GAO: Homeland Security Issues for Congressional Oversight

The GAO issued a report for the upcoming 110th Congress on issues that the GAO thinks will require Congressional attention. Not surprisingly, many issues deal with homeland security. They include:

Ensure the Effective Integration and Transformation of the Department of Homeland Security:

After its creation in 2003, the Department of Homeland Security (DHS) had to transform 22 agencies—several with major management challenges—into one department. ... The areas GAO identified as at risk include planning and priority setting; accountability and oversight; and a broad array of management, programmatic, and partnering challenges.

Enhance Information Sharing, Accelerate Transformation, and Improve Oversight Related to the Nation’s Intelligence Agencies:

Since September 11, 2001, the nation has made some progress in fixing a major vulnerability—intelligence and law enforcement agencies’ failure to “connect the dots” and share information on the terrorists. ... But progress has been slow in some key areas, including implementing the policies needed to govern information sharing. ... Without continued congressional oversight of these issues, the progress and results of the many requirements and initiatives will remain unclear.

Enhance Border Security and Enforcement of Existing Immigration Laws:

[S]uccessful implementation of these steps has often been hampered by inadequate planning and guidance, misaligned priorities and resources, and outdated information technology systems. Additional congressional oversight can help ensure that travel document, border security, and immigration enforcement initiatives are yielding improved national and economic security for our nation’s citizens.

Strengthen Efforts to Prevent the Proliferation of Nuclear, Chemical, and Biological Weapons and Their Delivery Systems (Missiles):

Additional congressional oversight can help assess the effectiveness of these activities and how U.S. resources might be better planned and managed to achieve nonproliferation goals.

Ensure the Effectiveness and Coordination of U.S. International Counterterrorism Efforts:

[T]he Congress has an important role to play in overseeing the implementation of these [9/11 Commission] recommendations and in assessing the effectiveness and coordination of U.S. diplomatic, military, intelligence, and law enforcement efforts to combat terrorism abroad.

Ensure a Strategic and Integrated Approach to Prepare for, Respond to, Recover, and Rebuild from Catastrophic Events. (Notably, the GAO emphasizes risk management as a guiding principle for dealing with catastrophic events):

Recent events—notably Hurricane Katrina and the threat of an influenza pandemic—have illustrated the importance of ensuring a strategic and integrated approach to catastrophic disaster management. ... Managing risk is also a key component of GAO’s model for managing risk provides a tool to assist the Congress, Department of Homeland Security, and other key players in preparing for and responding to such events.

Key Topics Needing Congressional Oversight

• Ensure that leadership, roles, responsibilities, and authorities are clear, well communicated, and understood and the capacity of the nation to prepare for, respond to, and recover/rebuild from catastrophic events is effectively assessed and exercised.
• Determine the extent to which relevant federal and state organizations consider risk-based factors when making management and resource decisions relating to catastrophic events.
• Identify and track the types and amount of federal assistance provided for addressing catastrophic events and develop metrics to inform congressional oversight.
• Examine the availability of private insurance for catastrophes and identify ways that the National Flood Insurance Program can improve the sufficiency of its financial resources and funding mechanism, mitigate repetitive losses, increase compliance with mandatory purchase requirements, and expedite the Federal Emergency Management Agency’s flood map modernization efforts.

A lot of these issues seriously affect state and local homeland security. It will be interesting to see how new leadership in Congress tackles these issues, and what differences emerge from the approaches taken since 9/11.

Collaboration in Mass. Emergency Response

The Boston Globe reported that the response to the Nov. 22 chemical plant explosion and fire in Danvers, Massachusetts was marked by good cooperation among responding agencies:

The blast turned into a major test of emergency response in the post-Sept. 11 era and, by all accounts, the response was swift, comprehensive, and coordinated.

Jay Bourgeois , a Newton fire lieutenant who served in New York after Sept. 11 and the Gulf Coast after Hurricane Katrina [said] there was one big difference between the emergency response to the Danvers explosion and those other calamities: a spirit of cooperation.

"The response out here, it's impressive, and everybody really played well in the sandbox," said Bourgeois, a member of the Massachusetts Task Force One Urban Search and Rescue unit, a squadron commissioned by the federal government to respond to emergencies. "There used to be a turf battle with different agencies. Now, everybody's singing to the same sheet of music."

State Fire Marshal Stephen D. Coan ... dispatched two hulking response vehicles from his headquarters in Stow, including a 44-foot red-and-white van that served as the locus of activity for emergency workers at the scene.

It took in pictures transmitted by police helicopters and acted like a high-tech translator, allowing agencies operating on different communications frequencies to speak with each other.

"There's no question," Coan said, "we're all better organized because of the lessons that came from 9/11."

Good news all around.

Information Sharing Environment - Implementation Plan

The Office of the Director of National Intelligence (ODNI) recently released its plan to implement the nation's Information Sharing Environment (ISE). From the beginning, it's clear that this is a preliminary plan and not a detailed blueprint of the ISE:

[T]he Program Manager for the Information Sharing Environment (PM-ISE) submits this Implementation Plan as the preparation for making a fully functional and useful Information Sharing Environment a reality for the struggle against terrorism.

As a result, much of the doc is still in future tense – the ISE will be this, the ISE will be that. There is some discussion of steps taken so far, but this is a relatively minor percentage of the text.

The document outlines the vision for the ISE. In doing so, it certainly says the right things about information sharing. The question is whether the actual information-sharing environment will develop as planned, or if it drowns in bureaucratic squabbles and turf battles.

We envision a future ISE that represents a trusted partnership among all levels of government in the United States, the private sector, and our foreign partners, to detect, prevent, disrupt, preempt, and mitigate the effects of terrorism against the territory, people, and interests of the United States of America.

The ISE will enable the rapid exchange of terrorism information whether collected, produced, or distributed by intelligence, law enforcement, defense, homeland security, foreign affairs, or other communities, including the private sector and foreign partners. It will provide access to and accommodate all types of data, including structured and unstructured data and finished intelligence products, at all levels of security. Whenever possible, the ISE will include data provided from multiple sources to build a composite picture of the terrorist threat.

Because the ISE crosses three security domains, it must support access to and handling of both classified and unclassified information. Wherever possible, classified terrorism information should be made available in unclassified versions to assure the widest distribution while still protecting sensitive sources and methods.

The doc recognizes the increasingly important role that fusion centers are playing in state, local, and tribal (SLT) homeland security:

Since 9/11, over 40 states and major urban areas have established statewide and regional fusion centers to deal with terrorist threats. Moreover, a growing number of localities, particularly in major urban areas, are establishing similar fusion centers to coordinate the gathering, analysis, and dissemination of law enforcement, public safety, and terrorism information. These fusion centers—and other SLT and regional initiatives—represent enormous financial, human, and technical resources at the State and local levels to combat the threat of terrorism.

Fusion centers are recognized as forums for sharing information on "all-crimes and all-hazards" – not just terrorism:

Further, this operating environment recognizes the “all-crimes and all-hazards” nature of State and local sharing, where SLT organizations may share and fuse together multiple types of information to address a variety of needs including law enforcement, preparedness, and response and recovery.

The new ISE will attempt to improve the relationship between the federal government and state and local fusion centers by standardizing the way that federal agencies relate to fusion centers:

[N]o national strategy or protocols [currently] define how Federal departments or agencies will collaborate with these centers. Accordingly, each center has developed its own way of interfacing with the various Federal departments and agencies involved in terrorism prevention and response. At the same time, those same Federal departments and agencies have established protocols with different fusion centers in a manner that varies across the States.

