Homeland Security: Building a National Strategy

On September 11, 2001, our nation was stunned by the sheer audacity of the al Qaeda terrorists. The devastation--human lives lost and symbols of our free society destroyed--left an indelible mark on the American psyche. In the aftermath we are left to rebuild our sense of personal safety and national security even as we wage war against terrorism on a global scale.

Although we were rightly horrified by the attacks, we should not have been surprised by the aggression. Osama bin Laden himself provided ample warning; in a January 1999 interview, for example, he said "hostility toward America is a religious duty, and we hope to be rewarded for it by God . . . . I am confident that Muslims will be able to end the legend of the so-called superpower that is America." This was not empty rhetoric; bin Laden was implicated in the 1993 attack on the World Trade Center, the 1996 Khobar Towers bombing, the 1998 American embassy bombings in Africa, and the 2000 bombing of the USS Cole. So--having been warned--why were we unprepared?


Before September 11
For the past decade, a steady parade of studies, task forces, and commissions have expressed growing concerns about threats to the American homeland. The 1997 National Defense Panel described adversaries who were willing to confront us at home--as well as abroad--using asymmetric techniques to counter our traditional military strengths. The panel also noted the growing importance of homeland defense as an element of national security (National Defense Panel, 1997). In 1999, the United States Commission on National Security/21st Century was asked to help create a national security strategy appropriate to the emerging threat environment. In the commission’s Phase I report, published in September 1999, the number one conclusion was that "America will become increasingly vulnerable to hostile attack on our homeland, and our military superiority will not entirely protect us" (USCNS, 1999). The final report, published in January 2001, predicted that"“a direct attack against American citizens on American soil is likely over the next quarter century" (USCNS, 2001). None of these reports, however, conveyed a sense of immediacy--in spite of evidence to the contrary.

I do not mean to suggest that we completely ignored the asymmetric threat. However, the lack of urgency and the absence of a strategy limited our progress toward the redefinition and transformation of our national security apparatus. Although our military capabilities have improved significantly in the past few decades, our forces have remained optimized for traditional warfighting--on a foreign battlefield--against a known enemy. The mountain of reports describing the asymmetric threat from various perspectives offered piecemeal, and often conflicting, solutions. When confronted with new demands, organizations that were overcommitted already inevitably called for new resources. A plethora of working groups and task forces were established solely to bridge the fault lines between agencies. The national security lexicon expanded to include new terms, such as weapons of mass destruction, weapons of mass effect, chemical/biological/radiological/nuclear/explosive, cyberterrorism, and critical infrastructures. But after nearly a decade of debate, protecting our homeland from asymmetric threats was still not a primary mission for any part of our government. On September 11, 2001, homeland security had still not been defined. In short, there was a great deal of activity but little progress toward resolving the core issues, which will necessarily impinge on legacy missions--and bureaucratic turf.


The Aftermath
September 11 provided a wake-up call to our nation. Suddenly the debate about if versus when there might be a catastrophic attack on our homeland was transformed to where next. The subsequent anthrax attacks made the threat of biological warfare real to the American public and strengthened our collective resolve. Even as the ruins of the World Trade Center continued to smolder, we mobilized our military to wage war against global terrorism.

At the same time, homeland security--still undefined--jumped to the top of the priority list for every branch of the federal government, many state and local governments, and even parts of private industry. On October 8, 2001, the President issued an Executive Order establishing the Office of Homeland Security with the mission "to develop and coordinate the implementation of a comprehensive national strategy to secure the United States from terrorist threats or attacks." In the Quadrennial Defense Review Report released on September 30, the U.S. Department of Defense "restored defense of the United States as its primary mission," even as U.S. forces went on the offensive against global terrorism (DOD, 2001). The Federal Aviation Administration took immediate action to strengthen airport security. The Federal Bureau of Investigation restructured its headquarters to increase its focus on the prevention--rather than the investigation--of terrorist attacks. The anthrax attacks provided an additional impetus to the nascent bioterrorism program in the U.S. Department of Health and Human Services and heightened concerns in the U.S. Department of Agriculture. Organizations with the words "homeland security" in their titles suddenly cropped up throughout government and industry. Legislation was introduced, and budgets were augmented--all before we had developed a strategy or defined our priorities.

