Summary: The Bush administration has waged an aggressive war against terrorists abroad, but it has neglected to protect the homeland, even though Americans in the United States are the ones most vulnerable to future attacks. The government must do more to safeguard critical U.S. infrastructure and mobilize the American public to help. For starters, it should create a semi-independent federal agency tapping into private resources that would develop and enforce security standards.
A FAILURE TO PROTECT
The United States is living on borrowed time -- and squandering it. The attacks of September 11, 2001, on the World Trade Center towers and the Pentagon highlighted just how open the United States is to unconventional attacks. The widespread economic and social disruption that flowed from the suicidal acts of just 19 terrorists also exposed the Achilles' heel of the world's sole superpower. The transportation, energy, information, financial, chemical, food, and logistical networks that underpin U.S. economic power and the American way of life offer the United States' enemies a rich menu of irresistible targets. And most of these remain virtually unprotected.
It does not have to be this way. Choosing to invest in offensive and defensive capabilities should not be an either-or proposition. In war, nations need both. Given the wealth of the United States, it can clearly afford to protect its most valued assets along with fielding a second-to-none military. But it cannot strike the right balance as long as it persists with treating homeland security as wholly separate from national security. Nor can muscular efforts to combat terrorism at its source be a substitute for the systematic engagement of civil society and the private sector in a collective effort to confront the threat of catastrophic acts of terror at home. The United States must do more than transform its armed forces and repair its broken intelligence services. It must also provide a new institutional framework to construct a more resilient society that has the capacity to take a blow as well as to strike one.
Washington has demonstrated an extraordinary degree of hardheadedness when it comes to acknowledging the limits of its military and intelligence capabilities to combat the terrorist threat. The premise behind the Bush administration's strategy of preemptive use of force is that as long as the United States is willing to show sufficient grit, it can successfully hold its enemies at bay. Vice President Dick Cheney made this case recently in an address to a class of newly commissioned Coast Guard officers. He asserted, "Wars are not won on the defensive. To fully and finally remove this danger [of terrorism], we have only one option -- and that's to take the fight to the enemy." On July 4, 2004, President George W. Bush made the point this way: "We will engage these enemies in these countries [Iraq and Afghanistan] and around the world so we do not have to face them here at home."
Targeting terrorism at its source is an appealing notion. Unfortunately, the enemy is not cooperating. There is no central front on which al Qaeda and its radical jihadist imitators can be cornered and destroyed. The commuter train bombings in Madrid in March illustrate that terrorists are living and operating within jurisdictions of U.S. allies and do not need to receive aid and comfort from rogue states. According to the U.S. Department of State's latest revised global terrorism report, the number of terrorist incidents went up in 2003, despite the U.S.-led invasions of Afghanistan and Iraq. And, according to a July statement by Secretary of Homeland Security Tom Ridge, al Qaeda remains at large inside the United States, busily planning its next attack on U.S. soil, perhaps before the November elections.
THE PHONY WAR
The reluctance of the White House and the national security community to adapt to the shifting nature of the terrorist threat bears a disturbing resemblance to the opening chapter of World War II. In September 1939, the German army rolled eastward into Poland and unleashed a new form of combat known as "blitzkrieg." When Poland became a victim of the Third Reich, London and Paris finally abandoned their policies of appeasement and declared war. The British and French high commands then began to execute war plans that relied on assumptions drawn from their experiences in World War I. They activated their reserves and reinforced the Maginot Line, defenses of mounted cannons stretching for 250 miles along the Franco-German border. Then they waited for Hitler's next move.
The eight-month period before the fall of Paris came to be known as "the phony war." During this relatively quiet time, France and the United Kingdom were convinced they were deterring the Germans by mobilizing their more plentiful military assets in an updated version of trench warfare. But they did not alter their tactics to respond to the new offensive warfare that the Germans had executed with such lethal results in eastern Europe. In May 1940, they paid a heavy price for their complacency: Panzer units raced into the lowlands, circumvented the Maginot Line, and conquered France shortly thereafter. The British expeditionary forces narrowly escaped by fleeing across the English Channel aboard a makeshift armada, leaving much of their armament behind on the beaches of Dunkirk.
Similarly today, the United States is fighting the war it prepared for in the twentieth century, rather than the one that is being waged upon it by al Qaeda. Instead of a Maginot Line, the Pentagon is executing its long-standing forward defense strategy, which involves leapfrogging ahead of U.S. borders and waging combat on the turf of U.S. enemies or allies. Meanwhile, protecting the rear -- the American nation itself -- remains largely outside the scope of national security even though the September 11 attacks were launched from the United States on targets within the United States.
