Countering Terrorist Networks and Technologies

The revolution in information technology, like all revolutions, can be used for good or evil. Anytime there is a shakeup in the way things work, there is an opportunity to better the world or make it worse.

With that in mind, it's interesting to review the recent RAND report entitled Network Technologies for Networked Terrorists. With RAND's usual thoroughness, the report outlines the potential ways that terrorist organizations can exploit new information technology and provides suggestions for addressing the threat.

There is, of course, good news and bad news:

Global consumer demand for new capabilities or products has fueled an explosion of new or enhanced technologies, many of which terrorists could use to make their operations more efficient or effective. However, technology can be a double-edged sword: As it boosts effectiveness or efficiency, it might also introduce new vulnerabilities.

Although these technologies can aid terrorist organizations by enabling military functions like command and control (see, for example, Whine, 1999), they can also provide capabilities that increase terrorists’ effectiveness in other necessary activities such as raising money or persuading people to join their causes.

One of my interests is in terrorist recruiting, which I perceive as presenting one of the more significant vulnerabilities of any terrorist group. Generally speaking, the conventional wisdom has been that successful terrorist recruiting involves one-on-one "grooming," bringing a potential recruit into the social sphere of the group and eventually cutting off ties with all other social groups. RAND argues, though, that advanced communication technologies can facilitate this process, making it easier to prime the pump and get recruits into the terrorist mindset at a distance and with more limited personal interaction:

Historically, recruiting for terrorist organizations has been a clandestine process. The need for security and secrecy heretofore has necessitated a low profile and often required that it be conducted face to face. ... Face-to-face recruiting limits the number of individuals who can be contacted. Moreover, small-scale recruiting coupled with the need for secrecy generally has meant a longer recruitment process, as the process must take place unobserved by security (often at a single site or in a few locations). Finally, recruitment into terrorist groups has frequently involved a lengthy proving period. In such circumstances, the technology available and the nature of the recruiting activity both worked to keep the cause local and the pool of potential recruits limited.

Today, forms of recruiting enabled by network technology greatly expand the scope, effectiveness, and efficiency of previous recruitment activities. First, recruiting can be done remotely. With recruiting materials on the Internet available from almost anywhere, face-to-face contact is not a necessity. This can facilitate recruiting by making a broad audience aware of a group’s existence and cause. Second, remote recruiting is efficient because a single recruiter can develop many candidates at the same time. Terrorist recruiters may now simultaneously work with audiences in many parts of a single country or in many far-flung countries, expanding the pool of potential recruits.

The idea is that recruiters can use distributed media (e.g., the Internet) for some recruiting purposes, generally early in the recruitment process, and then use other media (e.g., videos, which can be easily copied and shared) in a more personal context:

Recruiting normally involves employing a wide variety of communication methods—videos, pamphlets, Web sites, sermons, friendly news media, personal friends, and other influential people—in a number of locations: private homes, schools, religious sites, paramilitary camps, prisons, and so on. These aspects can be used to define two basic dimensions of recruiting:

Public versus private channel. Is the interaction taking place in or out of the public eye? The prevailing laws of the region, rules of the local institutions, and attitudes toward the group all will greatly affect where recruitment efforts fall on this spectrum.

Proximate versus mediated contact. Is the source of the recruitment effort physically close to the target audience? Cultural, technology, and economic circumstance are some of the variables that influence how the recruiting message can be passed to the intended target audience.

The rapid proliferation of network technology greatly increases the opportunity for interactions in mediated recruitment and for effective interactions in proximate recruiting efforts.

This can present challenges for prevention professionals:

Limiting a terrorist’s ability to recruit new members is already difficult. However, some technological advances might make countering terrorist organization recruiting harder still. Recruiting could be made more effective and efficient by the transfer of all or most of the indoctrination process into a virtual setting (e.g., online, videos). Although much recruiting may already be done virtually, indoctrination is more problematic, since many of the techniques used in indoctrination typically require immersion and proximity. Carrying out indoctrination processes through virtual channels would require that individuals be willing to isolate themselves, even in the absence of direct control over their actions by group leaders.

I think that last bolded bit is somewhat encouraging. Generally, a person who seeks to join a group (any group) is not looking for more isolation. They are looking for social interaction. They want to become a part of something. While it is possible that isolated immersion into a virtual world, with a virtual social sphere, could give a recruit this kind of social contact, from the perspective of a terrorist recruiter it may be simpler and more straightforward (albeit slower) to recruit the old fashioned way. The one-on-one, personal method also allow a recruiter to size up each recruit on an individual basis. Recruiting an online persona in a virtual world is riskier from the standpoint of operational security, because as the saying goes, "anyone on the Internet could be a dog."

Interestingly, RAND focuses on one potential avenue for distributed recruiting, the massively multiplayer online game (MMOG). "The SIMS" may be the best-known example of such a game.

The latest generations of computer-based, massively multiplayer online games (MMOGs), in which many individuals interact in a common virtual world, constitute a step toward the conditions in which such indoctrination might take place.

However, as intriguing as the games are and the possibility is that they could be used in ways to help in some serious applications such as reinforcing principles learned in conventional training situations, they represent a fairly modest enhancement to the terrorist repertoire of communication techniques. The communication enabled inside the game does not differ not significantly from other Internet-enabled communication,

A more interesting element of MMOGs, however, is that they might be a means by which groups may begin associations that they take offline, and thereby become a means of helping in recruiting processes.

Given the investment that has to take place to develop one of these games, my sense is that it's something of a long-shot to imagine terrorist groups making widespread use of them, especially when they would have to take their activities offline eventually anyway.

I'll briefly cover one other potential terrorist use of information technology - the planning of a terrorist attack. RAND points out that online information (as we all know) is generally not reliable enough to make final planning decisions. On-hand reconnaissance is necessary. This, of course, presents another vulnerability for any operational terrorist group.

Some useful planning information may be acquired from the Web, but recent studies indicate that, in most instances, it is not of sufficient resolution or reliability for terrorists to use it in final planning because of the risk from flawed or incomplete data to an operation’s success (Baker et al., 2004). It may, however, allow groups to focus their physical observations and thus lower the amount of exposure associated with reconnaissance.

In general, I agree with RAND's suggested strategy for countering the terrorist threat, which is to focus efforts on exploiting terrorist uses of information technology, rather than attempting to deny them the ability to use the technology. In a wired world, it's a lot harder to keep the technology out of their hands than it is to work in the background and exploit the vulnerabilities they expose themselves to, by virtue of using the technology:

The analysis suggests that the approach to countering terrorist groups’ use of network technology should focus primarily on the use of the technology as an efficiency-enhancing mechanism rather than one that allows dramatic new operational effects.

