[House Hearing, 110 Congress]
[From the U.S. Government Publishing Office]
PARTNERING WITH THE PRIVATE SECTOR TO SECURE CRITICAL INFRASTRUCTURE:
HAS THE DEPARTMENT OF HOMELAND SECURITY ABANDONED THE RESILIENCE-BASED
APPROACH?
=======================================================================
HEARING
before the
SUBCOMMITTEE ON TRANSPORTATION SECURITY
AND INFRASTRUCTURE PROTECTION
of the
COMMITTEE ON HOMELAND SECURITY
HOUSE OF REPRESENTATIVES
ONE HUNDRED TENTH CONGRESS
SECOND SESSION
__________
MAY 14, 2008
__________
Serial No. 110-114
__________
Printed for the use of the Committee on Homeland Security
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Available via the World Wide Web: http://www.gpoaccess.gov/congress/
index.html
__________
U.S. GOVERNMENT PRINTING OFFICE
43-939 PDF WASHINGTON DC: 2008
---------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing
Office Internet: bookstore.gpo.gov Phone: toll free (866)512-1800
DC area (202)512-1800 Fax: (202) 512-2250 Mail Stop SSOP,
Washington, DC 20402-0001
COMMITTEE ON HOMELAND SECURITY
Bennie G. Thompson, Mississippi, Chairman
Loretta Sanchez, California Peter T. King, New York
Edward J. Markey, Massachusetts Lamar Smith, Texas
Norman D. Dicks, Washington Christopher Shays, Connecticut
Jane Harman, California Mark E. Souder, Indiana
Peter A. DeFazio, Oregon Tom Davis, Virginia
Nita M. Lowey, New York Daniel E. Lungren, California
Eleanor Holmes Norton, District of Mike Rogers, Alabama
Columbia David G. Reichert, Washington
Zoe Lofgren, California Michael T. McCaul, Texas
Sheila Jackson Lee, Texas Charles W. Dent, Pennsylvania
Donna M. Christensen, U.S. Virgin Ginny Brown-Waite, Florida
Islands Gus M. Bilirakis, Florida
Bob Etheridge, North Carolina David Davis, Tennessee
James R. Langevin, Rhode Island Paul C. Broun, Georgia
Henry Cuellar, Texas Candice S. Miller, Michigan
Christopher P. Carney, Pennsylvania
Yvette D. Clarke, New York
Al Green, Texas
Ed Perlmutter, Colorado
Bill Pascrell, Jr., New Jersey
Jessica Herrera-Flanigan, Staff Director & General Counsel
Rosaline Cohen, Chief Counsel
Michael Twinchek, Chief Clerk
Robert O'Connor, Minority Staff Director
______
SUBCOMMITTEE ON TRANSPORTATION SECURITY AND INFRASTRUCTURE PROTECTION
SHEILA JACKSON LEE, Texas, Chairwoman
Edward J. Markey, Massachusetts Daniel E. Lungren, California
Peter A. DeFazio, Oregon Ginny Brown-Waite, Florida
Eleanor Holmes Norton, District of Gus M. Bilirakis, Florida
Columbia Paul C. Broun, Georgia
Yvette D. Clarke, New York Peter T. King, New York (Ex
Ed Perlmutter, Colorado Officio)
Bennie G. Thompson, Mississippi (Ex
Officio)
Erin Daste, Director & Counsel
Natalie Nixon, Deputy Chief Clerk
Coley O'Brien, Minority Senior Counsel
(II)
C O N T E N T S
----------
Page
Statements
The Honorable Sheila Jackson Lee, a Representative in Congress
From the State of Texas, and Chairwoman, Subcommittee on
Transportation Security and Infrastructure Protection.......... 1
The Honorable Daniel E. Lungren, a Representative in Congress
From the State of California, and Ranking Member, Subcommittee
on Transportation Security and Infrastructure Protection....... 4
Witnesses
Colonel Robert B. Stephan, Assistant Secretary, Infrastructure
Protection, Department of Homeland Security:
Oral Statement................................................. 7
Prepared Statement............................................. 9
Mr. Jonah J. Czerwinski, Senior Fellow, Homeland Security, IBM
Global Leadership Initiative:
Oral Statement................................................. 14
Prepared Statement............................................. 15
Mr. Shawn Johnson, Vice Chairman, Financial Services, Sector
Coordinating Council:
Oral Statement................................................. 17
Prepared Statement............................................. 19
Mr. William G. Raisch, Director, International Center for
Enterprise Preparedness, New York University:
Oral Statement................................................. 22
Prepared Statement............................................. 24
Dr. Kevin U. Stephens, M.D., Director, Health Department, City of
New Orleans:
Oral Statement................................................. 30
Prepared Statement............................................. 33
PARTNERING WITH THE PRIVATE SECTOR TO SECURE CRITICAL INFRASTRUCTURE:
HAS THE DEPARTMENT OF HOMELAND SECURITY ABANDONED THE RESILIENCE-BASED
APPROACH?
----------
Wednesday, May 14, 2008
U.S. House of Representatives,
Committee on Homeland Security,
Subcommittee on Transportation Security and Infrastructure
Protection,
Washington, DC.
The subcommittee met, pursuant to call, at 2:22 p.m., in
Room 311, Cannon House Office Building, Hon. Sheila Jackson Lee
[chairwoman of the subcommittee] presiding.
Present: Representatives Jackson Lee and Lungren.
Ms. Jackson Lee [presiding.] Good afternoon. Let me thank
the witnesses for their indulgence. The subcommittee will come
to order.
The subcommittee is meeting today to receive testimony on
partnering with the private sector to secure critical
infrastructure. Has the Department of Homeland Security
abandoned the resilience-based approach?
Importantly, this testimony will discuss what the Office of
Infrastructure Protection has done to promote the concept of
resiliency throughout the 17 critical infrastructure sectors.
I am proud to convene today's hearing, which will focus on
private sector participation in securing our Nation's critical
infrastructure. Among our goals today is to determine the
applicability of resilience to this mission, to what extent the
Department is promoting it, and what we as a Congress can do to
support these efforts.
At the outset, I wish to thank Chairman Thompson for
declaring May Resilience Month for our committee.
In support of Resilience Month, today's hearing will focus
on an area ripe with resilience-related issues. Perhaps nowhere
is resilience more relevant to homeland security than the area
of critical infrastructure protection, which I think could be
more accurately termed critical infrastructure protection and
resilience.
After the attacks on September 11, most of the record $80
billion in economic losses was suffered by the private sector.
The consequences of Hurricane Katrina and Rita caused
extraordinary damage, as well. The magnitude of the hurricanes'
actual impact was rivaled only by the catastrophic failure of
the Federal Government to adequately respond to the resulting
suffering.
I am proud to be focusing on critical infrastructure
resilience, but I know that others have also advocated this
position for some time. A task force of the Homeland Security
Advisory Council on Critical Infrastructure released a report
in 2006 stating that the focus should be shifted from
protection to resilience, because it made a more convincing
business case to companies.
I might add that we want to hear from those here today to
find a way to balance protection and resilience. I believe we
can.
The report said that resilience offers an effective
metric--time--companies can measure how long it will be down in
the wake of a particular disaster and can work to minimize that
time. Resilience, I must say, is not capitulation, we in no way
are saying that our guard should be taken down, to assert that
we are mere political theater.
Instead, we are honestly saying to the American people that
we cannot protect everything all of the time. So if we are hit
or one of our suppliers is hit, we plan to ensure that we can
recover quickly so grave damage is not done to our economy.
Our most recent examples--and we are very grateful that we
have not had a terrorist attack since 9/11. We applaud all of
the front-liners and certainly the Department of Homeland
Security and the diligence of this Congress. But we also use as
a backdrop of experience some of the tragedies that have
occurred over the last couple of years.
For example, Hurricane Katrina is a prime example of the
lack of resiliency. Who knows what will happen with the
terrible excess of tornadoes that have occurred over the last
couple of days and last couple of weeks and the damage that has
been done to major geographic areas, including the obliteration
or elimination of a whole city?
What is the resilience there? That is a very good example
for us to use as a backdrop. What is the resilience in
countries, of course, with different political systems? What
will be the resilience of a China or a Burma?
These are questions that we should be asking so that we are
prepared for what may happen to us here in the United States.
It is my belief that the Department should utilize
resilience as a means of which to encourage private owners and
operators to secure their infrastructure for three reasons.
It requires the provision of information that demonstrates
to companies that there is an actionable threat to their
infrastructure.
Most of the time, this information is not available and, as
a result, companies do not see the justification of these
expenditures in the absence of a threat.
Related to the first, companies have been trained by this
economy to have no expenditures that do not produce profit
within a few months. Protective and preventative measures to
defend against a terrorist act likely do not generate such a
profit.
Third, a focus on protection prevention is not measurable.
We have no metric for quantifying whether something is
protected. Without being able to quantify when enough is
enough, industry is more reluctant to act.
However, I might issue a warning: Failing to do this,
failing to do this is the storybook tragedy for failure and for
a long, drawn-out journey of recuperation. Look to see how hard
the people of New Orleans are working, but because of the
failed actions of the Federal Government, resilience,
recuperation has been long in coming.
A strategy based upon resilience is not a silver bullet,
but it does support the critical infrastructure security
objectives. Beyond encouraging preventative and protective
measures, it asks companies to ensure that they can bounce back
due to a disruption, which may include a terrorist attack.
This will support communities' supply chains and our
national psyche. Furthermore, a focus on resilience can
increase the profitability of our companies. For example, a
2007 report by the Council on Competitiveness, entitled ``The
Resilient Economy: Integrating Competitiveness and Security,''
asserting that the 835 companies that announced a supply chain
disruption between 1989 and 2000 experienced 33 percent to 40
percent lower stock returns than their industry peers.
Those companies that were resilient, and thus able to
effectively deal with and bounce back from disruptions, were
the ones which grew in market share and saw increased returns.
In many ways, last week's full committee hearing was eye-
opening. I do believe that the Department is doing more with
resilience than was mentioned at the hearing. I look forward to
hearing from Assistant Secretary Stephan about those programs
under his auspices, and where and why, and why not, and he sees
resilience as being more effective.
This committee has not shied away from promoting private-
sector security. The 9/11 bill passed last August included a
voluntary private-sector preparedness accreditation and
certification program.
By no means is this program regulatory, but it does provide
for a conversation between the Department and the private
sector about security.
Led by Chairman Thompson, we included language that called
upon the Department to work with Sector Coordinating Councils
under Assistant Secretary Stephan to develop the standards for
the voluntary program.
I look forward to hearing more about this program today and
hearing whether the contemplated standards will include an
element of resilience.
This subcommittee is not interested in blame or bashing.
This subcommittee cares only about securing our critical
infrastructure and having a constructive dialogue with the
Department.
We believe that this hearing is a part of that dialogue and
look forward to learning from Assistant Secretary Stephan and
our other witnesses. Resilience may not be the silver bullet,
but a real discussion about it may make us more secure in our
days, weeks, months and years.
Who knows? There may be legislative penalties for those who
don't see this as a constructive aspect of their business. We
have to be able to save lives; we have to be able to save the
economy; we have to be able to move forward during this time of
crisis. To do so, we need the involvement of the public and
private sector.
Once again, I would like to thank everyone for their
participation today, and I look forward to hearing from each of
the witnesses.
At this time, I would like to enter into the record the
2006 Homeland Security Advisory Council report on critical
infrastructure. Hearing no objections, so ordered.*
---------------------------------------------------------------------------
* The information has been retained in committee files.
---------------------------------------------------------------------------
The Chair is now pleased to recognize the distinguished
Ranking Member of the subcommittee, the gentleman from
California, Mr. Lungren, for an opening statement.
Mr. Lungren. Thank you very much, Chairwoman Jackson Lee.
Thank you, members of the panel, for coming here to
testify. But more importantly, thanks for the work that you
have been doing.
I certainly share the chairlady's interest and concern over
the challenges this Nation faces to secure critical
infrastructure. You probably know as well as anybody, those of
you on the panel, it is an enormous job because of the
thousands of critical infrastructure assets we enjoy,
stretching from coast to coast and beyond.
Pursuant to Homeland Security Directive 7, the Department
of Homeland Security developed the National Infrastructure
Protection Plan, NIPP, to identify these vital assets and
coordinate protection efforts across 18 critical infrastructure
sectors.
Assistant Secretary Stephan, we thank you for the work that
you have done in leading this effort on behalf of homeland
security. Also, I recall when you came and asked for delay of
its issuance until it met, by your judgment, the high standards
that you thought were required.
By identifying critical assets and interdependencies,
coordinating risk-based protection programs, and ensuring
information, the NIPP provides the blueprint, I believe, for a
safer, more secure, more resilient America. It sets national
priorities, goals and requirements for effective distribution
of funding and resources to help ensure that our government,
economy and public services continue in the event of a
terrorist attack or other disaster.
Because the private sector owns or operates approximately
85 percent of the Nation's critical infrastructure, partnering
with the private sector is absolutely essential. To a great
extent, we found the private sector has focused on ensuring its
systems and networks were resilient and able to withstand
disruption, manmade or natural, because of commercial and
economic benefits.
I guess one of the questions we have is: How do we ensure
that continues or, in those cases where it is tough to make it
justified by the bottom line, how do we change the analysis so
that people understand that to be important?
After 9/11, when the financial markets quickly resumed
normal activity, Homeland Security began fostering public and
private partnerships to perfect our country's critical
infrastructure, with each sector bringing strength to the
partnership.
The government provides access to critical threat
information, and I think that is as important as anything else
we do. If you don't have the proper information, it is very
difficult to calculate what the threat is out there and very
difficult for you to respond to that threat.
The government also provides grants, which each sector
controls its own security programs, research and development,
and other resources that are more effective when shared.
Another example, I believe, of the Department promoting
resiliency is the creation of the National Infrastructure
Simulation and Analysis Center. It identifies
interdependencies, the consequence of infrastructure
disruptions, and suggests remedial action across all critical
infrastructure sectors.
It just seems to me that the four key mission areas of the
Department of Homeland Security--preventing, protecting
against, responding to, and recovering from terrorist attacks
or natural disasters--are equally important, whether we use the
rubric of resiliency or not.
I would prefer to prevent an attack, as I am sure we all
would, rather than respond and recover from one. However, if
there is another attack or natural disaster, we must ensure
that the Department and its governmental and private-sector
partners can respond to and recover from such an incident.
So we thank you for being here. I look very much forward to
the testimony from our witnesses.
If I were still chairperson, I would invite you to speak.
But a funny thing happened on the way to the ballot box a
couple years ago.
With that, I would yield back the balance of my time.
Ms. Jackson Lee. The gentleman has yielded back his time.
I welcome our panel of witnesses. Our first witness,
Assistant Secretary Robert Stephan, was appointed to serve as
the Assistant Secretary of Homeland Security for Infrastructure
Protection in April 2005. In this capacity, he is responsible
for the Department's efforts to catalogue our critical
infrastructure and key resources and coordinate risk-based
strategies and protective measures to secure them from
terrorist attack.
I would like to especially thank Colonel Stephan for his
participation today. I understand--and he has been on and been
between two international trips. I might say--I don't know if I
want to say for the record, because he looks very well to me--
but we will put it in the record so that he is covered. He is
fighting off jetlag.
But he has always been very gracious in his relationship
with this committee and the Congress but, more importantly,
very dutiful and attentive to his responsibilities at Homeland
Security. This committee recognizes and appreciates his
dedication to the Department and this very important topic.
Our second witness is Mr. Jonah Czerwinski. Jonah
Czerwinski is Managing Consultant, Global Business Services at
IBM, and a Senior Fellow for Homeland Security in IBM's Global
Leadership Initiative.
First, we are glad that the private sector has seen fit to
establish such an initiative, and we look forward to hearing
his testimony. He is responsible for developing policy,
guidance for the global movement management campaign at IBM. He
also served on the Council on Foreign Relations Study Group on
Strategies for Defense Against Nuclear Terrorism.
From 2001 to 2004, he directed the center's homeland
security roundtable, which regularly convened senior homeland
security leadership of the executive branch and Congress with
leaders of the think-tank community, academia, and private
sector to discuss critical homeland security issues. He is the
primary contributor to the Homeland Security Blog,
www.hlswatch.com.
Our third witness is Mr. Shawn Johnson. Mr. Johnson is a
Managing Director of State Street Global Advisors. He is the
Chairman of the SSGA Investment Committee and Director of
Institutional Fiduciary Services.
Shawn is also a member of the State Street Corporation's
Major Risk Committee, as well as the SSGA's independent
fiduciary committee, and the SSGA Tuckerman Real Estate
Investment Committee.
In addition to managing SSGA's team of economists and
strategists, Shawn oversees SSGA's advanced research center,
product engineering, as well as private equity investments,
including CitiStreet, Wilton, ABCM, and SSGI Italy.