The degree to which the Bush administration is willing to invest in conventional national security spending relative to basic domestic security measures is considerable. Although the CIA has concluded that the most likely way weapons of mass destruction (WMD) would enter the United States is by sea, the federal government is spending more every three days to finance the war in Iraq than it has provided over the past three years to prop up the security of all 361 U.S. commercial seaports. This myopic focus on conventional military forces at the expense of domestic security even extends to making the physical security at U.S. military bases a higher budget priority than protecting the nation's most critical infrastructure. In fiscal year 2005, Congress will give the Pentagon $7.6 billion to improve security at military bases. Meanwhile, the Department of Homeland Security will receive just $2.6 billion to protect all the vital systems throughout the country that sustain a modern society.
Much of the nation's critical infrastructure is in densely populated areas, so if the country is attacked, average U.S. citizens, not uniformed military personnel, will be the most likely casualties. Yet the federal effort to promote civil defense has gone quiet after a rocky start that generated a run on plastic sheeting and duct tape and provided fodder for the late-night comedy shows. Police, firefighters, and emergency medical technicians will be the first on the scene of any attack; they will have to operate largely on their own for at least the first 12 to 24 hours. Yet on average, U.S. fire departments have only enough radios to equip half their firefighters on a shift, and breathing apparatus for only a third. Police departments in cities across the country do not have the protective gear to safely secure a site following a WMD attack. And most emergency medical technicians lack the tools to determine which chemical or biological agent may have been used.
The deadly weapons that local emergency responders are so poorly equipped to cope with do not need to be imported. But although the Bush administration has made a top priority of preventing the spread of WMD overseas, it has slashed funds to dispose of commercially held radioactive materials (such as cesium-137, cobalt-60, and americium), which could be used in constructing dirty bombs, within the United States. The release of a biological agent on U.S. soil would be even deadlier, yet there is no federal program to provide ongoing oversight of how lethal pathogens are handled. Many university research labs around the country hold highly contagious specimens, and post-September 11 inspections have documented significant lapses in control over access to the labs and the securing of dangerous materials. Meanwhile, half of the federal scientific and medical personnel that the nation would turn to in the event of a bioterrorism attack will be eligible to retire within five years, and there is no comprehensive plan to address this looming personnel crisis.
Finally, even though the most tempting targets for terrorists are those that can produce widespread economic and social disruption, the White House has declared that safeguarding the nation's critical infrastructure is not a federal responsibility. According to President Bush's 2002 National Homeland Security Strategy, "The government should only address those activities that the market does not adequately provide -- for example, national defense or border security. ... For other aspects of homeland security, sufficient incentives exist in the private market to supply protection." Unfortunately, this expression of faith has not been borne out. According to a survey commissioned by the Washington-based Council on Competitiveness just one year after September 11, 92 percent of executives did not believe that terrorists would target their companies, and only 53 percent of the respondents indicated that their companies had increased security spending between 2001 and 2002. With the passing of each week without a new attack, the reluctance of companies to invest in security has only grown.
SECURITY MATURITY
If improving homeland security requires that the U.S. government reconsider many of its assumptions and priorities, it also requires a population that acknowledges that security must become everyone's business. The starting point for engaging civil society in this enterprise is a willingness to accept that there will never be a permanent victory in a war on terrorism by overseas military campaigns. Terrorism is simply too cheap, too available, and too tempting to ever be totally eradicated. And U.S. borders will never serve as a last line of defense for a determined terrorist. What is required is that everyday citizens develop both the maturity to live with the risk of future attacks and the willingness to invest in reasonable measures to mitigate that risk.
This is not a defeatist position. Improving the United States' protections and its resilience to withstand acts of catastrophic terrorism has both tactical value in preventing these attacks and strategic value in deterring them in the first place. Radical jihadist groups do not have unlimited resources. When they strike they want to be reasonably confident that they will be successful. They also want to inflict real damage that will generate political pressure to adopt draconian measures in response to a traumatized public.
Today's terrorist masterminds know that the main benefit of attacks on critical infrastructure is not the immediate damage they inflict, but the collateral consequences of eroding the public's trust in services on which it depends. Certainly this lesson has not been lost on Osama bin Laden, who holds a degree in economics. On October 21, 2001, in an interview with an Al Jazeera reporter, bin Laden remarked that his attacks generated billions of dollars in losses to Wall Street, in the daily income of Americans, in building costs, and to the airline industry. All this damage, he pointed out, was "due to an attack that happened with the success of Allah lasting one hour only."