In developing such a strategy, security force decisionmakers should consider not only denial countermeasures—that is, measures that preclude the technology’s adoption, prevent its use, or degrade an adversary’s ability to use it as intended—but also exploitive countermeasures that enable security force operations that disrupt a terrorist organization more directly through offensive operations or arrests.

Security forces would do well to consider a countermeasure strategy based on terrorist organizations’ preference for exploiting the use of network technologies, rather than seeking to counter them directly. ... From a technical perspective, the approach suggested here, which can include allowing terrorists to use a given technology in order to exploit it, may seem counterintuitive, but may be the most effective (and practical) option in some circumstances.

Successful exploitation of a resource can also serve as a deterrent. If a terrorist group suspects that their information network has been compromised, they may give up use of that technology on their own. A well-known case of this is the abandonment of cell phones by al Qaeda operatives in Afghanistan when it became known that their calls could be monitored.

The best use of resources for those attempting to counter terrorist operations would seem to be developing ways to exploit the network technologies that terrorists will continue to use and that offer the highest payoff. ... Such exploitation can support direct action, such as arrests, and, because it threatens a key operational imperative of terrorist organizations, their security, it can also deter the use of the technology.

Drive-Thru Flu Shots

This is not a new idea, of course, but it's nice to see smaller communities thinking ahead, preparing for potential future disasters by changing the way they deliver the good old annual flu shot. Here's what they're doing in Boonville and Newburgh, Indiana:

Warrick County residents who want a flu shot this year can help out the county’s health department and participate in a disaster preparedness drill. On two Saturdays, flu shots will be given at drive-through clinics, one in Boonville and the other in Newburgh.

“It will test our disaster plan and our ability to give a large number of vaccines to a large number of people in a limited time,” said Sharon James, a Warrick County Public Health Nurse. “If we’d have an outbreak, we might be called upon to give medicine or a vaccine for whatever is out there.”

“The only way to know if we can do this is to practice,” said James. “And the only way to practice is to get people to come."

The idea of having drive-through clinics is a new one for the Warrick Health Department.

The idea, said James, came from a local hospital that tried the tactic last year. Patients will be directed to locations to fill out paperwork and get the flu shots without ever leaving their vehicles.

“People will pull into the parking lot, and there will be traffic controllers to direct them,” said James. “They will fill out their paperwork, be given an information statement and pay their money. Then they will drive forward under a tent, and there will be nurses on either side of the car, so we can do the driver and passenger at the same time.”

Another idea for emergency distribution of medicines that I find intriguing is to enlist the help of restaurants with drive-thru windows to serve as distribution points. Decentralizing the distribution can help speed the process and raise public confidence in the public health system. The trick is to work out the logistics and the record-keeping.

Information Sharing in Reluctant Neighborhoods

The latest issue of Officer.com has a nice article on encouraging information-sharing between police and citizens, especially in neighborhoods where residents are generally hesitant and may be distrustful of the police. The article focuses on recruiting volunteers who will regularly help police, but the advice is sound in any case.

Police officers are advised to think like marketing executives, paying close attention to the needs of their "customers" (i.e., those who may share information with them):

[T]hought should be given to how your volunteers will be perceived by their fellow citizens.

When faced with troubled areas of your community, a different approach to marketing your volunteer unit to soften the perception could be as simple as a name change. Choosing a unit name such as Neighborhood Assistance Volunteers or Community Support Team removes what could be viewed as negative words.

At some point, your volunteers will speak with their peers in the community, at which time they can explain their purpose.

Not feeling singled out by their peers as "police in hiding" may also provide an incentive for members of the community to step up and perhaps join the team or at least pass on information that may help your agency to solve and prevent crimes.

Projecting an image of helping the community - being supportive and assistive - extends beyond just words:

Some simple resources to consider would be providing your volunteers with a list of community agencies that offer help to folks who may be having problems paying their utility bills, resolving disputes with neighbors and landlords, finding educational programs to increase their self-worth and more.

Other ideas may include providing your volunteer units with donated child safety car seats, and/or bicycle helmets for families that may not otherwise be able to afford them.

Other items to consider may be new donated basketballs, footballs and games to give children in the community something constructive to do, rather than just hanging out on the street corner. Doing so will help your volunteers "walk the walk" if challenged by their peers to demonstrate how they are "assisting and supporting" the community versus "working for the police."

This is all part of building a trusting relationship. In the end, we freely share information with those we trust.

Pandemic Flu: Europe Not Prepared?

Just a brief note on this article regarding European preparedness for pandemic flu:

The study of 29 European countries by scientists at the London School of Hygiene and Tropical Medicine highlighted shortcomings in preparation for vaccine and antiviral drug distribution, insufficient stockpiles, and incoherent plans for border controls.

None of that sounds very good - but this is a pretty brief list. Some other issues are potentially more important. For example, it's likely that in the early stages of a pandemic, no vaccine will be available, as it will take time to develop a vaccine that targets the pandemic strain. Communities and nations have to be prepared for that phase of a pandemic.

In the absence of vaccine, social distancing is one of the best tools for slowing the progress of pandemic flu, so the planning needs to take into account healthcare resources, economic necessities such as food and water, and schools.

The full WHO report on Europe is here.

(Hat-tip to H5N1.)

Revised Homeland Security Strategy

The White House has formally released the revised National Strategy for Homeland Security. Also see this fact sheet.

(Hat tip to Jonah at HLS Watch)

Fight the Network, Not the Terrorist

Douglas Farah's post, "Why the Suicide Bomb Network Must be Dismantled," made me think more about a few recent incidents in which potential terrorist bombings have been prevented at more-or-less the last minute (e.g., London/Glasgow, Austria).

While it's comforting that no innocent lives were lost in these incidents, this is no way to fight a terrorist network. Farah also takes this view:

It is true that it is virtually impossible to halt the actual suicide bomber on his mission. But there are vulnerabilities in the network that create these human weapons. These areas can be far more easily attacked than the final product.

As Bob Baer, formerly of the CIA, recently wrote ... "this is an ideological battle that will be won, or lost, at the local mosque, at the family dinner table or between friends across the Islamic world."

Baer makes an important point here. Outsiders will not be able to "win" an ideological war between jihadists and nonviolent Muslims. But Jihadists are vulnerable in this ideological war, as the U.S. Military Academy's "Militant Ideology Atlas" pointed out:

The Jihadis lose credibility among mainstream Muslims when they attack women, children, and the elderly; damage the sources of a nation's wealth (such as tourism and oil); kill other Muslims; and declare other Muslims apostates.

(Also see my post on the Atlas.)

Evan Kohlmann also made a similar argument at the Counterterrorism Blog yesterday, pointing out that Algerian jihadists in the 1990s overreached and suffered backlash from the non-extremist population:

These men adopted a new philosophy that was, in short, "you are either with us or against us." According to Abu Hamza, "They classed the [faithful] Mujaahidin doing proper Islam as apostates. This was because they did not label every single person as a kaafir [infidel]… Anyone who differs with them, they call him a kaafir [infidel]."

