Homeland Security Watch

News and analysis of critical issues in homeland security

December 11, 2014

Resilience by Design

On Monday the Mayor of Los Angeles released a report entitled Resilience by Design.  It gives particular attention to how Los Angeles can take steps now to mitigate the consequences of major risks, especially an earthquake.

This is the kind of document that — too often — only appears after a major event.  It is significant that one of the first steps Mayor Garcetti took upon his election was appointment of a Science Advisor for Seismic Safety and tasking her to undertake this analysis.

The report gives particular attention to:

  • Resilience of building stock — It is interesting that this is treated as a matter of economic resilience as well as public safety.
  • Resilience of the water system — This is what worries me most regarding the vulnerability of the Los Angeles basin.
  • Resilience of the telecommunications systems — This is a key interdependency that can divide or multiply every other response and recovery capability.

There are, obviously, other crucial problems.  But too many of these kind of studies try to take-on too much.  If everything is a priority, really nothing is a priority.

These are three strategic elements within the ability of city government to seriously engage.  Enhancing the resilience of these three elements will improve the ability of the city and the whole community to address other challenges.

See the full report here.

November 5, 2014

RIP Former Boston Mayor Thomas Menino: The Public Health Mayor

This week Boston laid to rest it’s longest serving mayor, Thomas Menino.  He served as mayor in Boston for 20 years.  Yes. That’s right.  Twenty years.

To his admirers he was known as the “Urban Mechanic,” as the Boston Globe describes, ”leaving to others the lofty rhetoric of Boston as the Athens of America, he took a decidedly ground-level view of the city on a hill, earning himself a nickname for his intense focus on the nuts and bolts of everyday life.” To some of his detractors (and even his supporters) he was referred to as “Mumbles,” for his less than soaring rhetorical skills.

This humble man from the Hyde Park neighborhood of Boston rose to national prominence, with former President Bill Clinton paying his respects before the funeral procession and Vice President Joe Biden attending the ceremony. Impressive for a politician recognized to have no political ambition beyond running his city.

What does this have to do with homeland security? For some time I’ve heard from various colleagues that preparedness, particularly health-related preparedness, had an unusual amount of political support in Boston. Public health and EMS were not simply the minor leagues to law enforcement and fire service major league players. But it became vivid when I read the following description from a food-orientated homage to Mayor Menino from The Atlantic food critic Corby Kummer:

But aside from the coddling and special treatment any mayor who shows up gets, Menino cared about food for exactly the reasons today’s food-movement activists do, and long before it was fashionable to embrace what food can and should mean: access to fresh produce for everyone of every income level; gardens as ways to unite and repair communities; and, most importantly, fresh food as a route to better health. The mayor told everyone, including his biographer, longtime Atlantic senior editor Jack Beatty, that he wanted to be remembered as “the public-health mayor.” That made him work particularly closely with my spouse, John Auerbach, who served 10 years as Boston’s health commissioner. 

So….apparently I missed this self-appointment.  After the fact it was easy to find further evidence of Menino’s interest in public health.  See the videos I’ve posted below.

Again, how is this related to homeland security? Two points that at least I think of are interest. 

 

A lot, if not the majority, of public health work does not seem to fall into the category of homeland security. Expanding access to fresh produce in low income communities, anti-smoking efforts, childhood vaccination campaigns, etc.  It’s not always about responding to the next Ebola outbreak.  Yet when taken as a whole, improving the health of the community in general improves overall resilience.  Healthy people fare better during and following disasters than unhealthy ones.  People with access to health insurance are more likely to visit a primary care doctor than the emergency room for common maladies, thereby not taking up vital resources during events like the Boston Marathon bombing. A healthier community is a more resilient community.

Menino’s attention to public health underscores the importance of political leaders in homeland security. I have often heard professionals complain about meddling politicians (along with the annoying press) and how events can be run more smoothly when they are absent.  Yet not only do they play an important role in communicating with the public during and following disasters, they make or influence the choices made in a community before there is a bad day.  Menino’s focus on public health not only improved the overall health of Bostonians, but contributed to the competence exhibited during the response to the Marathon bombing, from the existence of a Medical Intelligence Center to the cooperation between city agencies such as Boston EMS and Public Health with the private hospital systems.

It is comparing apples and oranges, but in thinking about this I could not help but contrast Boston’s situation with that of New York City.  Size and resource issues aside, NYC has spent the most energy on security instead of general preparedness since 9/11.  I am not arguing that there has not been a lot of resources directed towards preparedness and response activities and organizations, only that it is lacking when compared with the radical changes enacted in the NYPD and other agencies charged with preventing a terrorist attack. I think I could make the case that Boston, under Menino’s leadership, took a more all hazards approach while NYC, under Mayors Giuliani and Bloomberg, remained primarily focused on terrorism. That is not a value judgement, but simply an observation.

If you are interested, the following video highlights many of Mayor Menino’s accomplishments in public health.  From the Boston Public Health Commission (which Menino created in 1996):

 

If you have a little more time, here is a longer discussion held at Harvard’s School of Public Health with Menino shortly after he left the Mayor’s office.  For those more security minded, at the beginning of the discussion he is asked and replies with a lengthy description of his point of view about the events surrounding the Boston Marathon bombing.

 

 

 

October 16, 2014

Adjusting our signal to noise ratio

I am currently involved in planning three different tabletop exercises.  Each are efforts to enhance “whole community” involvement.  My particular role is to enhance private sector involvement.  Currently the news media is not targeted for participation in any of these exercises.  In my several years of being involved with various homeland security training and exercises I can only recall two occasions when news media have been involved as participants.

There are several impediments to involving news media in these sort of activities, including:

  • Effective exercises are designed to expose gaps and shortcomings in order to improve preparedness.  News media are inclined to expose gaps and shortcomings in order to increase readership/listeners/viewers.
  • Many public sector participants tend to be “authoritative” or “officious” or “control-freaks”.  This is troublesome enough with other private sector participants.  With members of the media it can be explosive.
  • News media participation can discourage the involvement of other private sector parties due to fear of exposure (see first bullet).

But it seems to me increasingly clear we must find a way to involve news media in preparedness activities or continue — and deepen — the risk of serious mis-communication and public mistrust on the very worst days.  While major media are no longer the only or even primary sources of information, they are a significant source of amplification and confirmation.  Too often they are amplifying and confirming misleading information.  An ongoing example:

The media’s attention to symptoms can obscure attention to the source of problems.  I am astonished by the extraordinary attention given to a few instances of Ebola in the United States in contrast with lack of attention to sources of the problem in West Africa… despite clear and consistent and, at least to me, very reasonable analysis that until the source of the problem is better managed the risk to the United States will only grow.

On Tuesday afternoon the United Nations coordinator for Ebola response told the Security Council that the world basically has sixty days to contain the virus or face a serious risk of pandemic.  In much of the world, this was the Wednesday morning headline.  Not in the United States.

Below are two screenshots.  The first is for the Google News US edition.  The second is for the UK edition.  According to Google, “articles are selected and ranked by computers that evaluate, among other things, how often and on what sites a story appears online.”  The source stories can be found in US media, but too often buried beneath the symptoms.

Google US edition

UK edition

In my judgment a similar symptom vs. source issue is endemic to most US media coverage of terrorism, urban wildfire, flooding, and many aspects of border security.  It even erupts in how longer-term electrical outages are reported.

I am not arguing against news coverage of symptoms.  The attention given to the series of false steps in Dallas has clearly facilitated enhanced readiness across the US health System. But these are tactical –symptomatic — issues, not strategic issues addressing the problem at its source.

When novel and especially deadly threats emerge, the failure to distinguish between symptom and source is at least distracting and too often misleading… in a manner that can undermine public health and safety and, certainly, competence.  Sources can be even more complicated to understand than symptoms, but this further underlines the need for insightful media coverage.

There are very few editors, producers, or reporters who can afford to specialize in any of the so-called “low-probability, high-consequence” risks that confront us.  That’s a problem for most of the private sector and across the public sector as well.  We all need help adjusting our standard-operating-procedures to these non-standard events.  We should start to do so in workshops and exercises before the symptoms explode.

Some possible discussion topics and exercise issues:

In dealing with “high-intensity-risk-environments” (HIRE), do not mistake ambiguity for inattention.  Recognizing ambiguity may be evidence of close attention.