What if the next terrorist strike were on the American food supply system? The attack itself might kill only a handful of people, but without measures in place to reassure the public that follow-on attacks could be prevented or at least contained, consumers at home and abroad would become distrustful of a sector that accounts for more than ten percent of U.S. GDP. Similarly, a dirty bomb smuggled in a container and set off in a seaport would likely kill only a few unfortunate longshoremen and contaminate several acres of valuable waterfront property. But if there is no credible security system to restore the public's confidence that other containers are safe, mayors and governors throughout the country, as well as the president, will come under withering political pressure to order the shutdown of the intermodal transportation system. Examining cargo in tens of thousands of trucks, trains, and ships to ensure it poses no threat would have devastating economic consequences. When containers stop moving, assembly plants go idle, retail shelves go bare, and workers end up in unemployment lines. A three-week shutdown could well spawn a global recession.
As long as catastrophic terrorism is assured of generating a huge bang for the buck, current and future U.S. adversaries will make it the first arrow they reach for in attacking the country. Their confidence in their ability to inflict real damage on the world's sole superpower will be directly proportional to the unwillingness of private and public leaders to acknowledge the risk of market failures associated with excessive reliance on unprotected networks that are sophisticated, concentrated, and interdependent. Given the futility of taking on U.S. military forces directly, attacking these networks is not irrational. In warfare, combatants always seek to exploit their adversary's weaknesses.
If terrorist attacks were likely to be detected, intercepted, contained, and managed without doing any measurable damage to the American way of life or quality of life, however, their value as a means of warfare would be depreciated. Since such acts violate widely accepted norms, they will almost certainly invite not just American, but also international, retribution. Most adversaries would probably judge this too high a price to pay if striking civilian targets holds out little chance of causing the desired mass disruption.
A focus on homeland security measures can also improve the effectiveness of more conventional counterterrorism measures. By bolstering the security of critical networks in advance of possible attacks, adversaries must put together more complex operations to target them successfully. The resultant need for terrorists to raise more money, recruit expertise, and lengthen planning cycles and rehearsals would be a boon for intelligence services and law enforcement officials. This is because such pre-execution activities elevate the opportunities for infiltration and raise the odds that terrorist groups will attract attention.
There is an added bit of good news that comes from placing greater emphasis on homeland security. The most effective measures for protecting potential targets or making them more resilient in the face of successful attacks almost always have derivative benefits for other public and private goods. For instance, bolstering the tools to detect and intercept terrorists will enhance the means that authorities have to combat criminal acts such as narcotics trafficking, migrant smuggling, cargo theft, and violations of export controls. Diseases such as SARS, AIDS, West Nile, foot-and-mouth, and mad cow have highlighted the challenges of managing deadly pathogens in a shrinking world. Public health investments to deal with biological agents or attacks on food and water supplies will provide U.S. authorities with more effective tools to manage these global diseases. Measures adopted to protect infrastructure make it more resilient not only to terrorist attacks, but also to acts of God or human and mechanical error. They also invariably reinforce U.S. values that are respected around the world, whereas reliance on aggressive military measures invariably puts those values at risk.
How much security is enough? For the foreseeable future, the threshold for success is when the American people can conclude that a future attack on U.S. soil will be an exceptional event that does not require wholesale changes in how they go about their lives. This means that they should be confident that there are adequate measures in place to confront the danger.
In other words, homeland security should strive to achieve what the aviation industry has done with safety. What sustains air travel despite the periodic horror of airplanes falling out of the sky is the extent to which the industry's long-standing and ongoing investments have convinced the public that it is safe to fly. Public confidence can never be taken for granted after a major jet crash, but private and public aviation officials start from a credible foundation built upon a cooperative effort to incorporate safety into every part of the industry. Every time passengers board a plane, they receive instructions from flight attendants on how to fasten their seatbelts and don oxygen masks -- gentle reminders of the paramount importance that the industry assigns to safety. In the immediate aftermath of airline disasters, the public is reassured by the fact that the lessons learned are quickly compiled and released and that the government and the industry seem willing to take whatever corrective actions are required.
Ongoing and credible efforts to confront risk are essential to the viability of any complex modern enterprise. Aviation safety provides helpful reference points for how to pursue security without turning the United States into a national gated community. First, it demonstrates that Americans do not expect their lives to be risk-free; they just rightfully expect that reasonable measures be in place to manage that risk. Second, managing risk works best if safeguards are integrated as an organic part of a sector's environment and if they are dynamic in adapting to changes in that environment. Third, government plays an essential role in providing incentives and disincentives for people and industry to meet minimum standards. Bluntly stated, security will not happen by itself.