If we fast-forward to the first anniversary of our wake-up call, it is easy to imagine two potential--and equally undesirable--outcomes. Given the vast number of vulnerabilities inherent to our free society, and given the absence of clearly established national priorities, we could easily spend billions of taxpayer dollars and make little meaningful progress toward protecting our homeland from future terrorist threats or attacks. Alternatively, if Osama bin Laden fades from the scene and we experience no additional catastrophic attacks, we could declare success, turn our attention to other national issues, and continue to let entrenched bureaucracies prevail--thus allowing the current patchwork of organizational strategies to substitute for a national strategy.

To avoid these mistakes, we should learn from the past. After winning the Cold War, we failed to retool our national security establishment for the emerging asymmetric threat environment even though the need was discussed ad nauseam. In the aftermath of September 11, we heard the usual calls to investigate the organizational failures that had permitted the attacks. Instead of looking for culprits, we should consider it a failure of national strategy, policy, and will. The bottom line is that we--collectively--failed to heed well documented concerns; we did not make the tough decisions necessary to defend our homeland effectively. We should not assume that Osama bin Laden and his al Qaeda network are the only ones with the ability or desire to use asymmetric weapons; history is replete with examples. Nor should we assume that large oceans and friendly neighbors, even when backed by military power, can provide sanctuary from asymmetric threats. September 11 should be example enough. To protect our nation we must also defend our homeland.


Planning
Developing a strategy will be hard--and implementing it will be even harder. A national strategy for ensuring the security of our homeland will engage players who have not been part of our traditional national security apparatus--such as Health and Human Services and the Department of Agriculture. The strategy must bridge the gap between foreign intelligence and domestic intelligence authorities and policies--recognizing that geographic boundaries are not absolute in an era of global markets and coalition warfare. Federal control will have to be ceded to exploit inherently distributed authorities--as well as to leverage the knowledge and resources of other stakeholders. A comprehensive national strategy must link federal, state, and local strategies and integrate the strategies of private corporations who own much of our nation’s critical infrastructure. It should include an education and training program that supports the adaptation of operational strategy as well as tactical preparedness in a world of evolving threats and thinking enemies. It must provide a strategy for communication so we can share information--what we know and what we don’t know--with American citizens as well as operational communities. A national strategy will be supported--but not replaced--by a comprehensive budget plan that aligns resources with national priorities. An effective strategy for homeland security will inevitably alter the missions of many existing organizations--and most likely will require the creation of new organizations with new missions. Building such a strategy will be hard--but we must do it. We can no longer afford either the lowest common denominator solution that too often emerges from fully coordinated efforts or the patchwork of point solutions contributed by individual agencies.

Perhaps the greatest initial challenge will be defining success. What is the ultimate goal of the homeland security mission? How will we define success? Are we defending America--the nation--or protecting every individual American from every conceivable terrorist threat? If we set the bar too high, the resource requirements will be unaffordable and the loss of personal freedoms untenable. If we set it too low, American citizens may lose confidence in the government’s ability to protect the nation from terrorism. If we fail to answer the question, we will have no context for making decisions.

Once we have defined success, we must identify interim outcomes against which progress can be measured. This will require that we define priorities against which resources can be allocated, as well as responsibilities against which performance can be evaluated. These are the basics of any good strategy. But a definition in the context of homeland security presents a formidable challenge because of the scope of our national objectives, the diversity of the potential threats, and the fragmented ownership of both resources and responsibilities.


Strategic Framework
Ensuring the security of our homeland is inherently a multidimensional problem. A relatively simple framework would include three dimensions--national objectives, potential threats against which we are defending, and the operational entities that will implement the strategies.