He is also responsible for SSGA's merger and acquisition
activities globally. Additionally, Shawn is currently the Vice
President of the Financial Services Sector Coordinating
Council, the private-sector organization that coordinates
homeland security issues with Federal and financial regulators.
We need not go any further than 9/11 to recognize the
impact on the financial services industry, particularly Wall
Street, to know how important the testimony is today.
Our fourth witness is William Raisch, Director of the
International Center for Enterprise Preparedness, Intercep, at
New York University. He founded the center with initial funding
from the U.S. Department of Homeland Security, as the world's
first academic research center dedicated to private-sector
emergency preparedness and resilience.
His work with Intercep focuses on the development of actual
strategies and policies in this arena through active engagement
of key stakeholders. Topical concentrations reflect an emphasis
on the what and the why of resilience and include best
practices, standards, metrics, assessments, information flow,
public-private partnerships, and the economic impact of
resilience, including the role of incentives for business.
In addition to strong involvement with the U.S. business
sector, the center has an international outreach actively
working with a diversity of multinational corporations, as well
as representatives from various national governments and NGOs
globally.
You are welcome.
Our fifth and final witness is Dr. Kevin Stephens, Health
Director for the city of New Orleans. He has served in this
position since 2002. His responsibilities for public health in
New Orleans include managing six divisions and 30 programs,
encompassing a wide range of health issues.
Dr. Stephens served as Health Director both before and
after Katrina and knows firsthand the importance of health care
infrastructure resiliency.
Dr. Stephens serves on the clinical faculty of Xavier
University, Dillard University, LSU Medical School, and Tulane
Medical School. He is a member of the Louisiana Bar Association
and has worked as a consultant to many local and State and
Federal agencies.
It is my great hope, Dr. Stephens, that as we know that you
are certainly wanting to commend and celebrate the great
progress that has been made in New Orleans--and let me, for the
record, acknowledge that--I want you to be, if you will
unabashedly forward and forceful on the state of the health
infrastructure in New Orleans.
I will place in the record my appreciation and respect for
the hard work that the people of New Orleans and the municipal
leaders have engaged in. Today, however, we want the raw facts
of where you are today.
So I welcome all of the witnesses. Without objection, the
witnesses' full statements will be inserted in the record.
I now ask each witness to summarize his statement for 5
minutes, beginning with Assistant Secretary Stephan.
You are recognized and welcome for 5 minutes.
STATEMENT OF COLONEL ROBERT B. STEPHAN, ASSISTANT SECRETARY,
INFRASTRUCTURE PROTECTION, DEPARTMENT OF HOMELAND SECURITY
Colonel Stephan. Thank you, Madam Chairwoman, Ranking
Member Lungren. I appreciate the opportunity to be before you
today.
I also appreciate your ongoing leadership and focus in this
very important subset of the homeland security overall mission
area. I know you have heard previous testimony from some of my
department counterparts, as well as key private-sector
stakeholders, on this topic.
I also hope from my heart that you received a resounding
``no'' from them in response to the question that is titling
this hearing, ``Has the Department of Homeland Security
abandoned the resiliency-based approach?''
This is not about abandoning a resiliency-based approach.
The Department fully embraces the concept of resiliency. It is
not about protection versus resiliency. It is about both.
It is about achieving an appropriate balance, Madam
Chairwoman, as you said in your opening statement. That is what
this is all about, because we understand the incredible
necessity of being able to absorb an attack of Mother Nature,
of Al Qaeda, or some other emergency, and being able to
respond, recover, reconstitute quickly.
But we also feel that, in some cases, some of the more
extreme advocates of the resiliency construct dismiss the
importance of an upfront prevention and protection piece that
absolutely has risk as a critical component so that we can
direct our energies and resources appropriately.
We cannot afford to protect everything, but we cannot
simply stand by and protect nothing. So we have to do things in
advance, and we have to do things after the fact to make sure
that we are saving American lives, limiting disruption to the
economy, and getting American society back on its feet as
quickly as possible. That is what this debate is all about,
from my perspective.
Our focus on the Nation's critical infrastructure includes
actions to mitigate overall risk to assets, systems, networks,
functions, and their interconnecting linkages resulting from
any type of hazard, whether it be a terrorist attack, and
attack by Mother Nature, or a major safety incident.
This includes actions to deter threats, mitigate
vulnerabilities, and minimize consequences. Protection can
include, in the scope of a national infrastructure protection
plan, a wide range of activities, such as hardening facilities,
building resiliency redundancy, incorporating hazard resistance
into facility or system or network design, initiating active or
passive countermeasures, installing security systems, promoting
workforce security programs, and implementing cyber measures,
among various other precautions.
There cannot be a one-size-fits-all approach, as some would
advocate. Rather, we have devised a national-level approach
based on a combination of consideration that reflects an
understanding of vulnerabilities, interdependencies, and
priorities in this all-hazards context.
We view protection as an overarching risk management
strategy that is supported by very important and specific
congressional and executive branch authorities that fully
acknowledge the concept of resiliency where it offers the best
solution to managing a particular set of risk at the facility,
system, sector, or enterprise level.
Since the 9/11 attacks, we have made significant efforts to
define the scope of work required to establish the processes
and mechanisms to secure and mitigate the vulnerability of our
infrastructures, ensuring their functionality and resiliency in
a post-attack or post-incident mode, as well.
Because the private sector owns and operates most of the
Nation's infrastructures, DHS has pursued a framework in which
government and the private sector work together with our State
and local partners in a common approach to set goals and
priorities, identify risks, assign roles and responsibilities,
allocate resources, and measure progress across this framework.
The concept of resiliency is absolutely critical across this
framework.
We also recognize that adopting, however, a one-size-fits-
all construct would possibly create a very important imbalance.
Specifically, we must make sure that our approach incorporates
a resiliency-based response and recovery component, as well as
an upfront risk-based, risk-directed prevention and protection
component.
The chemical, nuclear and energy sectors are prime examples
of the need to balance our concern about infrastructure
restoration after an incident, with our ability to prevent the
release of dangerous chemical substance in the populated areas
in the context of these sectors.
After all, preventing the loss of American lives, innocent
lives, must remain our No. 1 goal and concern. Our efforts and
accomplishment to date, in partnership with many others,
reflect this need for a balanced approach between prevention,
protection, and resiliency.
In June 2006, we released the National Infrastructure
Protection Plan, again, a balanced approach between resiliency,
protection, response and recovery activities, and upfront
prevention.
The NIPP addresses the importance of resiliency over 52
times throughout the course of the document, and it is the
national unifying framework for understanding and managing
risks to our Nation's critical infrastructures.
The 17 critical infrastructure plans that were promulgated
about a year ago are the product of 18 months of joint effort
by CIKR owners and operators, State and local, tribal and
territory officials, and Federal officials to make sure that we
get this right.
The diversity of the sectors means that different types of
protection activities may be most effective for each. Certain
sectors are most likely to embrace resiliency as an overarching
approach, given their inherent characteristics, while others
may focus on specific types of physical protection or
cybersecurity or rapid response, to minimize consequences.
Ma'am, I appear with your staff on multiple occasions
various elements of the sector-specific plans. Just to
highlight some examples, in banking and finance, resiliency
integrated in 48 times, communications sector 55 times, dams 10
times, defense industrial base 14 times, energy 34 times, I.T.
24 times, postal and shipping 23 times, transportation 86
times, water 20 times.
The construct and concept of resiliency, working in
partnership with upfront, risk-based protection, prevention is
thoroughly engrained, embedded and indoctrinated into all the
national-level strategies and plans that we have been working
on for the past 3 years.
In addition, I brought a copy of the National
Infrastructure Protection Plan appropriately marked with all
the resiliency pieces of the puzzle flagged for your staff to
look at.
I brought recently, last night issued, while I was flying
back from overseas, our national hurricane analysis that really
focuses on pre-event, pre-landfall hurricane infrastructure
impacts, as well as what we think might happen post-landfall,
passed that out to our private-sector counterparts.
We recently promulgated the critical infrastructure,
resiliency, protection, security, information sharing annex to
the national response framework that we will use to guide
ourselves and the Nation through hurricane season, as well as a
terrorist attack.
Finally, pandemic influenza across the 17 critical
infrastructure sectors, in a guide that we built with the
private sector, to highlight the need to focus on this type of
pestilence from a resiliency perspective.
So I believe that the documents alone at the national level
speak to the effort that we have put in to making sure we get
this right and to achieve the balance that you spoke to at the
beginning of the conversation.
Ma'am, those are my opening remarks. We look very much
forward to the discussion and the dialogue with you today and,
again, appreciate your collective leadership on this issue.
[The statement of Colonel Stephan follows:]
Prepared Statement of Robert B. Stephan
May 14, 2007
Thank you, Chairwoman Jackson Lee, Ranking Member Lungren, and all
of the distinguished members of the subcommittee. I appreciate the
opportunity to address you on the role of the Office of Infrastructure
Protection (IP) and our many partners, including the private sector, in
securing and enhancing the resiliency of the Nation's critical
infrastructure and key resources (CIKR). I know you have heard from my
counterparts within the Department of Homeland Security on this topic,
and I trust you have also received from them a resounding ``No'' in
response to the question titling this hearing, ``Has the Department of
Homeland Security Abandoned the Resilience-Based Approach?'' Since we
have been in the process of adjusting to a major change in the American
way of life since September 11, 2001, I think it is fair to say that
there is resilience built into practically everything that the
Department of Homeland Security (DHS) does. In fact, DHS defines
resilience as ``the ability to recover from, or adjust to, adversity or
change.'' I would like to focus today on how IP works with its partners
to ensure that a comprehensive, multifaceted framework exists to
support the partnership dedicated to securing and enhancing the
resiliency of the Nation's CIKR.
I believe that a recent article in the publication Foreign Affairs
provides a good explanation of what we mean by ``resiliency.'' The
article stated that there are four factors, that when committed to in a
sustained manner, result in resilience.\1\ The first is robustness, the
ability to keep operating or stay standing in the face of disaster.
Second is resourcefulness, which involves skillfully managing a
disaster once it unfolds. Third is rapid recovery, defined as the
capacity to get things back to normal as quickly as possible after a
disaster. Fourth is the statement that resilience means having the
ability to absorb the new lessons that can be drawn from a catastrophe.
Again, I think that DHS' efforts to date reflect these tenets, and,
particularly for the CIKR protection mission, a sustained commitment is
an absolute requirement of all members of the partnership.
---------------------------------------------------------------------------
\1\ ``America the Resilient,'' Stephen E. Flynn, Foreign Affairs,
March/April 2008.
---------------------------------------------------------------------------
The CIKR protection mission includes actions to mitigate the
overall risk to assets, systems, networks, functions, or their
interconnecting links resulting from exposure, injury, destruction,
incapacitation, or exploitation. In the context of the National
Infrastructure Protection Plan (NIPP), this includes actions to deter
the threat, mitigate vulnerabilities, or minimize consequences
associated with a terrorist attack or other incident. Protection can
include a wide range of activities, such as hardening facilities,
building resiliency and redundancy, incorporating hazard resistance
into the design of a facility, initiating active or passive
countermeasures, installing security systems, promoting workforce
surety programs, and implementing cyber security measures, among
various others. There cannot be a one-size-fits-all approach to CIKR
protection, and we have to devise a strategy based on a combination of
considerations that reflects an understanding of vulnerabilities,
interdependencies, and priorities in an all-hazards context. We view
protection as an overarching risk-management strategy that fully
acknowledges and supports the concept of resiliency where it offers the
best solution to managing a particular risk or set of risks.
Since 9/11, significant efforts have been underway to define the
scope of work required to establish the processes and mechanisms to
secure and mitigate the vulnerability and ensure the functionality of
CIKR across our country. The private sector has made substantial
investments to boost resiliency, increase redundancy, and develop
contingency plans. To support these efforts, the Department has
provided nearly $14.8 billion in risk-based grant funding--with another
$2.5 billion to be distributed this year--to deter threats, reduce
vulnerabilities, and build resiliency.
Because the private sector owns and operates most of the Nation's
critical infrastructure, DHS has successfully pursued a voluntary
partnership approach, where government and the private sector work
together under a common framework to set goals and priorities, identify
key assets, assign roles and responsibilities, allocate resources, and
measure our progress against national priorities. As important as
resiliency is to a number of our critical sectors, we recognize that
adopting a ``one-size-fits-all'' solution could create an imbalance.
The chemical, nuclear and energy sectors are prime examples of the need
to balance our concerns about infrastructure restoration after an
incident, with our ability to prevent the release of dangerous
substances into populated areas. Preventing the loss of human life must
remain our No. 1 goal. Our efforts and accomplishments to date in
partnership reflect this need for a balanced approach.
In June 2006, DHS released the NIPP, the overarching goal of which
is to ``Build a safer, more secure, and more resilient America by
enhancing protection of the Nation's CIKR to prevent, deter,
neutralize, or mitigate the effects of deliberate efforts by terrorists
to destroy, incapacitate, or exploit them; and to strengthen national
preparedness, timely response, and rapid recovery in the event of an
attack, natural disaster, or other emergency.'' The NIPP, which uses
the word ``resiliency'' or a variant of it over 50 times, is the
national unifying framework for understanding and managing the risk to
the Nation's infrastructure through the creation of partnerships with
the private sector. The 17 CI/KR Sector Specific Plans (SSPs) required
under the NIPP were issued on May 21, 2007. They are the product of
almost 18 months of joint effort by the CI/KR owners and operators;
State, local, territorial and tribal governments; and the Federal
Government to identify and address sector specific risks and implement
tailored risk strategies, to include tailored resiliency components.
Specifically, the NIPP provides the coordinated approach to
establish national CIKR priorities, goals, and requirements so that
Federal funding and resources are applied in the most effective manner
to reduce vulnerabilities, deter threats, and minimize the consequences
of terrorist attacks, natural disasters, and other incidents. It
provides an integrated, risk-based approach to focus Federal grant
assistance to State, local, and tribal entities, and to complement
relevant private sector activities. It clearly identifies roles and
responsibilities of all partners, and includes mechanisms to involve
private sector partners in the planning process and supports
collaboration among security partners to establish priorities, define
requirements, share information, and maximize the use of finite
resources. The NIPP serves as the unifying framework to ensure that
CIKR investments are coordinated and address the highest priorities,
based on risk, to achieve the homeland security mission and ensure
continuity of the essential infrastructure and services that support
the American government, economy, and way of life.
Achieving the NIPP goals requires meeting a series of objectives
that include understanding and sharing information about terrorist
threats and other hazards, building security partnerships, implementing
a long-term risk management program, and maximizing the efficient use
of resources. IP focuses on programs, projects, and activities that are
aligned with the NIPP's objectives of Identification and Analysis,
Coordination and Information Sharing, and Risk Mitigation Activities.
This framework and its goals are foundational to what IP does. Every
day, we work with State, local, tribal and territorial leaders and with
private sector owners and operators to pursue a common goal of securing
the Nation's CIKR against terrorist attacks, natural disasters and
other emergencies.
The NIPP provides a Sector Partnership Model through which such
coordinated planning and program implementation can take place. The
SSPs, developed under the umbrella of this Partnership, reflect the
entire range of activities intended to accomplish the goal of security
and resiliency for the sectors, and by doing so, increased
preparedness. While this may sound like a relatively basic undertaking,
it represents probably the first time that the government and the
private sector have come together on such a large scale--literally,
across every major sector of our economy--to develop a joint plan for
how to protect and prepare our CIKR for natural and terrorist-related
incidents. The SSPs define roles and responsibilities within each
sector, catalog existing security authorities, institutionalize
security partnerships already in place; and set clear goals and
objectives to reduce risk, much of which also helps to prepare for
disasters and set the stage for a resilient approach.
The diversity of the CIKR sectors means that different types of
protection activities may be most effective for each. Certain sectors
are most likely to embrace resiliency given their inherent
characteristics, while others may focus more on specific types of
physical protection or training or rapid response to minimize
consequences; most represent a combination of various approaches. Some
examples of activities focusing on resiliency include:
In May of each year, the National Infrastructure
Coordinating Center (NICC), the 24 7 watch center for
coordination and communication with the CIKR sectors,
disseminates a series of documents to the CIKR sectors, which
includes scenario-driven hurricane impact analyses prepared by
the National Infrastructure Simulation and Analysis Center
(NISAC).
This year, NISAC has prepared 10 separate scenario
analyses for simulated hurricanes making landfall in
regions at high risk based on historic hurricane activity,
population, and potential CIKR impacts. These pre-season
analyses are intended to assist the CIKR sectors with
enhanced situational awareness and response and recovery
planning, based upon simulated impacts to each CIKR sector
in those geographical areas, as well as a better
understanding of cross sector interdependencies.
