Neglected Home Front
Stephen E. Flynn
From Foreign Affairs, September/October 2004
The Bush administration has waged an aggressive war against terrorists abroad, but it has neglected to protect the homeland,
even though Americans in the United States are the ones most vulnerable
to future attacks. The government must do more to safeguard critical U.S. infrastructure and mobilize the American public to help. For starters, it should create a semi-independent
federal agency tapping into private resources that would develop and enforce security standards.
Stephen E. Flynn is
Senior Fellow in National Security Studies at the Council on Foreign Relations. This article draws from "America the Vulnerable: How Our Government
Is Failing to Protect Us From Terrorism" (HarperCollins,
FAILURE TO PROTECT
United States is living on borrowed time -- and squandering it. The attacks of September 11, 2001, on the World Trade Center towers and the Pentagon highlighted just how open the United
States is to unconventional attacks. The widespread economic
and social disruption that flowed from the suicidal acts of just 19 terrorists also exposed the Achilles' heel of the world's
sole superpower. The transportation, energy, information, financial, chemical, food, and logistical networks that underpin
U.S. economic power and the American way of life offer the United
States' enemies a rich menu of irresistible targets. And
most of these remain virtually unprotected.
does not have to be this way. Choosing to invest in offensive and defensive capabilities should not be an either-or proposition.
In war, nations need both. Given the wealth of the United
States, it can clearly afford to protect its most valued
assets along with fielding a second-to-none military. But it cannot strike the right balance as long as it persists with treating
homeland security as wholly separate from national security. Nor can muscular efforts to combat terrorism at its source be
a substitute for the systematic engagement of civil society and the private sector in a collective effort to confront the
threat of catastrophic acts of terror at home. The United
States must do more than transform its armed forces and
repair its broken intelligence services. It must also provide a new institutional framework to construct a more resilient
society that has the capacity to take a blow as well as to strike one.
Washington has demonstrated an extraordinary
degree of hardheadedness when it comes to acknowledging the limits of its military and intelligence capabilities to combat
the terrorist threat. The premise behind the Bush administration's strategy of preemptive use of force is that as long as
the United States is willing to show sufficient grit, it can successfully hold its enemies at bay. Vice President Dick
Cheney made this case recently in an address to a class of newly commissioned Coast Guard officers. He asserted, "Wars are
not won on the defensive. To fully and finally remove this danger [of terrorism], we have only one option -- and that's to
take the fight to the enemy." On July 4, 2004, President George W. Bush made the point this way: "We will engage these enemies in these countries
[Iraq and Afghanistan] and around the world so we do not have to face them here at home."
terrorism at its source is an appealing notion. Unfortunately, the enemy is not cooperating. There is no central front on
which al Qaeda and its radical jihadist imitators can be cornered and destroyed. The commuter train bombings in Madrid in March illustrate that terrorists
are living and operating within jurisdictions of U.S. allies and do not need to receive aid and comfort from rogue states. According to the U.S. Department
of State's latest revised global terrorism report, the number of terrorist incidents went up in 2003, despite the U.S.-led
invasions of Afghanistan and Iraq. And, according to a July statement by Secretary of Homeland Security Tom Ridge, al Qaeda remains at
large inside the United States, busily planning its next attack on U.S. soil, perhaps before the November elections.
reluctance of the White House and the national security community to adapt to the shifting nature of the terrorist threat
bears a disturbing resemblance to the opening chapter of World War II. In September 1939, the German army rolled eastward
into Poland and unleashed a new form of combat known as "blitzkrieg." When Poland became a victim of the Third
finally abandoned their policies of appeasement and declared war. The British and French high commands then began to execute
war plans that relied on assumptions drawn from their experiences in World War I. They activated their reserves and reinforced
the Maginot Line, defenses of mounted cannons stretching for 250 miles along the Franco-German border. Then they waited for
Hitler's next move.
eight-month period before the fall of Paris came to be known as "the phony war." During this relatively quiet time, France and the United Kingdom were convinced they
were deterring the Germans by mobilizing their more plentiful military assets in an updated version of trench warfare. But
they did not alter their tactics to respond to the new offensive warfare that the Germans had executed with such lethal results
in eastern Europe. In May 1940, they paid a heavy price for their complacency: Panzer units raced into the lowlands, circumvented
the Maginot Line, and conquered France shortly thereafter. The British expeditionary forces narrowly escaped by fleeing across
the English Channel aboard a makeshift armada, leaving much of their armament behind on the beaches of Dunkirk.
