Telecommunications: FCC Should Improve Monitoring of Industry Efforts to Strengthen Wireless Network Resiliency

Americans increasingly rely on mobile wireless communications for safety-related communications like calling 911 and receiving weather alerts. Mobile wireless networks face risks from physical incidents including extreme weather events and intentional and accidental damage. For example, in 2017 several major hurricanes damaged wireless network infrastructure, leaving many U.S. citizens without reliable access to wireless communications.

GAO was asked to review federal efforts to improve the resiliency of wireless networks following natural disasters and other physical incidents. This report examines: (1) trends in mobile wireless outages reported to FCC since 2009 and (2) actions federal agencies and industry have taken since 2013 (after Hurricane Sandy) to improve wireless network resiliency, among other objectives. GAO analyzed wireless outage data from 2009 to 2016 (4 years before and after Hurricane Sandy); reviewed FCC, DHS, and industry documents; and interviewed stakeholders who represented a variety of perspectives, such as industry, public safety, and consumer groups. GAO assessed FCC's efforts to monitor an industry initiative to improve wireless network resiliency against federal internal control standards.

The number of wireless outages attributed to a physical incident—a natural disaster, accident, or other manmade event, such as vandalism—increased from 2009 to 2016, as reported to the Federal Communications Commission (FCC). During this time, the number of outages substantially increased from 189 to 1,079 outages, with most of the increase occurring from 2009 to 2011. FCC officials said this increase was due in part to growth in wireless customers and wireless infrastructure. Almost all outages attributed to a physical incident were due to an accident, such as damage to a cable due to a digging error (74 percent) or a natural disaster (25 percent). However, outages due to a natural disaster had a longer median duration (ranging from 19 to 36 hours), which was more than twice as long as outages caused by an accident. Power failures and failures in other providers' networks also play a role in wireless outages attributed to physical incidents. For instance, carriers reported that 87 percent of wireless outages attributed to a physical incident were due to a failure in another provider's network on which they rely.

Since 2013, federal agencies and industry have taken actions to improve the resiliency of wireless networks. For example, the Department of Homeland Security (DHS) and FCC charter federal advisory committees that have examined resiliency issues and potential solutions, such as sharing infrastructure during emergencies. FCC also proposed a rule that would disclose how individual wireless carriers' networks performed during emergency events. In response, an industry coalition announced an initiative—the Wireless Network Resiliency Cooperative Framework—whereby carriers agreed to allow roaming on each other's networks and aggregated statistics to be published on how networks performed during emergency events. This initiative prompted FCC to not adopt its proposed rule. FCC said it would engage with industry about the framework's implementation and use, but FCC has limited formal plans to oversee or spread knowledge of the framework:

FCC developed a plan to track the completion of initial implementation tasks outlined in the framework, but this plan does not include steps to track or evaluate any outputs or outcomes from the framework.

FCC and industry documents describe broad goals for the framework, such as advancing information sharing during and after emergency events, but neither FCC nor industry has set any specific measures to help determine whether the framework achieves these broad goals.

Although some public safety officials and other stakeholders GAO contacted were not aware of the framework, FCC did not have plans to actively communicate information about the framework to these audiences.

More robust measures and a better plan to monitor the framework would help FCC collect information on the framework and evaluate its effectiveness. Such steps could help FCC address any challenges or decide whether further action is needed. Also, by promoting awareness about the framework, FCC would help public safety officials and other industry participants to be well positioned to use the framework to help them prepare for or respond to emergency events.

FCC should work with industry to develop specific performance measures for the Wireless Network Resiliency Cooperative Framework, monitor the framework's outcomes, and promote awareness of it. FCC agreed with the recommendations.

Americans are increasingly reliant on mobile wireless communications in  their day-to-day lives to make phone calls and share information through  the Internet, including for safety-related communications, such as making  911 calls and receiving weather alerts. The nation’s mobile wireless  networks face risks from a variety of physical incidents including extreme  weather events and accidents, such as backhoe cuts to cables  connecting cell towers to the broader network. In recent years, major  storms have caused outages in mobile wireless networks, severely  impairing safety communications when they were most needed. For  example, several major hurricanes made landfall in the United States in  August and September 2017, damaging wireless network infrastructure  and causing power outages that led to localized wireless outages. This  included Hurricane Irma—which caused extreme damage in the U.S.  Virgin Islands, Puerto Rico, and Florida, among other states—and  Hurricane Maria that severely affected infrastructure including wireless  networks in Puerto Rico and the U.S. Virgin Islands. As a result of  Hurricane Maria, a majority of all cell sites were knocked out of service for  months, leaving residents without reliable and continuous access to voice  and data communications.

As citizens and public safety officials—such as police officers, firefighters,  and emergency medical-services personnel—are increasingly dependent  on wireless communications, federal agencies and the communications  sector have stressed the importance of resilient mobile wireless  communications during times of emergency. As of 2016, over 65 percent  of households in the United States relied solely or mostly on wireless  phones to make and receive phone calls. Further, according to the  Federal Communications Commission (FCC), about 70 percent of calls to  911 are made from wireless devices. The private sector owns and  operates the nation’s wireless networks as well as other communication  networks and is primarily responsible for managing and protecting these  assets. However, the federal government plays a role in promoting  wireless network resiliency—that is, the ability to prepare for and adapt to  changing conditions and withstand and recover rapidly from disruptions.  FCC is the federal regulatory agency for communications and its mission  includes promoting the safety of life and property through the use of radio  communications. The Department of Homeland Security (DHS) is  responsible for coordinating the federal effort to promote the security and  resilience of the nation’s critical infrastructure, which includes the  communications sector, and also serves as the lead agency for  coordinating and prioritizing security and resiliency activities in the  communications sector. Further, communications networks are especially  important due to the enabling functions they provide across all critical  infrastructure sectors; the loss of communications facilities could have  cascading effects on other critical infrastructures due to  interdependencies among sectors.

You asked us to review efforts that have been taken since Hurricane  Sandy in late 2012 to improve the resiliency of mobile wireless networks  as well as options that federal agencies could take to enhance wireless  resiliency following natural disasters and other physical incidents. This  report examines: (1) trends in mobile wireless outages attributed to  physical incidents since 2009 as reported to FCC, (2) the actions federal  agencies and industry have taken since 2013 to improve wireless network  resiliency, and (3) options that federal agencies could take to improve  network resiliency and their advantages and disadvantages. This report  focuses on the physical risks facing wireless networks; in other words, the  potential for an unwanted effect from an incident on a network’s  infrastructure such as towers, antennas, and switches. Therefore, we did  not examine cyber risks facing wireless networks.

To address these objectives, we analyzed data submitted by wireless  carriers to FCC’s Network Outage Reporting System (NORS) on wireless  outages that occurred from 2009 through 2016 (that is, to cover 4 years of  data before and after Hurricane Sandy). In particular, we determined the  total number and causes of wireless outages that were reported as  having occurred during that time period and identified the share of all  wireless outages attributed to a physical incident. We analyzed other  characteristics of wireless outages such as location, duration, and  whether the failure occurred in another company’s network. We took  several steps to assess the reliability of NORS data, such as reviewing  FCC documentation and interviewing agency officials responsible for  collecting and analyzing NORS data, and found the data were sufficiently  reliable for the purposes of describing trends in wireless outages.