In reflection, Abu Hamza al-Masri was deeply critical of these actions, referring to them as the equivalent of "shooting ourselves in the head": "This gave the enemies of jihaad a gun that they had never dreamed of having, ready pointed at us and loaded... This had far reaching consequences that sent an earthquake of instability among the adherents [of the mujahideen] and [their] aims. This worked beautifully for the enemies of Islam who were searching for a doorway or any angle to help them...in hopes that many people will leave the jihaad principles and the path of jihaad, only to seek reform through other means that are un-Islamic, like Democracy, Socialism, etc."

So there is an avenue for undermining the ideological legitimacy of the jihadists.

On the policing side, Farah goes on to argue, as I've also noted before, that some of the most vulnerable elements of a terrorist network are found in the recruiting and fundraising functions.

Imams that drum up volunteers-a key element. One that is often undertaken by mosques associated with the Muslim Brotherhood, particularly in Europe, and most noticeably in Great Britain.

Forgers almost always operate in networks, with different types of expertise working together. Another choke point.

Any of these chokepoints, from radicalization in mosques to radicalization in prison to cutting off the criminal enterprises that convey the suicide bombers to Iraq, are more efficient that hoping to stop the young person once they are one their way with a vest packed with explosives.

That's absolutely right.

Complications of a Regional Approach

I like the regional approach to security. A number of states have taken regional approaches, from Massachusetts, to Virginia, to Missouri. DHS has encouraged regional and multistate approaches; so has the National Governor's Association.

Many potential threats - both natural and man-made - are regional in scope. Regional approaches foster collaboration between neighboring jurisdictions, even those across international boundaries, such as

But there is a trick. We have existing government structures for local communities, states, and the nation. But for regions - not so much.

The Altoona Mirror reported that Pennsylvania has experienced problems defining ownership of assets that had been acquired for regional task forces:

The South Central Mountain Counter-Terrorism Task Force stopped its financial operations this summer because of concerns raised about who owns the federally funded equipment distributed throughout the eight-county region.

"The task force equipment wouldn’t have been locked up, and we wouldn’t have been told, 'You can’t use it,'" said Dave Cubbison, director of the Bedford County Department of Emergency Services.

Ownership became an issue when Centre County was advised by its auditor last year that it should list itself as the owner of all equipment bought for the task force. Centre is the task force’s financial agent.

The county disagreed with the finding because the equipment had been distributed throughout the eight counties.

"It was never clarified by the state," Nichols said.

The clarification came in a June e-mail from PEMA, which buys the equipment. The county that receives the equipment through the U.S. Department of Homeland Security grant is considered the "owner," Centre County Emergency Management Director Randy Rockey said.

Financial operations resumed in September after the task force received clarification from the state and federal governments, said task force chairman David Nichols, also Snyder County’s emergency management director.

Pennsylvania has also experienced problems with keeping inventory of available assets.

Another problem identified in the state report is the lack of a centralized database to manage resources on the municipal, county, task force and state levels.

Each county in the task force keeps track of its equipment, mostly on spreadsheets.

If you don't know an asset is available, it might as well not be available. It's critical to share this information.

Port Security Shortfall

Just taking note:

The Coast Guard faces budget challenges in obtaining the $260 million it estimates is needed to upgrade its command centers to meet the requirements of the Safe Port Act of 2006, according to a new report from the Government Accountability Office.

[A]ccording to the Coast Guard, none of the existing 35 sector command centers currently meets the requirements of the act, the report states.

However, four joint operations centers the Coast Guard has established with the Navy are a significant step in meeting these requirements, the report states.

There's nothing new about funding shortfalls, of course. Ports are such critical links in our economic system and critical nodes in our domestic security system, that I continue to be amazed by any shortfalls in securing them.

Bird Flu - Taking Note of the News...

This may not mean anything, but due diligence requires that we take note:

The H5N1 bird flu virus has mutated to infect people more easily, although it still has not transformed into a pandemic strain, researchers said on Thursday.

The changes are worrying, said Dr. Yoshihiro Kawaoka of the University of Wisconsin-Madison.

"We have identified a specific change that could make bird flu grow in the upper respiratory tract of humans," said Kawaoka, who led the study.

"[U]sually the bird flu doesn't grow well in the nose or throat of humans," Kawaoka said. This particular mutation allows H5N1 to live well in the cooler temperatures of the human upper respiratory tract.

"Clearly there are more mutations that are needed. We don't know how many mutations are needed for them to become pandemic strains."

The next pandemic flu might be next week, might be next year, might be in 20 years. The pandemic flu might not come from birds, either.

As Hamlet said, "The readiness is all."

(Related item: The California Association of Health Facilities has issued a new pandemic flu workbook for long-term care providers.)

Update Oct. 8, 2007: A bit of perspective from Effect Measure:

This is pretty scary sounding but it isn't new scary sounding. Kawaoka confirmed and filled in the picture about a mutation we already knew about, which is why he looked at it more closely in this paper. As far as we know the suspicion that a mutation in the PB2 gene at position 627 that substitutes lysine for glutamic acid (the mutation is written E627K in shorthand) goes as far back as 1992 when Subbarao, London and Murphy showed it was needed for a bird virus to infect mammalian cells. The idea that temperature is important was reported by Massin and colleagues in 2001.

Can We Count on Overseas Interdiction? Maybe Not So Much

Just a brief note on a new GAO statement on the effectiveness of U.S. law enforcement agencies' work with foreign governments to prevent terrorism. The report focuses on federal agencies such as DHS, the FBI, Immigration and Customs Enforcement, etc.

Generally it finds that, in spite of some recent successes, the effort is not organized as well as it could be:

Law enforcement agencies (LEAs) have increased efforts to help foreign nations identify, disrupt, and prosecute terrorists. However, we found that because most LEAs, with the exception of the FBI, have not been given clear guidance, they lacked clearly defined roles and responsibilities on helping foreign nations identify, disrupt, and prosecute terrorists. In one country we visited, the lack of clear roles and responsibilities between two U.S. LEAs may have compromised several joint operations intended to identify and disrupt potential terrorist activities, according to the U.S. and foreign nation LEAs. In addition, we found LEAs generally lacked guidance on using resources to assist foreign nations in addressing terrorist vulnerabilities and generally lacked performance monitoring systems and formal structures for sharing information and collaborating.

It's not like they haven't been doing anything; they have, especially the FBI. It's just not coordinated. One result has been a lack of information sharing that is especially disheartening:

In three of the four embassies we visited, we found that the embassies generally retained pre-9/11 structures for information sharing among LEAs. Although embassies generally use law enforcement working groups to share information, we found they were not focused on joint investigative or operational efforts to identify and disrupt terrorist acts. For example, in one country we visited with an extremely high terrorist threat, an FBI official told us that the law enforcement working group had never been asked to try to identify or disrupt any of the terrorists on the most wanted lists of the departments of State or Defense, or of the foreign nation itself.

