DSBlog

In a February post we discussed Executive Order 13556 establishing a Controlled Unclassified Information (CUI) program, an effort by President Obama to standardize and simplify the way the executive branch handles unclassified information. The order designated the National Archives and Records Administration (NARA) as the executive agent responsible for implementing the policies of the order and directed it to develop a document outlining for executive agencies the initial directives for implementation of the order.

Earlier this month, NARA released these directives, which will undoubtedly impact the designation process of Critical Infrastructure Information (CII), Law Enforcement Sensitive (LES) information and Sensitive Secure Information (SSI).

Pursuant to the directive, once a CUI program is implemented within an agency, CUI markings will be the only markings authorized to designate unclassified information requiring further safeguarding or dissemination controls. Legacy material markings, meaning sensitive but unclassified materials that were previously marked under agency-specific marking practices, will not be carried forward. In addition, the appropriate CUI marking will only be applied to legacy material if the information meets the requirements for designation as CUI. Further, the directive explicitly annunciates that CUI may not be controlled indefinitely unless explicitly stipulated by law, regulation or policy. And each category of CUI must have a specific time frame or triggering event for applicable decontrol.

The onus is now on the executive agencies, such as the Departments of Defense and Homeland Security. Each must provide NARA with a proposed plan for compliance with the requirements of the order, including the establishment of interim target dates in the next 180 days.

We will continue to monitor CUI developments as the agency implementation process progresses.

––––––––––––––––

Digital Sandbox is the leader in public safety risk management, providing analytic tools and information products to government agencies and large enterprises for optimizing risk-based strategic, policy and budgetary decisions.

Former Homeland Security Secretary Michael Chertoff says U.S. intelligence agencies are hamstrung in their fight against cyber threats by an “unbelievable thicket… of rules and regulations” that prevent them from conducting domestic investigations.

Chertoff’s remarks, quoted in yesterday’s Wall Street Journal, were made during an event sponsored by Opera Solutions, a data analytics firm advised by the Chertoff Group, the firm he founded after leaving DHS.

The Journal quotes Chertoff as saying: “‘We need to take a fresh look’ at laws that generally prohibit… intelligence agencies from investigating people in the U.S.,” which also prevent the agencies from investigating computers in the U.S. controlled by people outside the country. Such laws make the agencies reluctant to examine the computers during international cyber-terrorism investigations, the article paraphrases Chertoff, “because the computers typically contain data on people inside, as well as outside, the U.S.”

We certainly applaud the philosophical intent of Chertoff’s statements, particularly in regards to international actors, provided the breadth of any deregulation that takes place is closely monitored. And as we and others have pointed out for some time now, better information-sharing between agencies would also go a long way towards making those investigations run more smoothly.

Chertoff is weighing in at a time when cyber attacks appear to be on the rise, although as he noted in his talk, “It may be press attention, or a feeling by victims that they have to come forward now… Or it could be an increase in the tempo of the attacks.”

––––––––––––––––

Digital Sandbox is the leader in public safety risk management, providing analytic tools and information products to government agencies and large enterprises for optimizing risk-based strategic, policy and budgetary decisions.

The recently released Implementation Plan for Presidential Policy Directive 8 (PPD-8) on National Preparedness makes some minor tweaks in emphasis as compared to the original PPD-8 Directive and introduces a few novel pieces of doctrine.

PPD-8, issued by the White House on March 30, replaces the 2003 Homeland Security Presidential Directive ( HSPD-8) on National Preparedness. The six-page Directive mandates the development of “a national preparedness goal that identifies the core capabilities necessary for preparedness and a national preparedness system to guide activities that will enable the Nation to achieve the goal. The system will allow the Nation to track the progress of our ability to build and improve the capabilities necessary to prevent, protect against, mitigate the effects of, respond to, and recover from those threats that pose the greatest risk to the security of the Nation.” The first edition of the National Preparedness Goal (NPG) must be completed by September 25 and a description of the National Preparedness System (NPS) is due by November 24.

Public reactions to the original Directive ran the gamut from supportive to highly critical. Our own analysis noted among other things a more detailed and nuanced treatment of hazards (subdivided into terrorism, “catastrophic” natural disasters, cyber attacks and pandemics); the addition to the Target Capabilities List of a fifth mission area – Mitigation – to augment the more familiar Prevention, Protection, Response and Recovery; and the first (if not entirely clear) formal use of the term “resilience.”

The 13-page PPD-8 Implementation Plan, issued as scheduled 60 days after the Directive, seems to elevate the role of regional, state and local jurisdictions in regards to risk when compared to the Directive, while at the same time somewhat de-emphasizing risk or at least decoupling it from the core capabilities necessary to prevent, protect against, mitigate the effects of, respond to and recover from the above-mentioned hazards. (This post will examine the emphasis on state/local jurisdictions while a subsequent post will look at the risk-capabilities question.)