A comprehensive strategy for homeland security must encompass all phases of the strategic cycle. Therefore, the national objectives must be deterrence, prevention, preemption, crisis management, consequence management, attribution, and response (ANSER, 2001). The ultimate goal, of course, is to deter future attacks--by convincing the enemy that their efforts will be unsuccessful and/or that our response will be both immediate and devastating. But our traditional deterrence model is inadequate in a world in which suicide missions are common, commercial objects can be used as weapons, attacks can be launched anonymously, and adversaries may occupy no sovereign territory that can be held at risk. Therefore, although maintaining our nuclear and conventional military power is vital to our nation’s security, we must also bolster our security with a national policy and defense capabilities that explicitly address asymmetric threats to our homeland. In short, this will mean we must implement strategies to prevent the acquisition or delivery of asymmetric weapons, to preempt attacks already in motion, to limit the impact of an attack through crisis and consequence management, to attribute an attack to the perpetrator as well as the ultimate sponsor, and to respond immediately with the full force of our military and/or legal establishments. Deterrence will be most effective if our intent is made clear through policy and our ability is underpinned by operational capabilities that address all phases of the strategic cycle.

The spectrum of asymmetric options includes biological, chemical, unconventional nuclear or radiological, cyber, and enhanced conventional weapons--and is limited only by our adversaries’ imaginations (ANSER, 2001). We cannot hope to protect every building from a truck bomb or every public event from a biological release; nor can we afford to inspect every item that crosses our borders. For some threats, our focus will necessarily be on the latter part of the strategic cycle—dealing with the aftermath. We must, however, think through the spectrum of possibilities and make conscious decisions about the defenses we will implement, as well as how we can improve our capability of mitigating the impact of a catastrophic attack. And our ability to attribute an attack, coupled with the will to respond, must be apparent.

The strength of our nation is based on the distribution of authority and power among federal, state, and local governments, the free market that is the basis of our economy, and the personal freedom and privacy afforded to every citizen. Responsibility for protecting our homeland is distributed across a range of diverse organizations—complicating the development and implementation of a national strategy. How can we ensure that related fragments of information are fused to create national—versus local—situational awareness? How can we create the excess capacity that would be needed to respond to a biological attack in a market-driven health care system? How can we identify terrorists living among us without infringing on the privacy of our citizens? We must defend our homeland, but we must also protect the strengths of our nation.

The goal should be a national strategy—not a federal strategy—a synergy of the actions of individual organizations at all levels, ensuring that gaps are filled, conflicts are eliminated, and overlaps are minimized. The three-dimensional framework in Figure 1 may help to visualize the inherent complexities of the challenge. Within each subcube, we have a national objective, a threat category, and operational entities with varying responsibilities. Although operational responsibilities will not be uniformly distributed, a comprehensive national strategy must assign missions and authorities within each space.


Implementation
If we try populating the framework with current organizations and assigned missions, we can get an idea of the lack of coherence in our current state. Fault lines created by legacy missions appear not only at subcube boundaries, but also within each space. We cannot effectively define a strategy for meeting one national objective in isolation any more than a single organization can define its strategies in isolation.

The strategic cycle is a continuum rather than a set of discrete objectives, and success will depend on the sharing of information around the entire cycle. At any given time, we will be working to deter and prevent future attacks on our homeland; the insights gained will provide useful information for the consequence management community as it prepares for potential future attacks. Knowledge acquired through a preempted attack may inform national response and help deter future attempts. In other words, the boundaries between foreign and domestic intelligence authorities, as well as between national security and homeland security, will create additional fault lines that must be bridged.

Each threat category introduces its own complexities for various parts of the strategic cycle. It will be difficult to prevent an adversary from acquiring or delivering an asymmetric weapon—particularly when the weapon can be constructed from commercially available components and our own infrastructure can serve as a delivery system. Prior to September 11, few people would have included commercial airliners on the list of asymmetric weapons; even fewer would have called our U.S. Postal Service a weapon delivery system. In some instances, particularly if we are talking about biological or cyber weapons, it may be difficult to detect an attack. Cyberterrorists can hide their preparations in a background of hacker noise, can operate from safe havens far from the point of attack, and can choose from a variety of failure modes—some of which may be indistinguishable from common system failures. The slow-motion aspect of bioattacks, coupled with their similarity to natural outbreaks of disease, will complicate early detection and, therefore, our ability to mitigate the consequences—as well as to ensure positive attribution. Crisis and consequence management strategies designed for an explosion cannot equip us to deal with a biological attack. We must analyze each threat category separately across the full range of objectives to identify situations that require unique capabilities.