Of course, for local officials this doesn't really change anything. Local officials need to be vigilant. But it would be better to hear that overseas efforts - to stop them "over there" - are better organized.

The Nuclear Threat: A Close Look

The Nuclear Threat Initiative (NTI) has just released the Securing the Bomb 2007 report on the threat of nuclear terrorism. The report focuses on the risk of detonation of a nuclear weapon, primarily by terrorists. It pays little comparatively attention to other nuclear risks such as "dirty bombs" or attacks/accidents at nuclear power facilities.

NTI makes clear, early on, that the risk is real. There are two main scenarios: Either a terrorist group steals or buys a nuclear weapon on the black-market (perhaps stolen from Russia or Pakistan), or a terrorist group acquires nuclear material (either highly enriched uranium [HEU] or plutonium) with the intent of making a nuclear weapon. For technical reasons, HEU would be the more likely choice, as HEU can be used in a simpler "gun" type device.

NTI makes clear that the risk is realistic, even if it's remote compared to other risks such as conventional explosives.

A terrorist's first problem would be acquiring the material. The good news is that they can't make it on their own - it's too technically difficult. But it may be possible to acquire it, especially through three potential avenues:

[I]t appears that the highest risks of nuclear theft today are in Russia, Pakistan, and at HEU-fueled research reactors.

Russia has the world’s largest stockpile of nuclear weapons and materials, and remains the only state in the world where authorities have confirmed that terrorists have been carrying out reconnaissance at nuclear warhead storage sites.

[I]n February 2006, Russian citizen Oleg Khinsagov was arrested (along with three Georgian accomplices) with some 100 grams of HEU enriched to 89% U-235. The arrest was part of a sting operation in which a Georgian government agent posed as an Islamist buyer for a “serious organization.”

The risk of theft is real:

Today, security for the world’s vast and widely distributed nuclear stockpiles varies enormously, from excellent to appalling.

[A] substantial number of incidents of actual theft of weapons-usable nuclear material have occurred. ... The IAEA database on nuclear smuggling includes 15 incidents of real theft and smuggling of separated plutonium or HEU confirmed by the states involved.

In Russia, Chechen terrorists (some of whom have close links to al Qaeda) have carried out reconnaissance at nuclear weapon storage sites.

Locally, the greatest risk comes from research reactors:

More than 140 research reactors around the world are still fueled by HEU (though usually in forms that would require modest chemical processing before the material could be used in a bomb), and many of these facilities have modest security in place—no more than a night watchman and a chain-link fence in some cases.

A majority of research reactors are either in the United States or Russia.

Even at U.S. research reactors - especially at universities - security is relatively low:

Nuclear Regulatory Commission (NRC) security rules for research reactors are remarkably weak. ... U.S. HEU-fueled research reactors regulated by the NRC continue to have only the most modest security measures in place.

[As of the end of 2007] there will be 19 remaining HEU-fueled research reactors in the United States, of which 8 are licensed by the NRC.

Most civilian research reactors have very modest security. Some are located on university campuses, where providing serious security against terrorist attack would be virtually impossible—and where many of the operators are students, who cycle through frequently, making it extraordinarily difficult to provide serious checks of potential insider thieves.

In mid-2005 an investigation by ABC News documented conditions ranging from sleeping guards to security doors propped open with books at nearly all of the 26 U.S. university-based research reactors, including those with HEU.

None of the U.S. NRC-regulated HEU-fueled research reactors should be considered adequately secured against plausible terrorist and criminal threats (though several have either very modest amounts of HEU on-site, or HEU that is quite radioactive).

Once weapons-capable nuclear material has been stolen, especially HEU, it's virtually impossible to detect and locate. Unlike many nuclear materials (such as the fuel for a nuclear power plant), HEU gives off relatively little radiation, making it possible to transport with only minimal shielding.

[O]nce nuclear material has been stolen, it could be anywhere, and all the subsequent layers of defense, unfortunately, are variations on looking for needles in haystacks.

Moreover, the radioactivity from these materials is weak and difficult to detect from any substantial distance. ... You still can’t detect a nuclear device unless you are close to it.

Radiation detectors ... would have essentially no chance of detecting “clean” HEU with even modest shielding.

Even the expensive new Advanced Spectroscopic Portals now being developed would not substantially improve the ability to detect shielded HEU.

As drug smugglers and illegal immigrants have amply shown, it is not hard to sneak into the United States:

The myriad routes across the world’s scantily protected borders make nuclear smuggling almost impossible to stop. ... Attempting to protect the United States from nuclear terrorism by detecting and stopping nuclear contraband at the U.S. borders is like a football team defending at its own goal line.

And although terrorists could not enrich uranium themselves, it is conceivable that they could develop and transport a crude weapon:

Terrorists would need about 50 kilograms (110 pounds) of HEU for the simplest gun-type bomb—an amount of material roughly the size of a six-pack.

Even before the Afghan war, U.S. intelligence concluded that “fabrication of at least a ‘crude’ nuclear device was within al-Qa’ida’s capabilities, if it could obtain fissile material.”

Even a fully assembled bomb of the crude type terrorists might make could fit in a truck, a fishing boat, a small plane, or the hold of a yacht.

So there is some level of realistic threat, despite the technical difficulties involved and the challenge of acquiring fissile material.

How to solve the problem? A lot of the potential solutions would be in the jurisdiction of agencies such as the Department of Energy and Nuclear Regulatory Commission, along with the State Department and International Atomic Energy Agency (IAEA) for international efforts.

However, there is a local element to solving this problem. Police work is extremely important:

Almost all of the known interdictions have resulted from good police or intelligence work—from sting operations, or from people who became aware of the conspiracy deciding to inform the authorities. There are a wide range of steps that can and should be taken to strengthen international police and intelligence cooperation, to pursue additional demand stings (posing as buyers of nuclear material or expertise) and supply stings (posing as sellers), and to encourage the semi-feudal chieftains who control some of the world’s most dangerous borders to let us know about transports of nuclear material.

Some local police agencies have even provided security for local research reactors:

At the reactor at the Massachusetts Institute of Technology (MIT), since 9/11, there have been 1-2 Cambridge police officers with side-arms on-site to provide security—though these are not required by NRC rules. (Prior to the 9/11 attacks, the facility had no armed guards on-site, relying on response from off-site campus police of-ficers in the event of a problem.)

Other law enforcement activities, such as preventing recruiting and curtailing financial activities, may also be effective:

Terrorist efforts to recruit people with relevant expertise—such as nuclear physicists, metallurgists, or uranium machinists—may be one of the more detectable activities associated with a nuclear weapons effort. To increase awareness of this potential problem (and increase the chance that such recruitment attempts would be reported), police and intelligence agencies should seek to build relationships at locations that may pose particular opportunities for such recruiting efforts.

