National Security:

Additional Actions Needed to Ensure Effectiveness of 5G Strategy

GAO-21-155R: Published: Oct 7, 2020. Publicly Released: Oct 7, 2020.

Additional Materials:

Contact:

Brian Mazanec
(202) 512-5130
MazanecB@gao.gov

 

Nick Marinos
(202) 512-9342
MarinosN@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

5G will dramatically increase the number of devices connected to the Internet—and the number of opportunities for hackers to steal information and wreak havoc on connected systems.

The Administration issued a National Strategy to Secure 5G, which we assessed against our 6 key characteristics for effective national strategies.

The plan only partially addressed 5 of the 6 characteristics. For example, it didn't say what resources are needed to carry the plan out—which can make it hard to allocate and shift resources appropriately.

We recommended that Administration officials ensure the strategy fully addresses all 6 characteristics.

Graphic with five interconnected hexagons showing the evolution of technology from 1G to 5G.

Additional Materials:

Contact:

Brian Mazanec
(202) 512-5130
MazanecB@gao.gov

 

Nick Marinos
(202) 512-9342
MarinosN@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

What GAO Found

The federal government and private industry are preparing for the next generation of wireless technology, known as the fifth generation of mobile communication networks, or 5G. 5G is expected to introduce national security risks as malicious actors seek to exploit these new 5G technologies. In March 2020, the White House issued the National Strategy to Secure 5G of the United States of America (5G national strategy), as required by the Secure 5G and Beyond Act of 2020 (P.L. 116-129). The strategy is intended to provide direction on how the U.S. government will secure 5G infrastructure domestically and abroad. GAO identified six desirable characteristics of an effective national strategy and found that the strategy partially addresses five of these six characteristics and does not address one (see table).

Table: Extent to Which the March 2020 National Strategy to Secure 5G (5G National Strategy) Addresses the Desirable Characteristics of a National Strategy

Desirable characteristic

Elements of the desirable characteristic that should be addressed in a national strategy

Our assessment of the 5G national strategy against the elements of the desirable characteristics
Purpose, scope, and methodology Why the strategy was produced, the scope of its coverage, and the process by which it was developed Partially addresses
Problem definition and risk assessment What the particular national problems are, assessments of the risks to critical assets and operations—including the threats to, and vulnerabilities of, critical operations—and discussion of the quality of data available regarding the risk assessment Partially addresses
Goals, subordinate objectives, activities, and performance measures What the strategy is trying to achieve; steps to achieve those results; and the priorities, milestones, and performance measures that include measurable targets to gauge results and help ensure accountability Partially addresses
Results, investments, and risk management What the strategy will cost and the types of resources and investments needed Does not address
Organizational roles, responsibilities, and coordination Who will implement the strategy, what their roles will be, and mechanisms to coordinate their efforts Partially addresses
Integration and implementation How a national strategy relates to other strategies’ goals, objectives, and activities and to subordinate levels of government and their plans to implement the strategy Partially addresses

Source: GAO analysis of the 5G strategy | GAO-21-155R

As an example, GAO found that the 5G strategy partially addresses the problem definition and risk assessment characteristic. The 5G strategy includes some of the elements, such as information on the problem that it is intended to address and broadly identifies underlying vulnerabilities, threats, and risks. However, it does not include other elements, such as a risk assessment or complete information on 5G risks. In another example, GAO found that the 5G strategy does not address the characteristic of results, investments, and risk management. Specifically, the strategy does not explicitly discuss what it will cost and does not include any cost estimates either for achieving individual goals or for implementing the strategy as a whole.

GAO found that the 5G national strategy does not include all elements of the six desirable characteristics of national strategies because, according to officials from the White House's Office of Science and Technology Policy (OSTP) and the National Telecommunications and Information Administration (NTIA), the strategy was intentionally written to be at a high level. According to these officials, the 5G implementation plan, also required to be submitted by September 23, 2020 by the Secure 5G and Beyond Act of 2020, is expected to include specific details not covered in the 5G national strategy. The National Security Council (NSC) and National Economic Council (NEC) are developing the implementation plan and according to NTIA officials, it is expected to be finalized by the end of October 2020. NTIA and OSTP officials were uncertain of its final content and did not provide information about whether the plan would include all elements of the six desirable characteristics of national strategies. Until the Administration assures that the implementation plan fully addresses all elements of the six desirable characteristics, the plan will provide limited guidance to decision makers about allocating resources to address 5G risks and challenges.

Why GAO Did This Study

GAO was asked to evaluate the federal government's efforts to mitigate challenges and national security risks related to 5G. This report examines the extent to which the administration has developed a 5G national strategy that address the six characteristics of an effective national strategy. To conduct this work, GAO reviewed the 5G national strategy to determine the extent to which it addresses the characteristics of an effective national strategy identified in GAO-04-408T.

What GAO Recommends

The Assistant to the President for National Security Affairs, in coordination with relevant stakeholders from NSC and NEC, should ensure that the plan to implement the 5G national strategy fully addresses all elements of our six desirable characteristics of a national strategy. NSC and NEC did not provide a response to a draft copy of this report.

For more information, contact: Brian Mazanec at (202) 512-5130 or mazanecb@gao.gov or Nick Marinos at (202) 512-9342 or marinosn@gao.gov.

Recommendation for Executive Action

  1. Status: Open

    Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

    Recommendation: The Assistant to the President for National Security Affairs, in coordination with relevant stakeholders from NSC and NEC, should ensure that the plan to implement the 5G national strategy fully addresses all elements of our six desirable characteristics of a national strategy.

    Agency Affected: Executive Office of the President: Office of the Assistant to the President for National Security Affairs

 

Explore the full database of GAO's Open Recommendations »

Oct 29, 2020

Oct 21, 2020

Oct 1, 2020

Sep 23, 2020

Aug 20, 2020

Aug 14, 2020

Aug 6, 2020

Jul 30, 2020

Jul 27, 2020

Looking for more? Browse all our products here