THE TRAGEDY OF THE COMMONS
Washington's hands-off approach to critical infrastructure protection has stemmed not only from an excessive and unmerited faith in U.S. military, intelligence, and law enforcement capabilities. At the heart of the problem is also its misplaced faith in the market. The invisible hand of the free market simply will not provide sufficient economic incentives for private companies to protect from acts of terrorism the global networks that they largely own and operate. This is because their executives worry that such investments would place them at a competitive disadvantage.
Security is not free. A company incurs costs when it invests in measures to protect the portion of infrastructure it controls. If a company does not believe other companies are willing or able to make a similar investment, then it faces the likelihood of losing market share while simply shifting the infrastructure's vulnerability elsewhere. If terrorists strike, the company will still suffer the disruptive consequences of an attack right alongside those who did nothing to prevent it. Those consequences are likely to include the cost of implementing new government requirements. Therefore, infrastructure security suffers from a dilemma commonly referred to as the "tragedy of the commons."
Take the case of the chemical industry. By and large, chemical manufacturers have a good safety record. But security is another matter. Operating on thin profit margins and faced with growing overseas competition, most companies have been reluctant to incur the additional costs associated with improving their security. Now let us imagine that the manager of a chemical plant looks around his facility and gets squeamish about the many security lapses he finds. After a fitful night of sleep, he wakes up and decides to invest in protective measures that raise the cost to his customers by $50 per shipment. A competitor who does not make that investment will be able to attract business away from the security-conscious plant because his handling costs will be lower. Capable terrorists and criminals will target this lower-cost operation since it is an easier target.
In the event of an incident, particularly one that is catastrophic, two consequences are likely. First, government officials will not discriminate between the more security-conscious and the less security-conscious companies. All chemical plants are likely to be shut down while the authorities try to sort things out. Second, once the dust clears, elected and regulatory officials will scramble to impose new security requirements that could nullify the proactive plant owner's earlier investments. Given this scenario, the most rational behavior of the nervous manager would appear to be to keep tossing and turning at night while focusing on short-term profitability during the day.
The only way to prevent the tragedy of the commons is to convince all the private participants to abide by the same security requirements. When standards are universal, their cost is borne equally across a sector. As taxpayers or as consumers, Americans will end up bankrolling these measures, but what they will be paying for is insurance against the loss of innocent lives and a profound disruption to their society and the economy.
MOBILIZING THE HOME FRONT
When it comes to critical infrastructure protection, the issue, then, is to engage the private sector to develop standards and create effective mechanisms for their uniform enforcement. This is a task that necessitates a much different kind of institutional framework than setting up a new federal department of homeland security. What it requires is the creation of a structure that allows the private sector and civil society to participate as equal partners in the process of designing and implementing security for the U.S. homeland. Randolph Lerner, who chairs the bank holding company MBNA Corporation, has suggested that the United States needs a homeland security framework that resembles the organizational protocols and functions of the Federal Reserve System.
The Federal Reserve was created in 1913 to lessen the risks of serious disruptions to financial markets. It was organized around the notion that effective oversight of the financial sector requires drawing on the expertise of private representatives within that sector. Additionally, the Federal Reserve's charter recognized the value of taking into account the country's diversity by creating 12 regional banking districts and establishing 25 branches. This structure is not purely hierarchical. The regional banks are essential to the process of collecting information on conditions at the local level, and they provide a pool of advisers to inform national policymaking functions. Importantly, the Federal Reserve also retains a degree of independence from the executive branch. Although it regularly meets and supports the work of federal agencies with specific statutory responsibilities, the Federal Reserve Board reports directly to Congress, and its work is audited by the General Accounting Office.
The United States should roughly replicate the Federal Reserve model by creating a Federal Security Reserve System (FSRS) with a national board of governors, 10 regional Homeland Security Districts, and 92 local branches called Metropolitan Anti-Terrorism Committees. The objective of this system would be to develop self-funding mechanisms to more fully engage a broad cross-section of American society to protect the country's critical foundations from the widespread disruption that would arise from a terrorist attack.
To create the appropriate incentives for the market to invest in security, the FSRS would establish and oversee a mandatory program requiring owners and operators of critical infrastructure to carry adequate levels of insurance. The purpose of this insurance would be not just to reduce the call on public resources when acts of terrorism occur. It would also create incentives for the insurance industry to become a partner in ensuring that the owners and operators of essential systems do not neglect their security responsibilities.