In engaging a HIRE, do not confuse uncertainty with incompetence. The compulsion to sound certain in the midst of complexity is, in my opinion, a principal cause of incompetence.

In the midst of a HIRE, complexity and lack of control does not necessarily signal lack of organization or progress.  Efforts to control can escalate complexity and suppress resilient self-organization.

In a few months I should be able to let you know if I am successful in involving media in any of the exercises currently being planned.

–+–

And since I’m writing about attention to sources as well as symptoms, in regard to Ebola here are some potentially helpful sources on sources:

FrontPageAfrica – A Liberia based newspaper. (BTW, this is not the largest circulation Liberian newspaper, but some of its competitors have, in my opinion, their own serious noise-vs-signal problems.)

The Concord Times – A Sierra Leone based newspaper.

The Telegraph – A Sierra Leone based newspaper.

Doctors Without Borders Guinea News

Guinea (Conakry) Guinee Focus (French)

World Health Organization Africa Regional Office

US Department of Defense Africa Command

CDC Ebola Hub

Resources from the London School of Hygiene and Tropical Medicine here and here and here  (and it’s worth looking for more)

FRIDAY UPDATE:

Thursday evening NPR broadcast an interview with Dr. Lewis Rubinson.  An intensive care physician with the University of Maryland Medical Center, Dr. Rubinson spent three weeks in September serving Ebola patients in Sierra Leone.  The full interview (with transcript) is, I suggest, a good example of well-informed, realistic thinking about dealing with symptoms.  Following is an excerpt:

RUBINSON: There are nearly 6,000 hospitals in the U.S. It wouldn’t have made sense to me that every single facility would have the ability to be honestly prepared. It doesn’t mean that there doesn’t need to be an appropriate level of the ability to identify patients and provide early treatment and keep staff safe. I think that’s really on every institution because we can’t control where patients present. But I think out in West Africa, we got very, very good at being 100 percent all of the time. You had to. In the U.S. there’s no technological fix for this. We can’t buy a widget and just solve it and give it to the hospital and say, you’re prepared right now. Most of this is about diligence, it’s about discipline and it’s about 100 percent adherence. And I think, again, that’s very hard to imagine that every facility could do that. Not because they aren’t good facilities, it’s just there are other priorities that they need to be taking on at the same time. Again, every facility needs to be able to identify the patient, take care of the patient early, keep the staff safe, but I think it’s very hard to imagine that every facility would be good at managing a patient throughout their course of the disease, especially if they get very sick, like had happened in Dallas.

MORE

SECOND UPDATE:

In regard to sources rather than symptoms, here’s “top of the fold” attention being given British operations in West Africa.  According to Friday’s Telegraph,

Ebola is the “biggest health problem facing our world in a generation”, David Cameron has said, as he urged foreign leaders to “step forward” with more resources to fight the crisis.

The Prime Minister urged other leaders to “look to their responsibilities” to help tackle the Ebola epidemic ravaging parts of West Africa… 

He said: “Britain, in my view, has been leading the way. The action we are taking in Sierra Leone where we are committing well over £100 million, 750 troops, training 800 members of health staff, providing 700 beds; we are doing a huge amount.

“I think it is time for other countries to look at their responsibilities and their resources and act in a similar way to what Britain is doing in Sierra Leone, America is doing in Liberia, France is doing in Guinea.

“Other countries now need to step forward with resources and action because taking action at source in West Africa is the best way to protect all of us here in Europe.”

MORE

October 9, 2014

Retrospectively, it is often so clear

The Ebola outbreak is, almost certainly, a precursor for a future pandemic that will be much worse.

The current California drought is, almost certainly, a precursor of more to come.

The recent series of cyber-attacks are, almost certainly, a precursor of many more — and much worse — to come.

The intention of Australian terrorists to undertake random attacks is, almost certainly, a precursor for such attacks there and elsewhere.

In each case a current threat-vector is amplified by human behavior, especially increased population density and mobility.  Ebola is naturally occurring. Until the last four decades its natural range was isolated from humans and, especially, human networks.  Drought is naturally occurring in the American West and Southwest. Until the last six decades, this region was sparsely populated. Never before has so much monetary value been so concentrated and (at least virtually) proximate. Violence is naturally occurring in human populations, its mimetic mutations now facilitated by many more of us in communication, contact, and perceived competition.

In the case of Ebola, the rapidly increasing population of Guinea (Conakry) —  up 220 percent since 1960 —  has created substantial ecological and economic stress.  This has been especially the case in the forested uplands of Eastern Guinea neighboring Liberia where the current outbreak first emerged.  With about 70 people per square kilometer this region has twice the density of the Virginia county where I live.  It’s less than 300 miles to Monrovia, the capital of Liberia, which has a population density of 600 per square kilometer.  No wonder Monrovia has been hit so hard.

Macenta Epicenter

We don’t know precisely when or how the virus was transferred to humans in this epidemic, but consumption of bushmeat infected with the virus is a good guess.  That has been the origin in several previous — but much smaller — outbreaks in Congo and Gabon.

Mid-March is when I first read about what has unfolded into the Ebola outbreak:

(Reuters) – An outbreak of hemorrhagic fever has killed at least 23 people in Guinea’s southeastern forest region since February when the first case was reported, health authorities in the West African nation said on Wednesday.

At least 35 cases have been recorded by local health officials, said Sakoba Keita, the doctor in charge of the prevention of epidemics in Guinea’s Health Ministry.

“Symptoms appear as diarrhea and vomiting, with a very high fever. Some cases showed relatively heavy bleeding,” Keita said.

“We thought it was Lassa fever or another form of cholera but this disease seems to strike like lightning. We are looking at all possibilities, including Ebola, because bushmeat is consumed in that region and Guinea is in the Ebola belt,” he said. No cases of the highly contagious Ebola fever have ever been recorded in the country. (March 19)

Well into summer I assumed this Ebola outbreak would be contained as others have been contained.  I neglected to notice that this  time the threat had emerged in a region much more densely populated than previous outbreak zones (and with much easier access to even more densely populated areas).  I overestimated the vigilance and capacity of the World Health Organization. I underestimated the power-amplifiers of human need and social interaction and fear… multiplied exponentially as the vector penetrates more deeply into the matrix.

This is how it happens.  Prior success encourages undue confidence.  And maybe you’re  a bit distracted. The threat morphs and emerges into — then out of — a different context.  So it may not initially be recognized. The critical contextual cues are unnoticed.  The threat is given time and space to strengthen.  This is especially likely to happen with places or people already neglected.

What worked last time is not quite calibrated with the new context.  Besides, for many of those engaging this threat, this is their first time.  Former lessons have not been learned, are being re-learned.  This threat in this place is in many respects unique — at least in the experience of those who confront it this time.

It is a threat that, if recognized early-on, might be quickly suppressed or contained. But instead it proliferates, filling the void opened by neglect. Thus amplified the threat is much more likely to find and exploit vulnerabilities; even those that until the threat’s  emergence were seen as strengths. Which is typically how tragedy unfolds, when what had been strong makes us weak.

August 20, 2014

William Cumming on emergency management as an organizational process in governance

Filed under: General Homeland Security,Organizational Issues,Resilience — by Arnold Bogis on August 20, 2014

Long time (perhaps the longest?) HLSWatch commentator William Cumming has a guest blog up on Eric Holdeman’s Disaster Zone blog. And he doesn’t nibble around the edges:

Increasingly, I am supportive of the notion that emergency management is not a contrived subject or profession but in fact underlies much of organizational process that leads to various forms of governance.

I’m not sure if I accept this notion, but it is a big idea. However, I do think his opinion on the use of the military in most other nations for emergency management responsibilities is an important insight.

Well in my opinion, emergency management is the worst form of organizational response to crisis management and resilience (that includes elements of preparedness, planning, prevention, protection, mitigation, response and recovery) except all others. What alternative choices are there?

One big one is a military command and control system that actually can prevent effective collaboration and cooperation, whether among individuals, NGOs, governments or other spontaneously developing post-disaster organizations. Since more than 90 percent of the nation-states have vested their EM function in their military, organizationally designed to inflict maximum organized violence on some other group or nation-state, I find that this approach is largely vested in a leadership’s desire for control and resurrecting the status quo ante. These factors are not absent from emergency management but seem more likely not to dominate when the civil sector is dominate.