today, the United States is fighting the war it prepared for in the twentieth century, rather than the one that is being waged
upon it by al Qaeda. Instead of a Maginot Line, the Pentagon is executing its long-standing forward defense strategy, which
involves leapfrogging ahead of U.S. borders and waging combat on the turf of U.S. enemies or allies. Meanwhile, protecting
the rear -- the American nation itself -- remains largely outside the scope of national security even though the September
11 attacks were launched from the United States on targets within the United States.
degree to which the Bush administration is willing to invest in conventional national security spending relative to basic
domestic security measures is considerable. Although the CIA has concluded that the most likely way weapons of mass destruction (WMD) would enter the United States is by sea, the federal government
is spending more every three days to finance the war in Iraq than it has provided over the past three years to prop up the
security of all 361 U.S. commercial seaports. This myopic focus on conventional military forces at the expense of domestic
security even extends to making the physical security at U.S. military bases a higher budget priority than protecting the
nation's most critical infrastructure. In fiscal year 2005, Congress will give the Pentagon $7.6 billion to improve security
at military bases. Meanwhile, the Department of Homeland Security will receive just $2.6 billion to protect all the vital
systems throughout the country that sustain a modern society.
of the nation's critical infrastructure is in densely populated areas, so if the country is attacked, average U.S. citizens,
not uniformed military personnel, will be the most likely casualties. Yet the federal effort to promote civil defense has
gone quiet after a rocky start that generated a run on plastic sheeting and duct tape and provided fodder for the late-night
comedy shows. Police, firefighters, and emergency medical technicians will be the first on the scene of any attack; they will
have to operate largely on their own for at least the first 12 to 24 hours. Yet on average, U.S. fire departments have only
enough radios to equip half their firefighters on a shift, and breathing apparatus for only a third. Police departments in
cities across the country do not have the protective gear to safely secure a site following a WMD attack. And most emergency medical technicians
lack the tools to determine which chemical or biological agent may have been used.
deadly weapons that local emergency responders are so poorly equipped to cope with do not need to be imported. But although
the Bush administration has made a top priority of preventing the spread of WMD overseas, it has slashed funds to dispose of commercially held radioactive materials (such as cesium-137,
cobalt-60, and americium), which could be used in constructing dirty bombs, within the United States. The release of a biological
agent on U.S. soil would be even deadlier, yet there is no federal program to provide ongoing oversight of how lethal pathogens
are handled. Many university research labs around the country hold highly contagious specimens, and post-September 11 inspections
have documented significant lapses in control over access to the labs and the securing of dangerous materials. Meanwhile,
half of the federal scientific and medical personnel that the nation would turn to in the event of a bioterrorism attack will
be eligible to retire within five years, and there is no comprehensive plan to address this looming personnel crisis.
even though the most tempting targets for terrorists are those that can produce widespread economic and social disruption,
the White House has declared that safeguarding the nation's critical infrastructure is not a federal responsibility. According
to President Bush's 2002 National Homeland Security Strategy, "The government should only address those activities that the
market does not adequately provide -- for example, national defense or border security. ... For other aspects of homeland
security, sufficient incentives exist in the private market to supply protection." Unfortunately, this expression of faith
has not been borne out. According to a survey commissioned by the Washington-based Council on Competitiveness just one year
after September 11, 92 percent of executives did not believe that terrorists would target their companies, and only 53 percent
of the respondents indicated that their companies had increased security spending between 2001 and 2002. With the passing
of each week without a new attack, the reluctance of companies to invest in security has only grown.
improving homeland security requires that the U.S. government reconsider many of its assumptions and priorities, it also requires
a population that acknowledges that security must become everyone's business. The starting point for engaging civil society
in this enterprise is a willingness to accept that there will never be a permanent victory in a war on terrorism by overseas
military campaigns. Terrorism is simply too cheap, too available, and too tempting to ever be totally eradicated. And U.S.
borders will never serve as a last line of defense for a determined terrorist. What is required is that everyday citizens
develop both the maturity to live with the risk of future attacks and the willingness to invest in reasonable measures to
mitigate that risk.
is not a defeatist position. Improving the United States' protections and its resilience to withstand acts of catastrophic
terrorism has both tactical value in preventing these attacks and strategic value in deterring them in the first place. Radical
jihadist groups do not have unlimited resources. When they strike they want to be reasonably confident that they will be successful.
