A former coworker of my father used to say there's nothing
more vulnerable than entrenched success. He looked at companies
like General Motors and IBM and noted that there tended to be
changes which occurred in the environment in which they competed,
which, because of their entrenched success and their
self-perception of invulnerability, made them in fact vulnerable
because they didn't change the way they did business. They didn't
respond in a systemic, sea-change manner. Instead, they responded
in a normal manner, and, as a result, they were surpassed.
flow of history suggests the same kind of pattern in countries:
broader trends where everywhere, from the Roman Empire on, various
nations that seemed to be in a position of invulnerability were
found to lose over time that kind of strength and that kind of
The Pattern of Global Change
time, as you look at the history of a corporation or perhaps at
world history, there seem to be inflection points which mark the
change of one pattern to another. Those inflection points don't
necessarily cause the change in history but instead mark or
delineate the passage of one type of environment to another. For
example, Ford Motor Company builds an assembly plant, and, somehow,
that typifies the change from the type of economy that existed
before to the type of economy that existed after.
believe that such a point is also evident in September 11: that
September 11, 2001, marks a change of a global nature in the way
the world works--competitively, from a military strategy
standpoint, from a geopolitical standpoint, and so forth. In some
respects, what we're seeing is a change from where a competitive
advantage and dominance, which would previously have been based
upon being strong, impregnable, immovable, with massive force,
increasingly belong to the small, speedy, nimble upstart of one
kind or another.
Whether it's JetBlue taking on US Air and
United Airlines, or whether it's a small band of murderous, evil
terrorists taking on a whole nation, somehow our world has changed.
I think that pretty dramatic shift is in some ways symbolized by
the trajectory or the inflection point associated with September
11, 2001, which has to figure into all of our thinking about topics
as significant as homeland security.
that as a backdrop, I want to look at how well we're doing in our
homeland security effort and suggest areas for more significant
change. My perspective is built on two experiences, one of which is
the experience I had as the chief executive of the Salt Lake
Olympic Games. Protecting an Olympics is a small thing relative to
protecting a nation or a state, yet, in this case, the security
planning for the Olympic Games serves as a best-demonstrated
practice--a benchmark, if you will, of how homeland security can
work at its best.
other experience I'll draw on is my homeland security experience as
governor of my state. We recently carried out a project where I
asked my secretary of public safety to grade us, based on our
benchmarks, on all dimensions of homeland security, to see how well
we're doing and to compare ourselves with the ideal. He has
particular experience in doing this, as he was the chief of police
for Arlington, Virginia, where, of course, the attack on the
Pentagon occurred, and can draw upon that experience to help in the
Planning for the Olympics:
A Best-Demonstrated Practice
First, let me begin with the Olympics. As
we got into our Olympic planning, we looked back to the prior games
in the United States, which were held in Atlanta. Now, Atlanta was
not a best-demonstrated practice. Looking at Atlanta provided us
with some ideas as to what went wrong and how we had to
planning for security in Atlanta was done like most security
planning: Each county, each city or town, did its own planning for
security. They prepared their own security plans and decided where
their police officers would be deployed. They had their own
surveillance efforts, their own protection efforts, and so forth.
The federal government was doing its job, quite independent of each
of the cities and towns and the state police. They each had very
complete and robust plans, I'm sure. They just didn't happen to
coordinate those plans with one another, so the practices of one
jurisdiction might be different from the practices of another.
result of having such a disparate approach to planning, there were
gaps. There were not just physical gaps, but there were gaps in
terms of knowing where a response was going to be led if it
occurred in a particular area and who was following intelligence
leads in that area. I don't know that those gaps were the cause of,
or led to, the successful act of terrorism there. They certainly
did not prevent it, however, nor would they have prevented many
other possible terrorist incursions.
Decision Directive 62
Following the games, President Bill Clinton promulgated
something known as Presidential Decision Directive Number 62, which
established the provision for a national special-security event.
Under that provision, a series of measures were laid out to be put
in place in the case of a national special-security event such as
an Olympics or a political convention or the like.
addition to that directive, which helped us enormously as we
prepared for Salt Lake City, the State of Utah had the foresight to
establish something called the Utah Olympic Public Safety Command,
which said we're not going to have every city and town and county
deciding what the security's going to be for Olympic venues in
their area. Instead, we're going to call on all of the police
chiefs, sheriffs, state police to all come together in one central
command and plan on a central basis what we're going to do in our
went to the federal government and said, "Given this presidential
decision directive, can you come in and join us as well?" The
federal government could have said, "No, we're separate," but they
didn't. They said, "No, let's join. Let's all work together." So
all of these groups came together in one command.
a period of three or four years, these groups worked together to
lay out a series of responsibilities, to lay out a plan. The plan
was extremely comprehensive and, I believe, robust. Let me mention
some of the things that characterized it.