He goes on to provide five building blocks for emergency management going forward.  Please see Holdeman’s blog for the full text as it is well worth your time to read. It is also worth pointing out here his summary:

In summary, perhaps the system of emergency management must promote collaboration and cooperation so that the system is supportive of the best resilience. And while individual brilliance will from time to time appear and needs to be utilized, systems and processes must reflect the collective wisdom of those involved with the emergency management process in any crisis or disaster.

What I like here is the focus on process and system.  Often, at least it seems to me, leadership development and education is held up as the holy grail of homeland security development.  I believe Bill is pointing out that while when you get exceptional, or even adequate, leadership good things follow but the most important thing is to develop an overall system within which best practices are developed, shared, and implemented.

August 14, 2014

Resisting soccer-moms, embracing black swans, and expecting the unexpected

Filed under: Catastrophes,Preparedness and Response,Resilience,Risk Assessment,Strategy — by Philip J. Palin on August 14, 2014

Last week a regular reader and thoughtful commentator observed:

Black Swans are better ignored until their arrival – cynically, it reduces expectations for preparedness, responsibility and accountability if you do not acknowledge the possible threat.

Given the context of this individual’s commentary over the years I do not take this as cynical. At least in the modern use of cynic: “a person who believes that only selfishness motivates human actions and who disbelieves in or minimizes selfless acts or disinterested points of view.”

Rather, I hear irony: “the mildly sarcastic use of words to imply the opposite of what they normally mean.” I hear an encouragement to greater preparedness, responsibility and accountability.

If I have misheard, s/he — probably he — will correct me.

By definition Black Swans cannot be accurately predicted.  As a result they are not well-suited to tactical planning.  At least not if plan-execution is your goal. But assiduously working through strategic scenarios with tactical details can be helpful to expose preparedness issues. This is especially the case if tactical planning is consistently framed and facilitated to achieve strategic purposes.

Too often organizations are tempted to treat planning documents as operational algorithms, something that — with enough resources and training  – will unfold per specifications and achieve each outcome.

In disaster preparedness, involving black or white swans, this is self-deluding.

Lee Clarke has famously and persuasively called such plans: “Fantasy Documents.” He writes, “When uncertainty about key aspects of a task is high, rationalistic plans and rational-looking planning processes become rationality badges, labels proclaiming that organizations and experts can control things that are, most likely, outside the range of their expertise.”

This is hubris: “an excess of ambition, pride, etc, ultimately causing the transgressor’s ruin.”

Bill, Claire, others: Are there longitudinal studies of the personality types attracted to Emergency Management?  Especially planning folks?  I am familiar with a study of the Clark County (Las Vegas, NV) Fire Department that I tend to project on the homeland security professions.  It found more than three-quarters of CCFD personnel testing with a strong SJ temperament on a Myers-Briggs type instrument.

Those with SJ temperaments are often called “Guardians” or “Protectors”.  According to Dr. David Keirsey: ”Practical and down-to-earth, Guardians believe in following the rules and cooperating with others. They are not very comfortable winging it or blazing new trails; working steadily within the system is the Guardian way, for in the long run loyalty, discipline, and teamwork get the job done right. Guardians are meticulous about schedules and have a sharp eye for proper procedures. They are cautious about change, even though they know that change can be healthy for an institution. Better to go slowly, they say, and look before you leap.”

This personality type is especially well-suited for many aspects of public safety and disaster response.  But Black Swans are seldom tamed by following the rules and working steadily within the system.

Unless — I suggest — the rules and system are developed to anticipate Black Swans, to expect the unexpected and to develop the cognitive and organizational capabilities to critically and creatively engage the unexpected.

Nassim Nicholas Taleb drew on David Hume to popularize our current notion of Black Swans.  In his 2012 book Antifragile Taleb tells us:

The biologist and intellectual E. O. Wilson was once asked what represented the most hindrance to the development of children; his answer was the soccer mom… Soccer moms try to eliminate the trial and error, the antifragility, from children’s lives, move them away from the ecological and transform them into nerds working on preexisting (soccer-mom-compatible) maps of reality. Good students, but nerds–that is, they are like computers except slower. Further, they are now totally untrained to handle ambiguity. As a child of civil war, I disbelieve in structured learning… Provided we have the right type of rigor, we need randomness, mess, adventures, uncertainty, self-discovery, near-traumatic episodes, all those things that make life worth living, compared to the structured, fake, and ineffective life of an empty-suit CEO with a preset schedule and an alarm clock.

Rigorous random near-traumatic episodes sound like the sort of “content” that many of the personality types drawn to public safety and emergency management would welcome.  This is the kind of learning that encourages us to expect the unexpected and develop the skills to engage the unexpected.

When was the last time you participated in a table-top or exercise that you would describe as rigorous random near-traumatic?  Have you ever participated in a planning process that could be described with these terms?  Too many planners and trainers and, increasingly, managers (self-styled leaders) are really just soccer-moms in disguise.

June 26, 2014

QHSR: Translating the archetypes (especially anima/animus)

Filed under: Preparedness and Response,Private Sector,Resilience,Strategy — by Philip J. Palin on June 26, 2014

FRIDAY, JUNE 27 EDITORIAL NOTE:  The Friday Free Forum is on vacation this week, luxuriating in the quiet of a cool mountain glade beneath a sweep of stars, seeking to reclaim social and spiritual equanimity.  You are invited to join the QHSR discussion that is already underway below.

–+–

ORIGINAL THURSDAY POST:

How do we anticipate what we cannot predict?  That question animates the Quadrennial Homeland Security Review. Strategy generates benefits to the extent it accurately anticipates.  An effective strategy generates an initial — sometimes persisting — advantage in dealing with whatever specific challenges unfold unpredictably.

The QHSR is a bureaucratic document. This description is not meant as pejorative.  There are various DHS components, other national security agencies, White House and Congressional concerns, and many other stakeholders.  While the QHSR wants to accurately anticipate, it is not a prophetic text.  Rather than speaking truth to power, this is power in search of truth.  It can be cumbersome.

Meaningful interpretation recognizes the limitations — and opportunities — of the bureaucratic genre.  Much must be said. Where have the authors moved beyond the minimum requirements? Bureaucracies tend toward girth, but are sensitive to hierarchy.  What or who is given more attention?

The QHSR reviews previous challenges and outlines what it considers important shifts in the risk environment.  It gives particular priority to the following (page 28):

  • The terrorist threat is evolving and, while changing in shape, remains significant as attack planning and operations become more decentralized. The United States and its interests, particularly in the transportation sector, remain persistent targets.
  • Growing cyber threats are significantly increasing risk to critical infrastructure and to the greater U.S. economy.
  • Biological concerns as a whole, including bioterrorism, pandemics, foreign animal diseases, and other agricultural concerns, endure as a top homeland security risk because of both potential likelihood and impacts.
  • Nuclear terrorism through the introduction and use of an improvised nuclear device, while unlikely, remains an enduring risk because of its potential consequences.
  • Transnational criminal organizations are increasing in strength and capability, driving risk in counterfeit goods, human trafficking, illicit drugs, and other illegal flows of people and goods.
  • Natural hazards are becoming more costly to address, with increasingly variable consequences due in part to drivers such as climate change and interdependent and aging infrastructure.

Lots on the plate even here.  But these six risks are segregated from the rest. There is also a full page text-box highlighting Black Swans.  Words are carefully chosen to avoid accusations of being alarmist, but the visual rhetoric is emphatic. When push comes to shove, here are the risks  that this QHSR seems intent to especially engage.  How?

At different places in the document (especially page 16 and again in the conclusion) the following “cross-cutting” strategic priorities are articulated:

  • An updated posture to address the increasingly decentralized terrorist threat; 
  • A strengthened path forward for cybersecurity that acknowledges the increasing interdependencies among critical systems and networks; 
  • A homeland security strategy to manage the urgent and growing risk of biological threats and hazards; 
  • A risk segmentation approach to securing and managing flows of people and goods; and 
  • A new framework for strengthening mission execution through public-private partnerships.