For state, local, and tribal (SLT) homeland security professionals, the salient point in the implementation plan is that the fusion centers are envisioned as the primary avenue through which information will be shared. This was also emphasized in recent comments by DHS officials.

Designated fusion centers will serve as the primary points of contact within states or regions for further disseminating terrorism information consistent with DOJ/DHS Fusion Center Guidelines and applicable State, local, and tribal (SLT) laws and regulations.

Fusion centers will become the focus—but not exclusive focal points—within SLT governments for receiving and sharing terrorism information.

There will be a "hub" fusion center per state or region:

DOJ and DHS will work with Governors or other senior State and local leaders to designate a single fusion center to serve as the statewide or regional hub to interface with the Federal government and through which to coordinate the gathering, processing, analysis, and dissemination of terrorism information.

Local officials will receive most of their information through the fusion centers. Local officials will also use the fusion centers to relay information to the federal government:

Consistent with their respective roles and responsibilities, Federal departments and agencies will provide terrorism information to SLT authorities primarily through these fusion centers. Fusion centers will collaborate with such organizations as the Joint Terrorism Task Forces (JTTFs), Field Intelligence Groups (FIGs), and Information Sharing and Analysis Centers (ISACs).

It is envisioned that locally generated information that is not threat or incident related will be gathered, processed, analyzed, and interpreted by those same fusion centers—in coordination with locally based Federal officials—and disseminated to the national level via the FBI, DHS, DoD, or other appropriate Federal agencies.

Importantly, the ISE plan suggests that it will continue to encourage information sharing among fusion centers. That's far preferable to setting up a system where information has to travel up the chain before it can come back down again:

Collectively, [fusion centers'] collaboration with the Federal government, with one another (State-to-State, State-to-locality), and with the private sector represents a tremendous increase in both the nation’s overall analytic capacity and the multi-directional flow of information.

The [planned ISE] framework also preserves and maintains the roles and responsibilities of participating Federal departments and agencies, and mandates a coordinated and collaborative approach to sharing terrorism information with SLT officials and the private sector.

One danger seems to be that fusion centers could become a bottleneck, or (perhaps worse) a series of information stovepipes in their own right. But at this point they seem like the best option for sharing information between federal and state/local authorities. A good system is better than ad hoc sharing, but even ad hoc sharing is better than nothing.

Update (2006-11-28): A recently issued GAO report on issues for the 110th Congress says that Congressional oversight will be important to ensure that the ISE remains on track:

Key Topics Needing Congressional Oversight:

• Assess the progress in transforming the intelligence community across the wide range of current initiatives.
• Review how well the National Counter Terrorism Center and the Counter Proliferation Center have improved the quality of intelligence and how it is shared within the intelligence community and beyond.
• Evaluate how well the Program Manager for the Information Sharing Environment responsible for implementing the policy and technological road map for sharing has achieved this objective.

Training Exercises Fall Short?

Government Executive published a long article that examines the means by which governments at all levels train themselves for disasters. The article finds the training lacking:

"Exercises are not all created equal," says Michael Wermuth, director of homeland security programs at the nonprofit RAND Corp. "There are a lot of different kinds of exercises, a lot of different methodologies used to conduct exercises. There are exercises that sometimes seem to be destined to ensure success or at least a successful outcome in the exercise."

All but the first TOPOFF have occurred with advance warning. Emergency responders learn more valuable information for free from real-life false alarms - for example, a nerve gas scare in the Senate in February 2006 or a student pilot flying within three miles of the White House in May 2005 - critics say.

Problems also can be excluded or hidden if participants are less than honest. ... That was a problem during [the] Hurricane Pam [simulation, prior to Hurricane Katrina]. FEMA turned out to be unable to deliver on many of the promises it made during the simulation. "It happened a lot - the conversation would stop over something like generators or ice, and a FEMA guy would say, 'Look, don't worry about that, we've got contracts in place, you'll get your million gallons of water a day or whatever,' " recounted one Pam participant in Disaster: Hurricane Katrina and the Failure of Homeland Security by Christopher Cooper and Robert Block (Times Books, 2006).

"All these exercises don't mean anything unless there is some type of after-action report, [but] some people in some agencies see the exercise as the end in itself rather than a means to an end," says Carl Osaki, a clinical associate professor of environmental and occupational health at the University of Washington, who has designed several simulations. "A lot of times the findings of the after-action reports require additional training or policy. Sometimes [producing the reports is] time-consuming, or they're costly. So once they hit some of those barriers, the after-action report is sometimes seen as an academic exercise." That appears to have been a large problem with Hurricane Pam. Though many envisioned the tabletop simulation as the beginning of a conversation, according to Cooper and Block, FEMA canceled much of the follow-up work - including answering questions about moving emergency evacuees from short-term housing at the Superdome - for lack of funds.

Despite the notorious response failures during Hurricane Katrina, Hurricane Pam had some success. According to Cooper and Block, contraflow schemes - reversing one side of a divided highway so all lanes lead out of the city - historically had worked poorly in Louisiana, but evacuations improved markedly after Pam.

And others say that in addition to raising general awareness of potential threats, these exercises are successful because enduring a simulated crisis is a more effective way of learning than reading a lengthy evaluation or report. The most important benefit, they say, is the opportunity for first responders and public health workers to meet and get to know those with whom they would be working during a crisis. "Ninety percent of what you learn in an exercise you learn before the day of the exercise," says Fosher. "Sitting down with sister agencies and going through each other's plans, expectations and assumptions: 'I thought you were bringing the N95 [gas] masks.' 'No, it says you bring the N95 masks.' "

Two thoughts on this: First, the lack of follow-up after a simulation is an all-too-real occurrence, in all fields of endeavor. This is what happens when you use a training exercise as an opportunity to check off an item on a "to-do" list rather than as an opportunity to really improve what you're doing. Second, it makes sense to me that a significant benefit of these exercises is the simple opportunity for responders to get to know one another and work with one another. Creating collaborative relationships is not something you can do easily. An expensive and time-consuming training exercise may sometimes be necessary.

OSHA Disaster Preparation CD

OSHA and the Gulf Coast Chapter of the American Society of Safety Engineers (ASSE) are offering a Disaster Preparation Resources CD that features a compilation of resources from OSHA, ASSE, the Centers for Disease Control and Prevention, and the Federal Emergency Management Agency on ensuring safe and healthful response and recovery operations. OSHA says the CD will help employers review, develop and update their emergency preparedness plans.

Pandemic Flu Updates

Two recent reports focus on the risk of pandemic flu, as well as the steps being taken to prevent and/or mitigate it.

The first, a report from the Financial Services Roundtable, addresses the risk and current vulnerabilities. It also makes a number of recommendations for the federal government to prepare for a pandemic. (Its recommendations are focused on the national level because of the national and international scope of a pandemic.) A lot of the information about the threat is widely known. Below are some salient points from this particular report.

First, the report discusses the nation's state of readiness and finds it lacking.

No one is ready if the pandemic occurs within the next several years.

[T]he U.S. federal government plans to be able inoculate all Americans within six months of an outbreak -- by 2011. In other words, not only will it take six months after the outbreak of a pandemic to produce sufficient vaccine, this isn’t scheduled to be possible for another five years. This is not a workable plan – a pandemic could occur at any time.

In particular, there is broad consensus that most local health care systems – hospitals in particular – do not have the excess capacity of beds, equipment, and trained personnel to handle a large influx of patients seeking medical care in a moderate to severe pandemic.

[W]hen asked as recently as this summer if their city was prepared to meet a crisis on its own without federal assistance, only 30 percent of 183 Mayors’ offices responded affirmatively.