[I]t is worth making a major effort to change the conditions that make it easier for extreme Islamist terrorist groups to recruit and raise funds—to reduce the dangers of all forms of terrorism, not just nuclear terrorism.

Given the global nature of the threat, as well as the technical expertise required for dealing with nuclear materials, local officials may have relatively limited options to deal with the threat of nuclear terrorism; but that's not the same thing as having no options.

FEB's: Greasing the Wheels?

Given recent reports regarding the complexity and lack of clarity regarding the response to a biological incident (read: pandemic flu), GAO Director of Strategic Issues, Bernice Steinhardt, speaks glowingly of the ability of Federal Executive Boards (FEBs) to grease the wheels.

Created by a Presidential Directive in 1961, the FEBs are composed of the federal field office agency heads and military commanders in the FEBs’ areas of service.

Located in 28 cities with a large federal presence, the FEBs are interagency coordinating groups designed to strengthen federal management practices and improve intergovernmental relations. The FEBs bring together the federal agency leaders in their service areas and have a long history of establishing and maintaining communications links, coordinating intergovernmental activities, identifying common ground, and building cooperative relationships. The boards also partner with community organizations and participate as a unified federal force in local civic affairs.

The Office of Personnel Management (OPM), which provides direction to the FEBs, and the boards have designated emergency preparedness, security, and safety as an FEB core function and are continuing to work on a strategic plan that will include a common set of performance standards for their emergency support activities.

They already outreach with state and local agencies - good!

OPM reported that it expects the boards to serve as federal liaisons for state and local emergency officials and to assess local emergency situations in cooperation with federal, state, and local officials.

As a natural outgrowth of their general civic activities and through activities such as hosting emergency preparedness training, some of the boards have established relationships with, for example, federal, state, and local governments; emergency management officials; first responders; and health officials in their communities. Some of the FEBs are already building capacity for pandemic influenza response within their member agencies and community organizations by hosting pandemic influenza training and exercises.

Terrific! But all is not rosy.

The FEBs, however, face key challenges in providing emergency support, and these interrelated issues limit the capacity of the FEBs to provide a consistent and sustained contribution to emergency preparedness and response. First, their role is not defined in national emergency plans, which may contribute to federal agency officials being unfamiliar with their capabilities. In addition, with no congressional appropriations, the FEBs depend on host agencies and other member agencies for their resources.

True. FEBs are not mentioned in the National Strategy for Pandemic Influenza or its Implementation Plan, the North American Plan for Avian and Pandemic Influenza, the DOD Pandemic Flu Implementation Plan, or the HHS Pandemic Influenza Plan.

The FEBs are mentioned - once - in the National Response Plan. But their duty is limited to the first hour after an incident, when they are to deliver a "Federal Government status announcement [when the affected area is] outside the National Capital Region (NCR)." And then the FEBs get no mention at all in the draft National Response Framework, the proposed successor to the NRP.

This is a real detriment:

According to both FEB directors and FEMA officials, the FEBs could carry out their emergency support role more effectively if their role was included in national emergency management plans. FEMA officials from two different regions said they felt the boards could be used more effectively and that they add value to the nation’s emergency operations.

So it's perhaps a bit of a stretch to suggest that the FEBs will automatically slot into these plans. Still, they're an existing entity with the right kind of networking skills and mission:

Research has shown that systems like the FEBs have proven to be valuable public management tools because they can operate horizontally, across agencies in this case, and integrate the strengths and resources of a variety of organizations in the public, private, and nonprofit sectors to effectively address critical public problems, such as pandemic influenza.

And they've done good work in the past:

The FEBs have played a role in responding to past emergencies. For example, when the Oklahoma City Murrah Federal Building was bombed on April 19, 1995, the FEB staff knew all of the agencies in the Murrah Building; the home telephone numbers of critical staff; the city, county, and state principals in Oklahoma City; and which federal agencies were available to provide immediate relief and support.

During hurricanes Katrina and Rita, according to a FEMA official, the New Orleans FEB executive director established and maintained an essential communication link between FEMA’s Office of National Security Coordination and OPM.

But their effectiveness is far from universal:

Although all of the boards reported some involvement of state and local officials in their emergency activities, the degree of board connections with state and local officials varied. ... The Dallas-Fort Worth FEB executive director reported that the board partners with state and local government representatives, the private sector, law enforcement, and first responders, all of which are key players in assessing local emergency situations. On the other hand, the Chicago FEB executive director said that because Chicago is so large, the board has few established relationships with state and local officials.

There are other obstacles as well, starting with a serious lack of appropriations:

Although membership by agency heads on the boards is required, active participation is voluntary in practice, and the boards operate with no independent authority. The FEBs also have no congressional charter and receive no congressional appropriation but rather depend on voluntary contributions from their member agencies.

So is this a silver bullet? Even the FEBs say, "maybe not."

Looking ahead, however, representatives from 14 of the 28 FEBs disagreed on the role the boards should play in emergency service support, particularly during an emergency. Without adequate staff and resources, some of the executive directors expressed concern that they will not be able to meet expectations.

But with pandemic flu, the FEBs do have certain strengths:

[T]he nature of pandemic influenza, which presents different concerns than localized natural disasters, may make the FEBs a valuable asset in pandemic preparedness and response.

Many of the FEBs have cultivated relationships within their federal, state, and local governments and their metropolitan area community organizations as a natural outgrowth of their general activities. For example, FEB activities, such as the Combined Federal Campaign and scholarship programs, bring the boards into contact with local charities and school boards.

In terms of current pandemic planning, some of the FEBs are already building capacity for pandemic influenza response within their member agencies and community organizations by hosting pandemic influenza training and exercises.

The big question: Can FEBs really facilitate broader information sharing and clarify responsibilities? Or would it be a case of one more group without a clear mandate, gumming up the works?

Another Information Sharing System

FEMA has contracted an IT company to create an information-sharing system for emergency response:

Emergency responders nationwide will soon have access to vital information via a single online source.

The Federal Emergency Management Agency awarded a contract Sept. 28 to CNI All Points Logistics to set up FEMA’s Emergency Management Information Management System (EMIMS) as a repository for emergency management information.

"The system will be used to coordinate and effectively manage the incident, to develop future operational plans, to prepare comprehensive periodic reports, to track information requests and other pending actions, and to maintain accurate records,” according to a FEMA news release.

EMIMS sorts emergency information for validity and importance and then distributes it to multiple offices, including the National Response Coordination Center (NRCC), Regional Response Coordination Center and the Joint Field Offices.

