Congress' investigative arm, the General Accounting Office (GAO), has given the Federal Bureau of Investigation's National Infrastructure Protection Center (NIPC) a failing grade when it comes to issuing warnings about electronic attacks.

The NIPC was formed in 1998 to protect businesses and government from hackers and cyber-terrorists. But a report expected to be released Tuesday by the GAO found that NIPC warnings often come after attacks are well under way.

"To provide a warning capability, the NIPC established a Watch and Warning Unit that monitors the Internet and other media 24 hours a day to identify reports of computer-based attacks," the report said. "Since 1998, the unit has issued 81 warnings and related products, many of which were posted on the NIPCs Internet Web site. While some warnings were issued in time to avert damage, most of the warnings, especially those related to viruses, pertained to attacks underway."

Because the warnings did not come until attacks were underway the warnings were often too late to prevent wide-spread damage.

The GAO identified a number of reasons for the NIPC's failure to develop more than rudimentary analysis and warning capabilities.

One problem is a lack of private sector cooperation. Security experts and industry groups have been critical of the organization, and businesses have been slow to cooperate because many would prefer not to disclose information concerning security breaches to the public.

"[Ronald Dick, director of the NIPC] cited several reasons why some private-sector organizations have been reluctant to share information with the government, including the NIPC," the report said. "The reasons cited include (1) a lack of understanding or confidence in the exceptions found in the Freedom of Information Act, (2) concerns about whether Justice would pursue prosecutions at the expense of private-sector business interests, and (3) concerns about disclosing proprietary information to an entity beyond their control."

The NIPC has also had trouble cooperating with government agencies. The report found that government agencies have not routinely reported information to the NIPC, and some organizations, like the Secret Service, have even pulled out their NIPC representatives because they felt agents were not being assigned appropriate duties.

The center, which costs tax-payers $27 million a year, also suffers from chronic staffing shortages, according to the report.

The report does not call for the dissolution of the center, and even praises it for its work with the FBI in investigating cyber-crimes. However, it did make several recommendations.

First it recommended that the Assistant to the President for National Security Affairs direct federal agencies and encourage the private sector to better define the types of information that need to be shared to protect against computer-based attacks.

It also recommended the development of a strategy for identifying assets of national significance, and the resolution of discrepancies between Presidential Decision Directive 63 (which established the NIPC) requirements and guidance by the federal Chief Information Officers Council regarding computer incident reporting by federal agencies.

Finally, it recommended that the Attorney General direct the FBI Director to direct the NIPC Director to formalize relationships between the NIPC and other federal entities like the Department of Defense and the Secret Service, and develop plans for a two-way exchange of information with private sector ISACs (Information Sharing and Analysis Centers).