Currently, 24 States have active Water/Wastewater Agency
Response Networks (WARN) organizations, with eight more
scheduled to develop WARN organizations by the end of the third
quarter of 2008. The WARN system development is a direct result
of the sectors third goal from the SSP ``Maintain a Resilient
Infrastructure.''
The Communications SSA, the National Communications System
(NCS), participates in various programs that are aimed at
building awareness or educating a greater community about the
problem of critical infrastructure assurance and resiliency.
An example, the Route Diversity Forum periodically helps
educate NCS member departments and agencies about improving
communications resiliency.
To reach out to the broadcast industry, NCS works through
the Federal Communications Commission (FCC), trade
associations, and the FCC's Media Security and Reliability
Council, which is developing best practices to ensure
optimal reliability, robustness, and security of broadcast
facilities. The NCS also is reaching out to other sectors
with which it shares interdependencies and is assisting
them in reviewing how their plans address communications
interdependencies.
As part of the Nation's electricity supply infrastructure,
the nuclear sector works with regulators and other security
partners to ensure that full operations are resumed as safely
and quickly as possible following an incident which requires a
supply reduction. Furthermore, the sector is working with its
security partners to address medical radioisotope supply
resiliency in the event of a disruption in the radioisotope
supply chain.
Under the auspices of its SCC, the Nuclear Sector has
completed a pilot of its proposed Prompt Notification
program. The Prompt Notification capability will prepare
the sector and nearby CIKR assets to defend against a
geographically coordinated terrorist attack by providing a
real-time mechanism for emergency communications to the
Nuclear Sector, Federal entities, and critical
infrastructure community partners in the vicinity of a
security incident. This program will provide immediate
situational and operational awareness in the event of an
incident, and to enable more effective response and system
restoration.
The Commercial Facilities Sector represents one of our most
diverse sectors. Yet, under the NIPP, it has come together
through its SCC, in recognition of its shared risk and shared
interest in protecting its assets. The participation within its
council shows that there is a strong business case to be made
for making investments of this kind. The companies and
facilities that take steps to protect assets and plan for
emergencies are often the ones that can more quickly recover
from a disruption. Joint activities for this sector include:
The Commercial Facilities Sector Specific Agency
collaboration with the Meridian Institute during their
development of the Southeast Region Research Initiative),
which includes the Community & Regional Resilience
Initiative. These initiatives are intended to develop the
processes and tools needed for communities and regions to
achieve their highest measurable levels of resilience
against disruptions resulting from natural and man-made
disasters. Focus is placed on the ability to quickly return
citizens to work, reopen schools and businesses, and
restore the essential services needed for a full and swift
economic and social recovery. Selected cities in the
Southeast Region are participating in these initiatives.
The ultimate goal of this effort is to strengthen the
capability to withstand, prevent, and protect against
significant multi-hazard threats so that a community,
State, and region, and its private sector partners, can
rapidly restore critical services, re-establish the area's
economic base, and return to ``normal'' as quickly and
effectively as possible.
DHS conducting site assistance visits that incorporated
industry feedback into a set of educational reports that
owners and operators can use to identify vulnerabilities.
DHS providing security training as well as courses on
increasing terrorism awareness around commercial
facilities. To date, DHS has provided a total of 408
courses for the private sector.
Joint participation in major exercises covering terrorism,
hurricane preparedness, and pandemic planning.
Joint working group between DHS and the National
Association for Stock Car Auto Racing (NASCAR) produced a
planning guide for mass evacuation and a template for
NASCAR facilities to use in coordinating with State and
local stake holders and planning. The partnership at each
of these sessions included private sector, State, local,
Federal partners.
The Chemical Sector has numerous programs and initiatives
which increase the Sector's resiliency. In particular the
Sector's dedication to exercises enables the preparation
necessary for a real incident.
The Chemical Sector has participated in numerous national-
level exercises including Top Officials (TOPOFF) and
National Level Exercise 2-08 (NLE 2-08). The Chemical
Sector was active in the Cyberstorm II exercise with a
dozen private sector participants. Exercises like Cyber
Storm II build not only response capability, but also
strong organizational and individual connections that help
ensure the prevention and mitigation of attacks against our
critical systems and networks.
Developed the Pandemic Flu Guideline for the Chemical
Sector--This Annex to the Pandemic Influenza Preparedness,
Response, and Recovery Guide for Critical Infrastructure
and Key Resources will assist the Chemical Sector plan for
a severe pandemic.
The Dams SSA is participating in the development of a pilot
study on regional disaster resilience and risk mitigation for
the Columbia River Basin. This effort is conducted in
collaboration with the Pacific Northwest Economic Region
(PNWER), which leads the coordination efforts. The focus of the
pilot is on interdependencies and the cascading impacts
associated with disruptions of dams, locks, and levees along
the Columbia River Basin. In the event of natural disasters,
man-made events, aging infrastructures, and sub-standard
conditions, failure of these key assets could affect maritime
transportation, energy, agriculture, manufacturing, the overall
economy, health and human safety, and national security. The
goal of this multi-year effort is to identify a holistic
approach with States, localities and relevant key public and
private stakeholders.
As per the National Response Framework, the Office of
Infrastructure Protection has also instituted the Infrastructure
Liaison (IL) to provide the private sector a vital resource during
disasters, in part by enhancing the communications that are so vital to
resilient systems and sectors. The IL acts as the principal advisor to
the Joint Field Office Coordination Group regarding all national and
regional CI/KR incident-related issues and assists the Principal
Federal Official in the prioritization of protection and restoration
efforts. The IL coordinates CI/KR-related issues and actions with the
appropriate Emergency Support Functions (ESFs) and other State and
local components represented in the JFO, providing valuable reach-back
to DHS headquarters and the operational components of the National
Operations Center (NOC), including the NOC Watch, the NICC, and the
National Response Coordination Center (NRCC). Additionally, the IL
provides impacted private sector partners with an established mechanism
and process to address requests for information and assistance, either
directly or via the NICC, in compliance with applicable policies and
laws.
Finally, the CIKR sectors just completed participation in National
Level Exercise (NLE) 2-08, which involved both a hurricane making
landfall and a chemical terrorism threat. The exercise provided the
opportunity for all participants to assess where they have or need
redundancy for business continuity, and the ability to deal with
significant potential power outages and distribution systems
disruptions.
Additionally, we focus on CIKR with the activities of the Homeland
Infrastructure Threat and Risk Analysis Center (HITRAC), a joint
infrastructure-intelligence fusion center with the Office of
Intelligence and Analysis (OI&A). HITRAC analyzes and monitors risks to
U.S. CIKR, allowing IP to provide DHS decisionmakers, the Federal CIKR
community, owners and operators of CIKR, as well as State, local, and
tribal and territorial authorities with actionable analysis and
recommendations to manage risk. Analytical products are developed at
the asset, sector, region, and national level and provide an
understanding of the threat, CIKR vulnerabilities, the potential
consequences of an attack, and the effects of risk-mitigation actions.
Again, protection can include a wide range of activities. There
cannot be a one-size-fits-all approach to CIKR protection, and we work
with a variety of partners in a dynamic risk landscape to prioritize
activities and devise a strategy based on a combination of
considerations that reflect an understanding of vulnerabilities and
interdependencies in the all hazards context. We view protection as an
overarching risk management strategy that fully acknowledges and
supports the concept of resiliency where it offers the best solution to
managing a particular risk or set of risks. The NIPP and its supporting
SSPs chart the path forward for continuous improvement of security and
resiliency of our critical infrastructures, and the focused activities
of IP in concert with all of our CIKR partners ensures their
preparedness.
Thank you for your attention and I would be happy to answer any
questions you may have at this time.
Ms. Jackson Lee. I thank the Assistant Secretary. Without
objection, we will put his entire testimony, including his
documents, in the record.
Thank you again. I now recognize Mr. Czerwinski to
summarize his statement for 5 minutes.
Welcome.
STATEMENT OF JONAH J. CZERWINSKI, SENIOR FELLOW, HOMELAND
SECURITY, IBM GLOBAL LEADERSHIP INITIATIVE
Mr. Czerwinski. Given the unique risks of 21st century,
resiliency is a necessary goal. The balance you spoke of is
key.
I am a senior fellow at IBM's Global Leadership Initiative,
where I work on public-sector homeland security challenges from
a private-sector perspective, much of it on resilience. For the
past 15 months, I have worked on a framework for strengthening
commerce, security and resiliency.
Today, I would like to touch upon three things. First,
resilience and its definition, which can be an elusive concept,
meaning different things to different stakeholders; second, the
unique role served by the private sector; and, third, a
recommendation for how DHS can engage the private sector in
making this a more resilient Nation.
Chairman Thompson said that we all have a role to play,
because resilience is the responsibility of the Federal
Government, States and localities, academia, and the private
sector.
The first step toward accomplishing this is establishing an
agreed-upon vision for how we as a Nation can become more
resilient. That vision rests upon a clear understanding of what
is meant by resilience.
Resilience is the ability to reduce the risk and impact of
a terrorist attack or disruption, while also improving the
facilitation of trade and travel. In the context of natural
disasters, resilience enables people closest to the crisis to
act, provides them with the authorities and information
necessary to succeed, and employs an effective governance
framework.
However, redundancy is not resiliency. Having costly back-
up systems or two of everything is the easy, yet most expensive
way for infrastructure to bend and not break.
Finally, the private sector is an asset first and a
vulnerability second. It is an asset because the goods, people,
conveyances and information that comprise private-sector
activity interact at critical nodes that must be both protected
and viewed as a source of resilience.
This is a critical step toward being able to make the case
for private-sector engagement and to establish the form of
partnership this committee rightly calls out as a priority.
At IBM, we have been working on the issue of resilience in
the global trade system for the past several years. We found
that the global trade system can be organized and viewed as a
circulatory system of goods, people, conveyances, money and
information.
While many things that move through our systems of
transportation, immigration and trade are monitored a lot,
isn't monitored at all, even fewer things are monitored in
conjunction with one another. Yet it is those linkages that
often give us the clearest picture of what is going on and what
might be going wrong.
A robust framework that embraces the fundamental complexity
and networked nature of these systems will identify critical
interrelationships, inefficiencies, and vulnerabilities across
the flows. Staying within the stovepiped systems puts our
competitiveness and possibly our security at risk.
IBM recently released our paper, entitled ``Global Movement
Management: Commerce, Security, and Resilience in Today's
Networked World,'' in which my co-authors and I outline an
analytical framework we developed to strengthen the global
trade system by helping to identify and address vulnerabilities
in and across the elements that make up our global movement
system. It brings those interrelationships into focus.
This framework requires a partnership between the
government and the private sector, because it involves an
integrated and evolving mix of preemptive, preventive,
preparatory and responsive measures across three vital areas:
human capital, technology, and governance.
Individuals within companies and governments face
increasingly complex choices about how to perform and address--
how to improve performance and address risk.
Strategic human capital requires leaders to employ emerging
techniques for managing in a networked environment, some of
which are highlighted in my written statement.
We also need to change how we use technology to seek
efficiencies. By sharing greater volumes of information,
companies and governments can take advantage of open-source
techniques to drive innovation and help make the global systems
more efficient, resilient and secure.
Governance in this context requires that participants in
the global movement systems embrace a more comprehensive set of
factors to understand and a means by which to organize their
efforts to address the actual risks, costs and benefits that
accrue to an organization in today's networked environment.
Our research shows that organizations have successfully met
the challenges of organizing efforts across national
boundaries, but not yet across sectors.
In summary, to create a system in which security
improvements and performance improvements are not mutually
exclusive, but mutually reinforcing requires a partnership
between the owners and operators of this movement system and
the Federal homeland security enterprise.
For this reason, today's hearing represents a productive
step forward. With a common vision, better information, with
the right technology and well-trained government and commercial
employees who are empowered to take action, a more resilient
Nation is within reach.
Thank you very much for having me. I look forward to your
questions.
[The statement of Mr. Czerwinski follows:]
Prepared Statement of Jonah J. Czerwinski
May 14, 2008
Chairwoman Jackson Lee, Ranking Member Lungren, distinguished
Members of the subcommittee, I am pleased to appear before you today. I
commend you on your leadership to focus on a resilience-based approach
to securing the homeland. Given the unique risks of the 21st century,
resilience is a necessary goal.
I am a Senior Fellow with IBM's Global Leadership Initiative where
I work on public sector homeland security challenges from a private
sector perspective, much of it on resilience. I am also Managing
Consultant for IBM's Global Business Services practice. For the past 15
months I have worked on a framework for strengthening commerce,
security, and resiliency.
Today, I thought it would be useful to focus on three things.
First, really defining resilience, which can be an elusive
concept meaning different things to different stakeholders;
Second, the unique role served by the private sector; and
Third, a recommendation for how DHS can better engage the
private sector in making this a more resilient Nation.
Chairman Thompson said that ``we all have a role to play'' because
resilience is the responsibility of the Federal Government, States and
localities, academia, and the private sector.
The first step toward accomplishing this is establishing an agreed
upon vision for how we as a Nation can become more resilient. That
vision rests upon a clear understanding of what is meant by resilience.
i. defining resilience
Resilience is the ability to reduce the risk and impact of a
terrorist attack or disruption while also improving the facilitation of
trade and travel. In the context of natural disasters, resilience
enables people closest to the crisis to act, provides them with the
authorities and information necessary to succeed, and employs an
effective governance framework.
Resilience helps to avoid unintended consequences: Resilience--if
done right--affords the decisionmaker the enhanced ability to focus
response efforts on the part of the system that is actually stressed
and limits the risk of over-reacting, which often times leads to
unintended consequences.
Many suggest that resilience is the ability to ``bounce back.'' And
it is, but resilience is different from response and recovery.
Redundancy is not resiliency. Having costly back-up systems or two
of everything is the easy yet most expensive way for infrastructure to
``bend and not break.'' If done correctly, resiliency is more akin to
the concept of Intelligent Immunity that we put forth in the most
recent IBM report on Global Movement Management, and which I'll touch
upon in a moment.
ii. unique role of the private sector
Finally, the private sector is an asset first, and a vulnerability
second: It is an asset because the goods, people, conveyances, and
information that comprise private sector activity interact at critical
nodes that must be both protected and viewed as a source of resilience.
This is a critical step toward being able to make the case for private
sector engagement and to establish the form of partnership this
committee rightly calls out as a priority.
At IBM we have been working on the issue of resilience in the
global trade system for the past several years. We found that the
global trade system can be organized and viewed as a circulatory system
of goods, people, conveyances, money, and information.
While many things that move through our system of commerce are
monitored to a greater or lesser extent, a lot isn't monitored at all.
Even fewer things are monitored in conjunction with one another.
And yet it is those linkages that often give us the clearest
picture of what's going on and what might be going wrong.
A robust framework that embraces the fundamental complexity and
networked nature of these systems will identify critical
interrelationships, inefficiencies, and vulnerabilities across the
flows. Staying within a stovepiped system puts our competitiveness and
possibly our security at risk.
iii. a framework to support dhs leadership in building a resilient
nation
IBM recently released our paper entitled ``Global Movement
Management: Commerce, Security, and Resilience in Today's Networked
World,'' in which my coauthors and I outline an analytical framework we
developed to strengthen the global trade system by helping to identify
and address vulnerabilities in and across the elements that make up our
global movement system. It brings the interrelationships into focus.
This framework requires a partnership between the government and
the private sector because it involves an integrated and evolving mix
of preemptive, preventive, preparatory and responsive measures across
three vital areas: Human Capital, Technology, and Governance.
Strategic Human Capital
Individuals within companies and governments face increasingly
complex choices about how to improve performance and address risk.
Individual managers and employees face unprecedented volumes of
information, new technologies and competitive pressures that complicate
their work. At the same time, in a networked economy, decisions made at
the individual level can have increasingly global ramifications.
Strategic human capital requires leaders to employ emerging techniques
for managing in a networked environment. These techniques include
improved collaboration, latitude to reach across and outside
organizational boundaries, investment in organizational transformation,
enhanced technology and, above all, greatly improved training.
Technology
We need to change how we use technology to simplify work processes
and seek efficiencies. By sharing greater volumes of information,
companies and governments can take advantage of open-source techniques
to drive innovation and help make global systems more efficient,
resilient, and secure. Upstream companies can be better equipped to
provide warnings of supply shortages or other disruptions before they
affect downstream partners. Downstream companies can provide early
warnings about demand or delivery disruptions to those upstream.
Governments can augment counterterrorism efforts with more accessible
commercial data while also providing a higher degree of protection for
privacy and civil liberties than is currently the case.
Governance
Governance in this context can be characterized by the lack of a
coordinated approach that is necessary to address networked risk. Call
this a ``governance gap.'' To bridge this gap, participants in the
global movement systems need to embrace a more comprehensive set of
factors to understand the actual risks, costs, and benefits that accrue
to an organization in a networked environment. Moreover, participants
need a means by which to organize their efforts to address these risks,
costs, and benefits. Our research shows that organizations have
successfully met the challenges of organizing efforts across national
boundaries but not yet across sectors.
conclusion
In summary, to create a system in which security improvements and
performance improvements are not mutually exclusive, but mutually
reinforcing, requires a partnership between the owners and operators of
this global movement system and the Federal homeland security
enterprise. For this reason, today's hearing represents a productive
step forward.