What does “updated posture” mean?  Read pages 33-38. Compare and contrast with QHSR vers. 1.0 and your own counter-terrorism experience.  There are others better able to read-between-these-particular-lines.  I hope you will do so in the comments.

The attention to biological threats is not new, but concerns related to pandemic are even more acute. (“Of the naturally occurring events, a devastating pandemic remains the highest homeland security risk.”)  Urgent and growing are almost prophetic terms.  But once again, others are better prepared to give you the close-reading of how we are to be biologically battle-ready.

In my reading the most notable shift in this QHSR, and on which the rest of this post will concentrate, is the priority given so-called public-private partnerships (which I strongly recommended be amended to “private-public relationships”).

I perceive this enhanced priority emerges from a confluence of cyber-threats, disaster-management, and catastrophe preparedness.  In each of these domains the public good largely depends on private sector capacities and potential collaboration between private and public.

Flows of people and goods are given significant analytic attention. Flow-of-goods is treated mostly as a matter of economic security.  In time of significant crisis this is also the source-of-life.  The capacity to maintain a sufficient flow resides almost entirely with the private sector. In case of crisis, the public sector may be able to lead.  But in many cases the public sector will do better to follow and support.  Sometimes the best possible is for the public sector to get out of the way.  The latter alternative is most likely when there has been minimal private-public efforts in joint preparedness.  Leading or supporting require much more joint engagement than currently anticipated.

Being strategically prepared to — depending on context — lead, follow or get out of the way does not come easily.  Even the insight is atypical.  In advancing this insight the QHSR is making a potentially major contribution to safety, security and resilience.

Here is how the QHSR frames the issue (page 60):

At a time when we must do more with less, two guiding principles help public-private partnerships maximize the investment by each partner and the success of the partnership: (1) aligning interests and (2) identifying shared outcomes.

By focusing on how interests align, we can provide alternatives to costly incentives or regulations and help ensure a partnership is based on a solid foundation of mutual interest and benefit. There are many examples of public and private sector interests aligning in homeland security. Common interests include the safety and security of people and property, the protection of sensitive information, effective risk management, the development of new technology, reputation enhancement, and improved business processes. New ways of thinking about corporate social responsibility—in which societal issues are held to be core business interests rather than traditional philanthropy—also present an opportunity to identify shared interests.

Where interests do not directly align, potential partners can often be motivated by shared desired outcomes, such as enhanced resilience; effective disaster response and recovery; and greater certainty in emerging domains, such as cyberspace and the Arctic.

Aligning interests and identifying shared outcomes are absolutely a big part of effective collaboration.  But behind this reasonable rhetoric is a complicated, often treacherous cross-cultural tension.  I once spent a few years brokering decision-making between Japanese and Americans.  The intra-American — and perhaps global — private-public cultural divide is at least as profound.

The QHSR helpfully identifies five “archetypes” for framing relationships between private and public (see page 60-61).  A “Partnerships Toolkit” has also been developed.  All of this is potentially constructive.  When DHS folks started talking to me about archetypes I immediately thought of Jungian archetypes.  This matches my sense that to really work together private and public will usually require the institutional equivalent of long-term joint counseling.  But this analogous leap seemed to make some of my DHS colleagues uncomfortable.

Some were even more uncomfortable when I suggested private/public is the equivalent of the anima/animus archetype. C.G. Jung wrote, “The anima gives rise to illogical outbursts of temper; the animus produces irritating commonplaces.”  I’ll let you guess which I associate with private and which with public.

But C.G.’s most important insight regarding these contending archetypes is that each depends on each, each is fulfilled in relationship with the other, and robust elements of both are required for ongoing creativity and growth.  The recurring clinical problem is an inclination to diminish, suppress or oppress one or the other.

In the life of an individual failure to meaningfully engage both anima and animus is self-subverting and can become tragic.  Our current failure to effectively engage private and public presents a similar social threat.  To suggest why — in less than another thousand words — here’s yet another analogy:

I happened to be reading about the Battle of Austerlitz when the QHSR was released last week.  In the summer of 1804 the British Prime Minister, William Pitt, accurately anticipated Napoleon’s expansionist ambitions.  He effectively forged a strategic alliance with Austria-Hungary, Russia, and Sweden. In October 1805 the British Fleet soundly defeated a combined French and Spanish naval force at Trafalgar.  It was the right strategy and the strategy was proving effective. But then in early December on a cold fog-drenched Moravian bottom-land the entire strategy unraveled.  Europe was, once again, transformed.

There are many reasons for the Third Coalition’s failure at Austerlitz. My particular author focuses on a clique of over-confident young nobles around the Russian Czar who seriously underestimated the practical requirements of deploying two emperors and their very different armies into actual battle.  The practical requirements of a national capacity for effective private-public collaboration in crisis are much more complicated.

The QHSR has articulated the right strategy.  We will undermine the strategy by minimizing challenges involved in making the collaboration operational.

On July 16 there will be an early signal of our operational readiness and sophistication.  That’s when new applications for the Homeland Security National Training Program: Continuing Training Grants are due.  This includes Focus Area 4: Maturing Public-Private Partnerships.  Will be interesting to see what’s submitted.

Brian, please be very cautious of any proposals received from twenty-something Russian princes.

April 21, 2014

“We were Boston Strong, because we were Boston Ready”

Filed under: General Homeland Security,Resilience,Terrorist Threats & Attacks — by Arnold Bogis on April 21, 2014

Today, nine thousand more people are running the Boston Marathon than last year.  Officials expect over one million spectators – roughly double the average. Hotels have been booked for months, and people looking to volunteer have been turned away for weeks due to the crush of applicants.

I take a couple of points away from this and all the other outpouring of support for today’s race, runners, and the Greater Boston area:

  • To steal NSFW terminology from Big Papi, this is basically a big fuck you to terrorism.  It doesn’t work if people aren’t scared, and the people of Boston, Massachusetts, and runners and spectators from across this country and world are obviously not scared.
  • Not only do Bostonians (and Cantabrigians and Watertown-ians(?) and etc.) not scare easily, Americans in general do not scare easily.  So I hope pundits leave behind flawed concerns that the unprecedented shelter-in-place order on the Friday following the Marathon bombings was a sign of underlying weakness rather than determined strength born out of  in-the-moment operational necessity.
  • We as a society are resilient.  Yes, there are significant concerns about infrastructure and emerging threats.  Things can and should be improved across a range of sectors and issue areas.   However, I simply have not read nor heard convincing proof that our current society is any less resilient than in decades past.  Stephen Flynn I’m looking at you. Instead, we live in a different world with different vulnerabilities but also different strengths.

Leading up to today, there has been much said about the potential of missed clues or signals that could have led authorities to prevent this attack.  There has also been much shared about the resilience of those directly affected by the bombings. Rightly so.

I’d be lying, however, if I didn’t admit to being a little concerned.  The medical response to the attack has been lauded.  It has not been sufficiently explained.  It should not be taken for granted.

The concept of a “dry run disaster” has been advertised.  Lessons learned from the Iraq, Afghanistan, and the Israeli experience have been explored. It is easy to point out that the explosions occurred yards away from a medical tent, and that Boston is blessed with an overabundance of world class hospitals just minutes away from the scene.

Yet the underlying strength of the Boston response originated from years of planning, practice, and collaboration.  Similar examples of which are difficult to find across our nation. Boston was, and is, strong because it has, and continues to, work on preparedness.

Boston Strong because Boston Ready.

This should be noted and shared.

All I have to offer in addition is a few suggestions:

  • The Federal goverment, both the Administration and Congress, should increase funding to such programs as the Hospital Preparedness Program (HPP) that aims to instill the cross-sector collaboration that was so successful in Boston.  It would also be nice if top Administration officials not only talked about resilience but actually did something to drive actual change in their departments.
  • State and local governments should embrace the “whole of community” approach.  This would require that first responders embrace the possibility of a robust civilian response in their plans, as well as encouraging cooperation among private stakeholders.
  • Those private stakeholders, hospitals and healthcare systems and etc., should understand that cooperation and collaboration with others should not be viewed as a net loss on the ledger books, but as an overall positive contribution to their business model.
  • And finally, the individuals among us should realize that having health insurance is a good thing.  Not unduly burdening the emergency medical system during times of unexpected stress, such as the Marathon bombing, could save lives. Learning what to do to help our neighbors would be even better.