The report also discusses some of the potential effects of a pandemic.

Unlike the seasonal flu, the avian flu has struck most heavily amongst prime-age individuals, or those between the ages of 20 and 40 ...

The mortality rate during the 1918 pandemic, which killed at least 500,000 in the United States and perhaps as many as 50-100 million worldwide, was 2 percent of those infected. The mortality rate for the small number of identified avian flu cases has been something on the order of 50 percent. There seems to be some consensus, however, that a variation of H5N1 or a similar virus that is easily transmissible among humans would not be nearly as lethal.

A significant fraction – perhaps as many as 40 percent of the working population – will stay at home for extended periods of time in the event of a future pandemic ...

Although some business would be transferred to the Internet, the magnitude of this offsetting impact could be muted by the impact of the pandemic on the Internet itself ... [T]he surge in Internet traffic that might result from an increase in telecommuting would slow upload and download times, perhaps to the point at which the network could not function effectively. This would dampen use of the Internet for commercial purposes.

The Congressional Budget Office has estimated that a pandemic similar in severity and scope to the 1918-19 pandemic would reduce Gross Domestic Product (GDP) by about 4.25 percent during the year of the pandemic.

A second report, this one released by the U.S. Department of Health and Human Services, has a generally more optimistic tone. This is, after all, a report from a government department that is summarizing its own activities. It's not surprising that it accentuates the positive:

Vaccines have been developed for the two known variants of H5N1 and we have already stockpiled enough vaccine to treat more than some 3 million people.

Although these vaccines are not "perfect match" vaccines that would best protect against a mutated future form of the virus that's easily transmissable among humans.

The goal is to have 26 million courses of antivirals on hand by the end of 2006 and a total of 50 million courses in the SNS by the end of 2008. The Federal stockpile, in addition to State purchases of 31 million courses of antivirals, will ensure that we have enough antivirals for 25 percent of the population. We are on target to meet those goals. Sixteen million courses of antivirals have already been warehoused, and we will have 36 million courses on hand by March 2007.

The antiviral medications, Tamiflu and Relenza, are effective at treating flu symptoms. It is unknown how effective they would be against a particularly virulent form of bird flu. Indications are that they would be helpful.

[E]very state, every county, every community will be affected, and they could be affected over a short period of time. There would be little opportunity to shift resources from one part of the country to another, highlighting the priority of preparedness at all levels and by all sectors of society.

This last line, I think, is the key for preparedness professionals everywhere. The Financial Services Roundtable even recommends "live tests" of vital systems that would likely be affected by the flu (and more directly by the enormous absences from work that the flu would necessitate). These include vital networks such as healthcare, electricity, water, telecommunications, financial networks, etc.

IDF Finds Liquid-Explosive Suicide Belts

The Jerusalem Post reports that the Israel Defense Forces have uncovered a West Bank terror cell that had created suicide belts that used liquid explosives, which are undetectable by metal detectors.

Virginia Develops Common Language Protocol

Virginia is going beyond NIMS requirements that mandate the use of common language during mutual aid incidents. The commonwealth has developed a protocol for using common language, as opposed to 10-codes, in everyday use. Government Technology reports:

The State Interoperability Executive Committee (SIEC) and Commonwealth Interoperability Coordinator's Office (CICO) determined a common language protocol that allows the use of plain English for most transmissions.

While the National Incident Management System (NIMS) requires common language for mutual aid situations, the state went a step further by encouraging common language usage on a day-to-day basis for all responders.

"If responders do not use common language on a daily basis they will revert back to the codes they have always used in a crisis situation," said Charlottesville Fire Chief and SIEC Chairman Charles Werner.

The SIEC and the CICO will continue to obtain endorsements from Virginia's public safety community and work with training academies across the state to begin training on the protocol.

Recruiting Terrorists in the UK

The threat of jihadist terrorism in the UK is growing, as London's Telegraph reports:

[MI5 head] Dame Eliza Manningham-Buller said Islamic militants linked to al-Qa'eda were recruiting teenagers to carry out suicide attacks ...

The nature and gravity of the threat was deepening, fuelled by the rapid radicalisation of young British Muslims – some still at school, yet prepared to join the ranks of the suicide bombers.

''These plots often have links back to al-Qa'eda in Pakistan and through those links al-Qa'eda gives guidance and training to its largely British footsoldiers here on an extensive and growing scale."

It's not a surprise that radicals would target young, impressionable people. Terrorist recruiters generally seek those who are looking to give their lives meaning. Young people are vulnerable to this type of call, as are the recently converted.

In response, the British are appealing to the nation's peaceful Muslims to help intercept these threats. Foreign Secretary Margaret Beckett said:

"The Muslim communities in this country did not ask the terrorists to act in their name," she said. "The vast majority are sickened by the slur on their great and noble faith. They make a huge and vital contribution to the life of this country. And they, the Muslim communities, have a special ability to make a difference in the struggle against extremism ... We should let the extremists bark in the night while we, the vast moderate majority, find a common way to defeat them and the terrorism they espouse."

On the local level, developing trusting relationships with the local Muslim population makes sense. They are in a good position to point out jihadist threats, as they have done in a number of cases before, both in the U.S. and the U.K. Such relationships have to be crafted carefully, as some individuals and groups may represent themselves as moderate when they are not.

Phoenix Creates "Local Homeland Security Czar"

Phoenix is doing something interesting: transferring its police chief into a higher-level post that would oversee all of the city's vital homeland security functions. Sort of a "chief of local homeland security":

Phoenix is ratcheting up homeland security efforts by transforming the traditional police chief post into a higher-profile job that consolidates security oversight of aviation, transit, water and emergency operations.

And officials want retiring Phoenix Police Chief Jack Harris to fill the newly created position.

Harris essentially would take on responsibility for all aspects of homeland security, not just the Police Department, and he would be tasked with snagging more federal homeland security grants for the city ... Under the new structure, which is unique among Arizona's law enforcement agencies, a traditional police chief would not be hired.

Phoenix's intent seems to be to adopt a centralized model of collaboration. Presumably, all of the agencies will work together better, since they will be under the same boss. The danger is if Harris becomes the single point through which all information flows. That's an inefficient model of information-sharing.

Ham and Syringes

The recent discovery of syringe casings around the production line at a meat packing plant in Canada is a reminder of the threat of food and agricultural terrorism.

The Canadian Food Inspection Agency and Maple Leaf Foods have recalled some ham and sliced meat products after police were called in to investigate a small number of syringe casings found at an Ontario plant ... Police said it was the third such discovery reported by employees in the past two weeks.

So far, there have been no reported illnesses associated with eating the products, and no tampered meat has been found on shelves.

This type of terrorism involves a vast array of potential access points. The food industry is inherently vulnerable.

For the local homeland security professional, preparedness and collaboration are vitally important. In the event of a widespread threat, public health officials and law enforcement would have to work closely. Communications planning is also vital. The public will have to be kept informed of the exact nature and extent of the threat.

One final thought: The selection of ham as the target (if this was in fact an act of tampering/terrorism) raises eyebrows. Could certain food products be more attractive to certain types of terrorists? For example, I could see jihadists being attracted to ham as a target, because Islam forbids the consumption of pork. Or radical animal-rights groups might be attracted to meat products of all kinds.

Dems Likely to Increase Domestic HLS Spending

With Democrats in the majority in the House, and maybe in the Senate, they will push for their proposals on Homeland Security. This generally means an increase in domestic expenditures, which would affect homeland security professionals at local, state, and federal levels. Government Computer News reports:

With the Democrats taking control of the House of Representatives next January for the first time since 9/11, the nation is likely to see changes in anti-terrorism policy and increased domestic spending.