They also want to inflict real damage that will generate political pressure to adopt draconian measures in response to a traumatized
terrorist masterminds know that the main benefit of attacks on critical infrastructure is not the immediate damage they inflict,
but the collateral consequences of eroding the public's trust in services on which it depends. Certainly this lesson has not
been lost on Osama bin Laden, who holds a degree in economics. On October 21, 2001, in an interview with an Al Jazeera reporter,
bin Laden remarked that his attacks generated billions of dollars in losses to Wall Street, in the daily income of Americans,
in building costs, and to the airline industry. All this damage, he pointed out, was "due to an attack that happened with
the success of Allah lasting one hour only."
if the next terrorist strike were on the American food supply system? The attack itself might kill only a handful of people,
but without measures in place to reassure the public that follow-on attacks could be prevented or at least contained, consumers
at home and abroad would become distrustful of a sector that accounts for more than ten percent of U.S. GDP. Similarly, a dirty bomb smuggled in a container
and set off in a seaport would likely kill only a few unfortunate longshoremen and contaminate several acres of valuable waterfront
property. But if there is no credible security system to restore the public's confidence that other containers are safe, mayors
and governors throughout the country, as well as the president, will come under withering political pressure to order the
shutdown of the intermodal transportation system. Examining cargo in tens of thousands of trucks, trains, and ships to ensure
it poses no threat would have devastating economic consequences. When containers stop moving, assembly plants go idle, retail
shelves go bare, and workers end up in unemployment lines. A three-week shutdown could well spawn a global recession.
As long as catastrophic terrorism is assured of generating a huge bang for the buck, current and future U.S. adversaries
will make it the first arrow they reach for in attacking the country. Their confidence in their ability to inflict real damage
on the world's sole superpower will be directly proportional to the unwillingness of private and public leaders to acknowledge
the risk of market failures associated with excessive reliance on unprotected networks that are sophisticated, concentrated,
and interdependent. Given the futility of taking on U.S. military forces directly, attacking these networks is not irrational.
In warfare, combatants always seek to exploit their adversary's weaknesses.
terrorist attacks were likely to be detected, intercepted, contained, and managed without doing any measurable damage to the
American way of life or quality of life, however, their value as a means of warfare would be depreciated. Since such acts
violate widely accepted norms, they will almost certainly invite not just American, but also international, retribution. Most
adversaries would probably judge this too high a price to pay if striking civilian targets holds out little chance of causing
the desired mass disruption.
focus on homeland security measures can also improve the effectiveness of more conventional counterterrorism measures. By
bolstering the security of critical networks in advance of possible attacks, adversaries must put together more complex operations
to target them successfully. The resultant need for terrorists to raise more money, recruit expertise, and lengthen planning
cycles and rehearsals would be a boon for intelligence services and law enforcement officials. This is because such pre-execution
activities elevate the opportunities for infiltration and raise the odds that terrorist groups will attract attention.
is an added bit of good news that comes from placing greater emphasis on homeland security. The most effective measures for
protecting potential targets or making them more resilient in the face of successful attacks almost always have derivative
benefits for other public and private goods. For instance, bolstering the tools to detect and intercept terrorists will enhance
the means that authorities have to combat criminal acts such as narcotics trafficking, migrant smuggling, cargo theft, and
violations of export controls. Diseases such as SARS, AIDS, West Nile, foot-and-mouth, and mad cow have highlighted the challenges
of managing deadly pathogens in a shrinking world. Public health investments to deal with biological agents or attacks on
food and water supplies will provide U.S. authorities with more effective tools to manage these global diseases. Measures
adopted to protect infrastructure make it more resilient not only to terrorist attacks, but also to acts of God or human and
mechanical error. They also invariably reinforce U.S. values that are respected around the world, whereas reliance on aggressive
military measures invariably puts those values at risk.
much security is enough? For the foreseeable future, the threshold for success is when the American people can conclude that
a future attack on U.S. soil will be an exceptional event that does not require wholesale changes in how they go about their
lives. This means that they should be confident that there are adequate measures in place to confront the danger.
other words, homeland security should strive to achieve what the aviation industry has done with safety. What sustains air
travel despite the periodic horror of airplanes falling out of the sky is the extent to which the industry's long-standing
and ongoing investments have convinced the public that it is safe to fly. Public confidence can never be taken for granted
after a major jet crash, but private and public aviation officials start from a credible foundation built upon a cooperative
effort to incorporate safety into every part of the industry. Every time passengers board a plane, they receive instructions
from flight attendants on how to fasten their seatbelts and don oxygen masks -- gentle reminders of the paramount importance
that the industry assigns to safety. In the immediate aftermath of airline disasters, the public is reassured by the fact
that the lessons learned are quickly compiled and released and that the government and the industry seem willing to take whatever
corrective actions are required.
and credible efforts to confront risk are essential to the viability of any complex modern enterprise. Aviation safety provides
helpful reference points for how to pursue security without turning the United States into a national gated community. First,
it demonstrates that Americans do not expect their lives to be risk-free; they just rightfully expect that reasonable measures
be in place to manage that risk. Second, managing risk works best if safeguards are integrated as an organic part of a sector's
environment and if they are dynamic in adapting to changes in that environment. Third, government plays an essential role
in providing incentives and disincentives for people and industry to meet minimum standards. Bluntly stated, security will
not happen by itself.
