Lawyer Article

This article was published in the August 8th edition of Southeast Tech Wire.

The federal government is taking the lead in the United States in conversion from IPv4 to IPv6. The government has determined that internal government infrastructures will migrate first. Typically, government contractors will follow either as a matter of necessity or convenience. Finally, the commercial sector will change as hardware and applications increasingly require the IPv6 capability. So how is the federal government progressing?

Department of Defense
On June 9, 2003, the Assistant Secretary of Defense for Networks & Information Integration and Chief Information Officer John P. Stenbit issued a Memorandum regarding IPv6. He said:  "The achievement of net-centric operations and warfare, envisioned as the Global Information Grid ("GIG") of internetworked sensors, platforms, and other Information Technology/National Security System capabilities depends on effective implementation of IPv6 in concert with other aspects of the GIG Architecture."

In the Memo, Dr. Stenbit established the DOD goal to complete the transition to IPv6 for all inter and intra-networking across the DOD by FY 2008. As of October 1, 2003 all GIG assets being developed, procured, or acquired are to be IPv6 capable in addition to maintaining interoperability with IPv4 systems and capabilities. Segments of the GIG will complete transition between FY05 and FY07. The DoD CIO was to lead the development of a draft IPv6 transition plan within one month.

Until the transition is complete, IPv6 will be restricted to early adopter environments and will not be allowed on operational DOD networks. The DOD IPv6 Transition Office is developing guidelines to help networks get approval to operate. The Transition Office plans to offer help to networks in achieving authorization by readying a testbed network that DOD agencies will be welcome to connect with. The Transition Office also plans to establish an IPv6 training center for DOD and other government personnel.

Other Agencies' Initial Response
In May 2005, the Government Accountability Office reported that with the exception of the DOD, the majority of the 24 major federal agencies had not yet initiated key planning efforts for IPv6:

• 19 agencies reported not having inventoried their IPv6-capable equipment
• 22 agencies reported not having estimated costs for the transition

OMB Directive to All Federal Agencies
On August 2, 2005, Karen S. Evans, Office of Management and Budget Administrator for the Office of E-Government and Information Technology issued a Memorandum stating that June 2008 is the date by which all agencies' infrastructure must be using IPv6 and agency networks must interface with this infrastructure. Agencies were to heed advice regarding benefits, complexity, costs, and risks of the transition from Government Accountability Office and Department of Commerce National Telecommunications and Information Administration reports. In addition, the Department of Homeland Security's United States Computer Emergency Readiness Team ("US-CERT") issued an advisory regarding security issues with IPv6. The schedule set for all agencies by OMB is:

• November 15, 2005 - assign an official to lead and coordinate agency planning; complete an inventory of existing routers, switches and hardware firewalls; begin an inventory of other existing IP compliant devices and technologies; and begin an impact analysis to determine fiscal and operational impacts and risks of migrating to IPv6
• February 2006 - provide a completed IPv6 transition plan and provide a progress report on the inventory and impact analysis as part of the agency's Enterprise Architecture submission to OMB
• June 30, 2006 - Complete inventory of existing IP compliant devices and technologies; complete impact analysis of fiscal and operational impacts and risks
• June 30, 2008 - All agency infrastructures (network backbones) must be using IPv6 and agency networks must interface with this infrastructure. Agencies will include progress reports on meeting this target as part of their Enterprise Architecture submissions to OMB

Government Accountability Office's Latest Status Report
On June 30, 2006, the Government Accountability Office ("GAO") released a report concluding that federal agencies have taken steps in planning for the transition to IPv6, but several have not completed key activities. For example, almost all of the 24 major agencies have assigned an official to lead and coordinate the IPv6 transition. Ten agencies, however, had not developed IPv6-related policies and enforcement mechanisms. The GAO said that few applications that take advantage of IPv6 features are being planned or implemented, in large part because organizations are still in the early stages of the transition or because they lack incentives to use the new protocol.

Almost all of the 24 major agencies have assigned an official to lead and coordinate the IPv6 transition, have conducted an inventory of all routers and switches and hardware firewalls, and have begun a financial and operational impact analysis. As of February 2006, however, only 9 of the 23 agencies that had begun an impact analysis had developed preliminary costs for the transition. These costs ranged from $960,000 to $20 million.

As of April 2006, at least one-third of the 24 major agencies had not completed 7 of the 8 activities that OMB required to be completed by February:

• 9 agencies did not conduct a requirements analysis to identify the current scope of IPv6 within their agencies, current challenges using IPv4, and target requirements
• 10 agencies did not develop IPv6 policies and enforcement mechanisms
• 14 agencies did not begin IPv6-related maintenance and monitoring of their networks

As of April 2006, all 24 agencies had begun their inventories and all but one has begun to conduct an impact analysis.

OMB responded to the GAO Report by pointing out that IPv6 Working Group subcommittees were established in May 2006 to begin addressing challenges including security, testing, and standards, and that agencies were working with these subcommittees to find solutions to the challenges.

Conclusion
Without a deadline with true consequences, such as the Y2K deadline, the federal government has little incentive to remain on schedule. In addition, most federal agencies have not yet determined the additional costs required for conversion, meaning that these costs are not included in their annual budget requests. Since the FY07 budget is now being decided, it will be nearly impossible for the federal government to meet the FY08 IPv6 conversion deadline. Progress is being made, however, so there is hope that the conversion may be complete by FY09 or FY10.