'There Is No Perfect Security'

By MICHAEL CHERTOFF
February 14, 2006;

Last week President Bush introduced his budget for fiscal year 2007, requesting a 6% increase for the Department of Homeland Security. More importantly, however, his budget recognizes that in order to protect our country and defend our freedoms, we must continue to focus resources on the areas that pose the greatest risk. That is why, among the funding increases, we expect to devote an additional $80 million to the Urban Areas Security Initiative, a program that awards grants to our state and local partners based on a strict assessment of risk and need.

This process of assessing risk and setting priorities should be familiar to those in the private sector. Companies use risk management to make tough decisions and weigh the costs and benefits of a particular set of investments in money and effort against an array of potential outcomes. For our department, risk management starts with weighing threats, vulnerabilities and consequences of a potential terrorist attack or catastrophic event, then conducting a rigorous, information-driven analysis both to set priorities for resources and to give focus and strategic direction to our policies and programs.

In short, we drive homeland-security investments by looking to facts and analysis, not politics. We acknowledge, however, that while most people support risk management in theory, enthusiasm tends to diminish once it is applied in practice. This is because risk management, by its very nature, involves a trade-off. In a free and open society, we simply cannot protect every person against every risk at every moment in every place. There is no perfect security. If we tried to attain total security the cost would be exorbitant -- in financial terms and in lost freedom and prosperity. Balancing risk necessarily means applying resources against the highest risks -- and not against all risk. As in any trade-off, some will gain resources and others will not.

Though we anticipate a strong budget next year, resources are not limitless. The most effective and fair strategy for securing our homeland -- whether at our borders, our ports, our airports or our chemical facilities -- is tough-minded, common-sense distribution of resources through risk management. Risk management must be used to set federal funding priorities and ensure that federal homeland-security dollars are targeted to where risks and needs are greatest.

For example, we currently distribute homeland-security funding in two ways. One is to give a set percentage of total grant funds to every state based on population and political jurisdiction. While it is true that every state has homeland-security needs, not every state bears risk equally, and common sense tells us not all risks deserve to be funded at the same level.

A more sensible funding approach is to conduct a disciplined, risk-based analysis that provides a clearly defined, data-intensive assessment of where the risks are greatest in our country. Only then can we make a strategic investment of resources to "buy down" the risk and ensure that funds are building critical homeland-security capabilities in the right places and at the right levels. The Department of Homeland Security is fully committed to this risk-based funding approach, and this year we will provide more than $1.4 billion to states, high-threat urban areas, ports and mass-transit operations based solely on risk and need.

Of course, risk management is about more than just funding. We have to manage the risk posed by thousands of individuals and tons of cargo arriving at our airports, seaports and overland borders every day. This means promoting optimal security without damaging the flow of travelers and trade that promote our prosperity. Since 9/11, we have implemented a full range of screening systems, technology and infrastructure to identify and dismantle potential threats while keeping the lines moving and cargo flowing.

For airline passengers, risk management means using information and intelligence, coupled with advanced technology and screening procedures, to check individuals quickly -- and to focus on those who pose the greatest risk. For shipping containers, it means using information and intelligence to separate high-risk cargo from low-risk cargo and then inspecting those containers that give us cause for concern. This allows us to keep our maritime trade moving, preserve jobs and promote our economy. For critical infrastructure, it means working with the private sector to conduct a thorough assessment of facilities and security plans, and then taking specific steps to address threats and reduce vulnerabilities, without laying a heavy regulatory burden on businesses.

As threats, vulnerabilities and consequences increase or decrease, risk management allows us to adjust security measures up or down, constantly re-evaluating them in light of the latest intelligence and short- and long-term trends. In fact, security burdens need not always increase. For example, because we have implemented multiple layers of security in our aviation system -- from hardened cockpit doors to federal air marshals -- we are now able to lighten some restrictions on what passengers can bring aboard aircraft. The result is less hassle for travelers and a greater focus by our screeners on high-consequence items like explosives.

At the end of the day, we cannot protect our country by closing our doors or shutting down the systems we depend upon every day. We protect our country by effectively managing risk. We will always have to make tough choices about how to spend finite resources to provide the best possible protection for ourselves and our country. By using risk management as a template for setting homeland-security priorities, we can make sound decisions and remain flexible to the changing threats and challenges of the 21st century.