"Any person who’s in a position of command-and-control responsibilities, such as [the head of] the NRCC, needs instant access to information that he needs to make decisions in reference to the proper way to respond to whatever happens to be going on,” said John Richardson, contract specialist at FEMA. “This system will consolidate all that information and provide it in a format which [responders] will be able to read.”

Richardson said the basic system should be installed in two weeks, with additional customization to follow.

Questions: Let's say I'm with another federal agency, working at the Joint Field Office (JFO) under one of the Emergency Support Functions (ESFs). Do I have access to this system? Do I have access to this information? Is this system compatible with the other information systems that I already use?

Also, will the information be shared with state and local personnel? If I'm working at a state Emergency Operations Center - same deal.

Preparedness: Are We REALLY Sure?

It's hard to see the justification behind this:

The nation is preparing for its biggest terrorism exercise ever next week when three fictional "dirty bombs" go off and cripple transportation arteries in two major U.S. cities and Guam, according to a document obtained by The Associated Press.

Yet even as this drill begins, details from the previous national exercise held in 2005 have yet to be publicly released — information that's supposed to help officials prepare for the next real attack.

"The challenge with TOPOFF is not the exercise itself. It's to move as quickly as possible to remedy what perceives to be the problems that are uncovered," former Homeland Security Secretary Tom Ridge said in an interview with AP this week.

Yes indeed.

Ridge, who launched his own security consulting company on Monday, said he's a big fan of the TOPOFF exercises. But he said "it's not acceptable" that the review from the 2005 exercise is still not released publicly.

The after action report from TOPOFF 3, which deals with issues that came up in the 2005 exercise, is supposed to identify areas for improvement. That report is still going through internal reviews.

If one were feeling snarky, one might wonder if al Qaeda uses a similar review process.

According to a brief summary of the 2005 exercise — marked For Official Use Only, but obtained by AP — problems arose when officials realized the federal government's law for providing assistance does not cover biological incidents.

Hmm ... no clear authority for biological incidents. That sounds familiar.

Stopped at the Last Second

Yet another tale of a last-second intervention: A guy in Austria walks into the US Embassy with a sack of grenades and nails:

A Bosnian man carrying a bag of hand grenades and nails has been arrested after trying to enter the US Embassy in Vienna.

He was detained after a metal detector alarm sounded as he attempted to walk into the building, according to reports.

He dropped the backpack, fled on foot, but was arrested a short distance away. The bag also contained Islamic literature, Austrian police say.

"There were a lot of nails in that bag. Had it exploded, it would have had an enormous shrapnel effect," Doris Edelbacher, of Austria's counterterrorism office, said.

Great news, everything worked out, except...

It was only the last layer of security that stopped him. You can't count on last-second stops as a prevention strategy.

Are We Prepared? Are We Sure?

An article from last week's Federal Computer Week was provocative in that it raises the question: How do we know we're prepared?

A misconfigured firewall that malfunctioned during a federal disaster preparedness exercise in April showed how tenuous disaster preparation can be.

Mike Nicholson, director of the requirements office of the information technology division at the Homeland Security Department’s National Protection and Programs Directorate, said the firewall problem prevented an Army unit from connecting with the Defense Information Systems Agency, almost scuttling the demonstration.

“It took a month to get that resolved,” a delay that would not have been acceptable during a real emergency, Nicholson said.

That lesson highlights the reality that emergency preparedness requires training for almost every possible situation.

But many DHS officials say that even thorough training might not be sufficient. The most well-prepared plans can be derailed by the unpredictable nature of disasters.

Here's the thing: It's not how "well-prepared" the plan is. It's how adaptable it is. It's how flexible it is. it's how non-brittle it is.

You can plan and exercise your disaster strategy again and again, but it is still at risk if it is a brittle system, or if it relies on brittle systems. And we do have some brittle systems.

Other officials said a major component of disaster preparedness is coordinating with state and local governments. Although disasters typically are localized events, the federal response can be stymied by lack of local knowledge and obsolete information technology systems.

For example, making quick emergency acquisitions can be difficult because of regulations that require the government to spend some disaster relief money with local businesses to help rebuild economies in affected areas.

“The problem is trying to get these local communities acclimated to federal contracting,” said Tina Burnette, director of acquisitions management at the Federal Emergency Management Agency. “The laws that govern federal contracting are complicated.”

Think about those highlighted words, and whether they signify an adaptable or a brittle system. Federal agencies lack knowledge of local assets (a solveable problem in an adaptable system, but an intractable one in a brittle system). We are burdened with old, unchanging IT systems. We box ourselves in with regulations and complicated contracting rules.

Adaptability is the key to survival, both in nature and in human systems. It is even more so during a catastrophe.

On Precursor Crimes

Just a quickie on precursor crimes. In The Washington Institute for Near East Policy's PolicyWatch/PeaceWatch Michael Jacobsen writes:

[Europe and America's] preventive strategy [regarding terrorism] has revolved around an increasingly aggressive law enforcement approach. In 2006 alone, for example, European authorities arrested a total of 260 terrorist suspects. Most of these individuals were charged not with plotting attacks, but with a variety of other terrorism-related offenses such as financing, recruiting, and facilitation.

Also see these other posts re: precursor crimes.

Pandemic Preparedness: Adequate?

A brief GAO report asks if we're really prepared, especially at the federal level, for a flu pandemic. The short answer is, no. Although we have a National Strategy for Pandemic Influenza and an Implementation Plan for the strategy, critical questions remain. For one thing, it's not clear how everyone will play in the sandbox together:

Key federal leadership roles and responsibilities for preparing for and responding to a pandemic continue to evolve and will require further clarification and testing before the relationships of the many leadership positions are well understood. Most of these leadership roles involve shared responsibilities and it is unclear how they will work in practice. ...

Several federal leadership roles involve shared responsibilities for preparing for and responding to an influenza pandemic, including the Secretaries of Health and Human Services and Homeland Security, the Administrator of the Federal Emergency Management Agency (FEMA), a national Principal Federal Official (PFO), and regional PFOs and Federal Coordinating Officers (FCO). Many of these leadership roles and responsibilities have not been tested under pandemic scenarios, leaving unclear how all of these new and developing relationships would work.

Specifically:

[S]ince a pandemic extends well beyond health and medical boundaries, to include sustaining critical infrastructure, private sector activities, the movement of goods and services across the nation and the globe, and economic and security considerations, it is not clear when, in a pandemic, the Secretary of Health and Human Services would be in the lead and when the Secretary of Homeland Security would lead.

Moreover, under the Post-Katrina Emergency Management Reform Act of 2006 (referred to as the Post-Katrina Reform Act in this testimony), the FEMA Administrator was designated the principal domestic emergency management advisor to the President, the HSC, and the Secretary of Homeland Security, adding further complexity to the leadership structure in the case of a pandemic.