We also reviewed reports and documents from FCC, DHS, and the  National Institute of Standards and Technology (NIST); federal advisory  committees and partnership councils that cover wireless network  resiliency; and industry. We interviewed officials from FCC, NIST, and  several DHS component agencies responsible for protecting and securing  the communications infrastructure, as well as representatives from 24  stakeholders, selected to ensure we covered different perspectives.  Stakeholders included five wireless carriers and two owners of other  wireless network infrastructure, seven industry associations, three  consumer groups, five state and local government officials, one  partnership council, and one representative from academia. We selected  wireless carriers and owners of other wireless network infrastructure to  ensure variety in company size and industry role. We selected state  agencies to include states directly affected by two events in 2016— flooding in Louisiana and Hurricane Matthew—for which industry had  implemented elements of the framework at the time we began our review.  However, the views presented in our report are not generalizable to those  of all stakeholders.

We assessed FCC’s efforts to monitor an industry initiative to improve  wireless network resiliency against federal standards for internal control  and FCC’s current strategic plan. We identified options for improving  wireless network resiliency by examining federal agency reports,  literature, and other sources. We obtained stakeholder views on the  advantages, disadvantages, and feasibility of the identified options by  using open-ended questions to solicit input. Appendix I describes our  scope and methodology in greater detail.

We conducted this performance audit from January 2017 to December  2017 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Mobile devices use wireless networks to enable voice and data  communications. Mobile wireless networks comprise several components  and provide coverage based on dividing a large geographic area into  smaller areas of coverage known as “cells.” Each cell contains a cell  site—a base station equipped with an antenna—to receive and transmit  radio signals to mobile devices within its coverage area. (See fig. 1.) The  cell sites are often located on a tower, rooftop, or other structure to  provide coverage to a wide area. For a mobile device to transmit and  receive signals, it must be within range of a cell site antenna. In many  areas, a mobile device is able to transmit and receive signals from  multiple cell sites. Each cell site is linked to a base station controller that  manages communications between the cell site and the mobile switching  center (e.g., routes and hands over calls). The mobile switching center  then directs voice and data traffic to landline phones, other cell phones  via a carrier’s network, or the Internet. Backhaul facilities provide  transport for this voice and data traffic, and backhaul can be provided  over fiber optic or copper cables or wirelessly via microwave facilities.

According to FCC, there are four “nationwide” mobile wireless carriers— AT&T, Verizon, T-Mobile, and Sprint—with networks that cover most of  the United States. The industry also includes dozens of other carriers,  many of which provide service in a specific, sometimes rural, geographic  area. According to an FCC report on the wireless industry, most  consumers in the United States have the ability to choose among multiple  carriers with wireless network coverage in their area, and wireless  carriers typically compete on price, network quality, and the availability of  mobile devices with innovative features. Federal law states that FCC  must take into account whether its actions will encourage competition in  mobile wireless networks. Some wireless carriers own a portion or all of  the structures that host cell sites, but wireless carriers mostly lease space  from independent companies that own or operate a majority of the towers  and other structures that host cell sites.

Mobile wireless networks face several kinds of risks that could affect the  network’s physical components, resulting in disrupted service or an  outage. Government reports generally identify three types of physical  risks facing wireless networks:

Natural disasters, such as hurricanes, tornados, wildfires, and  earthquakes.

Manmade events, such as terrorist attacks and damage associated  with theft or another malicious act.

Accidents, such as cable damage due to digging or locating errors  and damage associated with a vehicle accident.

The potential effects related to these physical risks include damage to  wireless network components that requires wireless carriers and other  providers to make repairs or replace equipment to restore service. For  example, flooding, which can occur with a hurricane or heavy rain, could  damage the cable or other equipment submerged in water. Wildfires can  damage network components like antennas and backhaul facilities  (including fiber optic and copper lines and microwave towers) as well as  equipment in buildings if the buildings are damaged or destroyed.

In addition to physical risks, wireless networks face risks stemming from  their dependence on other sectors and providers. One key dependency  identified by several government and industry reports is the reliance on  commercially provided electricity, referred to in this report as commercial  power. Several components—including the mobile switching center,  antennas at cell sites, and consumer devices—may rely on commercial  power. Therefore, loss of electric power may result in a loss of wireless  communications. Another key dependency for wireless networks is  backhaul used to get data from an end user to a major network. Wireless carriers can provide backhaul but typically obtain it from another  communications provider, such as a local telephone company or cable  company. An outage in the backhaul network can cause an outage that  affects one or more cell sites or a portion of the wireless network. FCC  has reported that the loss of backhaul service is a major cause of a cell  site’s unavailability, which can lead to wireless outages. Also important is  having clear roads and highways, as wireless carriers’ personnel or  contractors need to be able to access cell sites to repair or replace  equipment, or deliver fuel for generators that are sometimes located at  cell sites.

Resilience is the ability to prepare for and adapt to changing conditions  and withstand and recover rapidly from disruptions, according to  Presidential Policy Directive 21. Owners and operators of wireless  networks can take a variety of actions to manage different risks, including  various physical risks, according to the Communications Sector-Specific  Plan. These actions can be designed to achieve different aims,  including to prepare for incidents, like creating and exercising disaster recovery  reduce a specific vulnerability, like elevating or moving a mobile  switching center in a flood-prone area to a higher location; mitigate the consequences of an incident, like installing backup  power—using batteries with a limited supply of power or generators  that run on diesel or other fuel sources—to support continued wireless  service during a commercial power outage; or enable efficient response and restoration following an incident, such  as deploying portable cell sites on trucks and other equipment after an  incident to provide wireless communications when the network  experiences an outage or a significant disruption.

FCC, pursuant to the Communications Act of 1934, as amended, is  charged with regulating interstate and international communications  throughout the United States, which means that FCC regulates wireless  networks and carriers, among other responsibilities. It develops and  administers policies and rules to advance the security and reliability of the  nation’s communications infrastructure; this responsibility includes,  among other topics, network resiliency, public safety communications,  and communications infrastructure protection. FCC administers two  web-based outage-reporting systems to help it oversee network reliability  and resiliency:

NORS: Carriers are required to report details about service  disruptions or outages (e.g., cause, location, and duration) to their  communications systems that meet specified thresholds set forth in  regulation. FCC uses NORS data to monitor trends in  communications outages and to try to identify and address any  shortcomings or issues going forward.

Disaster Information Reporting System (DIRS): Carriers can  voluntarily report on the status of communications infrastructure  during an emergency event in DIRS. For example, wireless carriers  report daily on the number of cell sites, by county, that are out of  service by reason (e.g., power outage, physical damage). FCC  activates DIRS in response to an event and then uses these data to  track network restoration during and after an emergency event.