With a common vision, better information, with the right technology
and well-trained government and commercial employees who are empowered
to take action--a more resilient nation is within reach.
Thank you.
Ms. Jackson Lee. We thank you for your testimony.
I now recognize Mr. Johnson to summarize his statement for
5 minutes.
STATEMENT OF SHAWN JOHNSON, VICE CHAIRMAN, FINANCIAL SERVICES,
SECTOR COORDINATING COUNCIL
Mr. Johnson. Thank you. Thank you, Chairwoman Jackson Lee,
Ranking Member Lungren, and members of the committee.
I am Shawn Johnson, chairman of the Investment Committee
for State Street Global Advisors and vice chairman of the
Financial Services Sector Coordinating Council, or FSSCC, a
volunteer position.
My comments today focus on efforts to improve resilience in
the financial services sector, and in particular the
resilience-based related activities of the FSSCC.
Thought established at the request of the Department of
Treasury, the FSSCC is a private-sector coalition working to
improve the financial sector's resilience to terrorist attacks,
manmade and natural disasters, cyber attacks, and other
threats.
In general, the U.S. financial services sector has
performed well in times of crisis. While events such as 9/11
and the attacks have revealed some weaknesses in the resilience
of our financial systems, industry and government have
responded and work cooperatively to address these weaknesses.
Some of the government's resilience activities have been in
the form of specific regulatory proposals, such as the issuance
of the best practices white paper by the Federal Reserve, the
OCC, and the SEC in 2003, addressing contingency planning and
backup facilities for clearing and settlement activities.
Implementation of the white paper has required significant
changes in business practices and substantial investment by
financial investment firms. But the result has been a more
resilient financial services system.
The government participates in other, less formal
activities, such as working with local public-private
partnerships to sponsor resilience exercises, which simulate
flu pandemic, natural disasters, or other terrorist events, and
provide valuable lessons to both the public and the private
sector.
Much of the work of FSSCC, of which I am currently vice
chair, has focused on resilience.
For example, the FSSCC has been working to improve industry
access to emergency credentials, which are critical in times of
emergency. We have also worked to expand the GETS program,
which provides access to priority telephone services during a
crisis.
We held a cybersecurity summit in February 2008 with
private- and public-sector participation, and the FSSCC and
FBIIC have since each launched new cybersecurity committees.
The FSSCC maintains relationships to help align academic
research with real-world business needs and offers programs
such as the FSSCC SMART program, which provides subject matter
expertise from financial institutions to R&D organizations.
The FSSCC is an active participant in the Partnership for
Critical Infrastructure Security, which is dedicated to
coordinating cross-sector initiatives.
Our infectious disease forum develops and communicates
information and strategies the private sector can employ to
prepare for an avian flu pandemic or other infectious disease
outbreak. In addition, all FSSCC members are active with their
own resiliency efforts aimed at their particular segment of the
financial services industry.
These efforts are summarized in the FSSCC's annual report,
which can be found on the FSSCC Web site.
I would like to conclude my testimony today by describing
one of the largest financial services industry resilience
exercises to date, the FBIIC-FSSCC Pandemic Flu Exercise of
2007.
The exercise was a public-private partnership, sponsored by
the FBIIC, the FSSCC, and SIFMA. It was conducted in the fall
of 2007 and simulated a pandemic flu impacting the financial
services sector.
More than 2,700 financial services organizations
participated. Participation was voluntary, free of cost, and
open to all organizations within the U.S. financial services
sector.
The results were aggregated, with anonymity provided by the
participating institutions. Participants were given scenarios
to implement that represented an escalating pandemic flu
epidemic. At the height of the exercise, for example, absentee
rates in some cases reached 49 percent, a level sufficient to
stress even the best contingency planning efforts.
The performance of the financial services sector under the
conditions simulated by the exercise was laudable, but not
perfect. In general, it appeared that, while there would have
been significant impacts to the financial sector, it would have
continued to cope and operate.
Perhaps more important than the immediate results of the
exercise, however, is the reaction of the participants: 99
percent of participants found the exercise useful in assessing
their organization's business-planning needs; 97 percent of
participants said the exercise allowed their organization to
identify critical dependencies, gaps, and seams that warrant
additional attention; and 91 percent said their organization
planned to initiate additional all-hazard plan refinements.
Full details of the exercise are provided in the after
action report.
Overall, I think the pandemic exercise provides a good
example of the potential benefit of the strong public-private
partnership that exists. While continuity and resilience
planning are certainly key regulatory and enforcement issues,
it is clear to me, as a representative from the private sector,
that the quality of the data obtained was considerably improved
by the cooperative and anonymous nature of the exercise.
As a result, both the private and public sectors were able
to obtain insights that would have been difficult or impossible
to obtain through standard regulatory channels.
Once again, thank you for providing me the opportunity to
testify on behalf of the FSSCC. I will be pleased to answer any
questions you have.
[The statement of Mr. Johnson follows:]
Prepared Statement of Shawn Johnson
May 14, 2008
Chairwoman Jackson Lee, Ranking Member Lungren, and members of the
Subcommittee on Transportation Security and Infrastructure, I am Shawn
Johnson, Chairman of the Investment Committee of State Street Global
Advisors and Vice-Chairman of the Financial Services Sector
Coordinating Council (FSSCC). I am pleased to submit this testimony
today on behalf of the FSSCC.
I appreciate the subcommittee's invitation to testify at this
hearing, titled ``Partnering with the Private Sector to Secure Critical
Infrastructure: Has the Department of Homeland Security Abandoned the
Resilience-Based Approach?'' Given my position with the FSSCC, my
comments today focus on the experience of the financial services sector
with regard to resilience, and, in particular, resilience related
activities in which FSSCC has participated.
The FSSCC was established at the request of the U.S. Department of
the Treasury in 2002 in response to Homeland Security Presidential
Directive 7, which required sector-specific Federal department and
agencies to identify, prioritize, and protect United States critical
infrastructure and key resources. We are a private sector coalition of
financial services firms and trade associations working to reinforce
the financial sector's resilience to terrorist attacks, man-made and
natural disasters, cyber attacks, and other threats to the sector's
critical infrastructure.
The FSSCC closely interacts with its Sector Specific Agency (SSA),
the Department of the Treasury, it public-sector counterpart, the
Financial and Banking Information Infrastructure Committee (FBIIC), and
the Department of Homeland Security. Membership lists for the FSSCC and
the FBIIC are attached.
We also strongly support regional public/private partnerships, such
as ChicagoFIRST, DFWfirst, and numerous others. These organizations
address homeland security and emergency management issues at the local
level, where many catastrophic events are primarily managed.
In general, the U.S. financial services sector has performed well
in times of crisis. While events such as the 9/11 attacks have revealed
some weaknesses in the resilience of our financial systems, industry
and government have responded, and worked cooperatively to address
these weaknesses.
Some of the government's resilience activities have been in the
form of specific regulatory proposals, such as the issuance of the
Interagency White Paper on Sound Practices to Strengthen the Resilience
of the U.S. Financial System in 2003 by the Federal Reserve, OCC and
SEC.
The White Paper addressed the importance of resilience in financial
clearing and settlement activities critical to U.S. financial markets,
and is intended to reduce systemic risk created when primary and back-
up facilities and staffs are located within the same geographic region.
Implementing the requirements of the White Paper has required
significant changes in business practices, and substantial investment,
by financial services firms--but the result has been a more resilient
U.S. financial system.
Formal rulemaking, however, is not the government's only means of
improving the resiliency of our financial infrastructure. For example,
the Department of the Treasury has worked with local public/private
partnerships to sponsor several resilience exercises, including:
A pandemic exercise in Chicago in December, 2006 (with
ChicagoFIRST),
A pandemic exercise in San Francisco in May, 2007 (with
BARCfirst),
A radiological attack exercise in Tampa Bay in July, 2007
(with FloridaFIRST), and
A hurricane exercise in Alabama in March, 2008 (with Alabama
Recovery Coalition for the Financial Sector).
Other similar exercises are being planned, including a terrorist
attack simulation involving all of the regional coalitions (through RPC
FIRST) in San Francisco this week.
Much of the work of the FSSCC, of which I am currently Vice-
Chairman, has also focused on resilience. FSSCC resilience-related
activities include:
Emergency Credentialing.--The ability of the private sector
to obtain security credentials during times of emergency is a
critical element to the financial services sector's resiliency.
The FSSCC has been involved in efforts to encourage States to
adopt credentialing programs, and expansion of the GETS
program. The GETS Program allows critical infrastructure
operators to gain priority telephone service during a crisis.
Cyber Security.--A Cyber Security Summit was held in
February, 2008 with information technology leaders from across
the public and private sectors, to discuss threats to the
financial sector from cyber vectors. The FSSCC and FBIIC have
since each launched new cyber security committees, whose
mission is to work with the financial services sector to
strengthen cyber security and resilience of current and future
IT operations.
Research and Development.--The FSSCC and its R&D Committee
encourage alignment of research into infrastructure protection
through outreach to academic institutions, and programs such as
FSSCC SMART, which provides subject matter expertise from
financial institutions to research and development
organizations.
Cross-Sector Cooperation.--FSSCC is an active participant in
the Partnership for Critical Infrastructure Security (PCIS),
which is dedicated to coordinating cross-sector initiatives to
improve the security and safety of U.S. financial
infrastructure.
Infectious Disease Forum.--A long-standing FSSCC work group
is the FSSCC Infectious Disease Forum. The purpose of the
Infectious Disease Forum is to develop and communicate
information and strategies that FSSCC members and their member
organizations may employ to prepare for an avian flu pandemic
or other infectious disease outbreak.
These ongoing efforts, and others, demonstrate the FSSCC's strong
commitment to resiliency. In addition, all FSSCC members are active
with their own resiliency efforts, aimed at their particular segment of
the financial services industry segment. These efforts are summarized
in FSSCC's annual report, which can be found on the FSSCC Web site
(https://www.fsscc.org/fsscc/reports/2007/annual_report_
2007.pdf).
I'd like to conclude my testimony today by describing one of the
largest financial services industry resilience exercises to date, the
FBIIC/FSSCC Pandemic Flu Exercise of 2007.
This exercise, conducted in Fall 2007, simulated a pandemic flu
impacting the financial services sector, and was intended to:
Enhance the understanding of systemic risks to the financial
sector;
Provide an opportunity for firms to examine the
effectiveness of their pandemic plans; and
Explore the effects of a pandemic flu on other crucial
infrastructures impacting the financial services sector.
The exercise was a public/private partnership, organized by the
FBIIC, the FSSCC, and the Securities Industry and Financial Markets
Association (SIFMA), the trade association representing the securities
industry.
By all accounts, the execution of the exercise was a success. More
than 2,700 financial organizations participated. Participation was
voluntary, free of cost, and open to all organizations within the U.S.
financial sector. Results were aggregated, with anonymity provided to
participating institutions. The exercise was intended to simulate the
medical, financial, and societal impacts of a pandemic flu, and gather
information about how financial institutions were able to react to such
scenarios. At the height of the exercise, for example, absentee rates
in some cases reached 49 percent, a level sufficient to stress even the
best contingency planning efforts.
The performance of the financial sector under the conditions
simulated by the exercise was laudable, but not perfect. In general, it
appeared that while there would have been significant impacts to the
financial services sector, it would have continued to cope and operate.
Perhaps more important than the immediate results of the exercise,
however, is the reaction of the participants:
99 percent of participants found the exercise useful in
assessing their organizations business planning needs;
97 percent of participants said the exercise allowed their
organization to identify critical dependencies, gaps, and seams
that warrant additional attention; and
91 percent said their organization planned to initiated
additional all-hazard plan refinements based upon lessons
learned during the exercise.
The After Action Report, issued in January 2008, provides
considerable detail on the results of the exercise, both in aggregate
and by industry segment, as well as numerous illustrations of possible
opportunities for further improvement, for both the public and private
sector. One such area for improvement is in the area of regulatory
relief. Discussions between the private sector and the regulators
continue regarding possible regulatory relief during a pandemic. The
industry recently started developing an internet-based application to
facilitate the collection of information to better gauge the health of
the sector.
Overall, the pandemic exercise provides a good example of the
potential benefit of strong public/private cooperation and
collaboration. While continuity and resilience planning are certainly
key regulatory and enforcement issues, it is clear to me as a
representative of the private sector that the quality of data obtained
was considerably improved by the cooperative, and anonymous, nature of
the exercise. As a result, both the private and public sectors were
able to obtain insights that would have been difficult or impossible to
obtain through standard regulatory channels.
Once again, thank you for providing me the opportunity to testify
on behalf of the FSSCC. I would be pleased to answer any questions.
APPENDIX
fsscc members
American Bankers Association; American Council of Life Insurers;
American Insurance Association; American Society for Industrial
Security (ASIS) International; BAI; BITS/The Financial Services
Roundtable; ChicagoFIRST; Chicago Mercantile Exchange; The Clearing
House; CLS Group; Consumer Bankers Association; Credit Union National
Association; The Depository Trust & Clearing Corporation (DTCC); Fannie
Mae; Financial Information Forum; Financial Services Information
Sharing and Analysis Center (FS-ISAC); Financial Services Technology
Consortium (FSTC); Freddie Mac; Futures Industry Association; ICE
Futures U.S.; Independent Community Bankers of America; Investment
Company Institute; Managed Funds Association; The NASDAQ Stock Market,
Inc.; National Armored Car Association; National Association of Federal
Credit Unions; National Association of Securities Dealers (NASD);
National Futures Association; NACHA--The Electronic Payments
Association; The Options Clearing Corporation; Securities Industry
Automation Corporation (SIAC); Securities Industry and Financial
Markets Association (SIFMA); State Street Global Advisors; VISA USA
Inc.
fbiic members
American Council of State Savings Supervisors; Commodity Futures
Trading Commission; Conference of State Bank Supervisors; Department of
the Treasury; Farm Credit Administration; Federal Deposit Insurance
Corp; Federal Housing Finance Board; Federal Reserve Bank of New York;
Federal Reserve Board; National Association of Insurance Commissioners;
National Association of State Credit Union Supervisors; National Credit
Union Administration; North American Securities Administrators
Association; Office of the Comptroller of the Currency; Office of
Federal Housing Enterprise Oversight; Office of Thrift Supervision;
Securities and Exchange Commission; Securities Investor Protection
Corporation.
Ms. Jackson Lee. Mr. Johnson, thank you very much for your
testimony.
I now recognize Mr. Raisch to summarize his statement for 5
minutes.
STATEMENT OF WILLIAM G. RAISCH, DIRECTOR, INTERNATIONAL CENTER
FOR ENTERPRISE PREPAREDNESS, NEW YORK UNIVERSITY
Mr. Raisch. Chairwoman Jackson Lee, Ranking Member Lungren,
and distinguished members of the subcommittee, thank you for
inviting me this afternoon to testify on the vital issue of
private sector resilience and, in particular, the Voluntary
Private Sector Preparedness Certification Program called for by
the implementing recommendations of the 9/11 Commission Act of
2007.
I am most honored to join you from the International Center
for Enterprise Preparedness at New York University. As you
mentioned, the center serves as the first academic center
focused specifically on private-sector resilience and
preparedness.
I am also most honored to have served as a private-sector
adviser to the 9/11 Commission.
More importantly, though, I am here to reflect on the
perspective garnered from 12 forums on this specific voluntary
certification program held since this past fall involving over
550 private-sector representatives and current five different
working groups, with over 250 participants in the private
sector.
Let me clearly state that there is substantial and growing
interest and also concern in the private sector on this
program. That being said, also, in preface, I would like to say
that it is my personal opinion that this single program has the
potential for doing more to institutionalize or economically
embed private-sector preparedness than much of the outreach, ad
campaigns, and other well-meaning and perhaps productive public
affairs efforts to date.
However, this is achievable if and only if two items are
addressed in priority. One, it must focus on enabling real
economic value to businesses. Further, it must actively and
directly involve and engage the private sector in the
development and ongoing implementation of the program itself.
Allow me to outline, perhaps, a couple of key
considerations for this program going forward and to
acknowledge, as well, that much good work has been accomplished
by a variety of organizations in the arena of public-sector
preparedness and resilience.
At our center, we have tried to reflect on this and really
present you with perhaps some key themes in that respect.
From that, we see four basic themes evolving.
They are, one, firstly and foremost, with respect to this
program, we need to assure that voluntary certification in this
program is a private-sector-led effort, that it specifically
addresses private-sector needs through the ongoing engagement
of key stakeholders. This engagement must involve both DHS and
the ultimate accrediting body to be chosen.