There are several references in the Implementation Plan that point to a greater role for state and local governments as compared to the Directive. It is possible some of these are due to subjective word choices, but we don’t think so. For example, on several occasions the Directive mandates that the Department of Homeland Security (DHS) will “consult with State, local, tribal, and territorial governments, the private and nonprofit sectors, and the public,” and it also calls for “an all-of-Nation approach for building and sustaining a cycle of preparedness activities over time.”

The Directive also states that the NPS “shall be designed to help guide the domestic efforts of all levels of government” and “shall include recommendations and guidance to support preparedness planning for businesses, communities, families, and individuals,” so clearly all levels of government are involved. However, the Implementation Plan goes a step further when it says that the NPG “will respect and leverage the Nation’s Federal, State, local, tribal, and territorial governmental structures, maximizing preparedness through adaptability and decentralization.” The implications of the latter statement are unclear. Did the writers simply mean “recognize” when they said “leverage”? (Some people may point to the potentially politically-touchy states-rights issue here, but the tone of the plan does not support such an interpretation.) Moreover, stating that preparedness will be maximized through adaptability and (especially) decentralization represents novel policy, since the Directive does not mention any such strategy. Optimists could see this as a strong statement of support for state and local government; pessimists could perceive the seeds of shifting responsibility.

Another statement in the Implementation Plan that seems to elevate the perspective of regional and local governments regarding risk is as follows: “The core capabilities that make up the [NPG] will represent preparedness priorities that reflect Federal, State, local, tribal, territorial, and private and nonprofit sector perspectives on risk.” While this sounds admirably inclusive, we would note that the groups listed represent stakeholders whose perspectives and incentives are not always co-aligned. While the Directive calls on DHS to consult with these stakeholders (perhaps to understand their perspectives on issues such as risk and preparedness), promising to represent their priorities in the NPG may be tricky.

The third notable statement in the Implementation Plan is this: “The national risk assessment should build on and integrate current models and best practices to enable the national assessment to be applied regionally and on a local level, as appropriate and practicable.” While extending DHS’ risk assessment methods to the regional and local levels would provide tremendous benefit to government planners at those levels, such a goal may be unrealistic in the short term and an attempt to do so may limit the methods DHS might choose to employ at the national level. It may be telling that the Directive itself does not compel DHS to extend its risk approach to anything lower than the national level.

Although DHS has made several attempts to develop comprehensive risk methodologies, none to date has successfully provided comprehensive national coverage and local granularity. FEMA’s flood map project identifies flood zones for select communities in the U.S., but does not provide universal geographic coverage and in any event is only available for flood hazards. MSRAM, TRAM, MAST, and RAMCAP provide granular risk assessments but none has been implemented across the entire U.S. in all sectors. Likewise, the national-level risk approaches used within DHS, such as RAPID and the HSGP grant formulas, are insufficient to provide a local-level assessment of risks. And while the THIRA process mentioned in the Implementation Plan can be performed at any level of jurisdictional hierarchy, it is difficult to compare different THIRAs to one another.

Anyone who has developed both national- and local-level risk methodologies will be able to personally attest to the difficulty of trying to create a single methodology to be used at both levels. One requires deep knowledge, the other, broad knowledge. Given that in this area, at least, it is exceedingly difficult to be simultaneously deep and broad, DHS might have been better off sticking with the national level for a comprehensive risk assessment in this instance.

––––––––––––––––

Digital Sandbox is the leader in public safety risk management, providing analytic tools and information products to government agencies and large enterprises for optimizing risk-based strategic, policy and budgetary decisions.

State homeland security managers face an unprecedented challenge in 2011: doing as much or more as they have in past years, only with less money. We’ll find out soon enough how they are coping.

In the remaining four months of fiscal-year 2011, the Federal Emergency Management Agency (FEMA) will distribute $2.1 billion worth of preparedness grants to cities and states around the U.S., nearly a quarter less than last year’s allocation. The difficulty for grant recipients – especially those cut entirely from one or more of the programs – will be to maintain an acceptable level of core capability, but at lower funding levels that are also unlikely to rise any time soon given the current tight fiscal environment. Clearly, some hard choices lie ahead.

The majority of the grants are distributed under FEMA’s $1.4-billion Homeland Security Grant Program (HSGP), which comprises five interconnected subprograms, the two largest of which are the Urban Areas Security Initiative (UASI) and State Homeland Security Program (SHSP).