DHS also plays a role in wireless network resiliency as the lead agency  for coordinating and prioritizing security and resilience activities for the  communications sector. Presidential Policy Directive 21 establishes  national policy to strengthen the security and resilience of critical  infrastructure and states that the federal government shall work with  critical infrastructure owners and operators to do so. DHS’s Office of  Cybersecurity and Communications, within the National Protection and  Programs Directorate, leads this coordination for the communications  sector as the sector-specific agency, and this office works with the  Communications Sector Coordinating Council and the Communications  Government Coordinating Council to set goals, objectives, and activities  for the sector. During a national emergency or disaster, DHS also  coordinates response efforts for communications systems in its role as  the coordinator for Emergency Support Function #2 – Communications  (ESF-2). Specifically, two DHS components—the Federal Emergency  Management Agency (FEMA) and Office of Cybersecurity and  Communications—lead the federal government’s work to support the  restoration of communications infrastructure, coordinate response efforts,  and facilitate the delivery of information to emergency-management  decision makers. DHS has direct access to FCC’s NORS and DIRS  data to support its work. Other DHS components also have  responsibilities related to wireless network resiliency. For example, the  Science & Technology Directorate conducts research in the area of  wireless and other communications network resiliency, although its focus  is on communications for the public-safety community.

Within the Department of Commerce, NIST also plays a role in promoting  network resiliency by sponsoring the Community Resilience Panel.  According to NIST, the Community Resilience Panel is sponsored by  NIST and co-sponsored by other federal agencies to promote  collaboration among stakeholders to strengthen the resiliency of  infrastructure that communities rely on, including communications  infrastructure. As part of this mission, the panel seeks to identify policy  and standards-related impediments to community resiliency, raise  awareness of sector dependencies and of the cascading effects of  disasters, and identify potential resiliency metrics.

Wireless Outages Caused by Physical Incidents Have Increased since 2009, and Outages due to Natural Disasters Lasted Longest

Trends in Number and Reported Causes of Wireless Outages

The number of wireless outages attributed to a physical incident  increased from 2009 to 2016 (see fig. 2). Specifically, the number of  outages with a physical incident reported as a root cause increased from  189 outages in 2009 to 1,079 in 2016. The number of outages  increased substantially during the first few years of this period and then  was relatively stable, which mirrored the trend for all wireless outages.  According to FCC officials, the increase in reported outages was due to  increases in both the number of wireless customers and wireless  infrastructure over this period, as well as due to FCC’s outreach to  wireless companies to clarify the thresholds for which carriers are  required to report wireless outages to help ensure that carriers were  consistently and fully reporting outages. From 2009 to 2016, about one- third of all wireless outages reported to FCC (6,002 of 18,325) were  attributed to physical incidents.

Of wireless outages reported to FCC that were attributed to physical  incidents, most were due to accidents, described below:

Accidents—which include cable damage due to a backhoe cut, among  other causes—were the root cause for 74 percent of wireless outages  attributed to a physical event.

Natural disasters—including tornados and wildfires—were the root  cause for 25 percent of wireless outages attributed to a physical  incident.

Manmade events—which include damage associated with theft or  other intentional damage to facilities—were the root cause for the  remaining 1 percent of these outages.

FCC typically suspends NORS reporting requirements in areas where  FCC activates DIRS reporting for an emergency event, generally a  natural disaster. For example, when FCC activated DIRS reporting for all  counties in Puerto Rico and the U.S. Virgin Islands in response to  Hurricane Maria in September 2017, FCC suspended NORS reporting  requirements for those counties. As a result, FCC officials said that  NORS data can undercount the number of wireless outages due to  natural disasters. For a large natural disaster, however, FCC still can  receive NORS reports for wireless outages outside the DIRS reporting  area that are due to the natural disaster.

Hurricane Irma   In September 2017, Hurricane Irma made  landfall as a Category 3 hurricane in Florida,  having previously tracked near Puerto Rico  and the U.S. Virgin Islands. The hurricane  produced sustained winds of nearly 115 miles  per hour as it made landfall in Florida. In the  days that followed, the hurricane’s impact was  felt over the southeastern United States, with  nearly 16 inches of rain falling over portions of  Florida and high winds observed in five states.  The President issued disaster declarations  covering portions of Puerto Rico, the U.S.  Virgin Islands, Florida, and Georgia.   The damage from Hurricane Irma—both  damage to wireless network infrastructure and  damage resulting in power outages—created  wireless service disruptions and outages in  certain impacted areas. In particular, over half  of cell sites were out of service for 3 or more  consecutive days in five counties in Puerto  Rico and in two counties in the U.S. Virgin  Islands, according to data from wireless  carriers reported to FCC. Within a week, only  6 percent of cell sites were out of service in  reporting counties in Puerto Rico, but a  majority of cell sites remained non-operational  in the U.S. Virgin Islands; in one county, St.  John, 90 percent of cell sites remained out of  service a week and a half after landfall. In  southern Florida, three counties had more  than half of cell sites out of service for 4  straight days. The number of out-of-service  cell sites decreased over time, so that less  than 20 percent of cell sites were out of  service in these counties within a week.  Looking more broadly across all counties for  which FCC collected data in Florida, Georgia,  and Alabama, about 13 percent, 2 percent,  and 1 percent of cell sites in the reporting  area were out of service 4 days after  Hurricane Irma’s landfall, respectively. cause and contributing factor fields. Looking across cause fields,  wireless outages citing an accident were most common, particularly from  2010 to 2016, as shown in figure 3. Wireless outages citing a natural  disaster were less common, although there were several spikes in the  number of outages citing a natural disaster. Some of these spikes  correspond with major natural disasters like the derecho affecting  Midwest and Mid-Atlantic states in 2012 or Hurricane Matthew in 2016.  Manmade events were rarely reported as the cause or contributing factor.

Duration of Wireless Outages Attributed to Physical Incidents

While less common than accidents, wireless outages attributed to natural  disasters lasted much longer than outages attributed to other physical  incidents. Specifically, figure 4 shows that outages where a natural  disaster was cited as the root cause were often twice as long as outages  attributed to an accident or manmade event. From 2009 to 2016, the  annual median duration of wireless outages attributed to accidents  ranged from 8 hours to 16 hours, compared to natural disasters, which  ranged from 19 to 36 hours. Due to this longer duration, wireless  outages attributed to natural disasters have a greater impact on the public  as it is left without key means of communication for longer periods of time. In addition, an industry association told us that even though public  safety officials primarily use dedicated communication networks, like land  mobile radio networks, to carry out their work, they also rely on their  mobile devices that use commercial wireless networks for maps and other  applications.

Ten of 24 stakeholders we interviewed said that natural disasters pose  the greatest risk to wireless networks as they have the most intense  consequences. Natural disasters can result in physical damage to or  flooding of critical network components, and fallen trees and debris can  temporarily block transportation routes, keeping repair crews from  inoperable cell sites and other network components, as described in the  Community Resilience Planning Guide for Buildings and Infrastructure  Systems. Further, the failure of other systems like commercial power  upon which wireless networks depend can lead to cascading failures in  communications networks. One industry association we spoke with said  that natural disasters are the primary risk to wireless network resiliency as  these events usually create the largest outages with the longest  durations.