Another question: How is this plan coordinated with the North American Plan for Avian & Pandemic Influenza? (See this post for background.)

Exercises might reveal potential problems, but:

[O]nly one national, multi-sector pandemic-related exercise has been held, and that was prior to issuance of the Plan.

GAO also points to in this Strategy and Plan that ought to be included in such documents:

The Strategy and Plan do not fully address the characteristics of an effective national strategy and contain gaps that could hinder the ability of key stakeholders to effectively execute their responsibilities. Specifically, some of the gaps include

• The Strategy and Plan do not address resources, investments, and risk management and consequently do not provide a picture of priorities or how adjustments might be made in view of limited resources.
• State and local jurisdictions were not directly involved in developing the Plan, even though they would be on the front lines in a pandemic. Officials told us that state, local, and tribal entities were not directly involved in reviewing and commenting on the Plan, but the drafters of the Plan were generally aware of their concerns.
• Relationships and priorities among action items are not always clear.
• Performance measures are focused on activities that are not always linked to results.
• The linkage of the Strategy and Plan with other key plans is unclear.
• The Plan does not contain a process for monitoring and reporting on progress. While most of the action items have deadlines for completion, ranging from 3 months to 3 years, the Plan does not identify a process to monitor and report on the progress of the action items nor does it include a schedule for reporting progress.
• The Plan does not describe an overall framework for accountability and oversight and does not clarify how responsible officials would share leadership responsibilities.
• Procedures and time frames for updating and revising the Plan were not established.

The lack of engagement with state and local officials is especially troubling, especially given the lack of clarity regarding roles. It's just this sort of thing that collaborative effort should be able to resolve.

New Massachusetts State Homeland Security Strategy

Massachusetts has released a new state homeland security strategy. It's an all-hazards strategy, which reflects the experience of Hurricane Katrina and the risk of other natural hazards such as pandemic flu.

The strategy lists three major goals:

Our obligations, from the state’s perspective, whether we are planning for response to a terrorism incident, detecting a potential influenza outbreak, managing a major fire, or preparing for a potential hurricane, are guided by three major goals:

1) to create a common operating picture among all homeland security and public safety stakeholders;
2) to strengthen and expand partnerships across assets and capabilities; and
3) to focus efforts on private sector and public participation in prevention and preparedness.

These are laudable goals - it's especially welcome to see the explicit focus on private sector involvement (more on that later). It covers the whole range of preparedness activities, from prevention to response and recovery:

[T]he state is ultimately responsible for ensuring both effective prevention and effective response and recovery.

Prevention primarily relies on intelligence that's funneled through the state's Fusion Center:

The intelligence aspect of prevention, in terms of securing critical infrastructure, maintaining resource databases, and all aspects of the Commonwealth Fusion Center, contributes to prevention by informing law enforcement and public safety officials about vulnerabilities. Once vulnerabilities are recognized, we can begin to find solutions to prevent incidents.

Initial thought - this is focused on vulnerabilities, but risk is not just vulnerability. Calculating a threat involves not just vulnerability, but likelihood and consequence as well.

To organize the effort, they're using not only the Fusion Center. For coordination of recovery efforts, Massachusetts is using a new, collaborative organization:

[W]e have launched the Massachusetts Recovery Alliance that will convene all relevant parties to ensure that all efforts – from building inspections, to federal support, to workforce replacement – are properly integrated after a disaster.

They also have an Implementation Team that oversees state support of HSPD-8, "National Preparedness":

The HSPD-8 Implementation Team is charged with assessing the ability of the Commonwealth to respond to catastrophic events. Since its inception in 2006, the team has identified and ranked existing gaps in capacity and compiled them into a matrix that aids in establishing funding priorities and gives direction and focus to state and regional capability improvement plans.

For implementation purposes, the state has been divided into 5 geographic regions:

Liaisons from EOPSS Homeland Security Division provide guidance and oversight to each of five geographically designed regions - the Northeast, Southeast, Central, Western, and Metro Boston (UASI) - which were created to support strategic planning and operational coordination at the local level. Regional Planning Councils for each region are responsible for developing and guiding the implementation of regional homeland security plans described in this document. ... Five Regional Homeland Security Advisory Councils serve as the governance body (both policy-making and administrative) for each of the regions.

Each region is responsible for developing local relationships (very good) and is relatively autonomous in setting priorities:

Substantial state and local collaboration and coordination have resulted from the working partnerships of the regions. In furtherance of SHSS activities, each region has individually dedicated homeland security resources to collaboration, planning, equipment, training, and evaluation.

• The Northeast Region has utilized homeland security funding to procure a variety of emergency supplies, coordinate first responder activities, and implement school safety mechanisms.
• The Southeast Region has made significant strides in improving interoperability and incident command training.
• The Central Region has expanded the capability of communities to recover from large scale incidents through the procurement and deployment of emergency equipment.
• Major accomplishments of the Western Region include interoperability and information sharing projects.
• The Metro Boston Homeland Security Region (MBHSR) has improved intelligence and information sharing, as well as communications interoperability.

In terms of implementing the states three major goals, the strategy briefly outlines some of the implementation activities that should go on statewide. Under the first goal of Creating a Common Operational Picture, the initial emphasis is on the fusion center:

Pursue effective prevention efforts through analysis of risks: In order to understand the strategic threats that face the Commonwealth and take the proper and appropriate protective measures, public safety and public policy officials need access to timely, accurate, and actionable intelligence and information. The Commonwealth Fusion Center is at the center of the state’s efforts to receive, produce, and share intelligence assessments and reports with our local, state, and federal partners. To that end, the Fusion Center has recently incorporated personnel and systems from the Federal Bureau of Investigation (FBI) and the U.S. Department of Homeland Security (DHS) to support the seamless exchange of information and intelligence regarding threats to the nation and the Commonwealth. These assessments and related products are regularly shared with key stakeholders for tactical support, situational awareness, and strategic planning purposes.

The top-down emphasis is a bit worrying - they're incorporating federal personnel into the fusion center. Let's not forget threat information that comes up the chain as well. Hopefully the threat information won't come mostly from "above."

However, it's nice to see that the info on vulnerability of particular assets will come from the local level, because locals know that best. Locals can also provide important info that helps determine likelihood and consequences:

Among the Commonwealth Fusion Center’s intelligence assessments and alerts agenda, a present primary focus is the recent adoption of the Automated Critical Asset Management System (ACAMS), a statewide inventory tool to categorize and prioritize critical infrastructure. The process of assessment includes leveraging existing state and local partnerships with public safety stakeholders and other subject matter experts to collect critical asset data by training and providing them access to ACAMS. These teams will bring together public safety professionals with other subject matter experts (e.g. structural engineers) to produce in-depth, robust vulnerability assessments of critical infrastructure and key resources. When joined with the ongoing assessment of potential threats conducted by the Commonwealth Fusion Center, a clearer assessment of risk in the Commonwealth will emerge.

