George Mason University at Forefront of Homeland Security Efforts Developing Models of Public and Private Cooperation

8/4/2003

From: Jim Finkelstein of George Mason University, 202-686-3436

WASHINGTON, Aug. 4 -- George Mason University (GMU) is actively engaged in developing strong relationships and methods of practice for coordination among government, private sector, and academia to strengthen homeland security, the university said today.

A clear example of the efforts underway is provided by the recent attention GMU has received concerning a research project focused on the nation's Internet infrastructure. This project, the Internet Infrastructure Study, sponsored by the Critical Infrastructure Protection (CIP) Project, extends work that was begun by a doctoral student, Sean Gorman, at GMU's School of Public Policy.

Gorman began his research into the physical connections of the Internet as a master's student in October 1997. His original goal was to determine how the business and industrial sectors were connected and measure their economic impact. Gorman and GMU Public Policy Professor Laurie Schintler, Gorman's academic advisor, wanted to help create policy recommendations for mitigating the effects of an attack on infrastructure and facilities. The focus of their research was theoretical models, and Gorman just happened to choose telecommunications.

Gorman and Schintler used a combination of information publicly available on the Internet and data purchased from firms to locate the infrastructure and identify the most vulnerable areas. Using raw data and mathematical calculations, they created a detailed map of the nation's telecommunications infrastructure.

"The mapping was a way to test mathematical models," Schintler said. "Our primary interest wasn't in the data, but in the modeling -- how networks would behave under a set of circumstances, including reliability and resiliency. We could have chosen the interstate system or the air traffic control network."

Gorman said they initially looked at the data from an economic development perspective but after Sept. 11, began to look at it from a security perspective. He says he and Schintler had initial concerns over the significant interest by industry and government the research received, and how that interest might limit his ability to use the research in his dissertation, but those concerns were "rapidly resolved" through a series of meetings. The CIP Project staff coordinated opportunities for Gorman and Schintler to present the research beginning in May 2002 to government and industry officials and allay their concerns about disclosing specific, vulnerable information.

"Those early meetings allowed the research project to set up some guidelines of what would be a good idea to publish and what wouldn't, and to set up a structure of what was sensitive and what wasn't," Schintler said. "We had no problem with showing the information to government officials. We wanted to work with others to make sure that any sensitive information contained in the dissertation would not be released."

Gordon Johndroe, spokesman for the Department of Homeland Security, said in a written statement: "We're pleased that both he (Gorman) and the school have chosen not to publish the entire report because it could be used to cause us harm. But certainly it is research that should be done and it is the type of work that our own infrastructure protection unit is currently involved in."

As for Gorman, he is confident he'll be able to use enough of the non-sensitive research to complete his dissertation and graduate.

"This has given me quite a bit of insight into a side of policy that a graduate student doesn't often see," Gorman said. "Being involved as the process goes forward was a unique experience."

The initial media reports focused on concerns over the sensitivity of the information and how to handle this type of information. CIP Project Director John McCarthy says that ultimately the media attention helped bring groups together to address the security concerns and further a GMU mission to bring together academia, industry, and government in solving real-world problems. In addition, McCarthy says that he has received numerous inquiries from other universities into how best to manage these types of research activities.

"The CIP project has brought together highly qualified and knowledgeable experts with significant experience in cyber security and critical infrastructure protection from the public and private sectors," McCarthy said, "along with renowned academic scholars from interdisplinary perspectives to carefully and deliberately address this area of pressing national security."

McCarthy says the CIP Project is also cooperatively involving corporations and other private sector entities, lawmakers, and other interested parties, such as the privacy community. The result, he says, is the CIP Project is now helping to provide a means for cooperation and collaboration between government, industry and academia that is addressing a void that had been growing as various initiatives were launched, often from disparate or divergent perspectives, to develop methods for cyber security and critical infrastructure protection. McCarthy says he sees an important role for academia as a neutral third party for this type of work so public and private organizations can cooperate and share information to keep making progress, while keeping the country's critical infrastructure safe.

The CIP Project is an interdisciplinary, multi-institutional, solution-based research initiative which actively engages stakeholders to balance public and private incentives and integrates the disciplines of law, policy, and technology for enhancing the security of cyber networks and economic processes supporting the nation's critical infrastructures.

The CIP Project has sponsored more than 50 individual research initiatives, such as the Gorman and Schintler Internet Infrastructure Study, in the areas of Law and economics, public policy, and technology. In addition to direct research activities, the CIP Project has sponsored various outreach activities including a monthly newsletter and several national conferences on topics ranging from cyber crime, information sharing and anti-trust, open source software, national security, university security, government industry relationships, and developing the law and policy national research agenda. The CIP Project has specifically sponsored 14 external universities, 11 academic units within GMU, 77 research professors, and some 150 research assistants and students.