In our May 24 post we noted that FEMA allocations for the FY2011 UASI program will total $662.6 million, 20% less than the prior year, while the number of cities receiving grants has been cut from 64 to 31, all of them in the lower funding category known as Tier II.  Meanwhile, SHSP allocations to the 50 states, four U.S. territories, Puerto Rico and the District of Columbia, which we analyzed on May 20, will total $526.9 million, 37% less than was allocated in FY2010.

In this sixth and final installment in the series we step back and take a look at the aggregate financial impact of changes to these two major HSGP programs on states and cities, which presents a somewhat different picture of the funding winners and losers than we saw when analyzing each individual grant program. We then make some observations about how these changes might affect various states – in particular ongoing operations at their strategically important fusion centers.

Aggregate Impact on the States
Our UASI-focused analysis looked at the states that lost the most number of cities this year compared to what they had in FY2010. By that measure we noted that the three biggest losers were: New York, which lost four of its five; Texas, three of five; and California, three of eight. However, if one looks at the dollar amounts cut or losses as a percentage of UASI funding, the picture doesn’t look so dire. New York lost only $10 million (6%); Texas, $15 million (18%); and California, $13 million (8%). The only entities to do better than that this year, as a percentage of FY2010 UASI funding, were Washington DC, Illinois, New Jersey and Massachusetts – four states that lost no UASI money because their cities were in Tier I rather than Tier II.

For gloomier scenarios, consider Connecticut (who’s Senator, Joe Lieberman, is Chairman of the Homeland Security Committee, which did little to ease its fate), Louisiana, Oklahoma or Tennessee, each of which had two UASIs in FY2010, funded at an average of $7 million, but which are now entirely out of the UASI program. Or consider Missouri (which lost Kansas City and saw a 30% cut to St. Louis) or Ohio (which lost Columbus and Toledo and saw 30% cuts to Cleveland and Cincinnati). Although these two states each lost about $10 million like New York did, that represented a much bigger percentage chunk of their overall UASI funding: 63% in Missouri’s case and 57% in Ohio’s, compared to 6% for New York.

From a purely UASI perspective, perhaps the worst off is Florida. It lost more UASI money than any other state this year: $16.6 million. It also lost one UASI city outright (Jacksonville), was forced to consolidate two others into one (Miami and Fort Lauderdale) and suffered approximately 30% cuts to each of its remaining two UASIs (Tampa and Orlando). It will require significant effort simply to implement the structural changes these cuts will require, and the Sunshine State must now do so with roughly half the UASI funds it had last year.

The overall state picture is further clarified by looking at the major SHSP trends. As we noted on May 20, one of the informal rules governing the SHSP funding distribution process this year appears to have been to spare New York, California, Illinois and Washington DC the 50% cuts that hit 19 other states. New York was already the biggest SHSP winner in getting cut just under 20% from its FY2010 levels – the smallest decline of any state or territory – while Illinois fell 38%. California may have suffered the largest dollar loss overall but its percentage loss was a fairly mild 32%. Contrast those SHSP cuts with Florida and Texas, which both fell 50%, as did four of the other six states mentioned above as being already hard-hit hit by UASI cuts: Tennessee, Louisiana, Missouri and Ohio.

In the aggregate, when one examines both funding lines as if they were a single unit, the broad trends become clear. The states that have emerged relatively unscathed in terms of percentage cuts from UASI/SHSP are New York (12%), Illinois (14%), California (18%) and New Jersey (19%). In the middle with more substantial cuts are Pennsylvania (27%) and Texas (31%). And the one state that now clearly emerges as having suffered the biggest hit of all is Florida, with a whopping 48% decline in its aggregate funding from these two largest HSGP programs. (Click on the expandable bar chart below for a graphical depiction of how these seven states fared in the combined UASI/SHSP funding environment.)

Effects on Fusion Centers
Among the biggest beneficiaries of FEMA grant money are the fusion centers (FEMA grants also represent by far the largest percentage of the centers’ funding, with much smaller amounts coming from the Department of Justice, the Drug Enforcement Administration and elsewhere). With the recent addition of Milwaukee, there are now 73 fusion centers around the U.S. Each of the 50 states has one state-wide center (as do the District of Columbia and Puerto Rico), and some of the larger cities and regions also have their own, including Los Angeles, Boston, Chicago, the Delaware Valley, Southeastern Florida and Northern Virginia.

In light of the funding trends described above, there are serious questions to be raised about how much money some states will have left this year to fund the 52 state-wide fusion centers. States get to keep 20% of both SHSP and UASI funds at the state level, and the bulk of remaining SHSP funding must flow down to local agencies. With SHSP down 37% and many states getting zeroed out of the UASI program, there are likely some difficult times ahead for any number of states. Among others we would highlight Florida, Ohio, North Carolina, Louisiana, Indiana, Tennessee, California, Wisconsin and Missouri. States running fusion centers in Tier-II cities that have been dropped from the UASI program and/or have taken a big hit in their SHSP funding will struggle particularly hard to fund these centers. Also vulnerable are those areas where two nearby centers could be merged to save money.

