Protecting the American Homeland: Governor Ridge’s Unfinished Work

Almost half a year after creating the Office of Homeland Security, how well is the Bush administration doing in improving protection of the United States against terrorist attacks? No major assaults have been launched since September 11, giving a first impression that the effort is going well. But al Qaeda has historically spaced its most horrific terrorist actions by a year or two and may need longer this time given the crushing blow dealt it in Afghanistan over the fall and winter, so the absence of attacks since September 11 may not mean much. The fact is that despite impressive progress posted to date, the administration has yet to develop general plans, much less request budget proposals and implement programs, for a range of threats. As a result, the country is still rather vulnerable.

To be sure, a large, free, and open country cannot make itself invulnerable to terrorism. An effective homeland security strategy can, however, greatly reduce the odds that the most deadly and costly types of terrorist attack will be carried out. Seen in that way, the goal of providing good homeland security is far from hopeless. But efforts to date are far from sufficient.

The Bush Plan

The Bush administration’s budget plan for fiscal year 2003, released in February, includes $38 billion in proposed homeland security funds. It emphasizes five broad initiatives: airline and airport security, preparations for biological attack, border security, information technology, and consequence mitigation for any attack that takes place despite our best efforts to prevent it. The plan would build on accomplishments to date and make the country more secure. It is a good start.

But the plan has two shortcomings—perhaps reflecting the haste with which it was necessarily developed. First, it is directed too narrowly toward possible recurrences of attacks like those in 2001 and earlier—through airliners or anthrax or conventional weapons bombings—rather than toward developing a more comprehensive agenda. It rightly focuses on the “last war” but does not also focus on the possible next one. Second, it does not do enough to prevent terror attacks. The nation can and must do more to keep terrorists and dangerous materials out of the country, to preempt any terrorists who might get into the United States, and to keep them from acquiring dangerous materials once they are here.

This lack of attention to preemption and prevention here at home must be addressed. The administration is right to focus on some elements of border security and on improving the country’s ability to respond to attacks. It is also right to try to improve protection for certain highly vulnerable key domestic sites such as airports. On these matters—consequence management, some elements of border security, and some aspects of domestic protection—the administration is on the right track, though it still has much work to do. But it needs to add a fourth basic tier of defense, prevention, to its current broad strategy for homeland security.

The administration itself recognizes that its budget plan is incomplete. Governor Tom Ridge and his Office of Homeland Security continue to work on a strategic plan for protecting the United States that is due out this summer. But given Ridge’s unwillingness to testify before Congress and the lack of public debate about that strategic plan, it is impossible to know if the deficiencies are being rectified.

The Brookings Plan

A team of seven Brookings researchers has developed a broad framework for homeland security and a preliminary agenda for identifying and mitigating current U.S. vulnerabilities to terrorist attack. Perhaps two-thirds of the agenda overlaps considerably with the administration plan. But the remaining one-third differs in important ways. By our estimates, even if the entire $38 billion Bush homeland security budget were implemented, between $5 billion and $10 billion more would be needed for other measures that promise considerable security benefits at a modest cost. The agenda includes several recommendations that go well beyond known Bush administration plans: expanding personnel and information technology in the nation’s domestic law enforcement agencies; expanding the Coast Guard and reforming the Customs Service by having it adopt fundamentally new concepts for cargo inspection; protecting major buildings and facilities, especially their air intake systems, against biological agents; protecting buildings against conventional explosives and fires; improving security for the nation’s nuclear power plants, toxic chemical plants, and biological research facilities; and improving safeguards on trucks carrying hazardous materials. In what follows I will consider several of these areas in somewhat greater detail.

Using Information Technology to Prevent Attacks

To stop terrorists before they can act requires using information effectively—collecting, collating, analyzing, sharing, and then deploying it promptly and in useful form. Although considerable resources go into all these tasks today, serious shortfalls remain. Equally important, today’s information strategy lacks an overall architecture. Massive information collection can be of little value until the data are shared in a usable way. Likewise, widely shared raw data will be of little use until collated and combined meaningfully.