Seems to me that if the fusion center gets information on threats and vulnerabilities from local personnel, as well as relevant info regarding likelihood and consequences, and really fuses it with the information on threat (as well as info relevant to likelihood and consequences) that comes from the FBI and DHS, then the fusion center will really be doing its job - fusing information from all levels to create an accurate picture of the threat. That's a good approach.

Moving on to some of the other objectives of the strategy...you don't always see this one:

Prepare the Commonwealth for Mass Evacuation and Shelter: To date, there are numerous local and state plans. However, they can not each stand alone and succeed. We need to ensure that the plans are fully integrated, that the expectations of one jurisdiction merge with another, and that the state, through the Massachusetts Emergency Management Agency (MEMA), is able to understand and assist in those efforts. ... This overall state and local effort has three interrelated parts – traffic plans, sheltering capacity assessments, and focus on individuals requiring specific assistance.

Next, a few notes on the second major goal, Strengthen and Expand Partnerships for Prevention and Preparedness. This is good to see:

Integrate Public Health Preparedness into Homeland Security Efforts: Protecting public health is an integral part of an all hazards approach to homeland security, whether it be detecting a naturally occurring or man-made public health threat, or protecting our first responders during a potential chemical, radiological, or biological incident.

But ... is there enough capability built into the public health system to accommodate a catastrophe? (See these two posts.) As for distributing medicines their plan is:

The foundation of the Boston plan is the staffing and operation of large dispensing clinics, located in schools and community centers all over the city, where residents would be able to pick up medications for themselves and their families.

On port security, just an interesting factoid:

[W]e continue to work with affected localities and the state of Rhode Island to oppose the proposed LNG terminal in Fall River. The Commonwealth opposes the proposed terminal based on the potential dangers associated with the storage and transfer of LNG and the U.S. Coast Guard report that expresses safety concerns regarding the transfer of LNG through the proposed waterway.

The risk of LNG to surrounding communities is somewhat unclear. Interesting that Massachusetts is taking this stand.

On Goal #3: Focus on Private Sector and Public Participation in Prevention and Preparedness, it's interesting how many of the specific implementation activities under this goal relate to personal preparedness:

Enhance Personal Preparedness: Help Us Help You Campaign - EOPSS is planning a wide variety of events for September, all of which will reinforce the idea that doing a little advance preparation on an individual level will help the government help you in a time of emergency.

Address the Needs of Individuals Requiring Specific Assistance: Statewide Individuals Requiring Specific Assistance Task Force on Emergency Preparedness: The intention is to enhance emergency preparedness planning for people with specific and/or functional needs and to include them in the planning process as well as exercises and drills.

Continue Community Outreach Efforts: Engage and empower immigrant populations. In order to change the pattern of exclusion, outreach efforts have been employed to engage and empower isolated groups.

I'd actually like to see more detail on how large private sector entities will be incorporated into the planning and preparation process (other than the very welcome involvement in ACAMS noted above). Often, critical businesses such as chemical plants, oil refineries, utilities and so on, are reticent to share information because of proprietary concerns.

While it is certainly important for individual citizens to be prepared, it's even moreso for the owners and operators of critical infrastructure elements to be coordinated with the state's preparation and response.

Update Sept. 26, 2007: I'd forgotten about this audit from last year that found Massachusetts unprepared (also see my post). The state Senate committee that oversaw the audit found four areas of concern:

• The state’s insufficient oversight of homeland security planning by cities, towns and the state’s agencies and authorities;
• The state’s failure to provide first responders with the proper means to protect against terrorist activity and natural disasters;
• The state’s inadequate communication of the statewide strategy; and
• The state’s unsuccessful implementation of its homeland security plan.

NYC Public Health System Not Fully Prepared

Not terribly surprising:

New York City's health care system is not prepared for a major disaster such as a large-scale attack, hurricane or pandemic, health care and disaster planning experts said.

The city, struck in the September 11 attacks and a world financial center, is vulnerable due to underfunding and a lack of understanding of the possible complexities of a crisis, officials from city hospitals and emergency services said this week at a conference on disaster preparedness.

"We have no idea what a prepared New York is. What we're doing now is random acts of preparedness that all together don't really amount to an appropriate safety net," said Irwin Redlener, director of the National Center for Disaster Preparedness at Columbia University's Mailman School of Public Health.

"We're in a very, very bad place."

There's a problem - long known - with a lack of excess capability. NYC, despite its high-profile status, is not immune to the problem:

Brian O'Neill, who heads emergency services for the North Shore - Long Island Jewish Health System, said the city's emergency services have the potential to move large numbers of people injured in a catastrophe, but not necessarily the hospital capacity to deal with them.

"We don't have 20,000 open beds ... for hospitals to absorb that," O'Neill said. "We would have to rely, at that point in time, for long-term solutions from the federal government."

Columbia's Redlener said hospitals would be immediately overwhelmed in such a situation and the number of deaths would balloon.

Like I said, all of this is not terribly surprising. Given the threat of pandemic flu, there has been a lot of study of our public health system. The basic problem is that we've given up excess capability for the sake of efficiency. (Which makes perfect sense for most businesses but is debatable in the healthcare field, where you need to be able to accommodate surges in demand.)

The Trust for America's Health reported late last year that we don't have enough beds for a flu pandemic. (Also see my post.)

Half of states would run out of hospital beds within two weeks of a moderately severe pandemic flu outbreak.

Last December, the Trust for America's Health, in it's "Ready or Not?" report, found that:

Forty states and D.C. have a shortage of registered nurses.

Six states cut their public health budgets between FY 2004-05 and FY 2005-06. As of FY 2005-06, the median state funding for public health is only $31 per person per year.

And that the public health system is hampered by:

• Lack of clear roles for the various state, local, and federal agencies.
• Limited coordination among the levels of government, including determination of how federal assets would be deployed to states and localities, and across jurisdictions, such as sharing assets and resources among states.
• No minimum standards, guidelines, or recommendations for capacity levels or services required of state and local health departments. This results in major differences in services and competencies across state and local agencies.

Public health officials in NYC are seeing the effects of this lack of clarity:

Bruce Logan, Chief of New York Downtown Hospital's Department of Medicine, said he was unable to get federal funding for an expansion of the hospital's emergency room, despite being four blocks away from Ground Zero where the World Trade Center's twin towers were destroyed on September 11 and the first hospital to respond to the attacks.

"We're in the financial capital of the world ... I see that emergency room as an element of our national defense," Logan said. "Unfortunately, I can't get our government officials -- especially the state and federal ones -- to see it the same way."

Public health is like anything else: You pays your money, you takes your chances. And we are taking our chances, that's for sure.

(Note: Late in 2007, we're supposed to get an updated report on the status of public health preparedness from the CDC.)