Specifically, they are likely to push for full implementation of the 9/11 Commission's proposals, both international and domestic.

Other anti-terrorism areas of emphasis for Democrats in Congress have included urban and mass transit security; chemical security, port security, first responders, disaster preparedness and privacy.

It is certain that the Democrats will be eager to push for an approach that differentiates them from the Bush Administration. But as always, it won't be the amount of money they spend. It will be how smart they spend the money.

DHS Discusses Foot-and-Mouth Threat

Nothing new here, but the agricultural threat of foot-and-mouth disease got some notice in the recent comments of a DHS official, GovExec reports:

The Homeland Security Department's senior adviser for weapons of mass destruction said late last week that the introduction of foot-and-mouth disease on American soil would have a tremendous effect on the U.S. economy, whether the outbreak is intentional or accidental.

Maureen McCarthy, the weapons adviser, on Friday told attendees of the Association for Intelligence Officers' annual convention that such an outbreak would cost the American agriculture economy "hundreds of billions" of dollars and could shutter some trade borders for "years" if officials deem it necessary.

"It will happen instantly," she said of the financial and trade impact, "even if there are no deaths."

During a discussion that in part focused on how biological agents might be used against the United States, McCarthy said foot-and-mouth disease could be used by terrorists.

Agricultural terrorism is a potentially major vulnerability. Collaboration with state and federal veterinary services is an important part of being prepared.

New GSA Office for Emergency Response

Federal Computer Week reports on the General Services Administration's new, centralized office for emergency response:

Emergency workers who need General Services Administration services in fast-moving disasters have a new resource. GSA announced today that it has consolidated its emergency procurement services into a new Office of Emergency Response and Recovery (OERR).

The office puts all of GSA's emergency resources into one central office for first responders, emergency workers and recovery teams.

In the National Response Plan, GSA is the coordinating agency for Emergency Support Function (ESF) #7 - Resource Support. This includes:

• Emergency relief supplies
• Facility space
• Office equipment
• Office supplies
• Telecommunications
  
• Contracting services
• Transportation services (in coordination with ESF #1 – Transportation)
• Security services
• Personnel required to support immediate response activities

DHS To Embed Intel Officers at Fusion Centers

Government Executive is reporting that DHS plans to embed a team of intelligence officers at each of its fusion centers, to foster information sharing with state and local agencies:

The Homeland Security Department hopes to improve information sharing with state and local government fusion centers by giving those centers intelligence officers and an advanced communications network for classified information, a senior official said Friday.

Department Chief Intelligence Officer Charles Allen said he plans to have intelligence officers embedded at 18 fusion centers by the end of fiscal 2007 and at all other centers by the end of fiscal 2008.

"My plan is to embed in these centers -- every one of them -- a team of intelligence officers whose responsibilities include ensuring robust, two-way sharing of information," he added.

He said the department is retooling the Homeland Security Information Network at the secret level to communicate with centers on an interim basis until a more capable system is developed. Allen called the network "a weak system" that he is "going to get rid of" by replacing it with the Homeland Security Data Network.

He added that he plans to have the new network installed by January at every center where he has intelligence officers.

It's hard to argue against reinvigorated efforts to improve information-sharing. Regarding the HSIN, though, DHS needs to make sure they get it right. They've said they're going to fix the HSIN, but if DHS really wants to improve information-sharing with state and local authorities, they can't afford to get this wrong again.

I think they're making things harder by doing this in a two-step process - first, doing an interim fix on the HSIN, then replacing it completely. They need to show clear improvement in both iterations; otherwise they'll lose credibility. You can't just build new systems and hope that one eventually works. If each iteration isn't better, then they won't have a fix, but just a cumbersome annoyance.

Successful Interventions by State Public Health Systems

In a new report, the Association of State and Territorial Health Officials highlights some recent successful interventions taken by state health departments to prevent and prepare for serious health threats. Most of the efforts involve improved collaboration and/or information sharing. Some highlights of the report:

The Arizona Department of Health Services ... has created a working network of food professionals from all segments of the food industry to increase food security awareness.

The Missouri Department of Health and Senior Services contracted with the Missouri School Boards Association to create a secure, web-based tool to assist schools in planning and training for emergency events. Beginning April 1, 2006, all schools in the state could upload critical information such as floor plans, students with special needs, staff information, and utility shut-off locations to aid the response to events such as infectious disease outbreaks and hazardous materials incidents.

In South Carolina, the Division of Acute Disease Epidemiology at the Department of Health and Environmental Control summarizes daily epidemiological reports for the state’s intelligence fusion center ... Health data such as summaries of calls to the state poison control center, reports on over-the-counter retail sales of certain medications, calls handled by the 24/7 consultant on-call, and chief-complaint information from hospitals are analyzed each day and summarized by the department prior to submission.

In New York City, the Emergency Data Exchange Network (EDEN) allows different agencies to share environmental health monitoring data. Using wireless Bluetooth technology, field staff are able to collect and automatically transmit environmental information including air and radiological monitoring data. The environmental handheld project is just one of the many data sources for EDEN.

The Ohio Department of Health used its public health communication system to rapidly establish a secure, Web-based reporting system for Clostridium difficile infection. Beginning January 1, 2006, more than 120 local health departments have weekly access to the system and the capacity to provide and update reports for the hospitals and long term care facilities within their own jurisdictions.

Tennessee ... merged tabletop and full-scale exercise activities of its public health, animal health, homeland security, and emergency management agencies under one umbrella. By doing so, the state has improved overall collaboration and gained a better understanding of how efforts are integrated during an emergency response.

The report also highlights some other examples, but I found these to be the most intriguing. Especially interesting to me are the ways that South Carolina and New York City have improved their situational awareness by using information-sharing technology.

DHS Pandemic Flu Guide for Critical Infrastructure Businesses

DHS has released a new guide for private sector businesses regarding planning for pandemic flu. For someone well versed in the threat, there is not much new information in the document. It primarily focuses on the potential severity of the threat, in the interest of motivating those who have not adequately planned for a pandemic. Here are some selected highlights:

The primary purpose of this Guide is to stimulate the U.S. private sector business community to act now.

The mounting risk of a worldwide influenza pandemic poses numerous potentially devastating consequences for critical infrastructure in the United States. A pandemic will likely reduce dramatically the number of available workers in all sectors, and significantly disrupt the movement of people and goods, which will threaten essential services and operations within and across our nation’s CI/KR sectors.

In each pandemic [during the 20th century - including the devastating Spanish Flu of 1918], about 30 percent of the U.S. population developed illness, with about half of those Americans seeking medical care. Children under the age of 18 have tended to have the highest rates of illness, though not of severe disease and death. Geographical spread in each pandemic was rapid and virtually all communities experienced outbreaks.

Implications of pandemic flu:

• Dramatic worker absenteeism (40 percent or more) will occur at all levels due to illness, family member care, death, childcare, and “worried well” (otherwise healthy people who avoid the workplace for fear of exposure).
• Pandemic disease spread will be rapid and unpredictable, likely precluding shifting personnel, resources, and emergency operations centers to “safe” areas.
• Movement restrictions and/or quarantines will disrupt the supply chains and municipal services.
• Social distancing requirements will affect business operations, especially when public contact is unavoidable (e.g., retail food) or workers share a common workspace (e.g., plants).
• Business closures and furloughs for prolonged periods may cause extensive financial harm or even ruin, increasing demand for social and welfare support.
• Lost income and competition for remaining skilled workers and scarce supplies and materials will dramatically affect business response and recovery.
• Reduced worker availability among first responders may result in greater risk of social and security disruptions.
• Disruptions and failures at essential businesses will cause localized economic and social challenges and may affect other businesses in the sector, region, and, perhaps, the nation.