Secondly, it must build on existing efforts, specifically
those efforts in certification, standards, and elements of
accrediting bodies. These basic building blocks already exist
for the program. The program should seek to integrate them and
focus them on private-sector preparedness.
There are existing standards that have been developed by
the private sector. Further, there are existing accreditation
and certification processes that have been utilized in private-
sector voluntary certification in such areas as quality
management, the ISO 9000 accreditation program, and
environmental management, the ISO 14000 program.
These processes were developed with active involvement of
the private sector and have evolved with private-sector
application for over 2 decades, in many cases.
There is also an existing accrediting body, ANAB, which has
administered private-sector certification for years, as well. I
am happy to note that this body has been preliminarily
designated by DHS as the appropriate body for the program
itself.
Thirdly, the program should allow for flexibility,
potentially utilizing a high-level umbrella or framework
approach that can be used independently to relate multiple
focused standards and practices, which business may already be
using.
Key organizations in the private sector have already
developed a seminal work on this, the framework for
preparedness, on a voluntary basis, sponsored by the Alfred P.
Sloan Foundation.
A real effort must be made to recognize, also, and accredit
effective activities already in practice by each key sector.
These sectors must be brought directly into the process.
Fourthly and finally, that we must enable potential market-
based incentives through the involvement of their stakeholders
and needs. First and foremost, business practitioners must be
actively involved in the development of this program to assure
that the program has real operational value.
Secondly and as importantly, potential incentive
stakeholders should be directly involved in the process,
including supply chain management community representatives,
legal counsel, insurance companies, rating agencies, and other
reporting entities.
Key action items for government are an opportunity in this
respect. I would suggest they are as follows, and I would
preface it by the fact that I would underline government in
this case can truly be a catalyst, it can be a convener, and it
can be, if you will, an investor, at least from a seed-funding
perspective on this important process.
Firstly, both DHS and ultimately the accrediting body it
designates must actively and consistently engage the private
sector in the development implementation of the program.
Specific considerations and issues are identified in my written
remarks in this respect.
DHS must also continue to maintain its integrated approach
to supporting this program, which includes FEMA currently as
program lead, but also active involvement by infrastructure
protection, science and technology, and the DHS private-sector
office, as well as others, as appropriate.
Additionally, other agencies in the executive branch,
including Commerce and SBA, should have involvement.
Congress should provide the resources, also, to enable
ongoing commitment by DHS to this program. It is an investment
that will yield substantial benefits, in terms of societal
resilience, given the role the private sector plays in backbone
critical infrastructure and dramatic impacts on the overall
economy.
Additionally, DHS should continue to evaluate the overall
opportunity for voluntary participation in the program by the
critical infrastructure business sectors. This community can
bring much insight to the program and may find significant
value in the assessment capability of the program.
Furthermore, the program may provide a very valuable tool
in cross-sector cooperation and assessment. A common reference
platform--a Rosetta Stone, of sorts--could aid in sharing best
practices and crosspollination across sectors.
Education and tools must also be developed by key
stakeholders, optimally with government support, to enable
businesses, large and small, to pursue program assessment and
implementation with minimal cost and disruption. Key trade and
professional associations may be very helpful in this regard.
In addition and finally, Congress should consider enabling
incentives for the program, including potentially facilitating
effective public reporting and appropriate acknowledgement of
proactive companies in this respect.
Additionally, Congress should consider legal liability
protections for those proactive firms that undertake
certification, perhaps including safe harbors and privilege for
vulnerability assessments.
Finally, enabling key industries, such as the insurance
industry, to consider industry-wide incentives or initiatives
in this regard around the issue of resilience, without concern
of antitrust considerations, should also be addressed by
Congress.
I welcome your questions. Thank you.
[The statement of Mr. Raisch follows:]
Prepared Statement of William G. Raisch
May 14, 2008
Chairwoman Jackson Lee, Ranking Member Lungren, and distinguished
members of the subcommittee, thank you for inviting me to testify on
the vital issue of private sector resiliency and the Voluntary Private
Sector Preparedness Certification Program called for by Title IX,
Section 524 of Pub. L. 110-523, The Implementing Recommendations of the
9/11 Commission Act of 2007.
As with many undertakings in the private sector, this new program
offers both substantial opportunity and significant risk, most
especially if the private sector is not effectively engaged. It will be
the balancing of these two elements that will determine the ultimate
success or failure of this program. It is an effort though that I
believe to be well worth undertaking for sake of both the individual
businesses and our wider society.
the 9/11 commission's private sector recommendations focused on the
``what'' and ``why'' of preparedness
As you may be aware, our Center, the International Center for
Enterprise Preparedness (or InterCEP) at New York University is the
first academic research center dedicated to private sector resilience.
Our activities regularly involve outreach to hundreds of businesses,
much of it through interactive forums focused on key issues.
The Center takes its primary focus from the private sector
recommendations of the 9/11 Commission, which I was honored to advise
on private sector preparedness.
The Commission's recommendations and thus InterCEP's research focus
on promoting private sector preparedness through the linking the
``what'' and the ``why'' of preparedness/resilience. The 9/11
Commission clearly understood that absent a compelling bottom-line
rationale for preparedness, businesses would not invest the funds and
other resources necessary to develop a preparedness program. The
Commission sought to leverage basic market-based economics, bottom-line
orientation, to promote effective private sector preparedness
activities by business. They did so with an initial focus on two key
elements:
1. Identifying a consensus-based industry standard for business
preparedness (the what to do); businesses were looking for a
high-level set of criteria that represented best practices in
preparedness yet allowed the business flexibility as to how to
achieve particular outcomes.
2. Identifying potential incentives for businesses to voluntarily
conform with that standard (the why to do it) including
mitigating legal liability after an event, potential insurance
recognition, and encouraging rating agency acknowledgement (all
in addition of course to the basic rationale of continuity of
the business in the aftermath of a crisis).
there is a need for a measurement approach/tool to assess business
preparedness
Since establishing our Center in October of 2004 and the extensive
research and interface with business that followed, it has become clear
that the linkage of the ``what'' and ``why'' of preparedness often
requires measurement or assessment to determine if the ``what'' to do
of preparedness has been or is being accomplished so that the ``why''
to do it can be confirmed or rewarded. Thus, there is a third key
element that our research with the business sector has identified as
critical to successfully promoting private-sector preparedness:
3. A method to measure or assess achievement of preparedness
objectives, i.e., identifying ``if preparedness is being
achieved.''
Measurement is important for several reasons. Internally, there are
multiple benefits:
First and foremost, a business needs a yardstick to assess
if it is achieving its preparedness goals for which it may have
invested effort and resources to assure its business
continuity.
Measurement may also have reputational benefits for
corporations that wish to demonstrate to their customers and
other stakeholders that they are prepared.
Measurement may additionally help advance corporate
governance goals, especially in validating risk management
efforts.
External to the firm, potential ``incentives stakeholders'' such as
supply chain partners, insurance underwriters, rating agencies and the
legal community need a credible confirmation that preparedness efforts
have been undertaken. These communities generally grant that there is
value in preparedness efforts by businesses, and these stakeholders may
be disposed toward acknowledging or rewarding preparedness in their
activities.
These potential incentives stakeholders do not however wish to
undertake the actual assessment or measurement of preparedness on their
own on a business-by-business basis. They do not want to nor do they
have the resources to send out assessors to a business to ascertain if
a particular business's program conforms to a particular industry
standard. Yet, if there was a credible program which indicated
compliance with such a standard, these stakeholders may consider
rewarding it, at least over time. Thus, external benefits to
measurement include:
Measurement could promote resilience of supply chains by
supplying a common approach and tool for assessing supplier
preparedness.
A common measurement program may make it easier for various
business incentive communities to acknowledge the value of
effective preparedness (e.g., insurance, legal, rating agency,
etc.) overtime.
Measurement to a commonly recognized standard may help
facilitate exchange of best practices, enabling business to
more easily compare practices across industries and sectors
which may have distinct terminology and approaches but lack a
``rosetta stone'' or common set of criteria to compare their
efforts.
A common measurement program may also enable more consistent
benchmarking to other firms both within and industry and
potentially across sectors--including potentially the critical
infrastructure sectors.
the developing voluntary private sector preparedness certification
program
It is in light of these three elements: (1) what to do, (2) why to
do it, and (3) a measurement of achievement that I would like to
discuss the developing Voluntary Business Preparedness Certification
Program.
This new program is proving to be a distinct catalyst, with
significant initial and potential impact on private sector
preparedness. It is also a program that nonetheless must be guided by
key considerations and private sector input to assure its success.
This new program could potentially integrate:
The ``what to do'' in the form of one or more preparedness
standards to be designated under the legislation,
An evolving ``why to do it'' by proactively identifying the
business case for preparedness and integrating its elements
into the program where possible including potential incentives
stakeholders in the process of program development and
implementation,
A credible measurement/assessment methodology based upon
historic experience with other voluntary certification programs
such as those in quality management (ISO 9000) and
environmental management (ISO 14000) which have been
implemented in and by the private sector for decades.
The announcement of this program has already to date provided a
catalyst for business sector activity. Despite the legislation's
annunciation that the program is to be voluntary, the perceived threat
of potential government regulation along with other concerns has
motivated significant private sector activity. Much of it based on the
presumption that the private sector must take the lead in this process
to assure that the outcome has positive value and not onerous impact.
For example, one remarkable effort involved four key professional
organizations coming together to define the core elements of private
sector preparedness based on existing standards and professional
practices across multiple disciplines. This effort was sponsored by the
Alfred P. Sloan Foundation which is a key funder of InterCEP's
activities and involved representatives from ASIS International (a key
security association), the Disaster Recovery Institute International (a
key business continuity association), the National Fire Protection
Association (which maintains the Standard on Disaster/Emergency
Management & Business Continuity referenced in the legislation and
endorsed by both the 9/11 Commission and DHS) and the Risk & Insurance
Management Society (a leading risk management society for businesses).
These organizations collectively defined a framework for voluntary
preparedness that supports a flexible approach to assessing
preparedness potentially including multiple standards reflecting a
common core set of preparedness elements. The final report is available
at www.sloan.org.
Additionally, other organizations have begun forums to discuss the
program including the U.S. Chamber of Commerce among others. As an
example, InterCEP currently has dozens of businesses actively engaged
in five different Working Groups which initially address key potential
incentive areas for program acknowledgement:
Supply chain management;
Legal liability mitigation;
Insurance;
Rating agency acknowledgement;
Business reporting acknowledgement/crediting.
key considerations and concerns of the private sector
Key considerations and concerns identified by the private sector
through a diversity of forums hosted by the Center are outlined in the
Appendix. The key themes include:
1. Assure that the program is private sector led and addresses
private sector needs through ongoing engagement of key
stakeholders.
2. Build on the existing including existing standards, proven
accreditation/certification processes and established industry
practices--key building blocks already exist.
3. Allow for flexibility potentially utilizing a high-level
umbrella or framework standard which can be used independently
or to relate multiple more focused standards and practices
which business may already be using.
4. Enable potential market-based incentives through involvement of
their stakeholders and concerns.
action items for government going forward
It will be vital to the ultimate success of the program that
government take the initiative as a catalyst and investor in this
process:
Both DHS and the ultimate accrediting body to be designated
by it must actively and consistently engage the private sector
in the development and implementation of the program. Specific
considerations and issues are identified in the Appendix.
DHS must continue to maintain its integrated approach to
supporting this program which includes FEMA as program lead but
also includes active involvement by Infrastructure Protection,
Science & Technology and the DHS Private Sector Office (and
others as appropriate).
Congress should provide the resources to enable an ongoing
commitment by DHS to this program. It is an investment that
will yield substantial benefits in terms of societal resilience
given the role that the private sector plays in backbone
critical infrastructure for our Nation.
DHS should continue to evaluate the voluntary application of
the program to critical infrastructure as this community may
find significant value in the capability of the program.
Furthermore, the program may provide a very valuable tool in
cross-sector cooperation and assessment.
Education and tools must be developed by key stakeholders
(optimally with government support) to enable business (large
and small) to pursue program assessment and implementation with
minimal cost and disruption.
Appendix.--Summary of InterCEP Research to Date On the Voluntary
Private Sector Preparedness Certification Program
per title ix, section 524 of pub. l. 110-523, the implementing
recommendations of the 9/11 commission act of 2007
may 14, 2008
Key Points & Considerations
Four basic themes are reflected in the following considerations,
they are:
1. Assure that the program is private-sector-led and addresses
private-sector needs through ongoing engagement of key
stakeholders.
2. Build on the existing including existing standards, proven
accreditation/certification processes and established industry
practices--key building blocks exist.
5. Allow for flexibility potentially utilizing a high-level
umbrella or framework standard which can be used independently
or to relate multiple more focused standards and practices
which business may already be using.
6. Enable potential market-based incentives through involvement of
their stakeholders and concerns.
Specific Considerations
Early and continuing stakeholder involvement must be
maintained to assure that the program is private-sector led.--
While government can play a catalytic role in the early
development of the program, ultimately the program should be
market-driven as has been the case with the continuing
voluntary certification programs in quality and environmental
management. Key to assuring that the voluntary certification
program has real operational value to business is to involve
the full-spectrum of the business sector in the development and
ongoing implementation of the voluntary certification program.
There is concern within the private sector that the program
could develop into a mandatory requirement by government.--
Similar concerns exist about whether the program will be truly
voluntary once market pressures force firms to pursue
certification in order to remain competitive.
There are concerns about the potential costs and liabilities
associated with the program.--It will be important to contain
the implementation costs and minimize the bureaucracy
associated with the certification process.
The program should build on existing voluntary accreditation
and certification processes. There are lessons to be learned
from historical experience with existing voluntary
certification programs in quality and environmental
management.--Current voluntary certification programs in
quality management and/or environmental management utilize
established processes for accreditation and certification.
These could potentially be utilized in the development of the
preparedness certification program thereby avoiding significant
time and effort as well as benefiting from substantial
historical application. Furthermore, opportunities and
efficiencies might potentially be achieved by businesses that
currently have existing quality and environmental programs by
building upon them (i.e., existing management processes). For
example, the program should be informed by lessons learned from
C-TPAT and pandemic planning regarding the best way to minimize
impacts on business and maximize benefits to business.
Existing efforts of key vertical industries, such as the
financial services sector, should be acknowledged and
incorporated into the voluntary certification program.--Some
business sectors have a long history in preparedness activities
and robust programs in place. The financial services sector is
one. The new law specifically calls for existing industry
efforts, standards, practices and reporting in the area of
preparedness not be duplicated or displaced but rather
recognized and integrated where appropriate. Opportunities
should be evaluated with each sector to see not only how their
existing efforts can be credited in the process but also how
the new certification program can address unique issues
important to their sector. Sector coordinating councils and key
industry associations should be involved.
A ``maturity model'' or multi-level approach should be
considered.--A ``maturity model'' approach should be considered
which could acknowledge various levels of preparedness and
depth of program; for example: Level 1, Level 2, Level 3, etc.
This could be helpful in several ways. Depth of program
capacity could vary based on how critical a particular
organization is in a supply chain. Levels could also be used as
targets for progression over the course of time to allow for a
step progression from a lower level of preparedness to a higher
level. Furthermore, levels may be appropriate in considering
expectations for small, medium and large organizations with
their varying levels of size, complexity and resources.
The voluntary certification should credit/integrate other
business reporting requirements when valuable.--Based on the
functions of a business, its vertical industry and public or
private ownership, there are a variety of reporting
requirements that businesses have to shareholders, customers,
partners, the government and others. As reflected in the
enabling legislation, efforts should be made to acknowledge and
existing reporting activity where appropriate so as to avoid
duplication and excess effort. Certification activity may be
able to ``piggy-back'' on some existing auditing efforts.
The program should support self-assessment by businesses as
well as external second party and third party assessments.--
Businesses should be able to apply elements of the program to
self-assess their operations and self-declare (first party
assessment) as well as utilize it in assessing related parties
such as suppliers (second party assessment). Third party
certification by unrelated certifiers should also be an option.
First, second party and third party assessments could be
valuable in assuring business preparedness in supply chains.
The corporate governance & corporate social responsibility
(CSR) areas should be evaluated for past lessons learned and
possible synergies with the voluntary certification program.--
In an increasingly risky business environment, risk management
is a growing concern among boards of directors and executive
management. The voluntary certification program might
potentially be structured to address these concerns at least in
part by assessing the state of business preparedness.
In designating one or more preparedness standards for use in
the program, a constellation of standards or framework approach
should be evaluated. An umbrella standard should be considered
in this regard to assure core consistency among various
standards.--There are multiple preparedness guidance documents
with significant value to one or more business sectors. Some
are general or program level; others may be more functionally
oriented, for example, risk assessment-focused. Consideration
should be given to structuring a certification process which
accommodates the assessment of the business against one or more
standards but in a unified framework. Such a framework could
acknowledge a common core of program elements potentially
utilizing an ``umbrella standard.''