Location of Wireless Outages Attributed to Physical Incidents

By location, the number of wireless outages attributed to physical  incidents increased from 2009 to 2016 in some states, including several  of the most populous states such as California and Texas (see fig. 5).  Most of the recent expansion of wireless networks has tended to be in the  most populous states, as those states contain the most customers and  the highest densities of customers, according to FCC officials. In addition,  the thresholds for which carriers are required to report wireless outages in  NORS are such that many outages that affect primarily rural areas will not  accumulate enough user minutes to be reportable. However, the number  of wireless outages with a physical incident as the root cause was  relatively steady in many states or had spikes that generally  corresponded with major natural disasters like the 2012 derecho.

For more detailed information on the location of all reported wireless  outages that occurred from 2009 through 2016, including the cause and  number of users associated with these outages, see an interactive  graphic which can be viewed at http://www.gao.gov/products/gao-18-198.

Power failures and failures in other providers’ networks (e.g., backhaul)  played a role in the majority of wireless outages attributed to physical  incidents. When an accident, natural disaster, or manmade event was the  root cause for an outage, we found that wireless carriers often also  reported a failure in one of these two key dependencies for wireless  networks:

Regarding power, 8 percent of wireless outages with a physical  incident as the root cause (465 of 6,002 outages) cited power failure  as the direct cause of the outage. Nearly all these outages were  attributed to a natural disaster.

Regarding failures in other providers’ networks, 87 percent of outages  attributed to a physical incident (5,206 of 6,002 outages) were due to  a failure in another provider’s network, which includes backhaul  connecting cell sites to mobile switching centers and onto the broader  network. Most of these outages—4,111—cited an accident (i.e., a  digging error resulting in cable damage) as the root cause. In 2014, a  working group from an FCC-chartered federal advisory committee  concluded that there is little to no shared, last-mile transport  infrastructure for backhaul that wireless carriers (or other providers)  could share dynamically to mitigate the effect of a backhaul failure.  Thus, a backhaul outage will often result in a wireless outage.  However, the working group identified existing best practices that  providers can employ to help reduce or lessen the impact of failure in  last-mile backhaul.

Federal Agencies and Industry Have Taken Some Actions to Improve Wireless Network Resiliency, but FCC’s Oversight of Industry Actions Is Limited

Federal Agencies Largely Continue to Use Existing Mechanisms to Improve Resiliency

Since 2013, FCC and DHS have both continued to take action using a  range of existing mechanisms to improve wireless network resiliency.  These mechanisms include leading communications-specific planning  activities and topic-specific research to develop and to share best  practices. While these mechanisms are not new, FCC and DHS report  updating and adapting these activities based on emerging needs and  lessons learned from exercises and emergency events. FCC and DHS  actions include the following:

Chartering advisory committees that examine resilience: DHS and  FCC charter federal advisory committees that have studied how  agencies and industry could improve resiliency. For example, one  such committee is FCC’s Communications Security, Reliability, and  Interoperability Council (CSRIC), whose members include  representatives from wireless carriers and other communications  companies, industry associations, and federal, state, and local  agencies. CSRIC working groups often develop best practices for  industry and make recommendations to wireless carriers, FCC, and  others to improve network resiliency. One example is a working group  that studied how industry could share backup power resources in  2014. FCC maintains a database of best practices and publicizes  these through presentations at conferences and in public reports, as it  did in a report on communications outages caused by the 2012  derecho. Six stakeholders we interviewed said best practices  represent a valuable means to improve resiliency, as for example,  best practices are flexible and enable providers to adapt practices as  communications networks evolve. One stakeholder attributed  CSRIC’s effectiveness in issuing and promoting best practices and  information in part to its affiliation with the industry’s regulator, FCC.

Other advisory committees that examined resiliency include DHS’s  National Security Telecommunications Advisory Committee and  FCC’s Technological Advisory Council.

Developing and implementing procedures to respond to physical  incidents: DHS leads emergency communications response and  recovery efforts, as coordinator for ESF-2. For example, within DHS,  the National Coordinating Center for Communications (NCC) holds  weekly calls with government and industry partners to exchange  information as part of NCC’s work to continuously monitor events that  may affect communications. These weekly calls sustain  relationships and promote readiness that can be leveraged to  coordinate a response to an emergency incident, according to DHS  and FCC officials and members of the Communications Sector  Coordinating Council. During an incident, NCC reports that it holds  these calls on a daily basis to understand the status of wireless and  other networks—along with FCC outage data and other information  collected from carriers—and to support industry response efforts. For  instance, NCC officials said that during an incident they can help  carriers find available generators or work with local governments to  enable carriers to enter disaster areas to make repairs if carriers are  denied access. Two carriers we interviewed said the NCC works well  to support industry response to and recovery from incidents, as NCC  has established response processes to help the communications  sector to coordinate with the power industry. According to DHS, NCC  participates in the Energy Priority Restoration Group that is dedicated  to determining power restoration priority following an incident. While  this group includes many sectors, it enables communications  providers to help prioritize power restoration for critical  communications components, like mobile switching centers.

Analyzing wireless outage data to identify trends and areas for further  study: As noted above, FCC collects and regularly analyzes data on  wireless outages during the regular course of business and during  emergency events. FCC meets with each nationwide wireless carrier  annually to discuss trends in the carrier’s outages and any issues  related to how the carrier completes NORS reports, according to FCC  officials and an industry association we interviewed. FCC also  analyzes and shares its analysis of NORS data with industry at  quarterly meetings of the Alliance for Telecommunications Industry  Solutions’ Network Reliability Steering Committee. Specifically, FCC  presents trends in NORS outage data for the last 3 years for different  types of outages. Such data include trends in the total number and  duration of wireless outages. The Network Reliability Steering  Committee, at FCC’s request or its own initiative, establishes teams to  examine NORS trends and to make recommendations that may  increase network reliability and reduce network outages. Based on  this work, the team may identify relevant best practices that carriers  could use to reduce or eliminate outages or suggest refining or  creating a new best practice. Representatives from two industry  associations said that FCC meets with industry to discuss outage data  and is receptive to feedback on how to improve data-reporting  processes and data quality.

In addition to these existing mechanisms, federal agencies have initiated  some new activities to enhance wireless network resiliency since 2013.

Community Resilience Panel: NIST issued the Community Resilience  Planning Guide for Buildings and Infrastructure Systems in October  2015 and sponsors the Community Resilience Panel, which aims to  reduce barriers to achieving community resilience by promoting  collaboration among stakeholders to strengthen the resilience of  buildings, infrastructure, and social systems upon which communities  rely. The panel held its first meeting in November 2015. The  planning guide provides a process that communities can use to  improve their resilience by setting priorities and allocating resources  to manage risks based on their prevailing hazards. The guide also  devotes sections to key infrastructures; the communications section  describes components of communications networks, the regulatory  environment, and industry standards that can help inform community  planning. The Community Resilience Panel also has a  Communication Standing Committee comprised of industry and  government members. This committee is currently creating additional  resources to support communities, including a methodology that  communities could use to involve wireless carriers and other  communications providers in resilience planning activities. While  communities have started to use the guide, NIST officials said it is too  soon to measure or point to specific outcomes attributable to the  Community Resilience Panel’s work.