- – - – - – - – - – - – - -

Recently, NBC’s “Meet the Press” aired a segment on “Boston Strong: The Marathon Bombing, One Year Later.”

You can watch a video of it here: http://www.nbcnews.com/storyline/boston-bombing-anniversary/boston-strong-marathon-bombing-one-year-later-n79161

It was a round table discussion with an audience of Boston first responders.  The individual making the incisive observation I took as the title of this post was Senator Ed Markey.  His full quote:

And, you know, we were prepared. We were Boston Strong, because we were Boston Ready. The city was ready. And the commissioner has a lot to do with that. The people who were here. There was a lot of cooperation at the local level. And then we needed the bravery of people then to respond on that day. And they did. And the resilience of people afterwards.

He makes a subtle and often overlooked point.

April 3, 2014

“Simply a manifestation of the criticality of the system” and the implications if true

Filed under: Catastrophes,Preparedness and Response,Resilience,Strategy — by Philip J. Palin on April 3, 2014

OSO_Photo by Marcus Yam_The Seattle TimesPhoto by Marcus Yam, The Seattle Times

John Schwartz and the New York Times gave us an unusually thoughtful piece of journalism last Saturday: No Easy Way To Restrict Construction In Risky Areas.  Several cases are examined: Oso Landslide, Sandy, Katrina and more.

This is largely an issue of the transfer, avoidance, reduction, or acceptance of risk.  Very closely related are attitudes toward contingency.

The Oso landslide is a specific case where “complexity originates from the tendency of large dynamical systems to organize themselves into a critical state, with avalanches or punctuations of all sizes.” Other dynamical systems include seismic networks, volcanoes, ocean currents and I would include the electrical grid and significant concentrations (populations) of almost anything.

In a seminal 1995 paper Per Bak and Maya Paczuski outline two very different explanations of the same “punctuation” event:

A Historian Describes a Sandslide.

On December 16, 1994, a grain of sand landed at the site with coordinates [14, 17] on the pile. Adding to the grains of sand already accumulated at this site, this addition caused a toppling of that site, spilling over to the neighboring sites. Unfortunately, one of these sites [14, 18] happened to be near an instability so that the toppling caused this site to topple also. This toppling destabilized sites [14, 19] and [15, 18] and eventually led to the collapse of a large part of the pile. “Clearly, the event was contingent on several factors. First, had the initial grain of sand fallen elsewhere, nothing dramatic would have happened. Also, if the configuration at position [14, 19] had been slightly different, the sandslide would have stopped sooner, without devastating consequences. While we can give an accurate and complete account of what actually happened, we are at a loss to explain how these many accidental features could possibly have conspired to produce an event of such magnitude. The event was contingent upon many separate, freak occurrences and could clearly have been prevented. Furthermore, we are baffled by the fact that even though sand had been added to the system for a longtime, only minor events had occurred before the devastating collapse, and we had every right to expect the system to be stable. Clearly, the event was a freak one caused by very unusual and unfortunate circumstances in an otherwise stable system that appeared to be in balance. Precautions should and could be taken to prevent such events in the future.

A Physicist Describes a Sandslide

During a long transient period, the pile evolved to a critical state with avalanches of all sizes. We were able to make a rough identification of the toppling rule and to construct a computer model of the phenomenon. Actually, the particular rule that we use is not very important. In any case, we do not have sufficient information about the details of the system to be able to make long-term predictions. “Nevertheless, our model exhibits some general features of the sandpile. We monitored how many avalanches of each size occurred, after the addition of a single grain to the pile. We made a histogram (Fig. 2), and found that the distribution of events where a total of s sites topple obeys a power law, P(s)- s-T. Thus, if one waits long enough, one is bound to see events that are as large as one has the patience to wait for. We ran our simulations (the tape of evolution) several times. Eliminating the particular grain of sand that caused a particular avalanche only made the system produce large avalanches somewhere else at different times. Changing the rules slightly — for instance, by planting snow screens here and there — does not have any effect on the general pattern.

Avalanches are an unavoidable and intrinsic part of the sandpile dynamics. “Actually, I’m not interested in the specific details of the event which Prof. Historian is so excited about and gives such a vivid account of. What the professor sees as a string of freak events appearing accidentally and mysteriously by an apparent act of God and leading to a catastrophe is simply a manifestation of the criticality of the system. History has prepared the sandpile in a state that is far from equilibrium, and the matrix through which the avalanche propagates is predisposed to accommodate events of large sizes. The complex dynamics which is observed in the ‘historical science,’ where the outcome appears contingent on many different, specific events, represents the dynamics of self-organized critical systems.

Historical narrative is inclined toward an understanding of reality where human intention, rationality and will can assert control.  Bak and Paczuski point toward the possibility of domains beyond our power, though certainly deserving our attention and respect.

March 20, 2014

A Catastrophic Failure

Filed under: Catastrophes,Preparedness and Response,Private Sector,Resilience,State and Local HLS,Strategy — by Philip J. Palin on March 20, 2014

Last Friday I finished about four years of work.  I won’t identify the specific work, but it is homeland security-related.

Mostly I failed.

Yes, progress was made:

  • We have a much better understanding of the problem; among other things we recognize a problem that previously was not widely recognized.
  • We have identified most of the key players who are needed to effectively engage the problem.
  • We have established some meaningful relationships among several of the key players.

But the actual problem is as threatening and complicated as it was four years ago.  Maybe more threatening.

After four years of serious, ongoing, and mostly well-received work, I failed to practically advance our security.

I advocate for a distinction between national security and homeland security. But as a wannabe classicist, I embrace “security” derived from the Latin se-curus, se: free from, cura: care.  If anything, today we are less-carefree than four years ago.

Greater knowledge has, if anything, increased our concern:

  • We now recognize there are substantive differences between catastrophic and non-catastrophic.  Enhanced effectiveness dealing with the non-catastrophic has in some cases increased our catastrophic risk.
  • We now recognize the larger an impact area the more likely a catastrophe, even if the “first impact” is less than catastrophic.
  • We now recognize the more interdependencies (power, transport, fuel, supplies, etc.) the more likely a catastrophe
  • We now recognize that self-made vulnerabilities are at least as important — often more important — than external threats.

These aspects of the strategic landscape may seem obvious to you, but four years ago they were anything but.  Even today these findings are taken by some as fightin’ words.

While we now have a much better view of reality, we have not substantively reduced vulnerabilities. An analogy: The thick flat jungle of Mexico’s Yucatan is periodically punctuated by a rise.  Most of these exclamation marks are the overgrown ruins of ancient Mayan structures.  As the vines and trees are cleared from the stonework the threat of erosion — and trampling by tourists — actually increase the likelihood of collapse.

In clearing our problem’s landscape we have also experienced the cultural differences that complicate potential collaboration between the private and public sectors.

In this particular problem-set the private sector tended to recognize the risk earlier than the public sector.   So unlike some homeland security problems, the private and public sectors are in rough strategic alignment.

But to actually do anything together to mitigate risk has been problematic.  A forensic analysis of the multiple problems is not appropriate for a blog.  But at the highest level I think it is fair to say there has been a persistent disconnect between private and public regarding the fundamentals of time and space.

The dimensions of space important to the private sector are usually determined by markets that extend for hundreds, even thousands of miles in every direction.  One private sector participant said, “For our daily operations states are legal fictions.”  Yet on very bad days those fictional creatures become very real… with both good and bad consequences.

Dimensions of time can be even more complicated.  Everyone is busy. Everyone is mostly focused on meeting the calendar for some specific deliverable or set of deliverables.   Private sector success or failure is measured at least once a day and the measures arrive from multiple  players (dozens to tens-of-thousands) across diverse markets.  The public sector calendar tends to be more extended even while the measures-that-matter emerge from a much smaller set of observers/consumers/commanders.

As the private sector experience of time encounters the public sector experience of time reality can be contorted in weird ways.

Over the last four years I failed to practically accommodate these differences of space and time. I am sure private and public share the same reality.  I am sure they depend on one another.   But as I finish this work they remain trapped at different points on a very Newtonian plane.