The program and chosen standards should be applicable on an
international basis to have the most value to multinational
corporations.--The program may involve a number of standards,
but whichever standards are chosen, they should be capable of
being applied on an international basis in order to accommodate
the needs of multinational firms.
Special considerations should be made for small businesses
that wish to pursue voluntary certification. The involvement of
industry associations and large-to-small business mentoring
should be considered.--Clearly not all small businesses will
see value in pursuing the voluntary certification. This is to
be expected. For those that do, the new certification program
must be economically and operationally achievable. Separate
classifications and methods of certification for small
businesses should be established as appropriate and in
consultation with small business representatives and
organizations. Supply chain mentoring should be explored to
consider how larger companies might assist their critical
suppliers that are small businesses.
Potential ``incentives stakeholders'' should be welcomed
into the process from the beginning to assure that the
voluntary certification program has value to them in
potentially acknowledging and rewarding business preparedness
efforts.--A major rationale cited in the testimony for the
program was the need to enable a closer link between
preparedness and benefits for business. Key stakeholders in
such areas as supply chain management, legal liability,
insurance and rating agencies have generally concurred that
business preparedness is valuable and should be acknowledged
more widely but to date there has been no generally accepted
methodology to confirm that preparedness exists in a business
so that it could be acknowledged. This program could supply
such a method, and so the process should involve these
potential incentives stakeholders as well as others early in
the development of the program. Following are considerations in
this regard:
As rating agencies potentially widen their review of
enterprise risk management in their analysis of businesses,
the rating agency perspective should be invited into the
development and ongoing operation of the certification
program.--This could potentially facilitate greater
recognition of effective corporate preparedness. Rating
agencies are increasingly focusing on enterprise risk
management in their analysis including business continuity
and emergency management programs by the corporation.
Including rating agency input into the voluntary
certification program might allow for these agencies to
acknowledge this voluntary certification more readily in
their own analysis and thereby effectively reward
preparedness by corporations.
Supply chain resilience is a growing concern among
corporations. The voluntary certification program offers
value in assessing supplier resilience. The supply chain
management perspective should be included in the
development and ongoing operations of the certification
program.--There is an increasing focus on supply chain
resilience and the preparedness of critical suppliers.
Firms frequently require supply partners to adhere to
certain preparedness requirements. Some firms promote
preparedness-related best practices through mentorship,
training, education and joint exercises with supply
partners. Corporations are looking for tools to assess the
resilience/reliability of the suppliers of critical goods
and services. From the supplier perspective, some firms are
noting significant time spent on interfacing with multiple
customers assuring each of the business' preparedness
status. A voluntary certification program could potentially
provide a commonly-accepted verification of preparedness
and thereby avoid multiple customer queries. Similarly,
customers could use the certification to minimize their
supply assessment efforts.
Insurance company and related input should be incorporated
into the voluntary certification program to support
increased recognition of business preparedness in the
future.--It can be argued that the insurance industry on
the whole understands the general value of business
preparedness to minimize losses to both the individual
businesses and the insurance company. However, how and if
insurance companies measure preparedness varies
significantly. Current efforts to correlate preparedness
actions to loss reductions are largely focused on property
risk. The insurance market is stratified, with larger
companies receiving relatively more attention and greater
flexibility from underwriters than smaller companies. A
commonly-accepted third party assessment of business
preparedness could be a valuable indicator of risk which
might be used by insurance companies in their underwriting
potentially. This could possibly result in a greater
recognition of preparedness in the future. The audit
processes involved with the certification program may
provide underwriters with data they cannot access otherwise
due to lack of time or expertise, helping them to
systematize their understanding of business continuity. In
addition, a voluntary certification program could also
begin to build a historical record that over time could
inform a closer understanding of what preparedness measures
best minimize future insurance claims. Challenges that need
to be addressed include how preparedness standards would
fit into underwriting guidelines. State insurance
regulators may also consider how to promote the
incorporation of elements of the certification program in
the underwriting process. Another possibility for driving
the development of insurance incentives for preparedness is
to approach it from a consumer demand standpoint. Insured
companies may take individual and/or collective action to
demand acknowledgement of preparedness efforts by insurers.
Representatives from the corporate counsel and wider legal
community should be incorporated in the development and
implementation process of the program to support a
potential role of certification in minimizing legal
liability for the impacts of emergencies.--Negligence tort
and other legal liability can be a major exposure for
companies of all sizes in the aftermath of an emergency.
When another party is impacted by the event, it is often
argued that the company did not do enough to prepare for
emergencies. Yet, it can be difficult to ascertain how much
preparedness is enough given the diversity of risks that
face a company. Advance and documented compliance with an
established recognized standard for preparedness can serve
to support an affirmative defense to liability claims after
an emergency. The certification program will be centered on
voluntary compliance with one or more industry standards.
Thus, the certification program should optimally be
structured to minimize legal liability of the business
which pursues preparedness in compliance with it. The
development of statutory guidelines would provide
additional legal motivation to pursue certification. On the
other hand, there is a potential disincentive pertaining to
undertaking preparedness certification and the related
documentation of preparedness actions undertaken by a
company, especially with respect to the identification of
risks to the company and its current vulnerabilities.
Legislation providing safe harbor from litigation to any
certified firm would provide a major incentive for
certification, as would the development of what is called
``self-evaluative privilege'' to ensure that the findings
of the certification process would not be used in court
against a proactive corporation.
Ms. Jackson Lee. Thank you very much for your testimony.
I now recognize Dr. Stephens for 5 minutes. Dr. Stephens,
you may also summarize your statement and be recognized for 5
minutes. Thank you.
STATEMENT OF DR. KEVIN U. STEPHENS, M.D., DIRECTOR, HEALTH
DEPARTMENT, CITY OF NEW ORLEANS
Dr. Stephens. Thank you, Chairwoman Jackson Lee, the
Ranking Member Lungren, and other members of the committee and
guests.
Thank you for your invitation and, of course, your most
gracious introduction.
New Orleans is one of America's most beloved and culturally
distinctive cities. As you are all aware, it has faced many
challenges in recovery and the rebuilding after the--and
perhaps our worst natural and manmade disaster to occur in the
United States of America.
Please know that I speak for our entire community when I
say that we are grateful for all that Congress has done. We are
very happy to have you help us recover from Hurricane Katrina
and the subsequent flooding. We are truly appreciative of your
continued concerns about our progress in caring for our
citizens, while we work diligently towards resolving our
longer-term recovery challenges.
Thank you for providing this opportunity for us to share
with the committee our unique perspective on the concept and
implementation of resilience, particularly regarding the
critical health care infrastructure of a community.
Being resilient means having the ability to withstand a
blow and to bounce back, a capacity which must be built on an
already-solid foundation. Our community suffered a catastrophic
disaster that destroyed most of its private and public health
care infrastructure when the levees broke, flooding 80 percent
of the land area in our city.
We continue to struggle to rebuild the health care
foundation and cover basic medical needs for our citizens. We
still have excessive waits at our emergency rooms. We have a
shortage of mental health inpatient beds. We have a lack of
primary care clinics to provide day-to-day health care for the
indigent and uninsured and minimal medical surge capacity, even
though we are ranked high in vulnerability, in terms of
terrorism and natural disaster.
Below are some of the major challenges we have encountered
to building resilience in the greater New Orleans health care
community, as well as some suggested solutions.
One of our challenges in the recovery and building
resilience that plagues our health care providers is the
duality that they face, as victims, as well as responders in a
critically needed system. It is quite difficult to play both of
these roles simultaneously.
Many of our providers lost everything, including their
offices, their medical diagnostic equipment, medical and
financial records, and their homes. Provisions must be made for
providers to resolve their personal difficulties before they
can begin to provide critically needed services.
Even for those providers and institutions left standing
after the disaster, a significant number of them experienced
losses in revenues and a scattering of their patients. Many of
our regional hospitals decided not to re-open their facilities,
and those that remain have a drastically reduced number of
inpatient beds.
This reduced capacity and capability has left doctors with
no place to admit their patients. Faced with a decreased
population pool and no reliable source of income, many had no
choice but to relocate, resulting in a further damage of an
already decimated health care system.
It should be noted that several local and regional
hospitals stayed open and re-opened immediately following
Hurricane Katrina. These hospitals have incurred tremendous
financial losses, primarily due to the number of increased
patients of uninsured individuals seeking health care.
While we owe a debt of gratitude to our community partners
for assisting our citizens in a time of need, financial relief
needs to occur for these institutions to continue to provide
quality health care services.
Many of our private-sector hospitals realized that rather
quickly following Hurricane Katrina that their financial risks
were tremendous. These institutions faced higher labor costs,
higher insurance costs, higher provider cost, higher uninsured
numbers, and higher construction costs.
It was evident that if they re-opened that they would be
likely to lose millions of dollars. Hence, four of our regional
health care facilities have decided not to re-open.
As mentioned earlier, in providing care in the increasing
indigent and uninsured population, due to dislocation, job
loss, and other financial woes stemming from the disaster, has
been one of the greatest financial liabilities in our private
hospital facilities.
Federal laws require emergency departments to accept and
treat patients regardless of their financial capability. With
the collapse of a State-run charity system immediately after
the hurricane, private hospitals were forced to assume the care
of the uninsured.
Some compensation for these services was provided by the
State at a later date, however, but according to many CEOs it
has been late in coming and woefully inadequate.
Following Hurricane Katrina, there was no readily
accessible database of patient health information available to
providers. But we would like to thank the American Medical
Association and other organizations who put together a database
that enabled patients to access their pharmacy information and
get badly needed prescriptions filled.
While this database proved to be an invaluable service,
much more health information is needed in a disaster situation
in order to provide excellent care to our citizens.
So we have just basically three solutions, starting with
the patients. It would be great to develop a national
continuity of care record system, which would allow patients to
access critical health care information at the time of a
disaster.
Entrepreneurs have also identified this and are flooding
the market with various forms of mobile personal data archiving
systems. While many health care provider associations have
agreed to the critical fields in a continuity of care record, a
federally standardized approach is warranted.
One must ask: Why we can access our e-mail accounts,
banking information, and other critical data while we are
abroad, but no such means for accessing our medical data
exists?
No. 2, for our providers, some of our action reviews that
were performed after Hurricane Katrina response cited a need
for a mechanism where providers can easily access across State
boundaries in a response to a disaster.
An avenue for expediting medical licenses and
certifications needs to be in place to facilitate the
credentialing and responding health care providers. A national
practitioner database could be used to meet this goal.
While we are aware of the Department of Health and Human
Services, that they created the Emergency System for Advance
Registration of Volunteer Health Professionals in response to
9/11, we need more emphasis linking various States, because
this is primarily a State-run program. We need a national
registry of providers.
For the hospitals, the health care community is pleading
for a more reliable and predictable reimbursement mechanism for
providers and hospitals that respond to a disaster, as declared
by the president.
The private sector must also have some assurances upfront
that they will be reimbursed for their contributions. Health
care services can be quite costly, and the health care
community should not be expected to absorb all of the expenses
incurred after a disaster.
For example, Medicaid payments should be made portable
during the time of a declared disaster so that health providers
in another State----
Ms. Jackson Lee. Mr. Stephens, if you could--I don't know
how much more you have. If you could summarize for us, please.
Thank you.
Dr. Stephens. Yes. The other stats would basically give
full faith and credit to their whole State Medicaid insurance
card.
Finally, we do acknowledge that we have a whole lot of
initiatives organized and authorized by Congress in the UASI
and the metropolitan response system. They are underfunded, and
we will suggest that they will be continued funding for the
local and State agencies.
So thank you very much for allowing me time to speak, and I
look forward to your questions.
[The statement of Dr. Stephens follows:]
Prepared Statement of Dr. Kevin U. Stephens
May 14, 2008
Chairman Thompson, Ranking Member King, Chairwoman Jackson Lee,
Ranking Member Lungren, and other distinguished members of the
committee and panel: I am Dr. Kevin U. Stephens, Director of the New
Orleans Health Department. New Orleans is one of America's most beloved
and culturally distinctive cities, but as you are all aware, it is
facing the challenge of recovering and rebuilding after the worst
natural and man-made disaster to occur in the United States of America.
Please know that I speak for our entire community when I say that
we are grateful for all that you in Congress and that the people of the
United States have done to help us recover from Hurricane Katrina and
the subsequent flooding. We truly appreciate your continued concern
about our progress in caring for our citizens while we work diligently
toward resolving our longer-term recovery challenges.
Thank you for providing an opportunity for us to share with the
committee our unique perspective on the concept and implementation of
resilience--particularly regarding the critical healthcare
infrastructure of a community. Being resilient means having the ability
to withstand a blow and to bounce back--a capacity that must be built
on an already solid foundation. Our community suffered a catastrophic
disaster that destroyed much of its private and public healthcare
infrastructure when the levees broke, flooding 80 percent of the land
area of our city. We continue to struggle to rebuild the healthcare
foundation and cover the basic medical needs of our citizens. We still
have excessive waits at our emergency rooms, a shortage of mental
health inpatient beds, a lack of primary care clinics to provide day-
to-day healthcare for the indigent and uninsured, and minimal medical
surge capacity, even though we are ranked high in vulnerability for
terrorism and natural disasters.
Below are some of the major challenges we have encountered to
building resilience in the Greater New Orleans Healthcare community, as
well as suggested solutions.
challenges
One of the challenges to recovery and building resilience that
plagues our healthcare providers is the duality they face as victims as
well as responders in a critically needed system. It is quite difficult
to play both of these roles simultaneously. Many of our providers lost
everything, including their offices, medical diagnostic equipment,
medical and financial records, and their homes. Provisions must be made
for providers to resolve their personal difficulties before they can
begin to provide critically needed services.
Even for those providers and institutions left standing after the
disaster, a significant number experienced loss of revenues and a
scattering of their patients. Many of our regional hospitals decided
not to reopen their facilities and those that remain have a drastically
reduced number of inpatient beds. This reduced capability has left the
doctors with no place to admit their patients. Faced with a decreased
population pool and no reliable source of income, many had no choice
but to relocate, resulting in further damage to an already decimated
healthcare system.
It should be noted that several local and regional hospitals either
stayed open or reopened immediately following Hurricane Katrina. These
hospitals have incurred tremendous financial losses primarily due to
the increased number of uninsured individuals seeking healthcare. While
we owe a debt of gratitude to our community partners for assisting our
citizens in a time of need, financial relief needs to occur in order
for these institutions to continue to provide quality healthcare
service.
Many of our private sector hospitals realized rather quickly
following Hurricane Katrina that their financial risks were tremendous.
These institutions faced higher labor costs, higher insurance costs,
loss of providers, higher uninsured numbers and higher construction
costs. It was evident that if they reopened, they were very likely to
lose millions of dollars. Hence, four of our regional healthcare
facilities have decided not to reopen.
As mentioned earlier, providing care to the increasing indigent and
uninsured population (due to dislocation, job loss and other financial
woes stemming from the disaster) has been one of the greatest financial
liabilities to our private hospital facilities. Federal laws require
Emergency Departments to accept and treat patients regardless of their
financial capability. With the collapse of the State-run ``Charity''
system immediately after the hurricane, private hospitals were forced
to assume the care of the uninsured. Some compensation for these
services was provided by the State at a later date, but according to
many CEOs it has been late in coming and woefully inadequate.
Following Hurricane Katrina, there was no readily accessible
database of patient health information available to providers. We would
like to thank the American Medical Association (AMA) and other
organizations that put together a database that enabled patients to
access their pharmacy information and get badly needed prescriptions
filled. While this database proved to be an invaluable service, much
more health information is needed in a disaster situation in order to
provide excellent care to evacuated citizens.
solutions
Some of the after-action reviews that were performed on the
Hurricane Katrina response cited the need for a mechanism where
providers can easily cross State boundaries in response to a disaster.
An avenue for expediting medical licenses and certifications needs to
be in place to facilitate the credentialing of responding healthcare
providers. A national practitioner database could be used to meet this
goal. While we are aware that the Department of Health and Human
Service's (HHS) created the Emergency System for Advance Registration
of Volunteer Health Professionals (ESAR-VIP) program in response to
September 11, more emphasis needs to be placed on the agency's ultimate
goal of linking these various State-managed ESAR-VIP programs into one
national database. This will ensure that healthcare providers are not
caught in bureaucratic red tape when citizens are in need of the
services that they can provide.
The healthcare community is pleading for a more reliable and
predictable reimbursement mechanism for providers and hospitals that
respond to disasters declared by the President. The private sector must
have some assurances up front that they will be reimbursed for their
contributions. Healthcare services can be quite costly and the
healthcare community should not be expected to absorb all of the
expenses incurred. For example, Medicaid payments should be made
portable during the time of a declared disaster so that health
providers in another State could receive reimbursement for services
rendered. One possible way to achieve this would be for States to give
full faith and credit to the Medicaid insurance card from the disaster
affected locality. The host State would allow their providers to bill
their Medicaid program for the care of evacuees. The host State
Medicaid program would then bill the disaster-affected State for
reimbursement. This would also allow for evacuees to obtain medical
care as well as medications in the event of an evacuation.