Unlike geographically and temporally bounded disasters, a pandemic will spread across the globe over the course of months or over a year, possibly in waves, and will affect communities of all sizes and compositions. In terms of its scope, the impact of a severe pandemic may be more comparable to that of war or a widespread economic crisis than a hurricane, earthquake, or act of terrorism.

A pandemic “wave” may linger in a community for six to eight weeks.

An estimated 50 percent of those who get the flu may require medical intervention, and the burgeoning throng of patients and “worried well” may overwhelm our healthcare delivery system.

Shortages of and disruptions to basic commodities and municipal infrastructure may cause localized security challenges for businesses and communities.

To survive a pandemic, all businesses must plan to collaborate with members all along their supply chain network, key customers, and business competitors.

DHS plans to use the National Infrastructure Coordinating Center (NICC) [one of the four sub-elements of the National Operating Center (NOC)] as the hub for all CI/KR private sector information sharing needs during all phases of a pandemic.

The guide includes a checklist for private-sector entities to develop continuity-of-operations plans pandemic flu. (See Section 5 of the guide.) The checklist is thorough, though somewhat general in that it must apply to all types and sizes of businesses.

Airport Workers Stripped of Clearance

The Scotsman reported today:

More than 70 Muslim workers at France's main airport have been stripped of their security clearance, after an investigation claimed staff had visited terrorists' training camps in Pakistan and Afghanistan.

Investigators found that one employee was believed to be a friend of Richard Reid, the British shoe-bomber now serving a life sentence in Colorado, while another is believed to be close to a senior figure in an Algerian terrorist group with links to al-Qaeda.

One French baggage-handler allegedly spent three years in Yemen and attended a military training camp run by Islamic militants.

Ten workers who were stripped of security clearance - nine baggage-handlers of North African descent and a French security guard who converted to Islam and is married to a Moroccan woman - are suing the airport authorities on the grounds that they have been discriminated against because of their religion.

Planting workers at airports has long been regarded as a potential avenue for terrorism. If the accusations are true, it's disappointing that this was allowed to happen.

CIA's "Intellipedia"

The LA Times reports that the CIA is using Wikipedia technology to build a dynamic storehouse of intelligence information.

The CIA and other U.S. intelligence agencies have created a computer system that uses software from a popular Internet encyclopedia site to gather content on sensitive topics from analysts across the spy community...

The system allows analysts from all 16 U.S. intelligence agencies to weigh in on debates on North Korea's nuclear program and other sensitive topics, creating internal websites that are constantly updated with new information and analysis, officials said.

The system, which the public cannot access, is divided into classification categories starting with "sensitive but unclassified" and ending at "top secret."

More than 3,600 analysts and other intelligence officials have registered to use the service since it was launched in April, officials said.

I wonder how many state and local agencies could consider this kind of system, assuming that the necessary precautions were taken. Generally, this sounds like a really good means of information sharing. Not only does it invite widespread participation, but a Wikipedia-type system has a built-in advantage, in that many people are already familiar with it.

So far, the number of registered users sounds promising. My only question is how many of them are actually using it. A separate info-sharing network, the Homeland Security Information Network (HSIN) has more than 16,000 registered users, according to a June 2006 report by the DHS Inspector General, but only a small fraction of them actually use the system on a regular basis (around 450, according to my calculations). DHS is trying to fix it, as I indicated recently.

A New, Vaccine-Resistant Strain of Bird Flu

From the "it may be nothing, but..." department:

National Geographic reports that a new strain of bird flu is spreading rapidly in China, and this strain is resistant to the vaccine that has been used so far in poultry.

A newly discovered bird flu strain has emerged in China and has spread rapidly through poultry in Southeast Asia. Human infections by the new strain have also turned up in several locations, including both farms and urban centers, intensifying fears of a worldwide flu pandemic that could kill millions.

Magnifying those concerns is the vaccine-selective nature of the new strain, which means that existing animal vaccines are less effective on it than they are on previously known bird flu types.

"However, we don't have any evidence to show whether this virus is more dangerous or less dangerous than any other H5N1 [bird flu] viruses," said Yi Guan, director of the State Key Laboratory of Emerging Infectious Diseases at the University of Hong Kong in China.

Disaster plans for pandemic flu are essential. Whether the culprit turns out to be bird flu or some other strain, it's not a question of "if" but "when."

Audit: Massachusetts Is Unprepared

The Massachusetts Senate Committee on Post Audit and Oversight has issued an audit that raises concerns with Massachusetts' homeland security response plans:

The Committee found the following general areas of concern:

• The state’s insufficient oversight of homeland security planning by cities, towns and the state’s agencies and authorities;
• The state’s failure to provide first responders with the proper means to protect against terrorist activity and natural disasters;
• The state’s inadequate communication of the statewide strategy; and
• The state’s unsuccessful implementation of its homeland security plan.

The committee places most of the blame on the Executive Office of Public Safety, the state agency responsible for homeland security. It notes that police and fire departments have lost 1,124 personnel since 9/11.

The Boston Globe reported that:

Executive Office of Public Safety spokeswoman Kelly Nantel rejected many of the report's findings and said the state has dramatically improved preparedness.

Nantel said the state has added more than 2,000 police officers since 2003 and has been praised by federal homeland security officials as one of 11 states that had "sufficient" preparedness plans.

A spokesman for Gov. Mitt Romney (R) said the Democrat-led Legislature is to blame for "the only real gap in the state's emergency planning," the lack of a better response for the outbreak of a pandemic flu.

I think the state is on the right track when they talk about distributing funds by region, as Missouri is also doing. But the rancor around this report seems to smack of partisan sniping. It's particularly disheartening to see that they can't even agree on the number of police officers and firefighters in the state.

USCG Hazmat Database Available to First Responders

The U.S. Coast Guard is publishing a free CD-ROM database of chemical information to first responders nationwide:

Users can search the database by a substance's color, odor, and physical appearance and use the data to plan for a safe and effective response. Chemicals are rated according to health risk, flammability, and reactivity, among other factors, using data from several sources. The CD-ROM, known as CHRIS+, includes:

• USCG's Chemical Hazards Response Information System (CHRIS)
• The National Institute of Occupational Safety and Health (NIOSH) Pocket Guide
• The Department of Transportation's Emergency Response Guidebook (ERG)
• USCG's Weapons of Mass Destruction (WMD) First Responder's Guide

This is a common-sense approach to information-sharing.

Collaboration in Missouri HLS Grant System

The Memphis (MO) Democrat reported last week about how Missouri is revising its system for distributing homeland security grants:

[I]n the past, approximately 1,300 sub-grantees successfully applied for Homeland Security funding across the state, causing a tremendous administrative workload on SEMA staff. The old process of allowing each political subdivision to apply for grant funding individually also led to duplication of equipment and resources within close geographical proximity to each other.

[T]he State has proposed to organize into [eleven] regions ... the local Regional Planning Commissions (RPCs) will be utilized to organize the local political subdivisions in the creation of regional grant allocation committees who will decide upon grant funding request priorities on a regional basis. The local regional planning commissions will also be responsible for handling local administration processing of the grant funding.

It generates incentive for local regions of the State to cooperate with each other in focusing on their immediate needs.

I think it is a good call to encourage this kind of collaborative effort. The committees can consider both local and regional needs.