TRAGEDY OF THE COMMONS
hands-off approach to critical infrastructure protection has stemmed not only from an excessive and unmerited faith in U.S.
military, intelligence, and law enforcement capabilities. At the heart of the problem is also its misplaced faith in the market.
The invisible hand of the free market simply will not provide sufficient economic incentives for private companies to protect
from acts of terrorism the global networks that they largely own and operate. This is because their executives worry that
such investments would place them at a competitive disadvantage.
Security is not free. A company incurs costs when it invests in measures to protect the portion of infrastructure it
controls. If a company does not believe other companies are willing or able to make a similar investment, then it faces the
likelihood of losing market share while simply shifting the infrastructure's vulnerability elsewhere. If terrorists strike,
the company will still suffer the disruptive consequences of an attack right alongside those who did nothing to prevent it.
Those consequences are likely to include the cost of implementing new government requirements. Therefore, infrastructure security
suffers from a dilemma commonly referred to as the "tragedy of the commons."
the case of the chemical industry. By and large, chemical manufacturers have a good safety record. But security is another
matter. Operating on thin profit margins and faced with growing overseas competition, most companies have been reluctant to
incur the additional costs associated with improving their security. Now let us imagine that the manager of a chemical plant
looks around his facility and gets squeamish about the many security lapses he finds. After a fitful night of sleep, he wakes
up and decides to invest in protective measures that raise the cost to his customers by $50 per shipment. A competitor who
does not make that investment will be able to attract business away from the security-conscious plant because his handling
costs will be lower. Capable terrorists and criminals will target this lower-cost operation since it is an easier target.
the event of an incident, particularly one that is catastrophic, two consequences are likely. First, government officials
will not discriminate between the more security-conscious and the less security-conscious companies. All chemical plants are
likely to be shut down while the authorities try to sort things out. Second, once the dust clears, elected and regulatory
officials will scramble to impose new security requirements that could nullify the proactive plant owner's earlier investments.
Given this scenario, the most rational behavior of the nervous manager would appear to be to keep tossing and turning at night
while focusing on short-term profitability during the day.
only way to prevent the tragedy of the commons is to convince all the private participants to abide by the same security requirements.
When standards are universal, their cost is borne equally across a sector. As taxpayers or as consumers, Americans will end
up bankrolling these measures, but what they will be paying for is insurance against the loss of innocent lives and a profound
disruption to their society and the economy.
THE HOME FRONT
it comes to critical infrastructure protection, the issue, then, is to engage the private sector to develop standards and
create effective mechanisms for their uniform enforcement. This is a task that necessitates a much different kind of institutional
framework than setting up a new federal department of homeland security. What it requires is the creation of a structure that
allows the private sector and civil society to participate as equal partners in the process of designing and implementing
security for the U.S. homeland. Randolph Lerner, who chairs the bank holding company MBNA Corporation, has suggested that
the United States needs a homeland security framework that resembles the organizational protocols and functions of the Federal
Federal Reserve was created in 1913 to lessen the risks of serious disruptions to financial markets. It was organized around
the notion that effective oversight of the financial sector requires drawing on the expertise of private representatives within
that sector. Additionally, the Federal Reserve's charter recognized the value of taking into account the country's diversity
by creating 12 regional banking districts and establishing 25 branches. This structure is not purely hierarchical. The regional
banks are essential to the process of collecting information on conditions at the local level, and they provide a pool of
advisers to inform national policymaking functions. Importantly, the Federal Reserve also retains a degree of independence
from the executive branch. Although it regularly meets and supports the work of federal agencies with specific statutory responsibilities,
the Federal Reserve Board reports directly to Congress, and its work is audited by the General Accounting Office.
