Letter to the Honorable Gene L. Dodaro, Comptroller General of the United States - Proceedings on Repealing FCC Net Neutrality Protections

Letter

Dear Mr. Dodaro:

On May 8, 2017, the Federal Communications Commission (FCC) announced that it was the victim of "multiple distributed denial-of-service (DDos) attacks." According to FCC staff, these attacks targeted the FCC's Electronic Comment Filing System (ECFS), the portal through which the public submits comments on ongoing proceedings. More specifically, it appeared that these attacks were designed to disrupt the ECFS system during a time period corresponding to the public comment period for the FCC's Restoring Internet Freedom Notice of Proposed Rulemaking, an ongoing proceeding to undo current net neutrality protections.

As you are likely aware, this proceeding has garnered intense public interest. It appears that these attacks were meant to inhibit or limit public comment on this important proceeding, raising doubts about the efficacy of the FCC's public comment process. Separately, the ECFS system has been flooded with fake comments related to the net neutrality proceeding, which undermines this critical component of the FCC's rule-making process. The FCC's lack of action in preventing or mitigating this issue is also cause for concern. In fact, taken together, these situations raise serious questions about how the public makes its thoughts known to the FCC and how the FCC develops the record it uses to justify decisions reached by the agency.

While the FCC and the FBI have responded to Congressional inquiries into these DDos attacks, they have not released any records or documentation that would allow for confirmation that an attack occurred, that it was effectively dealt with, and that the FCC has begun to institute measures to thwart future attacks and ensure the security of its systems. As a result, questions remain about the attack itself and more generally about the state of cybersecurity at the FCC -- questions that warrant an independent review.

In light of these concerns, we request that the GAO examine the following questions:

How did the FCC determine that a cyberattack took place on May 8th? What evidence did the security team provide to FCC CIO David Bray before his statement to the press on May 9th? What additional evidence did the FCC gather to further support its conclusions after that statement? What documentation did the FCC develop during its investigation of this reported attacked, and has it done any after-action reports or other evaluations that would help the FCC respond to future attacks of this nature?

What processes and procedures does the FCC have in place to prevent or mitigate a cyberattack on the ECFS system like the one that reportedly occurred on May 8th? Are these processes in line with best practices/recommendations from the Department of Homeland Security and the National Institute of Standards and Technology? Were these processes followed during and after the May 8th attack?

The reported May 8th attack raises questions about the general vulnerability of the ECFS. Is the ECFS designed in a manner that implements cybersecurity best practices? What are the risks associated with this attack vector? Can other FCC systems be accessed through ECFS vulnerabilities?

The attack also raises questions about the security of other FCC's systems. Are the FCC's other public-facing data systems, like the spectrum auction systems, also at risk? Has the FCC evaluated the security of its other public-facing computer systems in light of the reported May 8th attack? Has it taken steps to mitigate any vulnerabilities in those systems?

Sincerely

Source