–+–

A human being is a part of the whole called by us universe, a part limited in time and space. He experiences himself, his thoughts and feeling as something separated from the rest, a kind of optical delusion of his consciousness. This delusion is a kind of prison for us, restricting us to our personal desires and to affection for a few persons nearest to us. Our task must be to free ourselves from this prison by widening our circle of compassion to embrace all living creatures and the whole of nature in its beauty.

Albert Einstein, Letter to Robert S. Marcus, February 12, 1950

March 13, 2014

The 21st Century Stafford Act

Filed under: Congress and HLS,Preparedness and Response,Recovery,Resilience — by Philip J. Palin on March 13, 2014

Today’s post is authored by a member of the homeland security enterprise who would prefer to not be named. The post reflects the views of the author and does not necessarily reflect the views of any particular federal agency or the Federal Government.

–+–

In January, a bipartisan group of congressional legislators from Illinois introduced a bill entitled the Fairness in Federal Disaster Declarations Act of 2014. A few days later, Illinois’ senators would introduce the same bill in the Senate. The ostensive purpose of these bills is to bring fairness to rural communities when competing for federal disaster declarations by altering FEMA’s disaster declaration regulations.

The problem is no President has ever delegated the right to decide disaster declarations to FEMA and Congress has limited the President from establishing disaster declaration criteria based upon arithmetic formulas or a sliding scale based on income or population. Even if this bill would become law tomorrow, it almost certainly would not change the framework of disaster declarations and only make changes to unbinding regulations. So why would these members go through such an effort?

The answer may be the lack of serious discourse about the primary legal framework for federal disaster preparedness and relief, the Stafford Act, over the last 25 years. While the Stafford Act has been amended several times since 1988, outside of the addition of mitigation authorities in 2000, there has been no substantive review of the utility, incentives and disincentives put into motion by its overall structure and purpose. The end result is Congress’ knowledge has atrophied. The nation’s citizens have been deprived of a chance to understand the issues surrounding disaster relief and preparedness that would allow them to set practical expectations for the types and amount of disaster assistance they can expect after a disaster. This includes the lack of debate about how the Stafford Act may, or may not, have affected the role and responsibility of different levels of governments to prepare for disasters and provide disaster relief. Nor has there been a serious debate about the balance between public sector and private sector relief efforts.

Beginning in 1950, the first four decades of the modern era of federal disaster relief saw periods of spirited review about these issues. Four times this evaluation led to significant restructuring of the statutory configuration of federal disaster preparedness and relief, almost always expanding the assistance available through the Federal Government. However, with the exception of emphasizing and incentivizing mitigation in 2000, there has not been a serious study of the utility of the structural foundations for federal disaster preparedness and relief.

This has deprived the nation of the serious study of what disaster preparedness and relief efficiencies need to be reinforced and what deficiencies should be rectified. It has also prevented citizens from understanding how much disaster assistance they should expect and the level of risk and responsibility they should be prepared to assume. We have avoided questions of responsibility for disaster relief from their different levels of government, the private sector and non-profits. While the nation has seen several major disasters since 1988, the debate after each of these events never led to the serious and episodic reappraisal seen in the previous four decades. We are now nearly 26 years past the last serious evaluation of the responsibilities for disaster relief.

It may be that the answers to these questions have changed little over these last 26 years but how do we know? What are the issues that might be debated? The obvious ones are perpetual: The division of responsibility and risk between public and private, federal and state, state and local and the individual responsibility of citizens. The debate over these issues will always ebb and flow with the direction of the country but are the factors that influence this debate static? What about the dramatic changes in technology over the last 26 years? With the profusion of resources and capabilities to individual citizens, much of it relayed through the computer in every pocket, the smart phone, should citizens shoulder more responsibility (and risk)?

Does our increasing reliance on interconnectedness, much of it delivered through the private sector, provide a new role for federal disaster relief to critical infrastructure? How can we harness the capabilities of the newest generation of disaster relief organizations to provide a more efficient and nimble disaster relief response than their predecessors? Are there incentives or resources which could be provided by the Federal Government to incentivize these organizations without impeding their innovation and competences?

Now may also be the time to look back and see where the Stafford Act has created pockets of efficiencies and inefficiencies. What mitigation efforts have, or have not, incentivized states and local governments to become more prepared? Should we, and could we, reward local and state governments who shoulder more of the responsibility for mitigation efforts? Are preparedness efforts better funded locally or more broadly? How do we support growing inter and intra-state regional governments who fall outside traditional federal-state relationships for disaster relief? Should the Federal Government encourage new forms of intergovernmental cooperation? How do we weigh the responsibilities of states – does the Federal Government more actively force them to tax to their risk, or leave it up to them?

Could the Federal Government provide incentives for states to push more responsibility for disaster relief to lower levels of government? Is this wise? What should be done about the clearly anachronistic Cold War era Title VI of the Stafford Act? A decade later, does the relationship between the Stafford Act and the Homeland Security Act need to be clarified? Could the debate over the relationship between these two statutes lead to streamlined Congressional oversight for disaster relief?

We learn by talking, by debating, by the marketplace of ideas. It’s time for a serious and spirited discourse if for no other reason than to reeducate ourselves and reestablish consistent expectations and responsibilities for disaster preparedness and relief.

March 6, 2014

Neighbors: Engaged or Not

Filed under: Preparedness and Response,Resilience — by Philip J. Palin on March 6, 2014

Maybe you saw the reports of a neighborhood’s response to an avalanche last Friday:

Rescue officials say about 100 neighbors converged to help find three people buried Friday when an avalanche swept down a mountain in a residential area of Missoula in western Montana and crushed a house at the bottom.

“It was very chaotic but a lot of energy,” said Jeff Brandt, assistant chief of operations for the Missoula Fire Department.

Scores of neighbors had already started the rescue effort when he arrived about half an hour after the slide, and some 20 professional responders helped provide focus to the effort, Brandt said. An 8-year-old boy was pulled from the snow just as he arrived, he said.

The three people remained hospitalized Saturday, a day after the avalanche slid down 4,768-foot Mount Jumbo into the northeast Missoula neighborhood…  MORE

In crisis situations, we see this again and again.  We saw it on 911.  We saw it at the Boston Marathon.  In a few weeks we will see the annual festival of neighborliness called the Red River Flood.

But it is interesting to me that among urban public safety personnel a positive neighborhood response tends not to be expected.  In a few situations I have even heard police, firefighters or emergency management tell “civilians” not to get involved and let the professionals take charge.  Over a beer in Baltimore, Chicago, or Philadelphia many (not all) pledged to protect and serve the public consider that same public their greatest threat.

On March 13, 1964 Kitty Genovese was killed in a middle-class neighborhood of Queens.  Her story became a modern parable of corrupt priests, fearful pharisees, and bad Samaritans.

According to the New York Times and the story told and re-told, scores of neighbors did nothing even as they heard her screams for help.  Maybe you can depend on your neighbors in Missoula, but not in the big cities became a common understanding.  Since then we have looked for and found corroboration. Expect the worse and you will not be disappointed.

There are tw0 new books out on the Genovese story.   A debate is renewed over what happened — even more what did not happen — a half-century ago.  In the current New Yorker Nicholas Lemann reviews the books, sympathizes with the argument that urban apathy was amplified far beyond reality, and concludes, “The real Kitty Genovese syndrome has to do with our susceptibility to narratives that echo our preconceptions and anxieties.”

Meanwhile in the Daily News, Catherine Pelonero, author of the one of the new books, defends much of the urban myth.  (“In speaking of myths and mythologies we do not make claims regarding empirical truth,” a favorite professor explained, “but instead point to the power of popular perception.”) Yet even she writes, “The witnesses weren’t chronically hard-hearted  New Yorkers who couldn’t bother intervening while a neighbor was murdered.  They were normal people hobbled by a mix of fear, self-interest, and apathy.  We all fail at times, and how bravely we behave varies from day to day, moment to moment.”

I spend a good deal of my time and energy working with people who expect the worst and that may well include human nature.  Given this expectation they plan, act, and at times decide not to act in anticipation of viciously self-interested behavior.  I am aware evidence for this predisposition exists.  It is not, however, the only or always predominant evidence.

Emerging directly from the Genovese case is the empirically demonstrated “Bystander Effect“. We are, it would seem, more heroic when there are fewer folks about.  The larger a crowd,  the more we tend to defer to the heroism of others.

