National Cybersecurity and Communications Integration Center (NCCIC)

National Cybersecurity and Communications Integration Center (NCCIC)
Name	National Cybersecurity and Communications Integration Center
Formed	2009
Jurisdiction	United States
Parent agency	Department of Homeland Security

National Cybersecurity and Communications Integration Center (NCCIC) The National Cybersecurity and Communications Integration Center (NCCIC) is a United States Department of Homeland Security operational center that coordinates cybersecurity and communications protection activities among federal agencies, private sector partners, and international entities. It serves as a nexus for incident response, situational awareness, and information sharing involving stakeholders such as Federal Bureau of Investigation, National Security Agency, Cybersecurity and Infrastructure Security Agency, Office of the Director of National Intelligence, and private firms like Microsoft, Cisco Systems, and Google. The center interfaces with critical infrastructure operators including American Electric Power, ExxonMobil, and AT&T, and engages with international organizations such as NATO and the European Union.

Overview and Mission

The NCCIC's mission emphasizes detection, analysis, mitigation, and response for cybersecurity and communications incidents involving entities like Federal Reserve System, New York Stock Exchange, NASA, Fannie Mae, and Bank of America. It promotes resilience through collaboration with standards bodies including National Institute of Standards and Technology, Internet Engineering Task Force, and International Organization for Standardization, and aligns activities with statutes such as the Homeland Security Act of 2002 and initiatives from the White House and the Office of Management and Budget. The center supports election security for jurisdictions like State of Florida and Commonwealth of Pennsylvania and works with research institutions such as Massachusetts Institute of Technology and Stanford University.

History and Organizational Development

Established in 2009 in the wake of high-profile incidents involving actors tied to People's Republic of China, the NCCIC evolved from earlier DHS components including United States Computer Emergency Readiness Team and programs influenced by reports from Congressional Research Service and hearings in the United States Senate Committee on Homeland Security and Governmental Affairs. The center's development intersected with responses to operations attributed to groups like APT28, Equation Group, and events such as the 2014 Sony Pictures hack and the 2016 Democratic National Committee cyber attacks. Subsequent reorganizations reflected recommendations from panels including the Commission on Enhancing National Cybersecurity and resulted in integration with the Cybersecurity and Infrastructure Security Agency under leadership transitions involving officials from Department of Homeland Security and briefings to the United States House Committee on Homeland Security.

Structure and Components

NCCIC comprises technical, intelligence, and operational components similar to entities within United States Cyber Command and Federal Emergency Management Agency, and works alongside offices like Office of the National Cyber Director and DHS Office of Intelligence and Analysis. Its teams include analysts from FBI, liaisons from Central Intelligence Agency, and engineering staff with backgrounds from Arbor Networks and Symantec. The center hosts capabilities such as the National Coordinating Center for Communications interface, a Traffic Light Protocol-based information handling cell, and fusion capabilities linked to the National Cyber Forensics and Training Alliance. Physical facilities coordinate with sites like Fort Meade and regional fusion centers including the Mid-Atlantic Regional Cybersecurity Hub.

Roles and Responsibilities

NCCIC provides incident response services, vulnerability reporting intake, and remediation guidance to entities including Microsoft Azure, Amazon Web Services, and Verizon Communications. It facilitates threat analysis drawing on reporting from Mandiant, CrowdStrike, and intelligence from National Geospatial-Intelligence Agency. The center issues advisories similar to alerts from United States Computer Emergency Readiness Team and coordinates protective actions during events affecting systems operated by Port of Los Angeles, Los Angeles Department of Water and Power, and Con Edison. During significant outages, NCCIC liaises with agencies such as Federal Aviation Administration and Transportation Security Administration to manage cascading effects.

Partnerships and Information Sharing

Information sharing is executed via partnerships with private sector organizations like Financial Services Information Sharing and Analysis Center, Health Information Sharing and Analysis Center, and telecommunications carriers such as Sprint Corporation and Verizon Communications. International collaboration includes exchange with United Kingdom, Australia, and partners in the Five Eyes alliance, as well as coordination with multinational corporations including IBM and Apple Inc.. The center participates in standards and exercises with North American Electric Reliability Corporation, International Telecommunication Union, and academic consortia like Carnegie Mellon University's CERT Coordination Center.

Notable Incidents and Operations

NCCIC has been involved in responses to incidents such as remediation support during the WannaCry ransomware attack, coordination during the NotPetya disruption, and analysis of intrusions attributed to groups associated with Russian Federation operations. The center supported mitigation efforts after breaches at entities like Equifax and coordinated messaging during vulnerabilities such as those disclosed in the Heartbleed and Shellshock incidents. NCCIC's operational role extended to election infrastructure monitoring in the 2018 United States midterm elections and alerts during threats linked to actors from Islamic State of Iraq and the Levant and state-associated cyber units.

Criticism and Privacy Concerns

Critiques of NCCIC have focused on civil liberties issues raised by privacy advocates from organizations like the American Civil Liberties Union, legal scholars at Georgetown University Law Center, and oversight hearings in the United States Senate Judiciary Committee. Concerns include data sharing practices with corporations such as Palantir Technologies and questions about the scope of information retained under directives influenced by the USA PATRIOT Act and provisions reviewed by the Privacy and Civil Liberties Oversight Board. Calls for transparency have involved requests under the Freedom of Information Act and recommendations from watchdogs including the Government Accountability Office and Congressional Budget Office.

Category:United States Department of Homeland Security