The FSRS's national board of governors would play an oversight role in establishing prevention and response guidelines and monitoring compliance with security mandates within the water, food, chemical, energy, financial, information, transportation, emergency response, and public health sectors. Its responsibilities would include issuing regulations to carry out major federal laws governing the security of these sectors. Members of the board would be available to meet with the president's homeland security advisers and to testify before Congress. The board would submit an annual report to Congress on the state of security within each sector, along with a national vulnerability assessment. The board would also have a role in international bodies, such as the International Standards Organization and the World Trade Organization, in advancing universal security standards for critical networks that span international boundaries. For technical and scientific support, the board should establish a formal relationship with the congressionally chartered National Academy of Sciences.
Each of the ten Homeland Security Districts should be given lead responsibility for a specific critical sector, based on its relative importance within their jurisdiction. For example, the district for the northeastern region of the country might be assigned the lead on financial security. The district assigned primary responsibility for a sector would chair a committee made up of representatives from the remaining districts. In addition, the primary district would be responsible for hosting an international advisory committee that would include private-and public-sector experts from Europe, Canada, Mexico, Japan, and other allies of the United States.
The district board of directors would be made up of private-sector leaders representing each of the critical infrastructure sectors; a labor union representative; officials from the public health, public safety, and nongovernmental sectors; a designated civil liberty advocate; and media leaders. The federal regional director from the Department of Homeland Security would be a vice chair with one U.S. attorney from within the district, who would provide a formal link with the Department of Justice (DOJ). The Department of Defense's Northern Command, which has responsibility for protecting U.S. territory from armed attacks, would be allowed a nonvoting, ex officio seat on the board.
The districts would all be assigned support staffs whose composition would be divided between full-time public-sector employees and industry experts nominated by the private sector. These industry experts would be given a two-year leave of absence by their employers to support their work at the district level. As in the Federal Reserve, these private-sector appointments would be highly selective opportunities for talented midlevel executives to better understand and help inform the policy environment that will affect their respective sectors. All of the private participants would be provided with government security clearances.
At the metropolitan level, the FSRS could be tied into an expanded version of the post-September 11 Anti-Terrorism Advisory Committees and Joint Terrorism Task Forces that are run by DOJ and the FBI. Currently these groups are made up of representatives from federal, state, and local law enforcement agencies. They are essentially forums in which cops can talk with cops. Under the FSRS, these organizations would be set up in all states and within the major metropolitan areas and should include private-sector representatives who have received background checks and been issued the appropriate security clearances.
The Metropolitan Anti-Terrorism Committees should serve as a forum for sharing the latest threat assessment information with local and private entities that have direct operational oversight over critical sectors. They would also be charged with reviewing vulnerability assessments and security plans, including conducting exercises to evaluate prevention and protection efforts on the ground. Additionally, the teams would be given responsibility periodically to inspect compliance with security regulations in the same way that federal bank examiners are sent out periodically to assess the operations of their member banks. When serious discrepancies are found, the district board could impose sanctions.
The Federal Reserve describes itself as a system that is "independent within the government." This means it must work within the overall objectives established by Congress, but its decisions do not have to be ratified by the president or anyone else in the executive branch. This level of independence is justified as both a check on executive power and as a way to manage the risk that decisions directly affecting the operation of the marketplace might become dangerously politicized. The case for a similar approach to homeland security is compelling. In both instances, the goal is to better align commercial interests with public interests.
The overall thrust of this proposed FSRS is to create a participatory system that does not unrealistically rely on the activities of federal agencies. By using the Federal Reserve as a template for enlisting expertise beyond Washington, the United States can achieve a middle ground between placing the fate of critical networks entirely in the hands of overworked federal authorities and relying on a laissez-faire approach that provides no protection.
This, admittedly, is an ambitious proposal. But now is not a time for timidity. Nor is it a time for persisting with an outmoded national security framework, designed for a different enemy in a century gone by. Americans must demand that their government put in place the kind of structure that widens the breadth and quality of civic participation in making the United States safe. And the entire nation, not just the national security establishment, must be organized for the long, deadly struggle against terrorism.
Foreign Affairs
Stephen E. Flynn is Senior Fellow in National Security Studies at the Council on Foreign Relations. This article draws from "America the Vulnerable: How Our Government Is Failing to Protect Us From Terrorism" (HarperCollins, 2004).