National Guard Upgrading Emergency Communications

The National Guard is spending some money to buy communications systems that will allow easier communication with local, state, and federal responders during disaster response:

The National Guard Bureau is using supplemental congressional funding to upgrade its interim satellite incident site communications sets, which it deployed in 11 states, to field an upgraded version called the Joint Incident Site Communications Capability (JISCC). JISCC packages can be towed or airlifted to incident sites and can communicate via high-frequency radio, telephone, video and satellites to interface a variety of communications equipment used by first responders and state and federal agencies.

"We are on track to have this rapid-response capability in all 54 states and territories by mid-2007," Maj. Gen. Alan Cowles said.

Any step toward interoperable communications is good news. The lack of interoperable communications systems was a real hindrance to the response to 9/11 and Katrina.

Homeland Security Report Card

The Council on Foreign Relations' Stephen Flynn has given DHS a report card on its homeland security efforts. It is mostly focused on preparedness for various threats and does not address some threats such as bioterrorism, agricultural and food terrorism, and rail safety. But ... it is what it is. Here is the crib sheet on Flynn's grades:

• Port Security: D+
• Nuclear Plant Security: B/B+
• Air Defense: B
• Airport Security: C+
• Border Control and Immigration: C
• Chemical Plant Security: D-/F
• Disaster Response: C-
• Bridges, Tunnels, and Other Infrastructure: C
• Public Relations: D

Even though these things are always grossly oversimplified, I think they can at least serve some purpose if they refocus attention on threats that can face local jurisdictions. If there is a chemical plant in your area, what do you know about its security? What do you know about the critical infrastructure in your area? Etc.

Trying to Fix the HSIN

Problems have long plagued DHS' Homeland Security Information Network (HSIN) since its launch in 2004. It was supposed to be a dynamic, technologically advanced system for sharing information among local, state, and federal authorities.

The problem, as cited in a June 2006 report by DHS' Inspector General, is that not enough people use it:

HSIN is not effectively supporting state and local information sharing. Although users generally like the web portal technology because of its user-friendliness and flexibility, those we interviewed said they are not committed to the system approach. Users are confused and frustrated, without clear guidance on HSIN’s role or how to use the system to share information effectively. Because some lack trust in the system’s ability to safeguard sensitive information, and because the system does not provide them with useful situational awareness and classified information, users do not regularly use HSIN. Instead, users resort to pre-existing means such as related systems and telephone calls to share information, which only perpetuates the ad hoc, stove-piped information-sharing environment that HSIN was intended to correct.

This is a shame, but it isn't a unique problem. After all, how many consumer products fail because they don't adequately take into account their users' wants, needs, and concerns?

It may be a little late, but DHS is going to try to fix HSIN. Federal Computer Week reports:

The department recently established an HSIN advisory committee to provide independent advice from representatives of state, local and tribal governments, as well as from the private sector, about what users specifically need from HSIN ...

In the future ... HSIN would be made up of two parts: HSIN-Intelligence, which will handle unclassified information, and HSIN-Secret for the classified data.

I sincerely hope they get it right this time. A robust, widely-used, and reliable system for information-sharing across all levels would be a real benefit for all.

Homegrown Jihadism: U.S. & Europe

Two recent stories contrast the situation in Europe and the U.S. regarding homegrown jihadism.

The Christian Science Monitor reports that al Qaeda is finding the U.S. to be "sterile ground" for jihadism. The basic reasons are fairly simple: U.S. Muslims tend to be better educated, with higher incomes and social standing. The imams in their mosques tend to preach assimilation, rather than the extremism found in many European mosques.

"We weren't isolated growing up. We were part of the culture," says Hala Kotb, who grew up outside Washington in a family that inculcated a success ethic. "Religion was important, but not so much that you'd have to cover your head or if you don't pray five times a day, that's it - nothing like that. There were a lot more progressive attitudes" within her local Muslim community.

The young Muslims quoted in the article say that the danger for the U.S. is to overreach and end up alienating U.S. Muslims. One young Muslim calls the FBI's intense scrutiny on Muslim-Americans "good for the short term, but bad in the long term."

The young Muslims interviewed for this story chose their words carefully, but their inference is clear: They worry that suspicion toward Muslims has been building since 9/11, and they suggest that US intervention in Iraq and its support for Israel cause angst among many Arab-Americans.

FBI spokesman John Miller says that the Bureau is putting more effort into community outreach, and he adds that in a number of cases, the FBI has intervened to prevent potential jihadist terrorism in the U.S.

My own take is that a balance must always be struck, with the single most important variable being the establishment of trust. A certain level of intrusion can be tolerable to most people, provided that they perceive it as trustworthy and fair.

Meanwhile, across the pond, Terrorism Monitor examines the situation in Scandinavia, and finds it much worse:

In a security report released in September, PET, the Danish domestic intelligence agency, warned that the largest threat to Denmark, as in most European countries, comes from small, unsophisticated groups that are "inspired by al-Qaeda's global jihad ideology but can act autonomously and apparently without external control, support or planning."

[T]he overwhelming majority of terrorist activities taking place in Scandinavia currently are carried out by homegrown networks.

The article examines the cases of a number of young people arrested in Denmark, who were turned on to jihadism via the Internet and had an unusual profile for jihadists:

What is striking about the members of the Mujahedon network, aside from their extremely young age and operational un-sophistication, is their unusual profile. All three seem to have backgrounds and interests that have little to do with those of an Islamic fundamentalist: they appear to be young men with a greater fascination for violence rather than for the ideology of committed jihadis. Ramic is a troubled teenager who lives with his parents and is a regular hashish consumer (Sydsvenskan, May 3). Ganjin is also known as a consumer and petty smuggler of soft drugs. Fahlen is the son of a wealthy Swedish family and, while acknowledging an interest in Islam, claims not to have converted. Despite these backgrounds, the three developed a sudden fascination with radical Islam and, almost immediately after, began to send threats online.

Their knowledge of Islam is virtually non-existent and their fascination with jihad seems to be dictated by their rebellious nature rather than a deep ideological conviction. Nevertheless, these "improvised jihadis" seem to be the norm in Scandinavia.

This "non-ideological" jihadism was also recently described by Brian Michael Jenkins in his book, Unconquerable Nation (my review is here). Jenkins writes:

It is a trajectory we often see in terrorist organizations. Well-educated ideologues like Osama bin Laden and Ayman al-Zawahiri initiate the campaign. Violence is for them a means to an end, but as the organization grows, it recruits "soldiers" who share their beliefs ... The 9/11 attackers fit this category. As the violence continues and the earlier veterans are killed off or picked up, a third generation emerges. It usually lacks the intellect and ideological grounding of the first generation, which still dominates the leadership; it is more attracted by death and destruction. This is the generation in which we find the thugs, including, until his death, Zarqawi.

Invariably, tensions arise between the strategists of the first generation and the harder men of the third generation, who push for ever-escalating violence without concern for its longer-term political consequences.

I interpret this as a possible source of vulnerability for the terrorists. Thugs who are primarily interested in violence, rather than advancing an ideology, may be more likely to take unwise risks and expose the organization.

Disaster Prep: Text-Messaging in SF

San Francisco is starting a program that allows residents to register to receive text messages in the event of a disaster:

Oct. 17 - San Francisco Mayor Gavin Newsom announced the launch of AlertSF, a new text-message alert system for the public coordinated through the Department of Emergency Management. In the event of a large earthquake or natural disaster, the new system will provide emergency information and alerts to registered users.