The fusion centers have been very much a priority focus at the Department of Homeland Security (DHS) over the past couple of years, and their missions and capabilities are clearly of local, regional and national importance. The question now is how can they maintain their functions on much smaller budgets. In fusion centers, DHS has been building a system that is critical to U.S. national security, and it will be vital to ensure first and foremost that the centers maintain their longer-term strategic focus on region-wide issues like terrorism preparedness despite pressures to become absorbed in more mundane day-to-day operational matters. Equally important will be maintaining a sufficient number of centers to ensure all-hazard preparedness in regions beyond the largest urban areas.

We also wonder what FY2012 has in store for the fusion centers, the UASI cities and the states. The current fiscal year was foreshortened due to ongoing congressional fights that delayed final passage of the federal budget until April 15 (which incidentally caused additional financial pain at the state and local levels as none of the grant money could be distributed). Now the FY2012 budget approval deadline, ostensibly October 1, is fast approaching, and all indications are that the reduced funding levels of FY2011 will be the new normal. If that’s the case, will the Tier-II cities dropped from the UASI program or the states that saw their SHSP funding cut ever attain their former grant levels again? And if not, what is to become of the 73 fusion centers in particular, and state and local homeland security capabilities more generally, over the long haul?

It is virtually certain that some consolidation will have to occur, but even then it will take a great deal of ingenuity to maintain effective capabilities with smaller or non-existent budgets. As English physicist Lord Rutherford is said to have told his research colleagues a century ago after a particularly bruising budget battle: “Gentlemen, we’ve got no money, so we’ve got to think.”

––––––––––––––––

This is the sixth and final installment of our analysis of the Federal Emergency Management Agency’s FY2011 homeland security grant programs, including comparisons with prior-year funding, assessments of how key grant programs will be distributed and analysis of the broader impact of major FY2011 grant program allocations on states and cities. Here’s a recap and links to the earlier installments:
Part 1 – Series introduction and analysis/estimates of SHSP funding
Part 2 – Analysis/estimates of UASI funding
Part 3 – Analysis/estimates of Transit Security Grant Program (TSGP) funding
Part 4 – Analysis of actual SHSP appropriations/allocations for FY2011
Part 5 – Analysis of actual UASI appropriations/allocations for FY2011
––––––––––––––––

Digital Sandbox is the leader in public safety risk management, providing analytic tools and information products to government agencies and large enterprises for optimizing risk-based strategic, policy and budgetary decisions.

Amid much press reporting on the soon-to-be-unveiled Department of Defense (DoD) cybersecurity strategy, The Wall Street Journal has zeroed in on a critical aspect of the plan: “The Pentagon has concluded that computer sabotage coming from another country can constitute an act of war, a finding that for the first time opens the door for the U.S. to respond using traditional military force.”

Establishing an explicit linkage between the cyber and the physical, from the standpoint of both threats and responses, is to be applauded. We wrote in these pages last summer that conflicting approaches to these two types of threats have represented a critical shortcoming, and that recasting such threats as basically “two sides of the same coin” will open the door to more effective responses, not to mention improved sharing of the best practices that both security communities bring to the table.

What’s equally intriguing – and encouraging – about this strategic nod to the notion of convergence between the two realms is that the government appears prepared to get its collective head around prioritizing the value of cyber assets in the same manner it currently applies to physical assets, perhaps taking its cues from the framework DoD uses to value defense industrial base assets or the one the Department of Homeland Security (DHS) created for each of its 18 critical infrastructure/key assets (CIKR) sectors.

The number of attacks occurring daily against corporate and government IT systems can sometimes appear overwhelming, and it increases the danger of a disproportionate – and therefore ineffective – response, one that attempts to “boil the ocean” rather than focusing on protecting the most vital assets based on an assessment of the consequences of their degradation or destruction. The latter is a fundamental tenet of security risk management, and it’s encouraging to see the principle being applied by DoD strategic planners.

The new strategy also reportedly introduces the related notion of “equivalence” in shaping a U.S. response to a cyber attack, which the Journal calls an idea that is “gaining momentum at the Pentagon… If a cyber attack produces the death, damage, destruction or high-level disruption that a traditional military attack would cause, then it would be a candidate for a ‘use of force’ consideration, which could merit retaliation.” The Journal quotes a DoD official this way: “If you shut down our power grid, maybe we will put a missile down one of your smokestacks.”

The full Journal article is here.

––––––––––––––––

Digital Sandbox is the leader in public safety risk management, providing analytic tools and information products to government agencies and large enterprises for optimizing risk-based strategic, policy and budgetary decisions.