Post Hurricane Sandy hearings and proposed rule: In 2013, FCC held  field hearings on network reliability and continuity. The goals of the  hearings were to improve network resiliency, improve restoration,  empower the public, and unleash technological solutions. The two  hearings included a wide range of panelists including representatives  from FCC and FEMA, state and local agencies, consumer groups,  wireless carriers, and other communications providers. Following the  hearings, FCC issued a notice of proposed rulemaking to promote  transparency to the public on how wireless carriers compare in  keeping their networks operational during emergency events.  Specifically, FCC’s proposed rule would publicly report the number  and percentage of each carrier’s cell sites that remained operational  during an emergency event to enable consumers to compare wireless  carriers when purchasing service. Based on our review of  comments, public safety and consumer groups tended to support the  proposed rule while industry expressed concerns, in particular, that  the public reporting in the proposed rule would not accurately portray  the service available during an emergency or be a useful measure to  help consumers choose among wireless carriers. FCC decided not to  issue a final rule, stating in December 2016 that a voluntary industry  approach, described below, provided a more appropriate path to  improve network resiliency.

We asked stakeholders about the results of the actions taken by FCC and  DHS, and across the 24 stakeholders we interviewed, there was no  consensus regarding needed improvements in DHS and FCC guidance,  coordination, or research on wireless resiliency. Seven stakeholders  said they did not think there were any gaps or needed improvements from  FCC, and six stakeholders said they did not think there were any gaps or  needed improvements from DHS. Although most stakeholders identified a  need for further federal agency action, they tended to identify dissimilar  actions. However, the three state and two local agencies we interviewed  noted that more real-time data on wireless outages would help aid their  efforts to respond to an incident, which we discuss further below.

Voluntary Industry Framework Aims to Improve Wireless Network Resiliency, but FCC Has Limited Plans to Monitor This Framework

In April 2016, an industry coalition consisting of CTIA, a wireless industry  association, and five wireless carriers announced the Wireless Network  Resiliency Cooperative Framework (framework) in response to FCC’s  2013 notice of proposed rulemaking on wireless network resiliency. The  framework is a voluntary initiative designed to advance wireless service  continuity and information sharing during and after emergencies by  enhancing coordination and communication, both among carriers and  between carriers and government.

The framework has five elements; some elements are specific to disaster  response while other elements focus on preparedness and education.  Industry has taken steps related to all five elements of the framework, as  described in table 1. Furthermore, CTIA representatives told us they have  ongoing meetings with representatives from the public-safety community,  the outcome of which they expected to be a series of best practices  concerning planning before disasters, addressing coordination during and  after emergencies, and developing education and awareness strategies in  fall 2017. The threshold to trigger the response elements is when DHS  activates ESF-2 and FCC activates DIRS. At the time of our review, four  events—Hurricane Matthew in October 2016 and hurricanes Harvey,  Irma, and Maria in late 2017—had met the threshold to trigger the  response elements. Prior to the three events in 2017, FCC officials and  three stakeholders we interviewed told us it was too soon to know the  effectiveness or results of the framework.

FCC is responsible for administering policies to improve resiliency, which  include monitoring actions taken by industry, and federal standards for  internal control state that management should establish and operate  monitoring activities, evaluate and document the results of ongoing  monitoring, and then identify changes that either have occurred or are  needed. Federal standards for internal control also state that agencies  should define objectives clearly and that objectives should be in specific  and measurable terms that allow for the assessment of performance.

In December 2016, FCC said it would continue to engage with industry on  the implementation and use of the framework, and FCC has taken some  steps to monitor the framework’s implementation. Specifically, FCC  developed a plan to track certain tasks related to the framework in August  2017. This plan  tracks the completion of initial tasks related to the framework, such as  tracking industry’s publication of best practices to enhance municipal  preparedness and resiliency, and confirming the five signatory  wireless carriers’ commitment to the framework, and notes that FCC will update its emergency response documents to  ensure that the documents reflect the framework and include  checklists to validate that carriers take these actions during  emergency events (e.g. instituting roaming, providing mutual  assistance).

In August 2017, FCC also issued a public notice inviting carriers beyond  the five signatory wireless carriers to sign on to the framework.

However, we found FCC’s plan does not include any steps to document  and assess the effect of the framework on the resiliency of wireless  networks. In particular, FCC’s plan does not track any outputs or  outcomes over time that speak to the results of the framework, such as  the number of roaming requests made and fulfilled during an emergency  event. FCC’s plan to monitor the framework is still new. According to  FCC officials, FCC did not decide what division would lead its monitoring  of the framework until August 2017 because it needed to determine which  division should have responsibility for the framework. Since the plan  was created, FCC has met with industry groups and individual carriers to  gather additional information and has updated its plan with this  information to track implementation tasks.

Overall, by monitoring the outputs and outcomes of the framework, FCC  could determine where further changes are needed to help ensure that  wireless networks are resilient. In 2016, FCC reported that the framework  could produce benefits such as bolstering FCC’s situational awareness  and providing consumers with a means to hold carriers accountable for  service continuity during emergency events. Yet, seven stakeholders we  interviewed, including wireless carriers, said the framework largely  codified actions that carriers already generally take to prepare for and  respond to an emergency event. In addition, comments submitted to FCC  in 2016 were split on whether the framework represented a sufficient path  forward, and some stakeholders noted specific issues that they believed  could limit the effectiveness of the framework, for example:

Four stakeholders we interviewed—an industry association, local  agency, state agency, and consumer group—cited the lack of federal  agency enforcement or monitoring.

Two industry associations stated in joint comments that there was no  assurance that all carriers would conduct adequate testing to enable  roaming under disasters.

A local agency said in comments that the threshold to trigger the  response elements was too high; as such, carriers would not be-  obligated to implement the elements for more local events.

Therefore, monitoring the outputs and outcomes of the framework would  help FCC understand the effect of industry formalizing these actions in  the framework.

Furthermore, although FCC and industry documents that describe and  endorse the voluntary framework include broad goal statements, there  are no specific measures for what the framework hopes to achieve. As a  result, FCC lacks specific and measurable terms to monitor the effect of  the framework. The CTIA- and carrier-released public summary of the  framework said it aims to advance wireless service continuity and  information sharing during and after emergencies and disasters, as well  as help consumers be better prepared for future disasters. FCC, when  endorsing the framework, said it was a reasonable approach to achieve  FCC’s stated goals for the 2013 proposed rule, including promoting  availability of wireless mobile services in the event of natural disasters  and increasing provider transparency around wireless resiliency. FCC  officials told us they have not discussed possible measures to monitor the  effect of the framework with industry participants. As the creators of the  framework, industry participants could provide insight into such  measures. However, FCC officials acknowledged that it will be important  to determine what the results of the framework have been in light of the  2017 hurricanes, and that developing measures to assess industry’s  efforts under the framework would be beneficial.