Number one, and most important, there was a plan which
said that if you have a venue in your area, here's how we protect
that venue. It will have a perimeter. We had various parameters as
to whether it was going to be a hard perimeter, meaning literally a
fence, and, if so, whether it would be a fence with monitoring
systems, motion detection systems, and vision systems, or whether
we'd actually have armed personnel on the entire perimeter without
literally decided on the security requirements for any type of
Olympic venue within any jurisdiction, rather than having one
sheriff saying, "This is how we're going to patrol it" while
another police chief in another area came up with an entirely
different plan. We established what the intelligence protocols
would be, what were the types of risks which would require
surveillance and monitoring prior to the games and during the
games, and who would do that surveillance. We also decided how many
intelligence teams would be required, where they would come from,
and whose responsibility it would be: the FBI, the state police, or
the local police.
responsibilities that were outlined in Presidential Decision
Directive 62 were, of course, followed. The Secret Service would be
in charge of establishing the plan, the FBI would be responsible
for intelligence and response, and the Federal Emergency Management
Agency would take the lead in consequence management. However,
those responsibilities were then passed along and shared jointly by
local and state police authorities.
cost of such a comprehensive and complete plan, for the 17 days of
the Olympics, was about $350 million. This is for a small area for
17 days. It was a great plan, but it's very expensive if you want
to do something in that kind of a complete and comprehensive
There was clear responsibility for funding. We knew who
was responsible for paying the bills. The federal government was
going to take responsibility for all overtime and responsibility
for the air patrol. It was going to take responsibility for all
incremental equipment that was needed in the community, including
fencing, monitoring systems, and so forth.
Olympic Organizing Committee was going to take responsibility for a
series of specialized equipment as well, and in certain of our
venues, the local law enforcement would take responsibility for
recruiting police personnel, while all of their base pay and their
equipment would be the responsibility of the state and local
authorities. It's not that we had the only answer, but we knew
going into the games who was responsible for what. On that basis,
we were able to plan accordingly.
We defined specific responsibilities. We knew that the
Secret Service was in charge of the perimeter planning for a
particular venue: the monitoring of the mags and bags, where the
fence lines would be drawn, what the blast zone would be, and so
forth. They took that lead. We knew that the FBI was responsible
for all SWAT teams. We knew that the local police were responsible
for all traffic management, for normal crime, and for
intelligence-gathering at the ground level. We understood who was
responsible for what and, on that basis, were able to proceed
without duplication and with a comprehensive net of security
We also had highly coordinated information, and our
command and control was done in one place. We had a floor in a
building in downtown Salt Lake City, which had our adjutant general
of the National Guard with his people, the FBI, the Secret Service,
FEMA, the state police, sheriffs' offices, and local police chiefs.
All of these people were there, all with computer terminals, all
with lines to their respective offices, and everything we were
doing in the planning phase was done from that central point. As we
were proceeding with the event itself, incidents were brought to
that point, were discussed, and were given a response.
established certain protocols. For instance, if there were a bomb
threat at a venue, instead of having the local police chief have to
figure out what to do, we knew beforehand how we would respond. We
decided what the protocols would be, and then we brought any issue
that might require an immediate decision to this central point. We
also carried out a series of exercises, where we went through mock
threats and mock disasters to see if we had ourselves ready.
Finally, I would just note that these
elements--a clear plan, a clear responsibility for funding, clearly
defined responsibilities, and a highly coordinated communication
and information network--allowed us to handle a lot of issues that
came up one by one.
Putting It All
It was interesting to see what things looked like before
we put this whole plan together, because before we had a
comprehensive plan and this full outline, security was looking a
lot like Atlanta. The state police, for instance, came to me and
said they needed a couple of helicopters. The police chief in
Midway, Utah, a town of maybe 500 to 1,000 people, came and said
they needed an armored personnel carrier to be able to manage in
Midway if they had a problem. A sheriff who had responsibility for
one of our venues put together a plan as to how many personnel he
needed on the side of the mountain to protect that venue, and the
number exceeded the number of police in the whole Salt Lake City
everybody was doing his own thing: requiring his own equipment and
establishing a series of protocols and equipment needs and
personnel needs that were entirely out of line with one another and
entirely incompatible with the funding capacity of any of the
finally putting together a plan, by knowing who was going to pay
for what and who was responsible for what, and by having a
communication system that shared information, all of that confusion
went away. We decided on a regional basis how many aircraft we
needed and what mobile personnel capacity we needed to have, and
each element was part of an overall plan.