The Nation should develop a national CCR (Continuity of Care
Record) system which would allow patients access to critical health
information in the time of a disaster. Entrepreneurs have also
identified this need and are flooding the market with various forms of
mobile personal data archiving systems. While many healthcare provider
associations have agreed to the critical fields needed in such a
record, a federally standardized approach is warranted. One must ask
the question why we can access our email accounts, banking information
and other critical data while we are abroad, but no such means for
accessing our medical data exists.
It is important for Congress to authorize and continue to fund the
major grant programs that communities use to build resilience into
their critical infrastructure. Programs such as the Urban Area Security
Initiative (UASI), and the Metropolitan Medical Response System (MMRS)
support medical surge capacity, mass fatality prophylaxis, and other
key needs. Specific to the healthcare community, the Hospital
Preparedness Program (HHP), under the U.S. Department of Health and
Human Services, is a key provider of funding for hospitals and
healthcare systems' all-hazards preparedness and response capability.
During the past five funding years of the HPP grant, significant
improvements have been made in our area regarding interoperable
communication, surge capacity, decontamination capabilities, training,
and education. It is important to note that funding for these programs
has been reduced and their existence is constantly threatened every
budget year. For our community, the current allocation of funds for
healthcare preparedness as well as additional financial support is
needed to bring our healthcare infrastructure back.
We also advocate that Congress make provision for communities hit
by catastrophic disasters to have automatic access to funding to
rebuild what is lost or damaged by a disaster. Our Office of Emergency
Preparedness is faced with the daunting task of redeveloping our
medical surge, decontamination, triage and pre-hospital treatment
capabilities utilizing the MMRS grant. Many of the non-disposable items
that were purchased by this grant to support the 11 Target Capability
Focus Areas, outlined in the MMRS grant guidance document, were either
utilized or destroyed during the aftermath of Hurricane Katrina.
Additional grant dollars would greatly assist this initiative to return
our city's level of preparedness to our pre-Katrina standards.
conclusion
Ladies and gentlemen, thank you for allowing me to speak with you
on the status of our recovery and the challenges we and the Nation face
to make our homeland more resilient. I believe the proposals outlined
in this document will accelerate our recovery and assist others to
rebound faster and more effectively after a disaster of catastrophic
proportions. We thank you, the Homeland Security Committee, the
Subcommittee on Transportation Security and Infrastructure Protection
and Congress, for your continued support as we rebuild our city and
region. Though we still face historic challenges, we are hopeful that
with your assistance, we can solve the remaining problems and build a
better and stronger community for everyone.
Ms. Jackson Lee. I thank you very much for your testimony.
I thank all the witnesses for their testimony.
I remind each member that he or she will have 5 minutes to
question the panel.
I now recognize myself for 5 minutes.
Assistant Secretary Stephan, we hear the number 85 percent
over and over again of the critical infrastructure that is
owned and operated by the private sector. Among that 85
percent, with what percentage of the Department continuously
engage for critical infrastructure security purposes?
Because many of these assets are not regulated for security
purposes, what is the business case the Department makes to
these entities to secure their assets? What are the carrots you
use to get them to do the right things?
Do you encourage the private sector to be resilient and be
able to bounce back to effective operations? How do you do
that?
Colonel Stephan. Yes, ma'am. To answer your first question,
I do not have an exact percentage for you, but we routinely
engage with all 17--actually, now 18 critical infrastructure
sectors that are defined in the National Infrastructure
Protection Plan from communications, electricity, oil and gas,
I.T., transportation, you name it.
We have sustained governance mechanism that allows very
frequent meetings between our different entities, as well as an
information sharing, where virtually every day we are passing
either threat information or operationally-related information,
based upon what is happening with our infrastructures on a
daily basis, train derailments, bridges collapsing, the
wildfires in California and Florida that we are monitoring
today, ongoing activities and relationships.
Resiliency is built in as part of our organizing framework,
in terms of national level documents that we have built in
voluntary partnership with the private sector over the past 3
years, all the way down to our facility-level security plans
and buffer zone security plans that resiliency, redundancy,
robustness, redundant command post-type considerations that are
built into those frameworks.
The other piece on incentivization, as Congressman Lungren
pointed out, the threat piece is key. We can bring a lot of
people to the table with respect to providing them information
on what exactly the threat is.
If we have an emerging, credible threat in the sector, we
do everything we can to develop tearline information with the
intelligence community, get it into the hands of the owners and
operators.
Where we don't have that type of information, we have got a
special team of analysts in my shop, and Charlie Allen's shop,
that work on lessons learned from abroad. If the terrorists
start attacking hotels and discos and transit systems here,
they are certainly doing it abroad almost every day somewhere.
Iraq, Afghanistan, Indonesia, Jordan, Egypt, you name it, there
they are.
We are capturing those lessons learned, learning the
techniques and procedures, and exporting that information
across our private-sector information network.
Ms. Jackson Lee. Let me quickly ask another question. You
have submitted a lot of documents. Do you have an internal
white paper or managerial directive dealing with infrastructure
protection that define resiliency and how it is going to be
implemented?
If you have those, we would like to have those submitted to
the committee.
Colonel Stephan. Yes, ma'am. The definitions of protection
and resiliency and all of its other components are included in
the National Infrastructure Protection Plan that I have
provided or brought with me today to submit to the committee.
Ms. Jackson Lee. Do you have how it can be implemented? Is
that----
Colonel Stephan. Ma'am, it is all part and parcel of the
framework. For me, this is all about trying to drive--not you,
not members of this committee, but there are academics and
think-tanks out there that would like to drive a wedge and
cause us to make a choice between protection, prevention, and
the response and recovery side, or the resiliency side.
I would argue, as I heard you also argue, ma'am, in your
opening testimony, there isn't a choice to make. It is how do
we combine the two imperatives, how do we blend them? On the
prevention and protection side, we have to do it on a risk-
based approach or else we could be spending a lot of resources,
a lot of money in areas that don't provide bang for the buck.
We are not for that. Risk-based approach to the upfront
components, combined with the capability to absorb a strike and
respond adequately, that is what this Nation is all about.
Ms. Jackson Lee. Well, let me get Mr. Czerwinski and Mr.
Johnson, Mr. Raisch, to respond to that.
Mr. Czerwinski.
Mr. Czerwinski. Thank you, Madam Chairwoman. The Assistant
Secretary makes a very clear and important point, that is, that
the balance is critical.
The way in which resilience ought to be considered in this
context of the private sector is that risk has changed to the
point where prevention, yes, is critical and protection is
indispensable, but the resilience component has to evolve to
reflect the interconnectivity between the different sectors
themselves, so that, as we go through the process of educating
the sectors about the threats that they face and the risks that
are peculiar to those different sectors, the other side of the
coin is for us to identify the ways in which these different
sectors are actually interdependent themselves.
I know there are already efforts underway in this domain.
But there could be a great deal that we could gain from a
framework that might develop the information-sharing to the
next level, such that there is different kind of resiliencies
evolved.
The redundancy is a part of it that the Federal Government
has to embrace, but the redundancy is not the sort of thing the
private sector is going to be too enthusiastic about. So there
is still some opportunity to drill into that.
Ms. Jackson Lee. You think that the Federal Government can
do a better job?
Mr. Czerwinski. Well, I am an American citizen. I always
think the American government can do a better job. But I think
the--I think the Department of Homeland Security has been given
the authority and freedom to work with the private sector and
has created some engagement mechanisms that enable that. We
participate in some of them at IBM.
The way in which the opportunity resides, though, I think,
is actually to look at this framework that embraces a broader
picture of human capital technology and governance, not just
threat information.
Ms. Jackson Lee. If we can't get the private sector to give
us a good give-and-take, Mr. Czerwinski, we can't get to a
better product.
So, Mr. Johnson, please don't hold back. We are not here to
sugarcoat, nor are we here to suggest that Colonel Stephan does
not have a strong constitution and can accept constructive
criticism. So we would like to see what your thoughts are,
please.
Mr. Johnson.
Mr. Johnson. Thank you, Madam Chair.
The issue of resiliency in the financial services sector is
one that is longstanding. In fact, we are, in some ways, a bit
of a unique sector in that, in order to efficiently operate,
every one of the competitors in our private sector must trust
each other to operate efficiently as we pass money around the
system. Indeed, it goes out beyond the United States.
So resiliency is really core to what we do, and we are only
as strong as our weakest link. So we have to always ensure that
we are resilient in what it is we do, because we are so
interconnected.
That is different, potentially, in other sectors. As far as
what the public sector can do or do better, I don't have a
strong point of view that that is anything that needs to be
done in addition. I think most of what I see is the private-
sector organizations realizing how important resiliency is in
what it is we do every day and spending money because it is the
right thing to do.
Ms. Jackson Lee. Is that the industry spending money?
Mr. Johnson. That is the industry spending money.
Ms. Jackson Lee. Can the government do more in assisting
that? Is there the interaction between the government on
resiliency with the private sector from the financial services'
perspective?
Mr. Johnson. On financial services, there is a great
relationship between us and our sector-specific agency, which
is the U.S. Treasury. Lots of discussions about, as Secretary
Stephan said, a prioritization on the front end, or risk
assessment on the front end for protection, as well as a
resiliency perspective on day-to-day operations.
Ms. Jackson Lee. Well, can you point us to written
documents where you have received from the U.S. Department of
Treasury that focuses on resiliency? Do you have those?
Mr. Johnson. I do not have those with me, no, but I can
provide you guidance that comes from the Federal Government, as
well as our sector-specific plan--thank you, Secretary
Stephan--which articulates across the entire sector, from
banking to insurance.
Ms. Jackson Lee. Well, let me do this. I mean, a document
that has already been submitted into the record is fine. The
question is whether there is interaction that focuses on
resilience.
Let me yield to Mr. Raisch. I thank you for your answer, so
I can yield to the distinguished ranking member from
California.
Mr. Raisch. Thank you, Chairwoman.
A few very brief comments. I would say, firstly, I don't
think it is an either-or, prevention versus resiliency. This is
a continuum. I mean----
Ms. Jackson Lee. We agree on that.
Mr. Raisch. Got that.
Ms. Jackson Lee. But we want to know whether the Federal
Government can do better. That is what we would like to hear.
Mr. Raisch. Certainly, and I would think the Assistant
Secretary would agree, we can always improve.
Ms. Jackson Lee. The secretary is not the singular
representation of the Federal Government. So I know you are
sensitive to his presence on the panel.
Mr. Raisch. Very good. I think we can all do more to
leverage the economic rationale. We can call for business and
government to do--to be more prepared. Quite frankly, that is
right up there with apple pie, mom and pop, and so forth.
At a certain point, businesses have a responsibility to
their stakeholders to essentially make rational economic
choices. As such, I think DHS and other elements of government,
Congress included, can help clarify some of the business case
incentives, develop, perhaps, new ones.
As I mentioned in my testimony before, I think this
certification program that was recently passed has an
opportunity to link good practice with direct economic benefits
in a way that has not happened in the past. We have directly
worked in the past with elements of, if you will, the external
stakeholders, those being insurance, rating agency, legal
liability community.
Many of them are disposed towards acknowledging resiliency,
but have not had an effective measure to date to acknowledge
it. If you can't acknowledge it or measure it, you can't reward
it.
So I think there is a real opportunity in moving forward
this voluntary certification program, particularly with an
emphasis towards economic value to business.
Ms. Jackson Lee. I thank you.
Dr. Stephens, I am going to hold my questions for you.
I yield to the distinguished gentleman for his time of
questioning from California.
Mr. Lungren. Thank you very much.
I think the panel is to be commended for resisting the
temptation to treat Colonel Stephan as a pinata here.
Colonel, I happen to think that you have done a very good
job and the Department has done a good job in launching this
effort. That is what we have done: We have launched the effort.
There still remains a lot to be done.
Mr. Johnson, you made a very obvious point, but something
that we often overlook. The very nature of the financial
services industry is one of dependence on resilience. I mean,
if you go down for a day or two, your business essentially has
been drastically punished or suffered. I would say the same
thing with the communications industry, for instance.
But when we get into some of the other industries, I don't
think the resilience aspect is as obvious and, therefore, as
obvious to the bottom line and, therefore, as justifiable to
shareholders. It seems to me that is the nexus that we need to
sort of reach.
So let me posit this question to you, Mr. Raisch. Is that
the proper way to pronounce Mr. Raisch?
Mr. Raisch. Yes.
Mr. Lungren. Mr. Czerwinski.
Let's presume the government--the answer is not going to be
a lot more government money. Let's just set that aside, because
that is an easy one to say. ``Well, we will give you more
grants. We will do this.''
Setting aside money, what are the kinds of things that can
most effectively, efficiently and quickly allow that kind of
economic value to be realized by sectors other than the
financial services sector or the communications sector?
I mean, what are the keys to getting other parts of
American industry to have resilience as a part of--and it is
more than resilience, it is also protection and prevention from
terrorist attack or natural disaster?
Mr. Czerwinski. Well, I will go first. Thank you for that
question. This gets to the real critical point, which is, how
does this issue become portable across different sectors?
What we tried to look at, actually, was the cargo
container, flow of cargo and container traffic across maritime,
for example, if you were to take that, you could look at this
from a double bottom-line concept, where there is a way in
which you could find economic efficiencies to create better
system visibility, that is, understand what is going on from
end to end for a container cargo ship.
That is obviously useful from a regular bottom-line
perspective, because it gives you the understanding of where
disruptions exist or inefficiencies are.
But if you look at this from a double bottom-line, that is,
the resiliency component, that same system visibility--which,
by the way, is never perfect, and usually that information
resides in different sectors--could also enable this
decisionmaker to say, ``This disruption is actually unique.
This is not a situation where we are looking at a derailment of
a certain cargo, but we are looking at something completely
new.''
Without the ability to have that visibility, that
decisionmaker wouldn't be able to say, ``We need to react
differently,'' or, ``We need to re-route this,'' just taking
the cargo one, for example. So in that case, you could have
both resiliency and efficiency resulting in a double bottom-
line.
I hope that answers your question.
Mr. Lungren. Mr. Raisch.
Mr. Raisch. In reference to really the governmental role
that can add a new equation to this, I think--let's look at
businesses. They are organized as individual organizations and,
as such, that is their focus primarily.
I think government can bring a wider perspective. I think
we have touched on some other issues where we looked at
critical dependencies across sectors and across businesses and
so forth.
The reality of this is, right now, globalization is most
compelling bottom-line argument for a lot of resilience.
Organizations that we deal with daily have supply chains that
reach from here through Mumbai in India to Shanghai and back
again.
As such, I think businesses are learning the lesson, to the
extent they have a wider geographic footprint, if you will, for
any one adversity, whether the manmade or natural disasters to
occur.
But I think government can play a role in perhaps
distilling some of those lessons, reinforcing also the ability
to cross-pollinate across various elements of business. There
is a lot of good learning that has happened, particularly in
the critical infrastructure areas, under Assistant Secretary
Stephan, but also, quite frankly, I think cross-pollination
across those sectors, those 18 sectors now, can be facilitated.
I think the ability to, again, communicate in some common
elements of preparedness, defining, if you will, as I mentioned
earlier, that Rosetta Stone. I think this--again, getting back
to this certification program, I think that offers a tremendous
opportunity to do so.
So I think facilitating crosspollination across various
sectors, so we are sharing our insights in an effective manner,
providing an understanding of the societal dependencies, that
certainly the experience in New Orleans underscored
dramatically, that no company, no entity, no household is an
island, and, in fact, we are all very much integrated.
I think that is very much a governmental role in that
respect and one that, I think, provide assistance. The other
thing, I think, on a low-cost basis, I think the provision of
some common tools, based upon those key elements, preparedness.
In this electronic environment--and there are some good
things being done now on ready.gov, but I think we can move
forward and have a truly robust resource from an electronic or
Web-based environment that facilitates business preparedness
across the Nation.
Mr. Lungren. Dr. Stephens, I asked the others not to
consider money, but I want to change that with respect to a
question for you, and that is that, on the Federal side, we
have, in terms of the reimbursement we give to hospitals and
medical institutions, factored in a number of different things.
We have factored in and factored out costs of education,
training, et cetera.
Is there, on the part of the Federal Government, in terms
of reimbursement for expenses by medical institutions,
particularly hospitals, any consideration at the present time
of the resiliency factor, and particularly, if we do an
analysis of a hospital, and we try and analyze whether or not
there are sufficient beds to take care of a pandemic or other
natural disaster?