United States should roughly replicate the Federal Reserve model by creating a Federal Security Reserve System (FSRS) with
a national board of governors, 10 regional Homeland Security Districts, and 92 local branches called Metropolitan Anti-Terrorism
Committees. The objective of this system would be to develop self-funding mechanisms to more fully engage a broad cross-section
of American society to protect the country's critical foundations from the widespread disruption that would arise from a terrorist
create the appropriate incentives for the market to invest in security, the FSRS would establish and oversee a mandatory program
requiring owners and operators of critical infrastructure to carry adequate levels of insurance. The purpose of this insurance
would be not just to reduce the call on public resources when acts of terrorism occur. It would also create incentives for
the insurance industry to become a partner in ensuring that the owners and operators of essential systems do not neglect their
The FSRS's national board of governors would play an oversight role in establishing prevention and response guidelines
and monitoring compliance with security mandates within the water, food, chemical, energy, financial, information, transportation,
emergency response, and public health sectors. Its responsibilities would include issuing regulations to carry out major federal
laws governing the security of these sectors.
of the board would be available to meet with the president's homeland security advisers and to testify before Congress. The
board would submit an annual report to Congress on the state of security within each sector, along with a national vulnerability
assessment. The board would also have a role in international bodies, such as the International Standards Organization and
the World Trade Organization, in advancing universal security standards for critical networks that span international boundaries.
For technical and scientific support, the board should establish a formal relationship with the congressionally chartered
National Academy of Sciences.
of the ten Homeland Security Districts should be given lead responsibility for a specific critical sector, based on its relative
importance within their jurisdiction. For example, the district for the northeastern region of the country might be assigned
the lead on financial security. The district assigned primary responsibility for a sector would chair a committee made up
of representatives from the remaining districts. In addition, the primary district would be responsible for hosting an international
advisory committee that would include private-and public-sector experts from Europe, Canada, Mexico, Japan, and other allies
of the United States.
district board of directors would be made up of private-sector leaders representing each of the critical infrastructure sectors;
a labor union representative; officials from the public health, public safety, and nongovernmental sectors; a designated civil
liberty advocate; and media leaders. The federal regional director from the Department of Homeland Security would be a vice
chair with one U.S. attorney from within the district, who would provide a formal link with the Department of Justice (DOJ).
The Department of Defense's Northern Command, which has responsibility for protecting U.S. territory from armed attacks, would
be allowed a nonvoting, ex officio seat on the board.
districts would all be assigned support staffs whose composition would be divided between full-time public-sector employees
and industry experts nominated by the private sector. These industry experts would be given a two-year leave of absence by
their employers to support their work at the district level. As in the Federal Reserve, these private-sector appointments
would be highly selective opportunities for talented midlevel executives to better understand and help inform the policy environment
that will affect their respective sectors. All of the private participants would be provided with government security clearances.
the metropolitan level, the FSRS could be tied into an expanded version of the post-September 11 Anti-Terrorism Advisory Committees
and Joint Terrorism Task Forces that are run by DOJ and the FBI. Currently these groups are made up of representatives from
federal, state, and local law enforcement agencies. They are essentially forums in which cops can talk with cops. Under the
FSRS, these organizations would be set up in all states and within the major metropolitan areas and should include private-sector
representatives who have received background checks and been issued the appropriate security clearances.
Metropolitan Anti-Terrorism Committees should serve as a forum for sharing the latest threat assessment information with local
and private entities that have direct operational oversight over critical sectors. They would also be charged with reviewing
vulnerability assessments and security plans, including conducting exercises to evaluate prevention and protection efforts
on the ground. Additionally, the teams would be given responsibility periodically to inspect compliance with security regulations
in the same way that federal bank examiners are sent out periodically to assess the operations of their member banks. When
serious discrepancies are found, the district board could impose sanctions.
Federal Reserve describes itself as a system that is "independent within the government." This means it must work within the
overall objectives established by Congress, but its decisions do not have to be ratified by the president or anyone else in
the executive branch. This level of independence is justified as both a check on executive power and as a way to manage the
risk that decisions directly affecting the operation of the marketplace might become dangerously politicized. The case for
a similar approach to homeland security is compelling. In both instances, the goal is to better align commercial interests
with public interests.
overall thrust of this proposed FSRS is to create a participatory system that does not unrealistically rely on the activities
of federal agencies. By using the Federal Reserve as a template for enlisting expertise beyond Washington, the United States
can achieve a middle ground between placing the fate of critical networks entirely in the hands of overworked federal authorities
and relying on a laissez-faire approach that provides no protection.
admittedly, is an ambitious proposal. But now is not a time for timidity. Nor is it a time for persisting with an outmoded
national security framework, designed for a different enemy in a century gone by. Americans must demand that their government
put in place the kind of structure that widens the breadth and quality of civic participation in making the United States
safe. And the entire nation, not just the national security establishment, must be organized for the long, deadly struggle