But — or especially — in a crowd, when one steps forward to help, s/he will often be followed.  A significant element in social resilience is facilitating individual initiative to help.

Dorothy Day was about nine years old when she lived through the 1906 San Francisco earthquake and fire.  Years later she recalled:

What I remember most plainly about the earthquake was the human warmth and kindliness of everyone afterward. For days refugees poured out of burning San Francisco and camped in Idora Park and the race track in Oakland. People came in their night clothes; there were new-born babies. Mother and all our neighbors were busy from morning to night cooking hot meals. They gave away every garment they possessed. They stripped themselves to the bone in giving, forgetful of the morrow. While the crisis lasted, people loved each other.

It shows a susceptibility to narratives that echo my preconceptions and aspirations, but it seems to me part of being involved in homeland security, a large part of any presumed leadership role, and a significant part of being fully human is to do our best to love each other.

But I am embarrassed to speak in such terms.  Is my embarrassment part of the homeland security problem or is it just that love is as tough to define as homeland security?

February 13, 2014

Private-Public Cybersecurity Framework

Filed under: Cybersecurity,Private Sector,Resilience — by Philip J. Palin on February 13, 2014

Wednesday the White House “launched” the long-under-way Framework for Improving Critical Infrastructure Cybersecurity (41-page PDF).   A snow day has given me the chance to read it.

You need to turn to someone else for a technically competent reading-between-the-lines.  I have no particular competence in cyber hermeneutics.

Information Week reports, “Experts believe NIST’s voluntary Cybersecurity Framework will become the de facto standard for litigators and regulators.”

Several others suggest the voluntary standards are a reasonable step forward given the collapse of earlier efforts to draft legislation.  The US Chamber of Commerce continues to be suspicious of how even these kumbaya methods might be turned to satanic purposes.

The White House spin is well-set out in a detailed background briefing.

No one is suggesting the framework, even widely adopted, resolves vulnerabilities innate to the network.

Two aspects of the framework should not be taken for granted.  First, the methods to finalize the framework may be a model for future approaches to private-public problem solving.  The National Institute of Standards and Technology, a non-regulatory agency, played host and facilitator for a largely private-sector-driven process.  NIST did not try to drive the process in any particular direction, but was helpful in brokering practical paths for reaching consensus among sometime competitors and a variety of views.  ”Honest broker” is not the first thing many in the private sector usually attribute to the Feds.  It apparently worked here.

Second, several of the private sector “Big Boys” involved in the process (e.g. AT&T) have announced their intention to use audited compliance with the voluntary standards as a gateway for those enterprises from which they will purchase goods and services.

This tees-up the potential for a dynamic process of community self-enforcement that several studies (including many by my heroine Elinor Ostrom) have found are much more effective at proactive avoidance and prevention of problems, rather than after-the-fact sanctioning.  Given the “commons-like” characteristics of the cyber-domain this could be an important dynamic to consciously cultivate.

January 16, 2014

Engaging Uncertainty

Filed under: Catastrophes,Disaster,Infrastructure Protection,Preparedness and Response,Resilience,Strategy — by Philip J. Palin on January 16, 2014

Water-Order     Gov. Tomblin (right) and Jeff McIntyre, West Virginia American Water

Late on January 9 not much was known about the chemical leak into the Elk River. No one seemed to know how much of the chemical had poured into the river or been sucked into the water system. No one could be sure what sort of health-risks might arise from skin contact or ingesting water tainted with the obscure chemical. There was uncertainty about when the contamination had begun and how long it might take to remove the contamination. When 300,000 people might again be able to consume their tap water was beyond reasonable prediction.

Our species survived — and eventually thrived — largely based on our weird ability to imagine the future and recognize steps to achieve (or avoid) what we imagine. When this imagination is anchored in experience or knowledge (indirect-experience) it is a source of confidence, even solace. When the anchor is ripped up and our fragile craft is swept into a cyclone of uncertainty… well, different folks respond in different ways. But there is a tendency for fear to proliferate, which can unwind in atypical behaviors and amplify uncertainty.

In the first two days of the West Virginia water crisis there were many indicators of imagination untethered. Rumors spread. Conspiracies were alleged. Even worse to come was envisioned. But mostly fears were contained, rumors corrected, and a covenant of social trust and mutual concern was, if anything, strengthened.

A 500 word blog — okay, I’m not always so concise — is not the right place to undertake a full analysis of what happened and did not happen in terms of community resilience. But I advocate this being done.

My hypothesis is that what happened mostly involved the expression of preexisting social networks and relationships.

But I also want to credit — and ask others to more rigorously explore — the role of leadership that was courageous enough to embrace uncertainty.

I was in eastern West Virginia (outside the impact area) from Sunday through Tuesday, close enough to get a bit more of the local media angle. I was impressed by the calm, realistic, and consistently understated approach of the Governor, Earl Ray Tomblin, and the President of West Virginia American Water, Jeff McIntyre.

I never heard them claim to be in control. I did hear them state clearly the sources of uncertainty. They outlined in writing and in their remarks what was being done to engage the uncertainty. They did not try to distract citizens from the uncertainty with accusatory vents. They did focus on what citizens could do for themselves and their neighbors. They recognized progress. They did not over-promise.

Here is one of the first statements made by the Governor (bold highlights by me).

We urge all residents in the affected areas to follow West Virginia American Water Company’s “do not use” order until it is lifted. This includes water companies supplied by West Virginia American Water in this area. If you live in one of these areas, do not use tap water for drinking, cooking, cleaning, washing, or bathing. At this time, I do not know how long this will last.

Don’t neglect the use of that personal pronoun.  Next he said:

We ask that all West Virginian’s check on their friends, families, and neighbors—especially those with small children and seniors living in their households—to make sure they have enough water, food, and supplies. If you—or anyone you know–experiences symptoms including: nausea, vomiting, dizziness, irritation of the eyes and skin, seek care immediately.

Here’s what a citizen can do, even should do.  The most important action that can be taken is to practically and personally renew the human relationships on which we all depend.  Begin some new relationships if you can.  Then, here’s what  your government is doing on your behalf (he said more, this is one of four paragraphs):

I’ve mobilized and deployed all appropriate government assets and resources, including our Office of Emergency Management, our experts at DEP, DHHR Bureau of Public Health along with our National Guard—who are out doing health and wellness checks across the area along with collecting, testing and monitoring the water. The federal government is also providing assistance. The President has approved my request to issue a federal emergency declaration to provide FEMA resources. County emergency offices are also working 24-7.

Your basic human needs can and will be addressed:

If you are low on bottled water, do not panic. Help is on the way. We are taking every measure to provide water to you. There is no shortage of bottled water. Supplies are moving into the area as we speak. We encourage all West Virginians in affected areas to contact their local emergency management office for water distribution sites.

Please be active in helping yourself and others:

If you or your organization would like to donate supplies, please contact your local emergency center. If you are in the Kanawha Valley Area, we are organizing a call to action drive for needed items—including water, sanitizer, wipes, liquid baby formula, paper plates, plastic utensils, and microwavable meals. The drive will take place on the Boulevard in front of the State Capitol from 2:30 – 6:30 today. It is important to emphasize, water and supplies are available—there is not a persistent shortage of bottled water.

We are grateful for the offers of support from private firms and charities—and our fellow West Virginians—to aid in providing relief.

This is the second time I have listened-in to Governor Tomblin deal with a basically no-notice and hard-hitting disaster.  The first time was the late-June 2012 Derecho.  In that multi-state event I was able to compare and contrast his approach to that of other governors, mayors, and such.   When others were attacking, blaming, and threatening, Governor Tomlin was thanking and encouraging and informing.

I think there are some lessons to be learned.

January 13, 2014

Water everywhere, but not a drop to drink

MONDAY EVENING UPDATE:

Several media outlets — and some private emails — indicate some areas of the Kanawha Valley are being told their tap water is again safe to consume.  Different areas are being “cleared” in a step-by-step process of flushing and multiple-testing.

–+–

Last week an unknown amount of the chemical 4-methylcyclohexanemethanol leaked from a storage tank into the Elk River near Charleston, West Virginia (one estimate referenced 5000 gallons, another estimate is 7500 gallons). About one mile downstream from the discharge is the intake for a water system serving most of nine counties and up to 300,000 persons.