The Massachusetts Experience
let me take that experience and tell you how we're doing today on
the state level. In Massachusetts, we don't spend $345 million on
homeland security every 17 days. We don't have that kind of
funding. We have many more sites to protect than we would in an
secretary of public safety has gone through and graded us on a
series of dimensions, and most of the grades are Cs, a few Ds, a
few Bs, very few As. We've made a lot of progress, but we have a
long, long way to go.
We received the best grades on coordination and
information. We're doing very well in terms of gathering
information from Washington, D.C., the FBI, the CIA, and the
intelligence inputs which are being forwarded to us. We receive
them at the United States attorney's office.
take that information and then disseminate it to our first
responders through a special network we've established. That
network we call Saturn. It is very good at providing information to
the people who need to have it. It's working very well in terms of
the flow up from Washington out into the field.
We're pretty weak on getting information
back to Washington--having our first responders know what they're
to look for, having citizens understand what areas might be of
concern, and gathering that information, analyzing it, processing
it, and sending it to Washington and then finding out how it was
dealt with. We're not very good at being able to communicate
threats and passing them to people who we think ought to be able to
An area where our grades were not quite as strong is in
the area of establishing clear responsibilities. We have a pretty
good sense as to who's responsible for response--local law
enforcement--but where we fall down is in the area of intelligence:
gathering, processing, and analysis. How much should be done at the
local level? How much should our Boston police department do in
terms of following up on someone who appears to be suspicious? How
much of that should be done by the FBI? How much should be done by
the state police?
We're all doing some intelligence work
right now, but who's primarily responsible for monitoring,
surveying, wiretapping? Who's got the lead, and what should each
level of government be doing in the area of intelligence?
An area where we're not really strong is understanding
who's responsible for funding what. I'm very pleased with the
support we have received from Congress and from the Department of
Homeland Security. We've gotten appropriations bills. Monies are
coming through. We're being able to send them out, but longer-term,
who's going to take responsibility for the various tasks of
homeland security, from intelligence to response and the like?
Massachusetts Statewide Plan
Perhaps the area where I feel the greatest responsibility,
and which also received some of the poorest grades, is our
statewide plan. Our statewide plan looks a lot like a list of the
wants of individual cities and towns. We have 351 cities and towns.
They've each written their plans--and Boston has its plan--but
regional thinking is lacking.
What's the HAZMAT need for western
Massachusetts? What's the mobile command center need for western
Massachusetts as opposed to for each town wanting to buy its own
equipment, each fire department wanting its own specialized
equipment? What are the regional needs, and how do they blend
together? And if there's an emergency, how do we respond as a
region or as a state, rather than how does a town of a thousand
people, with its four police cars, respond to that need?
continue to think on an atomized, town-by-town, county-by-county
basis rather than on a theater-wide basis, and our resources need
to be shared across a theater-wide area. Our capabilities need to
be shared. Our intelligence certainly has to be done on a regional
basis rather than on an atomized local basis, and we have a long
way to go there.
I'm a mayor and I've got a major bridge in my city, what am I
supposed to do at that bridge when we go to Code Orange? Should I
have trucks at either end, to be able to block traffic? Should I
have armed military personnel, my police there, state police? What
do you do for a bridge? What do you do for a nuclear power plant at
Code Orange or Code Red or Yellow?
Right now, this is left up to people
who've never done this before. We have some major tunnels in
Boston. When we went to Code Orange, I got out the book. Code
Orange means we're supposed to protect key infrastructure. Well,
these tunnels are key infrastructure. They cost a lot of money.
They connect our city. What am I supposed to do?
could put a state police car at the entrance with its lights on,
but people drive in at 60 miles an hour. They can stop in the
middle. So I literally said, "Would you send someone down to New
York to see what they're doing and to see what they do at the
entrance of their tunnel?" Believe it or not, we don't have that
kind of shared information as to what's the best practice. What's
the best way to protect a tunnel? What should you do in Code Orange
if you're in a high-risk city with a high-risk piece of
do you do at a big sporting event when we go to Code Orange or Code
Yellow? You've got 20,000 people in an arena. Should we put a
perimeter around it? A blast zone? Local law enforcement and
governors don't have that kind of experience. We need a template to
tell us, given the risk level in the country and given the risk
level of a city or a community, what the appropriate level of
protection might be for a particular piece of infrastructure or a
We've got to go regional as well and think
not on an atomized basis, but on a far more regional basis. So we
have a lot of work to do. We've made a lot of progress. I wasn't
happy to see some Ds, some Cs. We've got a lot of work to do.
