Flu pandemic could overwhelm Internet capacity, GAO warns

A severe flu outbreak could send millions of workers and students home to telecommute, possibly overwhelming the Internet and disrupting networks vital to the nation’s security and financial well-being, the Government Accountability Office warns.

Agencies overseeing different segments of the critical infrastructure, including the Homeland Security Department, the Federal Communications Commission and the Securities and Exchange Commission, are ill-prepared for such an event, it said.

“Internet congestion during a severe pandemic that hampers teleworkers is anticipated, but responsible government agencies have not developed plans to address such congestion and may lack clear authority to act,” GAO concluded in the recently released report.

A degradation of service could come at a time when government plans to use the Internet as a way to communicate vital information to the public.

“Given the importance of the Internet infrastructure to our nation’s communications and commerce, we suggested that Congress consider clarifying the legal framework guiding Internet recovery,” GAO said.

GAO also offered a list of recommendations for DHS to improve its ability to respond to such events, but DHS officials responded that they have neither the authority nor the ability to regulate or control many aspects of the critical networks. They warned that users could not expect unlimited Internet access in the event of a pandemic and that people should be realistic in their expectations.

“All users which rely on the Internet, including the financial services sector, should not expect that Internet congestion problems will be easily solved, and should develop pandemic continuity of operations plans that do not rely on unimpeded Internet access,” DHS liaison officer Jerald Levine wrote in a response to GAO.

The issue of the availability of Internet and other communications during an emergency is one the government has wrestled with since the terrorist attacks of 2001. Natural disasters such as Hurricane Katrina in 2005 have emphasized the problem. But an influenza pandemic offers some unique challenges because it would come in waves over an extended time that could last up to years and could affect communities around the world.

President Barack Obama has declared the current outbreak of the H1N1 flu a national emergency. The World Health Organization and the Centers for Disease Control and Prevention have estimated that up to 2 million Americans could die from the disease. A key strategy in dealing with the pandemic is to create social distance between persons during an outbreak by shutting down schools, limiting public events and encouraging telecommuting.

But the resulting use of Internet services for learning, working, communication and entertainment could create serious problems. Critical industry plans for pandemic response and continuity of operations can fail at the ISP level.

“While a pandemic will not directly damage physical infrastructure such as power lines or computer systems, it could threaten critical systems by potentially removing the essential personnel needed to operate them from the workplace for weeks or months,” GAO said.

At the same demand, demand on local service providers would increase.

“A 2007 DHS study that was conducted in cooperation with various government, communication sector, and financial sector entities used modeling of residential and other network configurations to confirm that the increased traffic generated in neighborhoods during a severe pandemic is likely to exceed the capacity of the providers’ aggregation devices in metropolitan residential neighborhoods,” the GAO report said.

The study found that as absentee levels reached 40 percent in the workplace, most residential users would experience network congestion.

The problem does not lie so much in the capacity of the Internet backbone networks, but in the ability of regional networks and local access providers to deliver traffic to the backbone. According to the DHS study and Internet providers, additional pandemic-related traffic is likely to exceed the capacity of Internet service providers’ network infrastructure in metropolitan residential networks.

This is because the access networks -- be they Digital Subscriber Lines, cable, satellite or others -- are not designed to carry all the potential traffic that users could generate. Providers do not build networks to handle 100 percent of the total traffic that could be generated because not all users are online at the same time, nor are they sending maximum traffic at all times.

Network operators typically try to run their networks at 40 percent to 80 percent of capacity during peak demand, and begin to expand capacity when those levels rise to 70 or 80 percent. But building out additional capacity during an emergency is not feasible. Limiting or controlling traffic over existing networks presents legal and technical challenges.

Providers cannot identify users at the individual level to prioritize or manage traffic based on whether the user is serving a critical function. But service providers could attempt to reduce congestion by reducing the amount of traffic each user could send or receive. This would require adjusting the configuration file in each customer’s modem to temporarily reduce the maximum transmission speed, for example, from 7 megabits/sec to 1 megabits/sec. However, this could violate agreed-upon levels of service the customers are paying for and would require a government directive.

Shutting down sites that generate large volumes of traffic, such as video streaming sites, also would require government approval.

So far, neither Congress nor oversight agencies have fully addressed threats posed by a prolonged pandemic, GAO said. “Although serving as the coordinating agency for Internet recovery and pandemic response, DHS staff told us that their agency does not have a strategy to address Internet congestion.”

To ensure availability of critical infrastructure and services, GAO recommended that DHS:

• Develop a strategy outlining actions that could be taken to address potential Internet congestion.
• Coordinate with other relevant federal and private-sector entities about actions that could potentially reduce Internet congestion.
• Work with other federal partners to determine if sufficient authority exists for one or more relevant agencies to take any contemplated actions to address Internet congestion.
• Assess the effectiveness and feasibility, and undertake if warranted, a public education campaign to reduce such congestion.

But DHS, in its response to the recommendations, warned that “an expectation of unlimited Internet access during a pandemic is not realistic, any more so than an expectation that traffic congestion on hurricane evacuation routes can be completely avoided.” DHS will do its best, Levine said. “But users should base their own plans and activities on realistic expectations rather than assuming that anticipated congestion problems can be readily addressed.”