Dr. Stephens. No, unfortunately, we don't take that into
consideration, in terms of resiliency. In New Orleans
particularly, we are so busy trying to just mine day-to-day
that to get to resilient is not high on the radar.
I think it should be, though, because I think that the
ability to respond in the midst of a disaster is dependent upon
your ability to have resilience.
Mr. Lungren. See, I recall over about a 25- or 30-year
period of time Federal Government decisionmaking drove
hospitals to be more ``efficient'' and, in the process, we
actually caused hospitals to reduce the number of available
beds they had.
One of the ways we did that was making sure the patients
got up sooner, rather than later. I have seen it in communities
across America.
We prided ourselves on making our health care system more
efficient, and one of the indices was, hey, we have fewer beds
sitting out there. That is great, unless you need the beds.
So I think one of the things we have to deal with from a
governmental standpoint is, as we have tried to make the
medical system more efficient, we have created conditions that,
if we have a tremendous impact on a health care system in a
particular area, we don't have the infrastructure we had 40
years ago when we had so many beds available. I am not sure we
have totally dealt with that question.
Dr. Stephens. Your point is highlighted with the mental
health beds. You not only in New Orleans, in the State of
Louisiana, we have basically zero availability of mental health
beds, so our patients have to be transferred out-of-State to
get resources. That is private and public, so that point is
well taken.
Mr. Lungren. I yield back the balance of my time. Thank
you.
Ms. Jackson Lee. I thank the gentleman and yield myself an
additional 5 minutes.
Dr. Stephens, can you tell me how many hospitals, public
and private, were in New Orleans prior to Hurricane Katrina?
Dr. Stephens. Approximately 11.
Ms. Jackson Lee. What do you have now?
Dr. Stephens. Open, we have four.
Ms. Jackson Lee. Okay. Do you have a public Charity
Hospital open?
Dr. Stephens. Yes, we do. We have University Hospital,
which is our Charity Hospital.
Ms. Jackson Lee. The hospital--one of the hospitals that
was open before that is now closed, was that a Charity
Hospital? You indicate you had 11; there are now four.
Dr. Stephens. Yes. One of the hospitals--Charity Hospital
has had two hospitals, University, and the old Charity, as we
knew it.
Ms. Jackson Lee. It was open prior to----
Dr. Stephens. Yes, they both were open.
Ms. Jackson Lee [continuing]. Katrina?
Dr. Stephens. Now, only the University Hospital, which has,
as I understand it, maybe 200 beds is open now.
Ms. Jackson Lee. I didn't hear you. Pardon me?
Dr. Stephens. University, University Hospital.
Ms. Jackson Lee. Has how many beds?
Dr. Stephens. Two hundred.
Ms. Jackson Lee. How many did Charity have?
Dr. Stephens. Totally, they had 539, as I recall.
Ms. Jackson Lee. Is that building still standing?
Dr. Stephens. It is still standing.
Ms. Jackson Lee. All right. So, in actuality, if we looked
at the practicalness of what has happened, you had 11 hospitals
pre-Hurricane Katrina, is that correct?
Dr. Stephens. That is correct.
Ms. Jackson Lee. You now have four?
Dr. Stephens. Correct.
Ms. Jackson Lee. Now, one could put on the record that you
obviously have had a decrease in population, but I assume that
every effort that the city government is making and corporate
fathers and mothers are to build back your population by many
returning New Orleanians?
Dr. Stephens. Correct.
Ms. Jackson Lee [continuing]. People from New Orleans, is
that correct?
Dr. Stephens. That is correct.
Ms. Jackson Lee. So, in essence, if you were to go back to
full capacity of your population, you would have and may have
now a health crisis?
Dr. Stephens. We do. We currently have a--in fact, to go
from beds, we had 2,250 beds available in New Orleans before
Katrina. Now we have less than 1,000 available.
Ms. Jackson Lee. There was a MASH unit that was in, I
believe, the Hyatt. Has that been closed?
Dr. Stephens. Yes, it has been.
Ms. Jackson Lee. Where do those patients now go?
Dr. Stephens. To the University Hospital system, which is
the 200-bed facility that I mentioned.
Ms. Jackson Lee. Would you suggest that your health system
is at capacity or even beyond?
Dr. Stephens. Yes, we are bursting at the seams. We have
basically no available beds anywhere in the city.
Ms. Jackson Lee. So what could have been--and you have made
your appropriate statements. We thank you for recognizing the
hard work of this Congress in a bipartisan way. We accept that.
But what could have been more effective from a resilience
perspective, one, as you look at it, as a medical professional,
what could have been done pre-Katrina, but now, as we look at
post-Katrina, resilience also is the ability to get back in
operation?
Where did the resilience aspect of fixing the health care
system in New Orleans fall after Hurricane Katrina? What was
missing to put you in near-capacity?
Dr. Stephens. Well, I think the big thing is reimbursement,
the predictability and reliability of reimbursement.
We had several hospitals that opened up, but we couldn't
tell them, for the uninsured, when our Charity Hospital system
closed, we had a lot of uninsured patients that would show up
at your doorstep.
There was no predictable, reliable way that hospitals would
know, ``If I treated this person, I would get $1 or anything
for treatment of this patient,'' because--laws require that, if
somebody shows up in your emergency room, you have to see them,
but there are no revenues associated with that treatment.
So without having a predictable, reliable source of income,
the private-sector hospitals chose not to open, because the
hospitals that stayed open--I think I heard like $135 million
was lost last year among five hospitals that were open.
So without a predictable, reliable source of income, the
private sector says they are for-profit, they have to show----
Ms. Jackson Lee. But there is an aspect to resiliency that
deals with a revenue stream.
Dr. Stephens. Absolutely.
Ms. Jackson Lee. So, if we were to look at that sector, we
need to be assured that we have an immediate revenue stream or
some bridge that would keep them going?
Dr. Stephens. Absolutely.
Ms. Jackson Lee. What was the difficulty in opening--what
was the missing resiliency that would allow you to have opened
the other Charity Hospital with 539 beds?
Dr. Stephens. Well, the other Charity Hospital, as I
understand it, from the flooding, we had structural integrity
problems. In fact, there is a group now--looking at that
facility to see what impediments are preventing this one from
being opened or not.
But it was an old facility, grant you. They had many
problems. But I am not really sure. That is a very hot potato,
if you will.
Ms. Jackson Lee. But there was no capacity for you to sign
or to collaborate to have other resources to immediately find a
substitute location for those 539 beds?
Dr. Stephens. That is correct.
Ms. Jackson Lee. So there was a crack in the resiliency,
the start-up of getting back to where you were?
Dr. Stephens. Bigger than a crack.
Ms. Jackson Lee. Okay.
Let me pose a question to you, Mr. Czerwinski. Your
testimony clearly states that a resilience-based approach to
disruptions, including intentional human-made attacks, is a
company's best interests. How broadly practiced is such an
approach within the private sector? How can it be promoted?
As Colonel Stephan is not a good pinata, I hope that you
will give us a good critique of what we may do better in the
Federal Government in answering the question.
Mr. Czerwinski. Understood. Thank you, Madam Chairwoman.
Is it the case that the entire private sector embraces this
idea that resilience is in their economic interest? Likely not.
However, there is no doubt that the current efforts at the
Department of Homeland Security to engage these separate 18
sectors to communicate to them the importance of understanding
the threats that face them and the ways in which they can
protect themselves is sinking in.
There is no question that there are some sectors that are
absolutely more receptive to this than others. The financial
services sector, let's say, or the I.T. sector, they understand
their vulnerability and their criticality.
However, the next step beyond that is to be even more
proactive to suggest that, in fact, there is a way we can
bridge these different sectors to identify where these sectors
are dependent upon one another. If we can do that, we can
identify a different level of vulnerability that is no doubt
part and parcel of the 21st century type of risk we are facing.
How that would be incentivized could be taken in a few
different ways. One would be to provide a framework that
allowed these private-sector participants to gain some
different kind of treatment, let's say, when it interfaces with
the government.
Customs and Border Protection does this now, where they
work with multiple different sectors in their automated customs
environment. They share information across different sectors.
They, therefore, facilitate the flow of travel.
What that also provides them is the ability to see any sort
of aberrations that may be threats themselves.
Ms. Jackson Lee. Let me ask Mr. Raisch, does he have any
examples through his research of companies who have done a good
job at resilience? In your certification pilot or idea, does
there need to be assessments--I hate to use the word punitive
measures--but does there need to be a stronger assessment of
whether or not there is a resilient plan?
Does there need to be some punitive measures, some fines
assessed for those who don't have them? Is it that important?
You need to use as a backdrop Dr. Stephens, who indicated
that pre-Katrina there were 11 hospitals. There are now four in
New Orleans.
Mr. Raisch. Clearly----
Ms. Jackson Lee. Some of that is private, and some of that
is public, and we understand the challenges. But just use it as
a backdrop, that there was a problem with being resilient in
New Orleans in the medical sector, and so if you would respond.
Mr. Raisch. You bring in a very good point, assessment. I
mean, the question, as I think someone else mentioned earlier,
the issue is, what is preparedness or how much preparedness do
we need?
It is a difficult situation to assess, just given the fact
that many of us have different other operation
responsibilities. Nonetheless, speaking to your issue of
assessment, I think there is an opportunity, utilizing existing
private-sector standards, to assess the level of preparedness.
These are standards that developed through common practice
over the course of many years, input by corporations,
professionals in this area. So I think the criteria exist
currently to define effective preparedness.
The 9/11 Commission in particular recommended a particular
standard in SK 1600 that was developed some--I guess early
1990s--as one of those standards. There are other ones out
there, as well.
But what has been lacking in the past is a measurement
methodology. That is what, essentially, the legislation that
this Congress passed--I am sorry, last Congress passed in 2007,
and the focus there specifically was on one of developing an
assessment methodology that was built upon existing historical
experience.
In the world of business, there is quality management. ISO
9000 is a type of certification manufacturers have gotten since
the early, the mid-1980s, when quality was a problem in our
manufacturing firms. We can leverage that, and I think that is
what this program offers in the way of potential.
Relative to your other issues, I think you have
specifically focused on, what can government do better, and
particularly what can DHS do better?
I think the opportunity to be a convener--we don't have all
the answers at this table. There are very learned individuals
here, without doubt. I would like to say that there are pearls
of wisdom that would roll out of each of our lips.
At the same time, I think the answer probably is resident
out there. I think, just as this committee is convening
experts, I think DHS could do a--increase its activities in
convening, but convening with a specific focus, not only what
should be done, but why should it be done, really getting
Congress, congressional representation there, as well, to look
at what both legislative issues, as well as market-based
incentives are important.
We can't just look for these. We need, in some cases, to
create them. By bringing together private sector, bringing
together, I think, the congressional and legislative branch,
and the executive branch, I think there is an opportunity,
perhaps, to really define some, if you will, bottom-line
rationale and develop it over time.
Ms. Jackson Lee. So you don't think the certification
should have a fine component to it?
Mr. Raisch. Well, I think it is unrealistic at this point.
Quite frankly, I don't think there is the political will to
move this to a mandatory stage.
I think, quite frankly, though, there is a market-based
punitive element to it, to the extent--let's give supply chains
as an example. Many corporations out there right now, for their
critical suppliers--we have financial services here as an
example--they are regulated already to bring their offices up
and their operations up within 4 hours, many of them my primary
market-maker.
At the same time, for them to do that, they need critical
suppliers, in I.T., in telecom, in other elements of power
generation. They are looking, in many cases, for tools, a
measurement that would allow them to define whether or not
those particular suppliers in their supply chain can be there
for them when they are needed.
Now, if there is an effective measure out there and if
their suppliers that they are currently using don't meet that
measure, then you are going to see an economic impact, an
economic punitive, if you will, element, that will suggest,
``Jeez, if you are not prepared, I am going to go with this
other entity over here that has validated its preparedness
efforts.''
This was done in the manufacturing industry, again, with
quality management. It is done in environmental management. So
I think there is good precedent there.
I think we should look for--the opportunity here is for
government to be a convener and, if you will, to be a catalyst
in creating and accessing this in the way of bottom-line
incentives.
Ms. Jackson Lee. Let me--I ask unanimous consent to move
without a quorum--let me continue the other questioning. We are
moving toward the floor for a vote.
Mr. Johnson, the financial services industry, because of
Wall Street, I think, showed itself very much in tune with
resilience. Is there one singular aspect of what happened
during that time frame and what you have done since that you
think is very important for us to have on the record as it
relates to resilience and as you have seen it in the financial
services industry?
Mr. Johnson. Thank you, Madam Chairman. I would say one
thing that we have done and continue to do is test. I think if
there is one lesson learned out of 9/11 is to--you can't test
every scenario, but you can test.
I think that that is something that goes beyond financial
services to, indeed, other sectors.
Ms. Jackson Lee. So during the ongoing existence of your
business, you are repeatedly testing your ability to be
resilient?
Mr. Johnson. That is absolutely correct. Whether it was
required by a regulation or not, it is done, because all of the
financial services companies have, if you will, a motivation to
ensure they can continue to operate.
If there is something that I think we have learned, testing
does pay dividends. That would be my answer.
Ms. Jackson Lee. Let me ask, Colonel Stephan, Secretary
Stephan, to tell us what incentives DHS is providing to the
public, to the public and private, private sector, to encourage
more organizations to be resilient.
I know the documentation reports, but what is the
engagement? What is the thought of having a chief that deals
particularly with assessing risk, that companies may have
within the DHS shop?
Colonel Stephan. Well, what we have done is--the
infrastructure that we have identified to be most at-risk from
various threat vectors across the country, they number about
2,800 to 3,000. We are very focused on----
Ms. Jackson Lee. I didn't--what is 2,800 to 3,000?
Colonel Stephan. The infrastructures that we have
determined to be the most at-risk across the country on a
steady-state basis, lacking any specific----
Ms. Jackson Lee. That is in the private sector?
Colonel Stephan. The private sector mostly, although there
is----
Ms. Jackson Lee. Focused on what incentives you are giving
them to move toward resilience?
Colonel Stephan. Yes, ma'am. What we do is we have
vulnerability assessment programs in concert with them, and we
have buffer zone protection programs in concert with that.
Where we do security planning, that facilitates interaction
between the private-sector security folks, owners and
operators, and local, State law enforcement and National Guard.
The incentive there is that, with DHS facilitation, we
build a team of security and resiliency. Resiliency is
embedded, built into the security plan template--so is cyber
security, for that matter--rolling in there and facilitating
the interaction and getting the private sector, local law
enforcement, State law enforcement and the National Guard to
pony up to the plate based upon this nucleus of critical
individual facilities, assets, systems and networks that we
work together to identify.
That is one example. The exercise piece, bringing people
together very routinely, whether it is tabletop or full-scale
boots on the ground activity, like we did last week, we have
invited private-sector folks inside our National Infrastructure
Coordinating Center for the first time last week, during our
big national-level continuity of operations exercise, figuring
out the resiliency piece, the security requirements, the
information-sharing requirements, who needs what, based upon
what type of disaster.
Last week, we dealt with the double-headed monster of a
terrorism attack, as well as a major Category 4 hurricane
hitting the national capital region.
Ms. Jackson Lee. Mr. Secretary, let me ask that in writing
if you will focus on--and I have heard the sort of give-and-
take, and I think that we will ask staff to review closely the
documents that you are submitting--but if you can give some
particular corporate examples where DHS has interacted and, in
the letter, writing of companies that are under a particular
sector, showing the incentives and showing the give-and-take,
and seeing the progress of resiliency being built under our
present structure, I would appreciate it.
Colonel Stephan. We would be happy to do that.
Ms. Jackson Lee. I want the record to be clear that
Assistant Secretary Stephan is here, but he doesn't represent
the wholeness of America, the wholeness of the Department of
Homeland Security, though we appreciate his patriotism.
He is well able to engage in give-and-take to make things
better. Is that my--and I hope that that clears the record.
Dr. Stephens, let me close by simply acknowledging your
delegation with Melancon and Mr. Jefferson and others who have
been diligent on working on New Orleans. We thank you.
We expect that you will be able to give us some very good
insight. I would ask--I know your testimony has been put in the
record--but I would ask to be able to follow up with you on the
reason why, beyond the revenue stream, what the Federal
Government has not done to ensure that the resiliency of your
public health system, such as Charity Hospital, could not be in
place 3 years after Hurricane Katrina, particularly the
physical plant.
Maybe you could put that for me in writing. Would that be
all right? I thank you so much.
As I do for all of the witnesses, I thank them very much
for their testimony, valuable testimony. The members of the
subcommittee may have additional questions for the witnesses,
and we will ask you to respond expeditiously in writing to
those questions.
Having no further business, the subcommittee stands
adjourned. I will say thank each and every one of you for what
has been an instructive, but, I am sorry, abbreviated hearing.
Thank you very much.
[Whereupon, at 3:50 p.m., the subcommittee was adjourned.]