In addition, FCC has not communicated the framework to all state and  local public-safety officials and wireless carriers, potentially limiting its  effectiveness. At the time of our review, CTIA and the signatory wireless  carriers had released a high-level summary of the framework but no  additional documentation on the scope of wireless carriers’ obligations  under the framework. Based on our interviews, we found that  knowledge of the framework was not widespread. Six stakeholders we  interviewed, including representatives of state agencies we interviewed  and a non-signatory wireless carrier, were either unaware of the  framework or unaware of whether industry had taken actions on any  elements of the framework since its announcement. For example, a state  emergency manager in one state affected by Hurricane Matthew was  unaware of the framework and that FCC, based on one element of the  framework, had posted daily status updates on wireless service following  the hurricane. This manager noted that those updates would be useful for  response efforts.

Federal standards for internal control state that federal agencies should  externally communicate necessary, quality information to achieve the  agency’s objectives and that open communication can also help enable a  federal agency to obtain information from external parties. Among the stated objectives of FCC is to advise and assist public safety entities on  wireless communications issues and to develop and administer policy  goals and plans to promote reliable communications for public safety and  disaster management. Moreover, one of FCC’s current strategic  objectives is to promote access to effective public-safety communications  services used by government as well as all consumers in need. To  address this and other objectives, FCC stated that it will facilitate  discussions and share information among key constituencies. FCC uses  several mechanisms and standing forums to share information and  educate constituencies. For example, FCC gives presentations about  FCC activities at conferences on public safety communications that  include state and local officials. In addition, FCC participates in the  regular conference calls hosted by DHS’s NCC through which  government and industry exchange information and the Network  Reliability Steering Committee’s public quarterly meetings, as noted  above.

Without greater awareness of the framework, state and local public safety  officials may continue to be unaware of tools or other improvements  available through the framework that could help them prepare for or  respond to an emergency, such as the posting of daily updates on the  number of out-of-service cell sites or best practices that could aid  resilience. Also, smaller and rural (non-signatory) wireless carriers might  be unaware of commitments made by the signatory carriers, such as  committing to roaming under disasters that could benefit them and the  citizens they serve during an emergency event but may require entering  into and testing a roaming arrangement. By actively communicating  information about the framework, FCC could also increase the likelihood  of receiving information from industry or state and local public-safety  officials about any implementation issues or positive results from the  framework. In August 2017, FCC created a website that summarized the  framework and, as noted above, issued a public notice inviting additional  carriers to sign on to the framework. Only two carriers, as of October  2017, beyond the carriers involved in creating the framework publicly  informed FCC of their intent to participate in the framework. As of October  2017, FCC officials told us they did not have additional plans to promote  awareness of the framework, but noted that it would be important to  inform relevant stakeholder groups about the framework, especially those  who might remain unaware of it.

Stakeholders Cited Advantages and Disadvantages for Options Aimed at Improving Wireless Network Resiliency

We identified options that federal agencies could take to further improve  wireless network resiliency based on agency reports, federal advisory  committee recommendations, peer-reviewed literature, and other reports.  The options we identified could be implemented either alone or in  combination and are not meant to be exhaustive. We categorized them by  their aim—preparedness, response, and awareness. FCC, as the  regulator for wireless communications, would be the likely agency to  implement many of the options, although DHS or other federal agencies  could play a role in implementing some of the options. We asked  stakeholders to comment on the advantages and disadvantages,  including the feasibility—technical, legal, or other—of each option. The  tables below describe identified options by category, along with the most  frequently cited advantages and disadvantages.

FCC has previously suggested and discussed some of these options,  most recently during its notice of proposed rulemaking in 2013. FCC  noted that its proposed rule sought to comply with guidance from the  Office of Management and Budget to use disclosure requirements or  transparency measures where possible in place of prescriptive  regulations. However, as noted above, FCC declined to issue a final rule,  stating that the proposed rule was problematic in light of substantial  concerns raised about proposed metrics and disclosure requirements.

Two options identified in agency reports and literature intend to improve  resiliency by focusing on actions to be taken ahead of an emergency or  disaster, as described in table 2.

Twelve stakeholders we interviewed raised concerns about the feasibility  of the option to require a minimum level of backup power at cell sites due  to technical or legal issues. In 2007, FCC adopted a requirement for  wireless carriers to provide 8 hours of backup power at cell sites. That  requirement was vacated after the Office of Management and Budget  disapproved the rule’s information collection requirements. In contrast,  nine stakeholders we interviewed were more positive about the feasibility  of guidance. Further, FCC created the Broadband Deployment Advisory  Committee in January 2017 to provide recommendations on how to  accelerate broadband deployment. Two of the committee’s five working  groups focus on state and local regulatory barriers and model language  for state and municipal code, both of which could provide a model for  wireless network infrastructure.

As shown in table 3, agency reports and literature also included options  related to response activities during and after an emergency event.

For the first option, FCC officials and six stakeholders we interviewed  noted that wireless carriers have on occasion opened up their networks in  prior emergency situations, which indicates that the option is technically  feasible. For the second option, every state and local agency we spoke  with noted the value of having real-time information on wireless outages  during an emergency event. FCC collects DIRS data, and these data are  confidential when provided to FCC. According to FCC, if outage data  were shared with a state or local agency, it may be subject to open  records laws that provide a means for the public to gain access to  government documents.

Other options are intended to improve wireless network resiliency by  fostering transparency, as described in table 4. For some options below,  transparency would involve making information publicly available so  consumers could use this information when choosing a wireless carrier.  Such transparency could give industry an incentive to improve the  resiliency of their networks. For example, by setting performance  standards or requiring wireless carriers to disclose their efforts to improve  resiliency, consumers could compare the performance or practices of  wireless carriers. However, some of these options would require defining  specific parameters, whether a metric or the specific information to  disclose, and seven stakeholders we interviewed noted this could be  difficult given factors such as the variation in carriers’ wireless networks  and the pace of technological change. For other options below,  transparency would involve more selectively sharing information with  other public safety agencies to improve coordination and aid planning for  possible disruptions to wireless networks during emergencies.

During natural disasters and other emergencies, wireless network  outages can make emergency communications, such as making 911  calls, nearly impossible for the vast number of people who rely solely on  wireless communications. The wireless industry sought to enhance  resiliency by improving the continuity of wireless service and information  sharing during and after emergency events by introducing a voluntary  framework. Although FCC stated that this voluntary framework would  have many benefits, neither industry nor FCC has identified any specific,  measurable objectives that could be used to determine whether the  framework meets its broad goals, and FCC has limited plans to monitor  the framework’s implementation and use. Absent sufficient monitoring,  including identifying specific, objective measures for the framework, FCC  lacks information on the framework’s outcomes and overall effectiveness;  such information could help FCC identify whether it needs to take steps to  address challenges or take other action to further promote wireless  network resiliency. Furthermore, FCC does not have any plans to actively  communicate information about the framework to public safety officials  and industry representatives. A concerted effort by FCC to promote  awareness of the framework could help more public safety officials and  other industry participants use the framework to prepare for or help  mitigate the risks to wireless networks posed by natural disasters and  other emergencies.

