[6] GAO, Critical Infrastructure Protection: Progress Coordinating 
Government and Private Sector Efforts Varies by Sectors' 
Characteristics, GAO-07-39 (Washington, D.C.: Oct. 16, 2006). 

[7] The Federal Advisory Committee Act (FACA) (codified at 5 U.S.C. 
App. 2) was enacted, in part, to control the advisory committee process 
and to open to public scrutiny the manner in which government agencies 
obtain advice from private individuals and groups. See 648 F. Supp. 
1353, 1358-59 (D.D.C. 1986). Pursuant to authority conferred by the 
Homeland Security Act, 6 U.S.C. ß 451, DHS established the CIPAC as a 
FACA-exempt body to support the free flow of information and the need 
for regular, interactive discussions concerning threats and 
vulnerabilities. See 71 Fed. Reg. 14,930 (Mar. 24, 2006). 

[8] Homeland Security Council, National Strategy for Pandemic Influenza 
Implementation Plan Summary of Progress (December 2006), and Homeland 
Security Council, National Strategy for Pandemic Influenza: 
Implementation Plan One Year Summary (July 2007). 

[9] Centers for Disease Control and Prevention, Community Strategy for 
Pandemic Influenza Mitigation (February 2007). 

[10] Business Executives for National Security, Getting Down to 
Business: An Action Plan for Public-Private Disaster Response 
Coordination (January 2007). 

[11] House of Representatives Homeland Security Committee, Subcommittee 
on Emergency Communications, Preparedness, and Response, Hearing on 
Leveraging the Private Sector to Strengthen Emergency Preparedness and 
Response, July 19, 2007. 

[12] GAO, Influenza Pandemic: Further Efforts Are Needed to Ensure 
Federal Leadership Roles and an Effective National Strategy, GAO-07-781 
(Washington, D.C.: Aug. 14, 2007). 

[13] GAO, Statement by Comptroller General David M. Walker on GAO's 
Preliminary Observations Regarding Preparedness and Response to 
Hurricanes Katrina and Rita, GAO-06-365R (Washington, D.C.: Feb. 1, 
2006). 

[14] National Infrastructure Advisory Council, The Prioritization of 
Critical Infrastructure for a Pandemic Outbreak in the United States 
(Jan. 16, 2007). 

[15] GAO, High-Risk Series: An Update, GAO-07-310 (Washington, D.C.: 
January 2007). 

[16] GAO, Critical Infrastructure Protection: Sector Plans and Sector 
Councils Continue to Evolve, GAO-07-706R (Washington, D.C.: July 10, 
2007). 

[17] Year 2000 Information and Readiness Disclosure Act, Pub. L. No. 
105-271, 112 Stat. 2386 (Oct. 20, 1998), and Y2K Act, Pub. L. No. 106- 
37, 113 Stat. 185 (July 20, 1999). 

[18] GAO, Financial Market Preparedness: Significant Progress Has Been 
Made, but Pandemic Planning and Other Challenges Remain, GAO-07-399. 
Washington, D.C.: March 29, 2007. 

[19] 49 C.F.R. sections 390.23 and 390.25 provide automatic relief from 
certain truck safety regulations during an emergency, including hours 
of service for any motor carrier and driver providing emergency relief. 

[20] GAO-07-39. 

[21] Social distancing is focused measures to increase social distance, 
or to restrict activity. Depending on the situation, this may include 
cancellation of public events (concerts, sports events, movies, plays) 
and closure of recreational facilities and schools. 

[22] The draft National Response Framework was released for public 
comment on September 10, 2007. 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation, and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office: 
441 G Street NW, Room LM: 
Washington, DC 20548: 

To order by Phone: 
Voice: (202) 512-6000: 
TDD: (202) 512-2537: 
Fax: (202) 512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Gloria Jarmon, Managing Director, JarmonG@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, DC 20548: 

Public Affairs: 

Susan Becker, Acting Manager, BeckerS@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, DC 20548: