Grading Progress on Homeland Security: Before and After 9/11

The Pattern of Global Change

In time, as you look at the history of a corporation or perhaps at world history, there seem to be inflection points which mark the change of one pattern to another. Those inflection points don't necessarily cause the change in history but instead mark or delineate the passage of one type of environment to another. For example, Ford Motor Company builds an assembly plant, and, somehow, that typifies the change from the type of economy that existed before to the type of economy that existed after.

I believe that such a point is also evident in September 11: that September 11, 2001, marks a change of a global nature in the way the world works--competitively, from a military strategy standpoint, from a geopolitical standpoint, and so forth. In some respects, what we're seeing is a change from where a competitive advantage and dominance, which would previously have been based upon being strong, impregnable, immovable, with massive force, increasingly belong to the small, speedy, nimble upstart of one kind or another.

Whether it's JetBlue taking on US Air and United Airlines, or whether it's a small band of murderous, evil terrorists taking on a whole nation, somehow our world has changed. I think that pretty dramatic shift is in some ways symbolized by the trajectory or the inflection point associated with September 11, 2001, which has to figure into all of our thinking about topics as significant as homeland security.

With that as a backdrop, I want to look at how well we're doing in our homeland security effort and suggest areas for more significant change. My perspective is built on two experiences, one of which is the experience I had as the chief executive of the Salt Lake Olympic Games. Protecting an Olympics is a small thing relative to protecting a nation or a state, yet, in this case, the security planning for the Olympic Games serves as a best-demonstrated practice--a benchmark, if you will, of how homeland security can work at its best.

The other experience I'll draw on is my homeland security experience as governor of my state. We recently carried out a project where I asked my secretary of public safety to grade us, based on our benchmarks, on all dimensions of homeland security, to see how well we're doing and to compare ourselves with the ideal. He has particular experience in doing this, as he was the chief of police for Arlington, Virginia, where, of course, the attack on the Pentagon occurred, and can draw upon that experience to help in the grading.

Planning for the Olympics:
A Best-Demonstrated Practice

First, let me begin with the Olympics. As we got into our Olympic planning, we looked back to the prior games in the United States, which were held in Atlanta. Now, Atlanta was not a best-demonstrated practice. Looking at Atlanta provided us with some ideas as to what went wrong and how we had to improve.

The planning for security in Atlanta was done like most security planning: Each county, each city or town, did its own planning for security. They prepared their own security plans and decided where their police officers would be deployed. They had their own surveillance efforts, their own protection efforts, and so forth. The federal government was doing its job, quite independent of each of the cities and towns and the state police. They each had very complete and robust plans, I'm sure. They just didn't happen to coordinate those plans with one another, so the practices of one jurisdiction might be different from the practices of another.

As a result of having such a disparate approach to planning, there were gaps. There were not just physical gaps, but there were gaps in terms of knowing where a response was going to be led if it occurred in a particular area and who was following intelligence leads in that area. I don't know that those gaps were the cause of, or led to, the successful act of terrorism there. They certainly did not prevent it, however, nor would they have prevented many other possible terrorist incursions.

Presidential Decision Directive 62
Following the games, President Bill Clinton promulgated something known as Presidential Decision Directive Number 62, which established the provision for a national special-security event. Under that provision, a series of measures were laid out to be put in place in the case of a national special-security event such as an Olympics or a political convention or the like.

In addition to that directive, which helped us enormously as we prepared for Salt Lake City, the State of Utah had the foresight to establish something called the Utah Olympic Public Safety Command, which said we're not going to have every city and town and county deciding what the security's going to be for Olympic venues in their area. Instead, we're going to call on all of the police chiefs, sheriffs, state police to all come together in one central command and plan on a central basis what we're going to do in our Olympic theater.

They went to the federal government and said, "Given this presidential decision directive, can you come in and join us as well?" The federal government could have said, "No, we're separate," but they didn't. They said, "No, let's join. Let's all work together." So all of these groups came together in one command.

Over a period of three or four years, these groups worked together to lay out a series of responsibilities, to lay out a plan. The plan was extremely comprehensive and, I believe, robust. Let me mention some of the things that characterized it.

Protecting the Perimeter
Number one, and most important, there was a plan which said that if you have a venue in your area, here's how we protect that venue. It will have a perimeter. We had various parameters as to whether it was going to be a hard perimeter, meaning literally a fence, and, if so, whether it would be a fence with monitoring systems, motion detection systems, and vision systems, or whether we'd actually have armed personnel on the entire perimeter without a fence.

We literally decided on the security requirements for any type of Olympic venue within any jurisdiction, rather than having one sheriff saying, "This is how we're going to patrol it" while another police chief in another area came up with an entirely different plan. We established what the intelligence protocols would be, what were the types of risks which would require surveillance and monitoring prior to the games and during the games, and who would do that surveillance. We also decided how many intelligence teams would be required, where they would come from, and whose responsibility it would be: the FBI, the state police, or the local police.

The responsibilities that were outlined in Presidential Decision Directive 62 were, of course, followed. The Secret Service would be in charge of establishing the plan, the FBI would be responsible for intelligence and response, and the Federal Emergency Management Agency would take the lead in consequence management. However, those responsibilities were then passed along and shared jointly by local and state police authorities.

The cost of such a comprehensive and complete plan, for the 17 days of the Olympics, was about $350 million. This is for a small area for 17 days. It was a great plan, but it's very expensive if you want to do something in that kind of a complete and comprehensive manner.

Responsibility for Funding
There was clear responsibility for funding. We knew who was responsible for paying the bills. The federal government was going to take responsibility for all overtime and responsibility for the air patrol. It was going to take responsibility for all incremental equipment that was needed in the community, including fencing, monitoring systems, and so forth.

The Olympic Organizing Committee was going to take responsibility for a series of specialized equipment as well, and in certain of our venues, the local law enforcement would take responsibility for recruiting police personnel, while all of their base pay and their equipment would be the responsibility of the state and local authorities. It's not that we had the only answer, but we knew going into the games who was responsible for what. On that basis, we were able to plan accordingly.

Defining Specific Responsibilities
We defined specific responsibilities. We knew that the Secret Service was in charge of the perimeter planning for a particular venue: the monitoring of the mags and bags, where the fence lines would be drawn, what the blast zone would be, and so forth. They took that lead. We knew that the FBI was responsible for all SWAT teams. We knew that the local police were responsible for all traffic management, for normal crime, and for intelligence-gathering at the ground level. We understood who was responsible for what and, on that basis, were able to proceed without duplication and with a comprehensive net of security effort.

Importance of Coordination
We also had highly coordinated information, and our command and control was done in one place. We had a floor in a building in downtown Salt Lake City, which had our adjutant general of the National Guard with his people, the FBI, the Secret Service, FEMA, the state police, sheriffs' offices, and local police chiefs. All of these people were there, all with computer terminals, all with lines to their respective offices, and everything we were doing in the planning phase was done from that central point. As we were proceeding with the event itself, incidents were brought to that point, were discussed, and were given a response.

We established certain protocols. For instance, if there were a bomb threat at a venue, instead of having the local police chief have to figure out what to do, we knew beforehand how we would respond. We decided what the protocols would be, and then we brought any issue that might require an immediate decision to this central point. We also carried out a series of exercises, where we went through mock threats and mock disasters to see if we had ourselves ready.

Finally, I would just note that these elements--a clear plan, a clear responsibility for funding, clearly defined responsibilities, and a highly coordinated communication and information network--allowed us to handle a lot of issues that came up one by one.

Putting It All Together
It was interesting to see what things looked like before we put this whole plan together, because before we had a comprehensive plan and this full outline, security was looking a lot like Atlanta. The state police, for instance, came to me and said they needed a couple of helicopters. The police chief in Midway, Utah, a town of maybe 500 to 1,000 people, came and said they needed an armored personnel carrier to be able to manage in Midway if they had a problem. A sheriff who had responsibility for one of our venues put together a plan as to how many personnel he needed on the side of the mountain to protect that venue, and the number exceeded the number of police in the whole Salt Lake City Valley.

So everybody was doing his own thing: requiring his own equipment and establishing a series of protocols and equipment needs and personnel needs that were entirely out of line with one another and entirely incompatible with the funding capacity of any of the parties.

By finally putting together a plan, by knowing who was going to pay for what and who was responsible for what, and by having a communication system that shared information, all of that confusion went away. We decided on a regional basis how many aircraft we needed and what mobile personnel capacity we needed to have, and each element was part of an overall plan.

The Massachusetts Experience

Now let me take that experience and tell you how we're doing today on the state level. In Massachusetts, we don't spend $345 million on homeland security every 17 days. We don't have that kind of funding. We have many more sites to protect than we would in an Olympic setting.

My secretary of public safety has gone through and graded us on a series of dimensions, and most of the grades are Cs, a few Ds, a few Bs, very few As. We've made a lot of progress, but we have a long, long way to go.

Coordination and Information
We received the best grades on coordination and information. We're doing very well in terms of gathering information from Washington, D.C., the FBI, the CIA, and the intelligence inputs which are being forwarded to us. We receive them at the United States attorney's office.

We take that information and then disseminate it to our first responders through a special network we've established. That network we call Saturn. It is very good at providing information to the people who need to have it. It's working very well in terms of the flow up from Washington out into the field.

We're pretty weak on getting information back to Washington--having our first responders know what they're to look for, having citizens understand what areas might be of concern, and gathering that information, analyzing it, processing it, and sending it to Washington and then finding out how it was dealt with. We're not very good at being able to communicate threats and passing them to people who we think ought to be able to consider them.

Establishing Clear Responsibilities
An area where our grades were not quite as strong is in the area of establishing clear responsibilities. We have a pretty good sense as to who's responsible for response--local law enforcement--but where we fall down is in the area of intelligence: gathering, processing, and analysis. How much should be done at the local level? How much should our Boston police department do in terms of following up on someone who appears to be suspicious? How much of that should be done by the FBI? How much should be done by the state police?

We're all doing some intelligence work right now, but who's primarily responsible for monitoring, surveying, wiretapping? Who's got the lead, and what should each level of government be doing in the area of intelligence?

Responsibility for Funding
An area where we're not really strong is understanding who's responsible for funding what. I'm very pleased with the support we have received from Congress and from the Department of Homeland Security. We've gotten appropriations bills. Monies are coming through. We're being able to send them out, but longer-term, who's going to take responsibility for the various tasks of homeland security, from intelligence to response and the like?

The Massachusetts Statewide Plan
Perhaps the area where I feel the greatest responsibility, and which also received some of the poorest grades, is our statewide plan. Our statewide plan looks a lot like a list of the wants of individual cities and towns. We have 351 cities and towns. They've each written their plans--and Boston has its plan--but regional thinking is lacking.

What's the HAZMAT need for western Massachusetts? What's the mobile command center need for western Massachusetts as opposed to for each town wanting to buy its own equipment, each fire department wanting its own specialized equipment? What are the regional needs, and how do they blend together? And if there's an emergency, how do we respond as a region or as a state, rather than how does a town of a thousand people, with its four police cars, respond to that need?

We continue to think on an atomized, town-by-town, county-by-county basis rather than on a theater-wide basis, and our resources need to be shared across a theater-wide area. Our capabilities need to be shared. Our intelligence certainly has to be done on a regional basis rather than on an atomized local basis, and we have a long way to go there.

If I'm a mayor and I've got a major bridge in my city, what am I supposed to do at that bridge when we go to Code Orange? Should I have trucks at either end, to be able to block traffic? Should I have armed military personnel, my police there, state police? What do you do for a bridge? What do you do for a nuclear power plant at Code Orange or Code Red or Yellow?

Right now, this is left up to people who've never done this before. We have some major tunnels in Boston. When we went to Code Orange, I got out the book. Code Orange means we're supposed to protect key infrastructure. Well, these tunnels are key infrastructure. They cost a lot of money. They connect our city. What am I supposed to do?

We could put a state police car at the entrance with its lights on, but people drive in at 60 miles an hour. They can stop in the middle. So I literally said, "Would you send someone down to New York to see what they're doing and to see what they do at the entrance of their tunnel?" Believe it or not, we don't have that kind of shared information as to what's the best practice. What's the best way to protect a tunnel? What should you do in Code Orange if you're in a high-risk city with a high-risk piece of infrastructure?

What do you do at a big sporting event when we go to Code Orange or Code Yellow? You've got 20,000 people in an arena. Should we put a perimeter around it? A blast zone? Local law enforcement and governors don't have that kind of experience. We need a template to tell us, given the risk level in the country and given the risk level of a city or a community, what the appropriate level of protection might be for a particular piece of infrastructure or a particular risk.

We've got to go regional as well and think not on an atomized basis, but on a far more regional basis. So we have a lot of work to do. We've made a lot of progress. I wasn't happy to see some Ds, some Cs. We've got a lot of work to do.