This seems a very sensible approach to emergency communications. In the aftermath of a disaster, you don't know what's going to work. After Katrina, there were almost no communications. After 9/11, some communications systems worked; others didn't (mainly due to the fact that a major Verizon station was right across the street from the WTC, and a telecom hotel was just a few blocks away.)

The more channels that are available, the better your chances of getting the message out.

Local Police and Immigration Enforcement

A commentary in JURIST argues that local police should not be required to enforce immigration laws, because it would undermine efforts to share information and gather intelligence from immigrant communities. This information can be vital to locating potential homegrown threats:

Most police have realized that they must have the help and support of the communities they serve in order to do a good job of assuring public safety. This means that police must create and maintain relationships with the communities they serve – relationships based on trust. Without this kind of relationship, police will receive little in the way of intelligence and information from the public, making it harder for officers to do their always-difficult jobs.

Police officers understand that if they are forced to become adjunct immigration agents, people in immigrant communities will begin to fear talking to them because doing so might bring with it the potential for deportation ... The fear will cause immigrant communities to cut themselves off from police, not offering information about criminal activity and not reporting crime.

[P]ushing police into immigration enforcement will prove a substantial setback to every effort now underway to obtain crucial intelligence against potential terrorists on our own soil ... In any number of successful anti-terrorism cases in the U.S. – in Lackawanna, N. Y., and Toledo, Ohio, to take just two examples – crucial intelligence has almost always come from people in the Middle Eastern, Muslim, and Arab communities.

I find this a compelling argument. There are other ways to stem the tide of illegal immigration. The costs of chilling the relationship between local police and immigrant communities seem too great. Local police are in a unique position to develop a trusting relationship with immigrant communities and get information about potential threats before they emerge. No one else can do the job as well.

A Recipe for Disaster in the Schools?

As recent events have shown, U.S. schools continue to be vulnerable. Knowing that perfect security is not possible, school officials are left to do the best they can to minimize the threat.

A school district in Texas has become the first in the nation to offer "fight-back" training for teachers and students, and other school districts are considering it. Would it work? The company offering the training says so:

"Getting under desks and praying for rescue from professionals is not a recipe for success," said Robin Browne, an instructor for Response Options. "Five or six seventh-grade kids and a 95-pound art teacher can basically challenge, bring down and immobilize a 200-pound man with a gun."

To me, it sounds like a recipe for disaster. Close collaboration and extensive planning between school officials and local police seems like a better approach.

Evacuation Report Card for U.S. Cities

The American Highway Users Alliance just published an interesting study of the evacuation capacity of highway systems in 37 major U.S. urban areas - those with populations of 1 million or more.

The cities' highway systems were graded in three dimensions:

• Exit Capacity: Capacity of major roadways leading out of an urban area.
• Internal Traffic Flow: Traffic flow within the urban area, allowing access to exit roadways.
• Automobile Access: The percentage of city residents with access to an automobile

Highlights of the study included:

• Half of the 37 cities received an "F." (New Orleans got a "D.")
• Only one city, Kansas City, received an "A."
• Landlocked cities scored the best, because evacuation is possible in any direction. Every city that scored "C" or above is landlocked.
• The three largest cities in the U.S. had the lowest scores: New York, Chicago, and Los Angeles.

Specific problem areas are:

• The majority of cities lack sufficient exit capacity, with New York and Chicago having the most severe problems.
• Los Angeles and Chicago have especially bad internal traffic flow.
• New York scores lowest by far on automobile access, because many city residents rely on public transit.

It seems to me that disaster planners in smaller cities could do this kind of analysis, too. While it does not take into account any obstacles that are caused by the disaster itself (e.g., bridges washed out in a hurricane or destroyed in an earthquake), it provides a good baseline snapshot of a city's ability to clear itself out.

Chertoff: Local Police Are First Preventers

On Monday, DHS Secretary Chertoff spoke of the importance of local law enforcement - and the importance of sharing information with them - at the annual conference of the International Association of the Chiefs of Police. Chertoff told the police chiefs:

You are the most likely to detect the beginning phases of a possible plot, particularly a homegrown plot.

[T]he third area I want to focus on ... is the increasing threat of homegrown plots -- that is to say plots arising in local communities, involving local people, American citizens, who may become radicalized over the Internet or because of a recruiter and train themselves, again -- with networks, small groups -- and then would carry out the kinds of attacks that we saw, for example, in London last year...

Chertoff said he's committed to ensuring that local and federal information-sharing is a two-way street. To this end, he said DHS will continue to:

1. Continue to develop the national network of intelligence fusion centers, with 35 centers active by the end of fiscal year 2007
2. Expedite the classified, secret level clearance process, so that local law enforcement can be cleared more quickly to review classified data
3. Open up communication channels and training opportunities for local law enforcement

As I see it, one of the salient points in Chertoff's speech is his emphasis on the homegrown threat. Others have noted that the worldwide jihadist movement is evolving into a loosely connected network of small cells that can spring up spontaneously (i.e., the "seed crystal" method of recruiting, which I recently discussed).

Local authorities are in the best position to "take the temperature" of the local environment and detect the possible formation of new threats.

Lawmakers Want Info Sharing at Borders

Key lawmakers want more information sharing at the nation's borders, GovExec reports:

Senior members of the House Homeland Security Committee are calling for more information sharing among federal, state and local law enforcers in order to improve border security.

Committee ranking Democrat Bennie Thompson of Mississippi on Wednesday asked the Government Accountability Office to review how information sharing is working among the federal government and law enforcers in border communities.

"The development of border intelligence based on information sharing among the state, local and tribal stakeholders from states along the borders would be a valuable tool to ensure resource allocation decisions are made based on a sound understanding of the risks posed," Thompson wrote to GAO.

This sounds good, but it begs the question: Why are we still making proposals to share information, more than five years after 9/11?

$1.2 Billion - But Will It Work?

Yesterday, the Government Accountability Office (GAO) issued a report that was critical of DHS' Domestic Nuclear Detection Office (DNDO), who recently awarded a $1.2 billion dollar contract to a number of contractors for new portal monitors, known as “advanced spectroscopic portal monitors” (ASP), that can detect both the presence and the type of nuclear or radiological material.

DNDO tested ASPs in 2005. They set a goal of identifying highly enriched uranium (HEU) – the main ingredient in a "gun" type nuclear weapon – 95 percent of the time. But the ASP prototypes identified bare HEU only 70 to 88 percent of time. And when the HEU was masked with benign radiological materials, the success rates fell to 53 percent, 45 percent, and 17 percent for the three ASP systems tested.

GAO said:

Despite these results, DNDO did not use the information from these tests in its cost-benefit analysis. Instead, DNDO officials told us that since new portal monitors cannot meet the 95 percent level of performance, they relied on the assumption that they will reach that level of performance sometime in the future.

Moreover, DNDO’s cost-benefit analysis only considered the benefits of ASPs’ ability to detect and identify HEU and did not consider ASPs ability to detect and identify other nuclear and radiological materials.

In other words, DNDO did not consider the ASP portals' effectiveness in identifying radiological materials that would be useful in a dirty bomb, such as Cesium 137 and Cobalt 60.

GAO concludes:

DNDO’s cost-benefit analysis does not justify its recent decision to spend $1.2 billion to purchase and deploy ASP technology.

The lesson of this, as I see it, is that you have to take into account the entire spectrum of risk and reward before deciding on any particular intervention.

Al Qaeda Recruiting

I recently came across a useful analysis of terrorist recruiting: this chapter of the McGraw Hill Homeland Security Handbook.