Improving How We
Think About Homeland Security
Let me go back to the original comment I made about how
much our world has changed and how I think we need to look at
homeland security in a more sea-change kind of way than we have
normally approached problems in our country. As I look at planning
in my own state, I'd say that 80 percent of our thinking is about
response and first responders, how to clean up after the bomb's
gone off. We are concerned about interoperability, to make sure
that the firemen can talk to the policemen, and we're all concerned
about how to respond.
We're about 80 percent thinking about
response, in part because most of our homeland security's being
planned by responders. Then there's about 15 percent which is
associated with what I'll call detection and protection: detecting
elements in the air, determining whether there's an outbreak by
virtue of admissions in hospitals, assessing what's going on in the
community, and remote information-gathering, which allows us to
detect and protect various assets in personnel.
That's maybe 15 percent of our thinking,
and then 5 percent is on prevention. Who are the people that might
be risky people? What are the groups that might be risky groups?
Are we listening to them? Are we watching them?
We're not doing very much in that regard,
and my guess is that if we want a real sea change as it relates to
homeland security, we've got to reverse those percentages. We've
got to put a lot more into the prevention, and we've got to put a
great deal more also into detection and protection. First response
continues to be important, but we need to make sure those other two
areas get emphasized a great deal more.
appreciate the chance to meet with you. I appreciate your work. I
hope something I've said has stimulated some thinking that will
give us some help and some answers. We're looking forward to
receiving those. We'll keep working together and look forward to
facing this challenge successfully.
The Honorable Mitt Romney
is Governor of Massachusetts.
CHIEF SAM GONZALES:
My role was to talk about the response of government prior
to 9/11. I was the chief of police in Oklahoma City from 1991
through 1998, including the time of the bombing, so I'm going to
talk about the role of responding in 1995 at the time of the
bombing of the Murrah Building.
First, in this day and age, when we're
receiving so much money to fight terrorism, I always like to make
the point that Oklahoma City was not done by foreign terrorists.
Oklahoma City was done by local terrorism. So we have domestic
terrorism that we need to remember as well as foreign
second thing is that, although I now work for the FBI, what I'm
bringing you today is my lessons learned as a police chief in 1995
and may not reflect everything exactly the way the FBI would want
it to be reflected.
been asked to talk about the assistance received in Oklahoma City
or in events prior to 9/11. State and local mutual aid completely
overwhelmed us. We documented 112 different mutual-aid law
enforcement agencies that came to Oklahoma City. At one point, I
received a teletype from a mayor in California who said, "Chief,
you probably don't need the help, but I have three guys that need
the experience. They're on the way."
Preparing Localities to Respond
in my job now with the FBI, as I travel around the country and talk
about how locals need to plan for events, I warn them about the
fact that state and local law enforcement, firefighter, emergency
management, and mutual aid agencies will overrun them unless they
have a very comprehensive incident management plan that will help
them manage those resources.
also warn them that there are 42 different federal agencies at this
time receiving money to fight terrorism. Jim Schwartz, who is the
assistant fire chief with Arlington County, said that 42 of those
agencies showed up at the Pentagon to be a part of that response.
So if you have a large enough incident, you need to be concerned
that all 42 of these federal agencies will show up and want to be a
part of whatever response plans you have put together. Urban search
and rescue, also a federal asset, will also be there.
encourage them to build relationships with both the Red Cross and
the Salvation Army and to realize that volunteers will come in
droves. Volunteers will come from all arenas. We encourage them to
use the Red Cross and the Salvation Army because their volunteers
have already had background checks, but during the 17-plus days of
the response in Oklahoma City, we issued over 21,000 access badges
for our crime scene. A great many of those were for the people who
were providing support services such as food service.
Importance of Building Relationships
Unlike special events, where you have the
opportunity to go through and plan for an event to come to your
city, the only plans we had in place were emergency response plans.
