National Security: Additional Actions Needed to Ensure Effectiveness of 5G Strategy
Fast Facts
5G will dramatically increase the number of devices connected to the Internet—and the number of opportunities for hackers to steal information and wreak havoc on connected systems.
The Administration issued a National Strategy to Secure 5G, which we assessed against our 6 key characteristics for effective national strategies.
The plan only partially addressed 5 of the 6 characteristics. For example, it didn't say what resources are needed to carry the plan out—which can make it hard to allocate and shift resources appropriately.
We recommended that Administration officials ensure the strategy fully addresses all 6 characteristics.
Highlights
What GAO Found
The federal government and private industry are preparing for the next generation of wireless technology, known as the fifth generation of mobile communication networks, or 5G. 5G is expected to introduce national security risks as malicious actors seek to exploit these new 5G technologies. In March 2020, the White House issued the National Strategy to Secure 5G of the United States of America (5G national strategy), as required by the Secure 5G and Beyond Act of 2020 (P.L. 116-129). The strategy is intended to provide direction on how the U.S. government will secure 5G infrastructure domestically and abroad. GAO identified six desirable characteristics of an effective national strategy and found that the strategy partially addresses five of these six characteristics and does not address one (see table).
Table: Extent to Which the March 2020 National Strategy to Secure 5G (5G National Strategy) Addresses the Desirable Characteristics of a National Strategy
| Desirable characteristic |
Elements of the desirable characteristic that should be addressed in a national strategy |
Our assessment of the 5G national strategy against the elements of the desirable characteristics |
| Purpose, scope, and methodology | Why the strategy was produced, the scope of its coverage, and the process by which it was developed | Partially addresses |
| Problem definition and risk assessment | What the particular national problems are, assessments of the risks to critical assets and operations—including the threats to, and vulnerabilities of, critical operations—and discussion of the quality of data available regarding the risk assessment | Partially addresses |
| Goals, subordinate objectives, activities, and performance measures | What the strategy is trying to achieve; steps to achieve those results; and the priorities, milestones, and performance measures that include measurable targets to gauge results and help ensure accountability | Partially addresses |
| Results, investments, and risk management | What the strategy will cost and the types of resources and investments needed | Does not address |
| Organizational roles, responsibilities, and coordination | Who will implement the strategy, what their roles will be, and mechanisms to coordinate their efforts | Partially addresses |
| Integration and implementation | How a national strategy relates to other strategies’ goals, objectives, and activities and to subordinate levels of government and their plans to implement the strategy | Partially addresses |
Source: GAO analysis of the 5G strategy | GAO-21-155R
As an example, GAO found that the 5G strategy partially addresses the problem definition and risk assessment characteristic. The 5G strategy includes some of the elements, such as information on the problem that it is intended to address and broadly identifies underlying vulnerabilities, threats, and risks. However, it does not include other elements, such as a risk assessment or complete information on 5G risks. In another example, GAO found that the 5G strategy does not address the characteristic of results, investments, and risk management. Specifically, the strategy does not explicitly discuss what it will cost and does not include any cost estimates either for achieving individual goals or for implementing the strategy as a whole.
GAO found that the 5G national strategy does not include all elements of the six desirable characteristics of national strategies because, according to officials from the White House's Office of Science and Technology Policy (OSTP) and the National Telecommunications and Information Administration (NTIA), the strategy was intentionally written to be at a high level. According to these officials, the 5G implementation plan, also required to be submitted by September 23, 2020 by the Secure 5G and Beyond Act of 2020, is expected to include specific details not covered in the 5G national strategy. The National Security Council (NSC) and National Economic Council (NEC) are developing the implementation plan and according to NTIA officials, it is expected to be finalized by the end of October 2020. NTIA and OSTP officials were uncertain of its final content and did not provide information about whether the plan would include all elements of the six desirable characteristics of national strategies. Until the Administration assures that the implementation plan fully addresses all elements of the six desirable characteristics, the plan will provide limited guidance to decision makers about allocating resources to address 5G risks and challenges.
Why GAO Did This Study
GAO was asked to evaluate the federal government's efforts to mitigate challenges and national security risks related to 5G. This report examines the extent to which the administration has developed a 5G national strategy that address the six characteristics of an effective national strategy. To conduct this work, GAO reviewed the 5G national strategy to determine the extent to which it addresses the characteristics of an effective national strategy identified in GAO-04-408T.
Recommendations
The Assistant to the President for National Security Affairs, in coordination with relevant stakeholders from NSC and NEC, should ensure that the plan to implement the 5G national strategy fully addresses all elements of our six desirable characteristics of a national strategy. NSC and NEC did not provide a response to a draft copy of this report.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Office of the Assistant to the President for National Security Affairs | The Assistant to the President for National Security Affairs, in coordination with relevant stakeholders from NSC and NEC, should ensure that the plan to implement the 5G national strategy fully addresses all elements of our six desirable characteristics of a national strategy. |
NSC and NEC did not provide a response to a draft copy of this report. As of November 2021, the National Security Council and National Economic Council have not taken action on this recommendation.
|