In the chapter, RAND analysts Scott Gerwehr and Sara Daly point out the importance of recruiting to the jihadist cause. Simply put, if jihadists do not successfully recruit, their ability to function is seriously impaired.

As described by others who have reported on terrorist recruiting, it is commonly accepted that terrorist recruiters generally make subtle initial contact, followed by more intense contacts, finally resulting in the loss of the recruit's individual identity and the acceptance of the group's identity.

Recruiters focus their efforts on those who have little identity, feel lost, lack effective social support structures such as family, etc. According to Gerwehr and Daly, this means that:

[I]f a recruiter attempts to weaken targets’ family or community bonds in order to get them to join (e.g., by emphasizing a religious duty to go to war), an effective countermeasure is to strengthen or preserve those social networks (e.g., by emphasizing the religious imperative to protect and preserve one’s family).

One unique aspect of Gerwehr and Daly's analysis is their categorization system for terrorist recruiting strategies. For local homeland security professionals, I thought the most relevant of these strategies was the "seed crystal" method:

In this case recruiters may seek to provide a context for self-recruitment. This may be compared to lowering the temperature of a glass until the water inside it cools and then ice crystals form as the seeds of a complete freeze. Once individuals emerge within the population as new recruits, they will often follow the pattern of the infection. In "seed crystal" recruitment, critical variables include the type of environmental forces being used to "chill the glass," and the durability of the ‘‘freeze.’’

The authors conclude that "the seed crystal approach may be most successful in diasporas or populations where open recruiting is difficult or impossible."

The "seed crystal" method seems to describe the experience of the 2005 London subway bombers.

For local homeland security professionals, the challenge seems to be both "taking the temperature" of the local environment (i.e., the "glass") and figuring out ways to prevent the atmosphere from being "chilled," so that terrorist seed crystals do not form.

Maritime Terror Risks

The RAND Corporation released a new report yesterday, Maritime Terrorism: Risk and Liability. The authors used a threat-vulnerability-consequence methodology and concluded that the greatest risks in terms of threat and vulnerability are:

• Ferries: Onboard bombings
• Cruise Ships: Onboard bombings (followed closely by standoff artillery assauts and food or water contamination)
• Cargo Ships: Radiological Dispersal Device (i.e., dirty bomb)

Review: "Unconquerable Nation"

Brian Michael Jenkins of the RAND Corporation, a well-regarded expert on terrorism, recently released a book titled Unconquerable Nation: Knowing Our Enemy, Strengthening Ourselves.

I found the book to be excellent. Much of it deals with the strategy for addressing the terrorist threat overseas (i.e., Iraq, Afghanistan, Europe, etc.), but the last chapter specifically discusses homeland security. I want to highlight a few of Jenkins' key findings that relate to local efforts to prevent terrorism. Jenkins writes:

Most of the jihadist terrorist attacks since 9/11 have been at local initiative, carried out by local cells inspired by al Qaeda’s ideology ... An entire terrorist plot may proceed under the radar of national intelligence services.

The more than 600,000 sworn police officers in the United States are in the best position to monitor potential homegrown terrorists. They know their territory. Recruited locally, they are likely to be ethnically closer to the communities they serve, they are more aware of local changes, and they are more acceptable to local community leaders. Unlike federal agents, local police do not rotate to another city every few years. They are in the best position to identify “hot spots” for terrorist recruiting, talk to local merchants and community leaders, and develop local sources of intelligence. As we have seen in many cases, local police, through routine criminal investigations, community policing, or dedicated intelligence efforts, may be the first to pick up leads to terrorist plots.

So, not only are local police capable of preventing terrorism, in some cases they are better positioned to prevent terrorism than their federal counterparts.

In assessing the threat, Jenkins points to a significant vulnerability that jihadists are increasingly relying upon: low-level criminal activity.

Eager jihadists must now provide their own funding, which they do through petty crime or even from their own resources. Although not an entirely new phenomenon . . . this intersection between low-level crime and terrorism has become a signature feature of today’s more-decentralized jihadist operations.

Any low-level criminal activity places the group at risk of detection, which is critical to any preventive effort. In its recent "Trends in Terrorism: 2006" report, the Congressional Research Service also commented on terrorists' increasing tendency to fund their activities through illegal means.

Jenkins also discusses recruiting, which I recently examined. Recruiting is not only critical to the strategic goals of jihadist terrorists; it is also one of their most critical points of vulnerability. While recruiting, terrorists must reveal themselves to those outside their trusted circle. When authorities know the methods of terrorist recruiting, they are in a better position to intervene. Jenkins writes:

As is done in all armies, jihadist recruiters target impressionable adolescents and men in their twenties. Few recruits are married or have children. More often they are lonely young men seeking to belong to something. Joining a secret elite gives them a special sense of power.

The recruiting vocabulary focuses on humiliation, shame, and guilt, contrasted with dignity, duty, and honor. A volunteer doesn’t sign up for jihad and board a bus to basic training. Initiation into jihad is a multistep process that usually begins in a religious setting, at a mosque, religious school, or study group, but it can also start at a student meeting, bookstore, street corner, cybercafe, or cellblock—anywhere young men assemble.

A simple intervention to foil recruiting is to maintain a presence. When recruiters are not completely certain that they are secure, they drastically reduce their activities. If recruiters see every potential recruit as a potential mole for authorities, or if recruiters feel that their activities are being observed in any way, this tends to have a chilling effect on recruiting.

All-in-all, I found the book to be very much worth reading.

Markle Report #3: In-Depth Review

I recently finished reviewing the Markle Foundation Task Force's third report, "Mobilizing Information to Prevent Terrorism (pdf, 4.8MB)."

It was a somewhat disappointing report, though maybe not too surprising. Its essential finding is that, although information sharing has improved in the five years since 09/11/2001, it is still not adequate across levels of government. Here are a few excerpts I found especially significant:

State and local governments have not become full participants in the information sharing environment. Many feel they are still not getting the information they need, and that there is no effective process for sharing their information with the federal government.

[S]tate and local governments are critical to homeland security. They have more resources, they interact more frequently with the public, and they are often in a better position than the federal government to provide and act on useful information.

One of the most significant barriers to effective pre-September 11 information sharing, identified by numerous investigations, is risk aversion. Risk aversion arises in part from fear among government officers that information sharing that is clearly authorized at the time of sharing will subsequently be judged to be improper, resulting in personal criticism, career damage, and even criminal prosecution.

The human dimension is critically important for information sharing. . . . Lack of common training contributes to cultural gaps between intelligence, law enforcement, homeland security, and military personnel; these gaps remain a root cause of poor information sharing. The situation has become even more difficult as the community of counterterrorism analysts and collectors expands beyond the federal level to include state, local, and private sector participants, and as the volume of available information grows.

The report offers some suggestions for creating a comprehensive system for information sharing. Such a system may be the ultimate long-term answer; but given the current status of inadequate sharing across levels of government, there may be a need for shorter-term solutions. The threat is still present. Preventing catastrophe requires sharing information to recognize threats and manage risks. Only then can appropriate measures be taken to prevent disaster.

State Homeland Security Officials Survey

In May 2006 Western Carolina University released the results of a survey of state homeland security officials. Overall, the picture was not too encouraging. A couple of findings that seemed particularly salient:

• The majority of state officials said that DHS directives are not being implemented effectively at the state level.
• Although 88% of state officials say that prevention is the most important priority for the federal government, only 38% say that prevention is the most important priority for state government. At the same time, 73.5% say that prevention is the most difficult task for states to accomplish.

At the very least, it seems like our homeland security priorities and efforts are not being adequately coordinated across the levels of government.