In any prevention-based information strategy, the FBI will be crucial. It is a core agency in collecting information about potential terrorists, a focal point for collating and analysis, and—as a law enforcement agency—an essential user of information. Before September 11, roughly 25 percent of the FBI’s nearly 9,000 special agents in the field were assigned to counterintelligence or counterterrorism duties. After the attacks, the FBI shifted several thousand agents to such activities. Clearly, FBI manpower needs expanding.

The Bush administration has proposed adding 450 counterterrorist agents, but last December, the FBI was already using 3,000 more agents for counterterrorism than it had budgeted. It should add 5,000 more intelligence agents, as well as more language specialists for counterterrorism and counterintelligence—at a cost of $750 million to $1 billion a year.

Wiser use of state and local law enforcement officers can also improve information collection, surveillance, and law enforcement. Here the challenge is not manpower, but better training and resources. Improved training would help officers use information to identify potential terrorists, and added resources would help them share data with federal officials quickly, allowing them to apprehend or interdict potential terrorists.

Both the public and private sectors are improving their ability to collect and analyze data. The FBI can search e-mail traffic for specific senders, recipients, and keywords. Its Magic Lantern capability can surreptitiously record keystrokes on targeted computers, thus circumventing encryption. Software that matches digital images of faces to suspects in a database can help track and apprehend terrorists before they strike. Expanding the development and application of such technologies, while enhancing their privacy-protection features, is essential.

A central element in a prevention-based information strategy is visas. Today the U.S. visa system is in such disarray that the government often cannot say whether a visa holder who has entered the country remains here. The Immigration and Naturalization Service estimates that 40–50 percent of illegal immigrants in the United States entered the country legally but overstayed their visas. In 1996 Congress required the INS to automate the collection of entry-exit data, but deadlines have had to be extended to 2003 at airports and seaports and to 2005 at all other ports of entry. A new system to track student visa holders is scheduled to be in place next January.

But even if reliable information on visa overstays existed, affected agencies do not have the resources to make full use of it. With only 2,000 investigators and intelligence agents, the INS is already overextended. Agency manpower will have to grow. Adding 10,000 people throughout all affected agencies would cost roughly $1.5 billion a year.

Progress must be made sharing and collating data in other areas. The FBI is taking steps to better share information from its Integrated Automated Fingerprint Identification System, the National Crime Information Center, and Law Enforcement On-Line. But problems remain. The NCIC, for example, has no data about immigration status or minor crimes, and state and local law enforcement authorities often fail to enter relevant data promptly. Tying together disparate data sources, linking databases run by incompatible systems, and expanding the use of handheld computers by law enforcement agents at all levels will require several billions of dollars in investments.

Fears are often expressed that massive data sharing would move the United States closer to “big brother” practices having nothing to do with preventing terrorism. Policymakers can and should take such concerns into account to improve privacy protection while mobilizing information to fight terrorism. For example, because it is easier to monitor how officials access and use electronic records than to track how they use paper records, using electronic records can improve privacy protections. Requiring court supervision of collection methods and use can also enhance privacy protection. Equal care should be paid to the use of public data by private entities. Authorization controls can be used to assure that, say, an airline representative can gain access to information on John Doe about prior convictions on immigration violations or about his presence on a watch list that could justify more intense scrutiny—but to nothing else.

Another key link in the nexus between information strategies and prevention is the driver’s license, which is issued by states and generally accepted in other states as valid identification. Rules for issuing licenses, however, vary widely. Seven of the September 11 terrorists had Virginia drivers’ licenses (though none lived in Virginia) and used them to board airplanes, use credit cards, and open bank accounts. States should standardize rules for issuing licenses and require biometric information and a digitized photo on all licenses. And the nation should publicly debate the desirability of a national ID card, which I am personally inclined to favor.

The Coast Guard and Customs

The Coast Guard and the Customs Service are crucial elements in bolstering the nation’s defense against terrorist access by sea. The Coast Guard, the country’s principal defense against illicit shipping, would be critical for stopping explosives or weapons of mass destruction headed for an American city on a ship. It is also responsible for preventing attacks against major ports crucial in military contingencies.