We are making the following three recommendations to FCC:  The Chairman of FCC should work with industry, to the extent practical, to  develop specific and measurable objectives for the Wireless Network  Resiliency Cooperative Framework, such as outputs to measure the  extent of the framework’s use. (Recommendation 1)

The Chairman of FCC should develop a plan to monitor the outputs and  outcomes of the Wireless Network Resiliency Cooperative Framework  and document the results of its monitoring to evaluate its effectiveness  and identify whether changes are needed. (Recommendation 2)

The Chairman of FCC should promote awareness about the elements of  and any outcomes from the Wireless Network Resiliency Cooperative  Framework among state and local public safety officials and other  industry stakeholders, such as through existing outreach mechanisms  and government-industry forums. (Recommendation 3)

We provided a draft of this report to FCC, DHS, and the Department of  Commerce for comment. In its comments, reproduced in appendix III,  FCC agreed with the recommendations. FCC also provided technical  comments, which we incorporated as appropriate. DHS and the  Department of Commerce had no comments.

As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the appropriate  congressional committees, the Chairman of FCC, the Secretary of  Homeland Security, and the Secretary of Commerce. In addition, the  report will be available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-2834 or goldsteinm@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

This report examines federal agency and industry efforts to improve the  resiliency of mobile wireless networks in response to natural disasters  and other physical incidents since Hurricane Sandy, a natural disaster  that caused significant communications outages across several states in  late 2012. Specifically, this report examines: (1) trends in mobile wireless  outages attributed to physical incidents since 2009 as reported to the  Federal Communications Commission (FCC), (2) the actions federal  agencies and industry have taken since 2013 to improve wireless network  resiliency, and (3) options that federal agencies could take to improve  network resiliency and their advantages and disadvantages. This report  focuses on the physical risks facing wireless networks; that is, the  potential for an unwanted effect from an incident on a network’s  infrastructure like towers, antennas, and switches. Therefore, we did not  examine cyber risks facing wireless networks.

To determine the trends in wireless outages, we analyzed data from  FCC’s Network Outage Reporting System (NORS) on wireless outages  that occurred from 2009 through 2016. We chose this timeframe to cover  4 years of data before and after Hurricane Sandy. Communications  providers, including wireless carriers, are required in regulation to submit  outage reports in NORS for network service disruptions that reach certain  thresholds. Given our focus on wireless outages, we examined reports in  NORS for outages (1) that were reported by wireless companies that  identified themselves as either a wireless carrier or Voice over Internet  Protocol (VoIP) provider and (2) that were cited, as the reason the  outage was reportable, a reporting requirement applicable to a wireless  carrier or VoIP provider in 47 C.F.R. Part 4.

We analyzed NORS data for wireless outages to determine the total  number and the causes of wireless outages that occurred from 2009  through 2016. FCC provides carriers a list of 19 main categories from  which a carrier selects a root cause, direct cause, and contributing  factor(s) for an outage. We examined the root cause and direct cause for each wireless outage reported to FCC. We collapsed several of the FCC  categories to create 9 categories for ease of presentation. Table 5 shows  the crosswalk between the 19 FCC categories and our 9 collapsed  categories.

We also analyzed the data to identify the share of all wireless outages  attributed to a physical incident—that is, a natural disaster (e.g., flooding,  earthquake, wildfire); accident (e.g., backhoe cut); or manmade event  (e.g., theft, malicious act). FCC provides carriers a list of categories from  which they select a root cause, direct cause, and contributing factor(s) for  an outage. Using these FCC categories, we created three new categories  for natural disasters, accidents, and manmade events (see table 6). We  based these three new categories on the description and categorization  of physical risks in FCC and DHS reports, including the Communications  Sector-Specific Plan.

To understand the distribution of causes across all wireless outages in  our time frame, we focused primarily on the root cause for each wireless  outage. However, we also examined the root and direct cause reported  for each outage to better understand the multiple factors that may have  led to an outage and to understand wireless network dependencies (e.g.,  power, backhaul). Finally, we examined the number of outages, by month  and by year, for which a wireless carrier reported a physical event as the  root cause, direct cause, or contributing factor to better understand the  total number of outages related to a physical incident during our time  period.

We also analyzed other characteristics of wireless outages such as  location, duration, and whether the failure occurred in another company’s  network. To examine location, we focused on three NORS fields—city,  state, and description of location—to identify a city(ies) and state for each  outage, and then we determined the latitude and longitude for each  outage. We also examined NORS data in conjunction with two other data  sets. First, data on events for which FCC activated its Disaster  Information Reporting System (DIRS) or “DIRS-lite” to understand any  correlation between wireless outages and major physical incidents.  Second, data from CTIA’s annual wireless survey on the number of  wireless subscribers and other measures of wireless networks’ size to  understand any correlation between wireless outages and the size of the  wireless industry.

To assess the reliability of NORS data, we reviewed FCC’s data glossary  and other FCC documentation on the NORS data system and data  elements. We interviewed agency officials responsible for collecting and  analyzing NORS data to understand the manual and automated controls  used to review carrier-reported outage information and any potential  limitations in the data. We also reviewed relevant data elements for  missing data, outliers, and errors. We found the data were sufficiently  reliable for the purpose of describing the number and type of wireless  outages reported to FCC that were attributed to a physical incident.

To determine the actions federal agencies have taken since 2013 to  improve the resiliency of mobile wireless networks, we reviewed reports  and documents from FCC, the Department of Homeland Security (DHS),  and the National Institute of Standards and Technology (NIST) within the  Department of Commerce. Specifically, we reviewed transcripts and  papers from hearings and a workshop FCC held in 2013 on  communications reliability and continuity. We also analyzed agency  orders and comments submitted in FCC’s 2013 proceeding on wireless  resiliency. In addition, we reviewed communications sector planning  reports, such as the 2015 Communications Sector-Specific Plan and  2013 National Infrastructure Protection Plan, and other DHS  communications sector-specific documents, as well as the NIST  Community Resilience Planning Guide for Buildings and Infrastructure  Systems and related documents. We also examined reports from  federal advisory committees and partnership councils that cover wireless  network resiliency, including reports from the Technological Advisory  Council; Communications, Security, Reliability, and Interoperability  Council; National Security Telecommunications Advisory Committee; and  the Communications Sector Coordinating Council.

To ensure we covered relevant agency actions and to seek any  information on the results of these actions, we interviewed officials from  DHS’s Office of Cybersecurity and Communications within the National  Protection and Programs Directorate, including officials from the  Stakeholder Engagement and Cyber Infrastructure Resilience division— the sector-specific agency that leads federal efforts to protect and secure  the communications critical infrastructure—and National Cybersecurity  and Communications Integration Center—the center that continuously  monitors incidents that may impact communications. We also interviewed  officials from DHS’s Federal Emergency Management Agency and  Science and Technology Directorate, FCC, and NIST.

