Katrina and the Case for Risk

The question of whether or not the Department of Homeland Security is too big a bureaucracy with too many missions has dogged the agency since even before it was created. But it always has been a theoretical question for wonks and think tanks.

Hurricane Katrina and the ensuing floods made the theoretical visceral. And it provided shocking evidence that the answer is Yes. DHS is too big and supports too many missions.

But there's more texture to the answer than that. Besides its size and lack of focus, DHS has also elevated some of its missionsanti-terrorism, for examplewhile enfeebling otherslike emergency preparedness. The Federal Emergency Management Agency was once a Cabinet-level agency with historically decentralized operations. The power of FEMA's decentralization was its ability to understand threats specific to local geographies and have local expertise inform the responses. Once FEMA was subsumed by DHS and centralized in Washington, it lost the very model that made it effective.

This became painfully evident last week as images and reports from the Gulf Coast told one story, and DHS leadersand we use that term looselyin Washington told another. FEMA chief Michael Brown managed to blame victims for not evacuating the city, despite the fact many didn't have the means to evacuate. He also was quoted as saying, "I've heard no reports of unrest" and, "I actually think the security is pretty darn good. There's some really bad people out there that are causing some problems, and it seems to me that every time a bad person wants to scream or cause a problem, there's somebody there with a camera to stick it in their face." That is, its the medias fault.

On NPR's All Things Considered, host Robert Siegel asked DHS secretary Michael Chertoff about the thousands of people in the New Orleans Convention Center, surviving with no food or water amongst corpses and human waste, and when they would get relief. "The one thing about an episode like this is if you talk to someone and you get a rumor or you get someone's anecdotal version of something, I think it's dangerous to extrapolate it all over the place," Chertoff said. Later, Chertoff and Brown were forced to admit they didn't know about the widely documented, verified, horrifying conditions at the Convention Center.

Brown's and Chertoff's knee-jerk reactions were remarkably similar: The buck stops somewhere else and if you try to pin the blame here, you're just part of that media spin machine that sticks cameras in faces and promulgates rumors.

From a security standpoint, the most offensive reaction of all from Washington was the perfect storm defense. Chertoff used this. It's the notion that Katrina was unforeseeable, a cataclysmic act of God. Chertoff was quoted as saying the levee breach that resulted in floods "exceeded the foresight of planners," and "is one which I really think is breathtaking in its surprise."

But that is patently false. If anything, it was breathtaking in its predictability.

The levees were known to be designed for only category 3 hurricanes and anything worse could drown the city; Katrina was a category 4. It was also known that funding for maintaining the levees had dwindled. The head of the National Hurricane Center told FEMA 32 hours before the storm reached land that it would likely overtop the levees. In August 2002, Adam Cohen of The New York Times wrote a story called "If the Big One Hits, New Orleans Could Disappear." That same year, the New Orleans Times-Picayune ran a detailed five-part story on a doomsday flooding scenario and the state of the levees. The Army Corps of Engineers has reiterated over the past few days that it has feared this scenario for decades. Last year, New Orleans participated in an exercise called "Hurricane Pam," which simulated a Category 5 hurricane and flooding eerily similar to Katrina. Even Michael Brown, who works for Chertoff, said on Larry King Live last week, "...we planned for it two years ago. Last year, we exercised it. And unfortunately this year, we're implementing it."

All of this warning, all of this threat data, and still a hesitant, ineffective, callous response when the disaster struck. What's going on here?

It seems to be a classic example of perceived versus actual risk. The perceived number-one risk of the day is terrorism. We are scared of it. We must stop it. We have declared war on it. This is Michael Chertoff's number-one job, to be sure. Tighten up the borders. Make air travel safer. Protect critical infrastructure from bad guys.

This is an important job. But if we were to run a statistical risk analysis, we'd quickly find out that a catastrophic natural disaster is far more likely to happen than a terrorist attack, the financial outfall from such a natural disaster is as great or greater than from a terrorist attack, and in this case we have a region predisposed to suffer such an event. A known sitting duck.

But still terrorism wins the day in Washington. Why? Two reasons. One, emotionit always clouds our risk analysis. It's what makes us afraid to fly on a plane when really we should be about 300 times more afraid to drive our car to the store to get milk. As its very name describes, terrorism grabs our psyche and compels an emotional response which usually isn't matched up to the actual risk.

And two, it's policy. At this point, it benefits this administration's agenda to keep terrorism front and center, even if that means burying or shirking other real, more prominent risks.

To be sure, terrorism is still a real risk, and no one should argue (or is arguing here) that terrorism should not be a concern to DHS. What is being argued is that resources should be allocated commensurate to the actual risk profile for the so-called homeland. It would be interesting to see what DHS would look like if it were run based on risk analysis. I suspect that agencies like FEMA and the Coast Guardwhich mitigate many common, predictable threatswould dominate the agency and we'd hear a lot less about (and give a lot less money to) things like bioterrorism defense and face recognition for airport screening of potential terroriststhreats that, while real, are in statistical terms relatively rare.

Then again, if we had responded rationally post-9/11, with a dispassionate, risk-based response, DHS probably never would have been created in the first place. In terms of risk, such a megabureaucracy just doesn't make any sense. FEMA may still have been a Cabinet-level agency, and Katrina may not have been the miserable debacle it has become.

What do you think? Let me know at sberinato@cxo.com

Copyright © 2005 IDG Communications, Inc.

The 10 most powerful cybersecurity companies