The Coast Guard operates on about $6 billion a year and employs some 35,000 active-duty personnel, making it less than one-tenth the size of the army or navy. Its fleet is simply too small for the new tasks assigned it since September 11. Within a month of the attacks, it was patrolling 72 security zones around major naval bases, key landmarks, and oil refineries near major cities; by December, the number exceeded 100. It inspected all vessels in New York harbor; guarded prominent ports and cities such as New Orleans; patrolled waters near certain of the country’s 68 nuclear power plants along navigable waterways; and boarded and searched cruise ships. The pace of these and similar security measures increased nearly tenfold.

The 1,000 foreign-flag ships reaching U.S. shores every week pose a huge challenge to the Coast Guard. Port and waterway security alone requires almost the equivalent of a full Coast Guard fleet operating at normal tempo; other Coast Guard activities have been sharply curtailed. Many of its new missions seem likely to remain important indefinitely, though the pace of operations should slow. Efficiencies will be found; in the end, homeland security may take no more than 25 percent of total Coast Guard effort. Still, its fleet and budget will need to grow by roughly 20 percent.

Just as the Coast Guard takes the lead in providing security along waterways, the Customs Service is chiefly responsible for finding and stopping illicit cargo hidden within shipborne containers—or trucks or aircraft. Its roughly $2.4 billion budget supports some 20,000 employees monitoring trade at 300 points of entry and observing borders elsewhere for possible contraband. Customs has typically inspected about 2 percent of all containers arriving at U.S. shores, less than 5 percent of those arriving overland. Those figures may have grown closer to 10 percent since September 11, but huge numbers of potentially deadly containers still go uninspected.

Steve Flynn, Coast Guard officer and researcher at the Council on Foreign Relations, has proposed developing a database for real-time tracking of containers headed toward the United States using a new system whereby many goods would be inspected, generally by the companies shipping them, before reaching U.S. shores or land borders. The benefits for large shipping and trucking companies could be great: in exchange for cooperating with port authorities to implement tighter security precautions and for monitoring their own cargo and loading zones, they could avoid long customs lines when bringing merchandise into the United States. Customs agents could focus their limited resources on monitoring and inspecting shipments that did not undergo such offshore procedures, thus avoiding the need to expand capabilities tenfold.

Protecting Buildings from Biological Attack

The air intake systems of many large buildings are an Achilles heel for this nation. Many are accessible and exposed to a terrorist armed with even small amounts of a biological or chemical agent. And most buildings lack good filters to clean up any biological contamination that gets into the system.

Air intakes on major U.S. buildings should be made as inaccessible as possible. In some cases, this may require little more than locking doors. In others, protective housing may need to be constructed. Still others may entail relocating air intake systems, particularly when they are being replaced anyway. Most existing large buildings could be protected at a modest cost, typically no more than tens or hundreds of thousands of dollars per building. (Insurance companies could provide incentives for buildings’ owners to take the more costly approach of relocating or replacing existing air and heat systems.) Adopting such measures for all of the nation’s 4.6 million commercial buildings, 99 percent of which house fewer than 250 workers, would nonetheless be prohibitively expensive and unnecessary, so such measures should be concentrated on the nation’s 500 or so skyscrapers, each with an average occupancy of perhaps 5,000 people. Information from Michael Janus of Battelle indicates that air filtering systems for such buildings might cost about $1 billion. Replacing filtering systems as needed thereafter, as well as routine maintenance, might cost several hundred million dollars a year nationwide.

Another avenue of protection, especially in new commercial buildings, is tougher building safety codes that focus on structural integrity, minimizing the probability of collapse even after an explosive attack, and making the buildings more resistant to fire. Given the costs of “hardening” new buildings and the trade-off between risk and cost, any such “antiterrorism” building codes should probably apply only to the largest new structures, those that would hold thousands of people.

Similar precautions should be taken at the nation’s roughly 250 major sports arenas and stadiums. Protecting the air intake systems and otherwise hardening these structures could cost about $1 billion.

Getting On with the Job

This agenda is challenging but hardly excessive. Even once fully adopted, federal homeland security programs would constitute only 0.5 percent of GDP and about one-seventh of total defense spending. State, local, and private-sector expenses together would be comparably costly. But many of those costs are already being paid, so the need for additional resources is limited.

The Bush administration has done a fairly good job to date of improving the country’s protections against terrorist action here at home. But its efforts are not yet sufficient and have not been adequately subjected to congressional and public oversight. It is time to broaden the debate and get on with the job. We may not have much time to lose.