Beyond federal agency officials, we interviewed 24 stakeholders to further  understand federal agency and related industry actions to improve  wireless network resiliency since 2013 and any results from these  actions. Stakeholders included wireless carriers and other owners of  wireless network infrastructure, industry associations, consumer groups,  and state and local government officials. We selected stakeholders to  ensure we covered different perspectives (e.g., industry and consumer  groups, associations that represent state and local public safety officials).  In particular, we selected industry associations and individual companies  to cover both wireless carriers—which operate networks and own some  network infrastructure—and communications tower companies—which  own and operate towers and sites and then lease space to wireless  carriers. We selected wireless carriers to include both nationwide and  regional carriers. We selected state agencies to include states directly  affected by two events—flooding in Louisiana and Hurricane Matthew— for which industry had implemented elements of the framework at the  time we began our review. The views presented in our report are not  generalizable to those of all stakeholders. See table 7 for a list of  interviewed stakeholders.

We reviewed documents describing the Wireless Network Resiliency  Cooperative Framework (framework)—a voluntary, industry initiative  announced in April 2016. We interviewed CTIA and three of the five  wireless carriers that collectively proposed the framework to learn about  the impetus for, status of, and any outcomes or lessons learned from use  of the framework to date. We also interviewed FCC and DHS about each  agency’s awareness of and role monitoring industry use of the framework,  and we reviewed FCC plans to monitor and share information about the  framework. Finally, we asked stakeholders we interviewed, as described  above, about their knowledge of and experience with the framework,  including any observed outcomes from its use to date. We assessed  FCC’s efforts to monitor implementation of the framework against  Standards for Internal Control and FCC’s current strategic plan.

To determine what options exist for federal agencies to improve wireless  network resiliency, we examined federal agency reports, literature, and other sources. First, we reviewed filings in FCC’s 2013 proceeding  examining wireless resiliency, including FCC’s orders and comments filed  by various parties, for proposed options that federal agencies could  take. Second, we conducted a literature review of peer-reviewed  articles, government reports, industry publications, and think tank  publications from the last 5 years to identify additional options. Third, we  examined reports from the aforementioned federal advisory committees  on wireless network resiliency, the NIST Community Resilience Planning  Guide for Buildings and Infrastructure Systems, and the Hurricane Sandy  Rebuilding Task Force for recommendations made to federal agencies to  enhance wireless network resiliency. From these sources, we identified  11 proposed options that federal agencies could take to improve wireless  network resiliency. We eliminated one option—requiring wireless carriers  to disclose outage information to the public—as this was the only option  that FCC specifically proposed as a new rule in its 2013 proceeding, but  ultimately FCC decided not to move forward on this proposal when it  decided to not issue a final rule. The identified options were primarily  those that FCC could implement, as FCC is the regulatory agency for  wireless communications, although DHS or NIST could implement several  of the options.

We interviewed a variety of stakeholders, described above, to obtain their  views on the advantages, disadvantages, and feasibility of each of the  identified options. We used open-ended questions to solicit input on each  option rather than provide a list of advantages and disadvantages to  stakeholders. We also asked stakeholders if there were additional options  for federal agencies to ensure we had a thorough list of options for federal  agencies. Based on interviews with stakeholders and federal agencies,  we decided not to present two options in our report—establish more  formal, ongoing collaboration between wireless carriers and power  companies and create a program to facilitate collaborative restoration  between wireless carriers and power companies—as federal agencies  told us they were already taking actions on these fronts. Therefore, we  included federal agencies’ actions related to these two options while  describing actions taken by federal agencies since 2013. We analyzed  information collected through the interviews with stakeholders to identify  the most commonly cited advantages and disadvantages, and to  determine the number of stakeholders that supported or did not support  each option. The information collected from stakeholder interviews is not  generalizable to all industry stakeholders.

Appendix II: Analysis of FCC Data on Wireless Outages

The figures below provide results from our analysis of Federal  Communications Commission (FCC) data on wireless outages from 2009  through 2016. The data is from the Network Outage Reporting System  (NORS), the system that wireless carriers and other communications  providers use to report information on outages meeting certain threshold  as required by regulation. The figures below present information on the  number, cause, and duration of all wireless outages reported to FCC for  this period.

To describe wireless outages by cause, we use nine categories that  collapse several of the FCC categories from which wireless carriers select  the root cause, direct cause, and contributing factor(s) when reporting an  outage. The following provides a brief description of these nine  categories. Appendix I contains information on the scope and  methodology for this analysis, including these nine collapsed categories.

Cable damage/failure includes outages caused by an error locating or  digging that resulted in cable damage, by an aerial cable that was  damaged or ceased to function, and by loss of transmission in a cable  due to aging, among other causes. FCC categories: cable damage,  cable damage/malfunction.

Equipment failure contains outages caused by the failure of a  hardware component (e.g., circuit pack or card in a processor) or by a  problem with the design of firmware, hardware, or software (e.g.,  failure for firmware to reset or restore after initialization, logical errors  in software). FCC categories: design-firmware, design-hardware,  design-software, hardware failure.

Network robustness includes outages caused by, for example, a  failure to provide or maintain diversity, thus preventing single points of  failure. FCC categories: diversity failure, simplex condition.

Maintenance includes outages caused by a needed spare part not  being on hand or available, a vendor or contractor lacking updated  procedures for its work, a service provider not providing adequate or  up-to-date training, and scheduled maintenance to upgrade a network  component or fix a known problem, among other causes. FCC  categories: spare, procedural-other vendor/contractor, procedural- service provider, procedural-system vendor, planned maintenance.

External environmental contains outages caused by earthquakes,  wildfires, flooding, and other natural disasters as well as vandalism,  theft, vehicle accidents that impair or destroy a component, and  animal damage. FCC category: environment (external).

Internal environmental contains outages caused by contamination due  to dirt or dust that leads to overheating, by water entering manholes or  vaults that destroys or impairs a component, and by other damage  related to the condition of buildings and structures housing network  equipment. FCC category: environment (internal).

Other/Insufficient data includes outages for which there is not enough  information for a failure report or investigation to determine the cause  of the failure, service was restored before the cause could be  determined, and the cause cannot be determined or proven. FCC  categories: insufficient data, other/unknown.

Power failure includes outages due to a commercial power failure  (including power failures that extend beyond any backup power  capabilities), a generator running out of fuel, a power system that was  insufficiently sized for its purpose, and batteries not functioning as  designed. FCC category: power failure (commercial and/or backup).

Traffic/System overload contains outages where a network is  overloaded or congested because of an unplanned, external event, or  because of under-engineering the network due to changing demand  or technologies. FCC category: traffic/system overload.

Appendix III: Comments from the Federal Communications Commission

Appendix IV: GAO Contact and Staff Acknowledgments

In addition to the contacts named above, Sally Moino (Assistant Director);  Joanie Lofgren (Analyst in Charge); Enyinnaya David Aja; Stephen  Brown; David Hooper; Richard Hung; Joshua Ormond; Amy Rosewarne;  Andrew Stavisky; and Timothy Young made key contributions to this  report. Jon Ludwigson, John Mortin, Mark Pross, Pam Snedden, James R  Sweetman, Jr., and Joe Thompson also made contributions to this report.