To build effective defenses, and to ensure our ability to mitigate the impact in case of an attack, will require that we identify likely targets for each threat category. Potential homeland targets include large gatherings of people, symbolic facilities, and critical information or infrastructures—including industries that underpin our national economy. It is readily apparent that the possibilities are endless—and equally apparent that we cannot hope to imagine every potential attack. But too often we focus our resources on preventing a recurrence of the last attack rather than imagining the next one. Recent terrorist attacks—and attempted attacks—demonstrated significant creativity on the part of our adversaries; but our nation’s capacity for innovation can provide a formidable basis for the development and evolution of a national strategy. What we need is an ongoing process that includes imagining attack scenarios, drafting strategies that span the cycle of national objectives, and independent gaming to test the efficacy of strategies. Over time, this approach will yield increasingly robust national strategies; the challenge will be to create new scenarios continually to keep us one step ahead of our adversaries, who will be observing us and learning from our actions.

But even the best strategy will be worthless unless it is implemented. Therefore, we must also develop a national playbook—a living playbook—to guide the activities of diverse operational entities. Just as no sports team can be fielded without practicing, our homeland security teams must participate in exercises to build relationships and institutionalize processes, thereby creating an end-to-end capability. In the aftermath of the September 11 attacks, it became clear that some federal authorities, some local authorities, and some private companies all had fragments of information related to the attacks; but we had neither processes nor relationships in place to construct an operational picture until it was too late. The same thing could happen if a biological attack were launched against us. Our nation has never confronted a deliberately introduced contagious pathogen, but we know that a biological warfare attack is unlikely to obey traditional public health models that predict the spread of infectious disease. Therefore, our ability to mitigate the consequences of such an attack will depend in large measure on our having exercised in advance contingency plans to keep our society functioning. Plans and exercises cannot cover every possible attack, but they will, over time, create a robust capability for protecting our homeland.

The question that continues to plague the government is who is in charge. The answer must be—it depends. Even at the federal level, there is no way to reorganize so that a single individual—apart from the President—would be in charge for every conceivable situation. In addition, much of the responsibility for homeland security will be vested in organizations outside the federal government. We must not let our desire for hierarchical command and control become our Achilles heel. Through ongoing scenario development, planning, and exercises, we can, over time, find an answer to the question. But it is likely to be it depends.


Conclusion
We have never lived in a risk-free world—and a comprehensive national strategy for homeland security will not change that. We must aim for success—deterrence of future terrorist attacks—but prepare for failure. We must build strategies for each phase of the strategic cycle to meet a broad spectrum of potential threats. These strategies must define people, processes, and technologies—in military terms, training, doctrine, and materiel—and must clearly assign responsibility and accountability to appropriate operational entities. The strategies must be accompanied by measurable outcomes and clear metrics and must be supported by a comprehensive budget plan that aligns resources with responsibilities.

But we must not stop there. We are facing a world in which agility defeats bureaucracy. We need a planning process—rather than a static plan—to protect our homeland. Only by continually adapting our plans to new threat scenarios and exercising those plans can we hope to defend ourselves against evolving threats and thinking enemies. As Dwight Eisenhower aptly said, “In preparing for battle I have always found that plans are useless, but planning is indispensable.”


References

• ANSER. 2001. A Primer on Homeland Security: Strategic Functions, Threats, and Mission Areas, by Randy Larsen and Dave McIntyre. Available online at: <http://www.homelandsecurity.org>.
• DOD (U.S. Department of Defense). 2001. Quadrennial Defense Review Report. Washington, D.C.: U.S. Department of Defense.
• National Defense Panel. 1997. Transforming Defense: National Security in the 21st Century. Washington, D.C.: U.S. Department of Defense.
• USCNS (United States Commission on National Security/21st Century). 1999. New World Coming: American Security in the 21st Century. Available online at: <http://www.nssg.gov>.
• USCNS. 2001. Road Map for National Security: Imperative for Change. Available online at: <http://www.nssg.gov>.

Figure Captions
Figure 1 Strategic framework for homeland security.


Pull Quotes
On September 11, 2001, “homeland security” had still not been defined.
Federal control will have to be ceded to exploit inherently distributed authority and to leverage the knowledge and resources of other stakeholders.
We must protect our homeland, but we must also protect the strengths of our nation.