Improving How We Think About Homeland Security
Let me go back to the original comment I made about how much our world has changed and how I think we need to look at homeland security in a more sea-change kind of way than we have normally approached problems in our country. As I look at planning in my own state, I'd say that 80 percent of our thinking is about response and first responders, how to clean up after the bomb's gone off. We are concerned about interoperability, to make sure that the firemen can talk to the policemen, and we're all concerned about how to respond.

We're about 80 percent thinking about response, in part because most of our homeland security's being planned by responders. Then there's about 15 percent which is associated with what I'll call detection and protection: detecting elements in the air, determining whether there's an outbreak by virtue of admissions in hospitals, assessing what's going on in the community, and remote information-gathering, which allows us to detect and protect various assets in personnel.

That's maybe 15 percent of our thinking, and then 5 percent is on prevention. Who are the people that might be risky people? What are the groups that might be risky groups? Are we listening to them? Are we watching them?

We're not doing very much in that regard, and my guess is that if we want a real sea change as it relates to homeland security, we've got to reverse those percentages. We've got to put a lot more into the prevention, and we've got to put a great deal more also into detection and protection. First response continues to be important, but we need to make sure those other two areas get emphasized a great deal more.

I appreciate the chance to meet with you. I appreciate your work. I hope something I've said has stimulated some thinking that will give us some help and some answers. We're looking forward to receiving those. We'll keep working together and look forward to facing this challenge successfully.

The Honorable Mitt Romney is Governor of Massachusetts.

CHIEF SAM GONZALES:
My role was to talk about the response of government prior to 9/11. I was the chief of police in Oklahoma City from 1991 through 1998, including the time of the bombing, so I'm going to talk about the role of responding in 1995 at the time of the bombing of the Murrah Building.

First, in this day and age, when we're receiving so much money to fight terrorism, I always like to make the point that Oklahoma City was not done by foreign terrorists. Oklahoma City was done by local terrorism. So we have domestic terrorism that we need to remember as well as foreign terrorists.

The second thing is that, although I now work for the FBI, what I'm bringing you today is my lessons learned as a police chief in 1995 and may not reflect everything exactly the way the FBI would want it to be reflected.

I've been asked to talk about the assistance received in Oklahoma City or in events prior to 9/11. State and local mutual aid completely overwhelmed us. We documented 112 different mutual-aid law enforcement agencies that came to Oklahoma City. At one point, I received a teletype from a mayor in California who said, "Chief, you probably don't need the help, but I have three guys that need the experience. They're on the way."

Preparing Localities to Respond

So in my job now with the FBI, as I travel around the country and talk about how locals need to plan for events, I warn them about the fact that state and local law enforcement, firefighter, emergency management, and mutual aid agencies will overrun them unless they have a very comprehensive incident management plan that will help them manage those resources.

We also warn them that there are 42 different federal agencies at this time receiving money to fight terrorism. Jim Schwartz, who is the assistant fire chief with Arlington County, said that 42 of those agencies showed up at the Pentagon to be a part of that response. So if you have a large enough incident, you need to be concerned that all 42 of these federal agencies will show up and want to be a part of whatever response plans you have put together. Urban search and rescue, also a federal asset, will also be there.

We encourage them to build relationships with both the Red Cross and the Salvation Army and to realize that volunteers will come in droves. Volunteers will come from all arenas. We encourage them to use the Red Cross and the Salvation Army because their volunteers have already had background checks, but during the 17-plus days of the response in Oklahoma City, we issued over 21,000 access badges for our crime scene. A great many of those were for the people who were providing support services such as food service.

Importance of Building Relationships

Unlike special events, where you have the opportunity to go through and plan for an event to come to your city, the only plans we had in place were emergency response plans. Oklahoma has about 75 tornados a year. We're used to having tornados. We had very extensive response plans to respond to tornados.

I had the luxury of having four 60-person emergency response teams that planned and trained and exercised on a monthly basis, and we used them extensively in maintaining our perimeters. In 1994, Oklahoma City, as a city, had gone to Emmittsburg, Maryland, spent a week in a disaster management school, and gone through some actual scenarios to help us prepare for the possibility of a disaster in Oklahoma City.

The big thing that it gave us an opportunity to do was build relationships across the lines in our community with every agency that would come to stand by us, not only in public safety, the police department, law enforcement, and emergency management, but also with the utility companies, with the medical examiner's office, and with other entities that came to help us. The number one message that we give--and it's the same thing that the governor said--is that you have to have pre-existing relationships built to be able to respond.