Oklahoma has about 75 tornados a year. We're used to having
tornados. We had very extensive response plans to respond to
had the luxury of having four 60-person emergency response teams
that planned and trained and exercised on a monthly basis, and we
used them extensively in maintaining our perimeters. In 1994,
Oklahoma City, as a city, had gone to Emmittsburg, Maryland, spent
a week in a disaster management school, and gone through some
actual scenarios to help us prepare for the possibility of a
disaster in Oklahoma City.
big thing that it gave us an opportunity to do was build
relationships across the lines in our community with every agency
that would come to stand by us, not only in public safety, the
police department, law enforcement, and emergency management, but
also with the utility companies, with the medical examiner's
office, and with other entities that came to help us. The number
one message that we give--and it's the same thing that the governor
said--is that you have to have pre-existing relationships built to
be able to respond.
touch on programs that were needed and that we still need today
very, very briefly. One is community training. Prior to 1995, it
was usual for law enforcement to meet and train with law
enforcement, for the fire service to meet and train with the fire
service, but it was very, very seldom if ever that you saw the fire
service and the police department training and planning for an
event together. We planned separately. We trained separately. We
exercised separately. Therefore, when we responded in 1995, we
responded as different police departments responding to a single
incident instead of responding as a community.
we encourage now is the same thing the governor said: that
communities have to redefine geographically how large they are. You
cannot simply be a city; you have to be the metropolitan area. You
have to be not only your city, but the cities surrounding you. You
have to bring in not only public safety, but the private sector to
find out what kind of assets you will have to respond to an
tell people that in all probability, unless they live on the East
Coast, they will be on their own for at least six to eight to 12
hours following a large incident. At some point, state and federal
help will come, but the initial first response by the local
community will be left up to whatever assets they collectively
bring to the table to respond to this incident.
Responding to the Attack on the
think one of the factors in the terrorist attack at the Pentagon
being handled so well--and from all of the reports I've seen, it
was a textbook case--is the fact that they had pre-existing
relationships. The Capital Response Team is a responding team made
up of the FBI, Arlington County firefighters, Arlington County
police, Metropolitan Police, and all of the agencies in the capital
response area. They plan and train and exercise together. They
answer calls together on a daily basis. They had done a lot of
preparation for the inauguration of the President.
9/11 happened, everyone who showed up at the scene knew each other.
They knew who was going to be in charge. They had done the
community training that they needed to do to be able to respond. We
still need to do that across America. In too many of our cities, we
still have communities that are planning just within their
community, just within their law enforcement agency, just within
their firefighter services.
As I travel around the country, there are still a lot of
cities where police departments, fire departments, and public works
departments are all on different radio frequencies and do not have
the ability to talk to each other. There are a lot of things now
that can be done by cellular phones, but there's not a whole lot of
security. We go through the issues of communications. We go through
the issues of the media and how the media can help you during these
situations and how they possibly can be a hindrance.
There's a lot of money coming out from the Department of
Homeland Security and other venues to provide equipment and
resources to first responders. We encourage them to take advantage
of that. A lot of it is still, as I understand, in the process, and
we won't know for sure until October 31 exactly what's going to be
available and how it will be accessed.
Response of the
Oklahoma City responded, I think, as well as any community
in America could respond. As we would have needs, our community
would respond and overwhelm us with that response.
times, that's good, and at times, it's bad. At times, you get
overrun with an item that you may need. We did not, in our
planning, prepare for how you document what's given to you in case
you need to give some back. Certainly, as the police chief and Gary
Marrs, the fire chief, would tell you, we wanted to acknowledge
everyone that gave something to Oklahoma City. If you do not have a
plan to do that, then you can't even do that. So you need to plan
for the response of your community.
In law enforcement, in Oklahoma City at least, we did not
do as much work as we needed to do in the mental health arena. When
you put people doing things for 17-plus days that they do not
normally do, you can expect a certain number of them to develop
some mental health problems.
CEOs of public safety, as police chiefs, as fire chiefs, as city
managers, as city leaders, we need to take on the responsibility of
taking care of our employees and making sure that we have plans in
place for not only short-term defusings and debriefings during the
incident, but long-term mental health plans that will come up later
on. We had one police officer in Oklahoma City who two years after
the incident committed suicide. Not all mental health problems will
occur within the first 30 days or within the first three months.
You need some long-term plans.
The last thing is the budget process, the money. I don't
think any municipality, any county budgets for an incident like
Oklahoma City. You're going to expend a lot of money that you
planned on using somewhere else. Programs that you intended to put
in place, equipment that you intended to buy, resources that you
intended to get will fall by the wayside until you have an
opportunity to get that money back.
tell them that FEMA has a mechanism to get that money back for
them, if the site is declared a disaster area by the President. We
encourage them to include FEMA in their planning so that they know
exactly which T's to cross, which I's to dot, to be able to get
that money returned to their system.
biggest problem that I still see across the United States is the
fact that we have not yet built all of the bridges, built all of
the relationships, across all of the disciplines we need to in
order to be able to have a truly coordinated community response in
a geographical area larger than just a city to an incident that may
Sam Gonzales served as
Chief of Police in Oklahoma City, Oklahoma, from 1991 through