The resilience vision

Tuesday, February 20, 2007

A fully functioning infrastructure is vital for the freight industry; as such Jeff Gaynor urges action on the recommendations of the Critical Infrastructure Task Force.

Following his retirement from government service, we engaged with former Director of the Emergency Response Senior Advisory Committee, and Director of the US Department of Homeland Security's Critical Infrastructure Task Force Jeff Gaynor for insights into Critical Infrastructure Resilience, the Task Force's recommendations and his impressions of them – now viewed from the private sector.

Has your new private sector perspective in any fashion changed your view on the recommendations of the Critical Infrastructure Task Force?

If anything, and one year after its public release, my view from outside Government has only amplified my belief in, and commitment to, the immediate implementation of the Critical Infrastructure Task Force's Report and its principal recommendation: 'Promulgate Critical Infrastructure Resilience (CIR) as the top-level strategic objective – the desired outcome to drive national policy and planning.' In my 14 years of addressing critical infrastructure policy and programmes, there has been, and continues to be, an imperative for adoption of a comprehensive, and objectively measurable critical infrastructure, and by extension, national preparedness standard. The standard – as recommended by the distinguished members of the Task Force, the Homeland Security Advisory Council, and virtually every audience that I have encountered – is resilience.

Historically, national policy change in the wake of a crisis or tragedy has been quick and decisive. Unfortunately, in the absence of crisis and tragedy, proactive policy change, even that based upon independent, disciplined, and well-considered study by people of great experience and intellect, and specifically designed to address certain 'all-hazards' consequences, has been strongly resisted and thus has been far more difficult to implement.

Iteration of 20th Century policies and programmes can not be characterised as successful, and must give way to innovation, agility, and 21st Century realities. Charles Darwin noted in his work The Origin of Species: "It is not the strongest of the species that survive or the most intelligent, but the ones that are most responsive to change." A quotation attributed to Albert Einstein¹ put it more colloquially. Einstein defined insanity as "Doing the same thing over and over again and expecting different results." If the globe's experience with events of the first six years of the 21st Century portends anything, it portends challenge and, with it, opportunity. Provided authorities are willing to listen and be receptive to vision and to the innovation vision drives, the challenges before us will provide the catalyst for transformation and will spur humanity's greatest century.

That said, reality is that an embedded, highly dedicated, inventive, agile, patient, and self-sacrificing enemy has joined omnipresent acts of nature, looming pandemics, ongoing technological complexities, human error, and protected critical infrastructure failures to produce a spectrum of unacceptable 'all-hazards' threats, vulnerabilities, and consequences. The all-hazards environment has produced effects that traditional, node-centric, static, predictable, and objectively immeasurable² protection efforts have been, and are simply, unable to prevent or mitigate. Thus, while a 'comfortable' first step and an essential foundation for further effort, protection in and of itself is not an adequate critical infrastructure and national preparedness standard or objective.

What is being done, and what needs to be done, to make critical infrastructure resilience America's national policy and preparedness standard?

As noted above, change is always an exceptionally difficult undertaking. It is made even more difficult through the distribution of resources that reinforce compliance with the status quo. Despite this, I am convinced that the process of making critical infrastructure, and by extension, national resilience standard a reality is already under way. As envisioned in our Constitution and most importantly, this transformation is being driven 'by the people.'

At eNTEGRITÍ we have experienced and observed that: State and local government as well as private sector leaders throughout the nation and in Canada, like Homeland Security Secretary Michael Chertoff, recognise that, while investment in protection is necessary, it is impossible to protect against all things in all places at all times. Thus, resilience is seen as a logical and necessary advancement of the protection standard. Further, resilience is an innovation and standard that conforms fully to the spirit and intent of past, ongoing, and projected government and business continuity related legislation³ and resulting investments. The resilience standard (ie. time to reconstitution) provides a universally understood, risk-based, achievable, and sustainable metric of preparedness; and an objectively measurable and manageable Return on Investment that the protection standard cannot provide.

The first Secretary of the US Department of Homeland Security Tom Ridge had the focus of national policy creation right when he often stated: "When hometowns are secured, the homeland will be secured" and "all events are local". His point was that all Homeland Security policy and supporting resources and efforts must begin with a focus on hometowns. America's, and any other modern nation's, hometowns are an integration of inextricably interdependent people, cultures, businesses, and social activities and the government and critical infrastructure services that serve and empower them. In short, critical infrastructure operation is the enabler of hometowns and nations. If not made resilient, they constitute a hometown's and a nation's Achilles' heel.

Thus, the people who live and work in America's hometowns, counties, tribes, states, and regions are the people best able to understand their functioning, vulnerabilities, and needs. They are the people with the highest stake in their and their communities' lives and futures and, accordingly, those best able to set critical infrastructure resilience requirements. To effectively do so, and in addition to critical infrastructure sectors, communities must be trusted, empowered, and actively supported by the Government.