I'll touch on programs that were needed and that we still need today very, very briefly. One is community training. Prior to 1995, it was usual for law enforcement to meet and train with law enforcement, for the fire service to meet and train with the fire service, but it was very, very seldom if ever that you saw the fire service and the police department training and planning for an event together. We planned separately. We trained separately. We exercised separately. Therefore, when we responded in 1995, we responded as different police departments responding to a single incident instead of responding as a community.

What we encourage now is the same thing the governor said: that communities have to redefine geographically how large they are. You cannot simply be a city; you have to be the metropolitan area. You have to be not only your city, but the cities surrounding you. You have to bring in not only public safety, but the private sector to find out what kind of assets you will have to respond to an incident.

We tell people that in all probability, unless they live on the East Coast, they will be on their own for at least six to eight to 12 hours following a large incident. At some point, state and federal help will come, but the initial first response by the local community will be left up to whatever assets they collectively bring to the table to respond to this incident.

Responding to the Attack on the Pentagon

I think one of the factors in the terrorist attack at the Pentagon being handled so well--and from all of the reports I've seen, it was a textbook case--is the fact that they had pre-existing relationships. The Capital Response Team is a responding team made up of the FBI, Arlington County firefighters, Arlington County police, Metropolitan Police, and all of the agencies in the capital response area. They plan and train and exercise together. They answer calls together on a daily basis. They had done a lot of preparation for the inauguration of the President.

When 9/11 happened, everyone who showed up at the scene knew each other. They knew who was going to be in charge. They had done the community training that they needed to do to be able to respond. We still need to do that across America. In too many of our cities, we still have communities that are planning just within their community, just within their law enforcement agency, just within their firefighter services.

Ongoing Concerns

Communications
As I travel around the country, there are still a lot of cities where police departments, fire departments, and public works departments are all on different radio frequencies and do not have the ability to talk to each other. There are a lot of things now that can be done by cellular phones, but there's not a whole lot of security. We go through the issues of communications. We go through the issues of the media and how the media can help you during these situations and how they possibly can be a hindrance.

Equipment and Resources
There's a lot of money coming out from the Department of Homeland Security and other venues to provide equipment and resources to first responders. We encourage them to take advantage of that. A lot of it is still, as I understand, in the process, and we won't know for sure until October 31 exactly what's going to be available and how it will be accessed.

Response of the Community
Oklahoma City responded, I think, as well as any community in America could respond. As we would have needs, our community would respond and overwhelm us with that response.

At times, that's good, and at times, it's bad. At times, you get overrun with an item that you may need. We did not, in our planning, prepare for how you document what's given to you in case you need to give some back. Certainly, as the police chief and Gary Marrs, the fire chief, would tell you, we wanted to acknowledge everyone that gave something to Oklahoma City. If you do not have a plan to do that, then you can't even do that. So you need to plan for the response of your community.

Mental Health
In law enforcement, in Oklahoma City at least, we did not do as much work as we needed to do in the mental health arena. When you put people doing things for 17-plus days that they do not normally do, you can expect a certain number of them to develop some mental health problems.

As CEOs of public safety, as police chiefs, as fire chiefs, as city managers, as city leaders, we need to take on the responsibility of taking care of our employees and making sure that we have plans in place for not only short-term defusings and debriefings during the incident, but long-term mental health plans that will come up later on. We had one police officer in Oklahoma City who two years after the incident committed suicide. Not all mental health problems will occur within the first 30 days or within the first three months. You need some long-term plans.

The Budget Process
The last thing is the budget process, the money. I don't think any municipality, any county budgets for an incident like Oklahoma City. You're going to expend a lot of money that you planned on using somewhere else. Programs that you intended to put in place, equipment that you intended to buy, resources that you intended to get will fall by the wayside until you have an opportunity to get that money back.

We tell them that FEMA has a mechanism to get that money back for them, if the site is declared a disaster area by the President. We encourage them to include FEMA in their planning so that they know exactly which T's to cross, which I's to dot, to be able to get that money returned to their system.

Conclusion

The biggest problem that I still see across the United States is the fact that we have not yet built all of the bridges, built all of the relationships, across all of the disciplines we need to in order to be able to have a truly coordinated community response in a geographical area larger than just a city to an incident that may occur.

Sam Gonzales served as Chief of Police in Oklahoma City, Oklahoma, from 1991 through 1998.