By Thursday evening a “Do Not Use” order was announced. Water customers were instructed to avoid bodily contact with tap water. Water has continued to flow for sanitation and firefighting (and to flush the system).

Even 24 hours after the spill the contamination risk was not well-understood. While not thought to be toxic, the chemical can cause irritation of the eyes and skin. Ingestion could cause nausea, gastrointestinal distress, and liver damage.

The chemical is known to be harmful in concentrations of 500 parts per million. By Friday evening levels of the chemical’s concentration in the Elk River near the water intakes had dropped from 2 to 1.7 parts per million.  On Saturday it was announced the “Do Not Use” order would not be lifted until a comprehensive testing process found concentrations of less than 1 ppm throughout the Kanawha Valley water network.  On Monday morning several spot-checks are reporting levels below 1 ppm.

The water network involves over 100 storage tanks and 1700 miles of pipeline.  On Saturday the water company explained, “Concentric flushing beginning at a central location and moving out to the far ends of the distribution system is expected to take several days but will not be simultaneous based upon the construction of the system. The timeline may vary based on geographic location, customer demand and other factors that impact water usage and availability.”

Retail supplies of bottled water quickly sold out on Thursday night and Friday.  But by Saturday most stores had been resupplied and some major retailers were providing customers water at no charge.  Several public distribution locations had also been established.  FEMA has shipped over 1.5 million liters into West Virginia.  Proactive efforts are being made to ensure drinking water distribution to the elderly, disabled, and other vulnerable populations.  Both private and public supply chains will continue to surge water into the greater Charleston area.

This is a still developing situation.  Lots of lessons — and pseudo-lessons — are likely to emerge.  With appropriate trepidation, let’s begin to gather some observations and hypotheses.

Prevention and Mitigation

In my personal experience secondary-effects on water systems are especially consequential. I have seen urban areas emerge from a detailed analysis of a nuclear detonation in what seemed a survivable condition only to have the water system fail and unwind an entire region.

As with many — most — modern systems of supply urban water systems are nodal networks.   These networks are innately more efficient on good days and innately predisposed to catastrophic cascades on bad days.  Trouble at any node is likely to propagate to other nodes.   The nodes — electrical, logistical, water, whatever — are especially susceptible to no-notice concentration stresses.   (This is what is currently speculated to have happened at the UPS Worldport on the weekend before Christmas causing one of the best supply chains in the world to nearly collapse.)

A significant aspect of the problem in West Virginia is that the — largely unknown — chemical was released in considerable quantity so close to the node.  There was not sufficient time-and-space for dilution to do its magic before the whole system was contaminated.  Electrical, computing, fuel, and other networks are vulnerable to analogous risk.

Response

West Virginia is on the edge of four regional supply chain networks.  This is so rough to be at least a bit misleading, but think of large circles radiating out from Washington-Baltimore, Pittsburgh, Cincinnati, and Charlotte/Roanoke.  Depending on the commodity or sector, these circles overlap in West Virginia.

I expect — but it is only an informed guess — that the spike in demand signals began emerging after Thursday orders and Friday morning deliveries were processed.  So it took until Friday morning to seriously engage the unexpected explosion in demand.  Then it was late Friday or early Saturday before sufficient commercial stocks of bottled water could be redirected into the network.

Again just an informed guess, but Kroger, Walmart, Sysco, and  McLane are probably the principal distributors of bottled water in West Virginia.  They will also be the principal sources for sanitizers, baby wipes, paper plates, and related products  For players this size, there is an existing strategic capacity to surge supply.  While 300,000 with a no-notice loss of drinking water is non-trivial it does not exhaust capacity… especially because this is on the edge of four regional supply networks, each with very deep resources. The challenge is more an issue of transport than supply.  So… by Saturday the commercial supply chain was aware of the problem, reorganizing to supply the problem, and largely successful doing so.

Provision of water by local fire departments, state emergency resources, and FEMA is a crucially important complement to the commercial supply chains.  Red Cross, churches and similar organizations are especially important to filling the demand-and-supply gap for non-mobile populations.

My off-the-cuff analysis would not be nearly so benign if a similar event hit a much more densely populated area that was served by a less diverse supply chain.

Recovery

Contamination events are especially challenging.  How do you prove a negative?  Rumors will fly faster than facts.  Bottled water is going to be more popular in the Kanawha Valley than ever before, enjoying sustained demand long after chemical concentrations fall below 1 part per million.

Nodes are important here too.  What and who are the psycho-social nodes in this (these) communities?  What relationships have already been established?  How can those relationships be energized in this instance to deal with this issue?  Will these communities respond as victims, as survivors, as heroes? And what, in retrospect, will they decide to learn?

One of my West Virginia friends who contributed to this report offered,  ”Tell your readers that if they want to help they need to plan their next vacation or convention for Charleston.” Basic human needs are being addressed, but the long-term economic consequences will be very troubling.

Much more to come.  This crisis continues. But in any case, Coleridge was right:

Water, water, everywhere,
And all the boards did shrink;
Water, water, everywhere,
Nor any drop to drink….

He went like one that hath been stunned,
And is of sense forlorn:
A sadder and a wiser man,
He rose the morrow morn.

Rime of the Ancient Mariner

November 21, 2013

Complex versus complicated

Filed under: Catastrophes,Preparedness and Response,Recovery,Resilience — by Philip J. Palin on November 21, 2013

Sunday I was doing what I could — not much — to deploy barges, boats, anything that could float a truck to the San Bernadino strait between Luzon and Samar in Eastern Philippines.

About the same time several tornadoes were tearing through the area of downstate Illinois  where I grew up.  In Pekin and Washington over 500 homes were destroyed, over 100 were hospitalized, one died.  There was more death and destruction across the Midwest.

In each case — Central Illinois and Central Philippines — the precipitating cause was a cyclonic event with winds exceeding 190 miles per hour. In each case similar critiques have emerged related to risk-awareness, mitigation, warning, and preparedness.

Otherwise the differences are significant.

While there were over 70 confirmed tornadoes across the Midwest on Sunday, tornadoes are episodic. Tropical cyclones are epic.  Survivors in the tri-county region of Illinois talk about two-minutes of hell.  Survivors in the Visayas region of the Philippines experienced hours of assault by rain, wind, and surge. It is now estimated that up to 4 million have been displaced by the typhoon. Over 518,000 houses have been destroyed.  The dead are still being found.

Terrestrial cyclones don’t come with storm surge.  Water kills much more effectively than wind. Only earthquakes are more deadly… especially if they splash up a tsunami.

The scale — specific power at impact — of the EF-4 tornado that hit Washington is comparable to the CAT-5 typhoon that passed south of Tacloban.   In terms of their scope… well, look for yourself.

Haiyan to Washington

But it is a mistake to only see the differences as a matter of scope or scale.  In terms of consequences these events are expressions of entirely different categories.  The Visayas Event was/is complex and very much continuing to unwind.  The Washington Event was complicated and, except for those directly affected, is now mostly finished.

Disasters are contained in recognizable time-and-space, temporarily disrupting patterns that mostly rebound.  Catastrophes are complex cascades marking a fundamental shift in experience and direction.

There is a temptation to focus on size, as if one is a ping-pong ball and the other is a basketball.  Instead, it seems to me, we need to recognize that one is any size ball and the other is a positron: two very different types of reality, requiring two very different strategies of engagement.

For example:

In Illinois it is entirely reasonable to form a security perimeter around the impact site, to focus on evacuating survivors, and to defer mostly to private sector decisions related to recovery.

In the Visayas these same choices are possible, but where in Illinois the velocity and outcome of these choices are reasonably predictable and positive, in the Visayas such choices are likely to make things even worse (especially the next time).   In any case, in the Visayas (the positron) we are dealing with probability not predictability.

Given the catastrophic context in the Philippines instead of perimeters, focus on permeability (e.g. clear debris, repair bridges, expedite convoys).  Instead of evacuation, focus on quick restoration of lifelines (especially water and food, even electricity is secondary).  Private choices will be important in both places, but there are threats and vulnerabilities in Tacloban and elsewhere that would benefit from a much more active role by both government and civil society.

Catastrophes are not just big and complicated, they are an entirely different category of reality.

Next Page »