Former New York State Senator and now New York's Deputy Secretary for Public Safety and Homeland Security Michael Balboni observed that: "[Critical Infrastructure Resilience] is a 21st Century and empowering foundation for action." Recognising the 'all-hazards' environment, the limitations of historically insufficient protection efforts and the need for improved personal and community preparedness nationwide, Secretary Balboni also noted that the requirement for a new resilience standard is
the basis for "an adult conversation with the American People."

In a 17th November 2006 article in Washington Technology, staff writer Alice Lipowicz reported on Government Accountability Office findings on the development of Critical Infrastructure Sector plans called for in the National Infrastructure Protection Plan or the NIPP. Ms Lipowicz reported that: "While responding to draft versions of the national plan, members of five of the 17 critical infrastructure sectors – Information Technology, public health, energy, telecommunications and transportation – said the plan should emphasise resiliency rather than protection."

In so doing, the representatives of perhaps the nation's highest consequence sectors (as did the members of the Critical Infrastructure Task Force) very clearly signalled to the Government that they understand that there is a fundamental difference between protection and resilience and that the repeatedly stated objective of the NIPP, Critical Infrastructure Protection, was – at the very best – not good enough.

In the critically acclaimed forthcoming book 'The Edge of Disaster – Rebuilding a Resilient Nation'⁴, Stephen Flynn identifies the shortcomings of continuing the critical infrastructure and national preparedness status quo.

Flynn's writings clearly support the recommendations of the Critical Infrastructure Task Force, the requirements and initiatives of the private sector5 and further, make the very sobering and compelling case for making resiliency our national motto.

While it is gratifying that the imperative for the advancement in critical infrastructure, national security and preparedness policy from protection to resilience is recognised, what is needed now is a national accelerator and enabler. In executing its solemn constitutional obligations to provide for the common defence, it is the Government's responsibility to listen, learn, and translate the people's post-9/11 needs and expectations into a coherent, comprehensive, and integrated national critical infrastructure resilience programme.

The President and the new Congress have the opportunity to be both the accelerators and enablers. For its part, and as the responsible federal organisation, the Department of Homeland Security now has the obligation to be agile and responsive to the imperative of critical infrastructure resilience. With that obligation, the Department must create and support a new critical infrastructure and national preparedness vision, policy, plan, and standard. Contrary to the current iteration of pre-9/11 critical infrastructure protection programmes, the critical infrastructure and national resilience programme must empower trusted, requirements-based information sharing, critical infrastructure, supply chain, and business resilience efforts that, while leveraging existing protection efforts, are:
• Objectively measurable – providing a 'desired time to reconstitution' as the operational resilience and preparedness standard;
• Comprehensive, compatible, and inclusive – built from the 'bottom-up' and beyond infrastructure providers, inclusive of high consequence private sector entities from hometowns to Washington and beyond;
• Realistic – recognises the 'predator's view' and growing capabilities, and the history and consequences of infrastructure warfare;
• 'Realistic' – recognises that protection in an interdependent, all-hazards environment will limit only the behaviours of honest humans and will not prevent consequences. Public education to that
effect will serve to enhance individual knowledge, responsibility and preparedness and is a first step in building a resilient population;
• Consequence mitigating – directly addresses and lowers the lasting economic, physical, human, and societal consequences that predators seek to inflict, and Mother Nature often inflicts. Low consequence producing targets are unattractive. Resilient critical infrastructures and facilities mitigate not only initial consequences at the moment and point of impact but also the cascading consequences that are the product of critical infrastructure, economic and social interdependencies.

The empowerment, acceleration, and adoption of an advanced critical infrastructure and national resilience standard will also provide a foundation for a proactive investment in the nation. America's and a great many industrialised nations' critical infrastructures are ageing, vulnerable, and consequence amplifying. The resilience standard will provide ability to objectively risk manage, triage, and then direct well considered actions to pre-empt multiple repetitions of events like the protected critical infrastructure failure that exponentially amplified Hurricane Katrina's consequences.

The bottom line
Given the realities the 21st Century has brought and will bring, continuing failure to transform America's 20th Century critical infrastructure and national preparedness standard from protection to resilience will virtually guarantee validation of the words of Spanish philosopher George Santayana in The Life of Reason, Volume 1: "Those who cannot remember the past are condemned to repeat it." A far superior 21st Century alternative is within our grasp. The resilience vision, spirit, and reality are captured in the words of Winston Churchill: "History will be kind to me for I intend to write it." The responsible choice is now ours to make and in doing so write a far brighter future for this and generations to follow.

1 Source: Michael Moncur's (Cynical) Quotations.
2 There is no credible answer to the question: how much protection is enough?
3 The Sarbanes-Oxley and Terrorism Risk Insurance Acts.
4 Stephen E Flynn (2007) The Edge of Disaster: Rebuilding a Resilient Nation, Random House.
5 See www.dhs.gov/hsac for the Critical Infrastructure Task Force Report and www.tisp.org for their Regional Disaster Resilience Guide.