Comprehensive Risk Assessment

Vulnerabilities and risk assessment tend to be undertaken from a micro point of view. For example, if you are a county commissioner you are only looking at those critical infrastructures that fall under your jurisdiction. Out of all of those, you tend to focus on facilities or structures most vulnerable to attack or failure. From there the list is narrowed further prioritizing which infrastructures will received funding to improve their survivability in the event of an attack. Measures could range from hardening to replacement depending on the work required and the funds available to support the work. Prioritization of projects occurs both in the public as well as private sectors and is standard practice for equitably distributing limited funds amongst multiple projects. Often as the saying goes it’s the squeekiest wheel that gets the grease. Prioritization of projects may make sense from a fiscal point of view, however it does not change the fact that many other vulnerabilities may exist but due to a lack a funding must be left until sufficient dollars become available. By addressing vulnerabilities in such a manner, the county commissioner in this example could be increasing the likelihood that their community may be attacked. Tacticians regardless of their motivations and allegiances look for areas of weakness in their enemies defenses to exploit. Major homeland security projects will call the potential terrorists attention to which structures have been protected and be default which ones have not.

With the possible exception of Alexander the Great who favored attacking an enemy at their strongest point, most tacticians (military and otherwise) look for weaker area to exploit during an attack. Attacking a weak point makes sense both from a tactical level as well as a financial one. Going against a hardened facility may be not only be tactically unsound as well as being cost prohibitive. A planner looking for a vulnerability to exploit may discover their target by a simple process of elimination. In one sense by hardening one area against attack may provide the inspiration needed to divine the true area of vulnerability.

Going back to my example of the county commissioner, efforts to insure vital areas and critical infrastructures are protected could drive a terrorist to plan an attack from an adjacent location. The location may not have sufficient funding nor have the same risk associated as their neighbor. For instance, the city water supply may originate from a remote area outside the county and thus susceptible to attack. Taking steps to protect water supplies may cause terrorist planners to note other targets such as power substations, fiber optic cables, or agricultural areas. The location or size of these targets prevents any large scale physical security measures from being enacted. Even in those cases where physical security measures can be taken, costs may prohibit a comprehensive plan from being taken.

Too often communities implement systems to reduce terrorist attacks but do so in a vacuum without looking at how such actions may fit into larger strategic plan. Jonah Czerwinski over on Homeland Security Watch wrote a piece about the New York city subway tip line. If a commuter sees something amiss, they are to call the tip line and report the suspicious activity. As Mr. Czerwinksi notes, the premise is good but is incomplete. Commuters could tie up the tip line with numerous reports of everything BUT the very suspicious activity it was designed to prevent. He notes that despite having not actually capturing any terrorists, it does seem to have made commuters more aware of their surroundings. What is missing in the New York city example, and Ohio for we have a See It Report It hotline, is an education program for the public. The specific behaviors commuters should be looking need to be shared with the public. The system is good but was implemented in a vacuum without taking into considerations how to make it even more effective. The tip-line could be part of a comprehensive plan to increase citizen awareness not just on subways but throughout their daily travels. Citizens in this case could be used force multipliers for law enforcement and others responsible for preventing terrorists attacks.

Education and training of average citizens seems to still be an under-developed area of the homeland security spectrum. Homeland security grants pay for high-dollar projects yet the efficacy of these projects remains to be seen. Ohio has the Multi-Agency Radio Communication System (MARCS) which gives subscribing agencies contiguous communications throughout the state. Because agencies have to pay monthly fees per each radio, many smaller agencies are unable to afford MARCS radio. In theory MARCS is a statewide radio network but costs prohibits all agencies from being able to use it. Inversely the most remote communities are the ones with the least number of radios due to the costs which these communities cannot afford. To be sure, MARCS is far better than what Ohio had in 1989 and had NO interoperable radio system during the Shadyside floods. However, MARCS needs to be part of a comprehensive interoperability plan and one that the average citizen understands.

Football season is over for teams from the local area (the Bearcats won their bowl game and well the Bengals are still the Bengals) but I still recall watching a championship high school game earlier this year. Two high school teams were playing for the regional championship at the University of Cincinnati with a record crowd of 20,000 (a huge turnout). It occurred to me that for all of the fear about attacks at NFL games, a Friday night high school game could present a terrorist far easier group for attack. Homeland security experts and law enforcement agencies would agree there is a risk but would also lament the lack of funding to deal with a rather remote threat. Instead of accepting this defeatist attitude, the development of a comprehensive homeland security plan that includes educating the public what to look for would pay far more benefits than many of the high dollar measures. Of course educating the public runs the risk of offending special interest groups but if these groups are brought in at the start, such protests could be reduced or eliminated altogether. Comprehensive means not just addressing all likely scenarios and vulnerabilities but also including all stakeholders from the community. Education of the community may not pay high-dollars but it is a cost-effective way of protecting ALL of the community, not just selected portions.