America finds gaps in security hard to close

Nearly five years after 9/11, the United States remains far too vulnerable to natural disaster and major attack.

That's the consensus of security experts and a new federal report released Friday. Most states and local authorities lag in emergency planning, the report found. At the same time, the federal government is still struggling to close big security gaps in airline passenger screening and port security and at chemical plants, these experts say.

The reasons are many, they add, but a crucial one is American industry's limited security efforts. An estimated 85 percent of critical infrastructure is in private hands. But the Bush administration has largely resisted mandating the minimum security standards for business.

"What we've done at this point is look to the private sector to set their own security standards – and if they're doing it, they're doing it very, very slowly," says Lee Hamilton, president of the Woodrow Wilson International Center for Scholars and vice chairman of the 9/11 Commission. "It's not working very well, so maybe we have to think more seriously about government imposing standards."

The result? The nation's guard is down, critics say, or at least not what it should be.

"We haven't come very far at all in terms of credible security that would deter a determined terrorist from going after the things most valuable and vulnerable," says Stephen Flynn, a senior fellow for national security studies at the Council on Foreign Relations in Washington.

The chemical industry, for example, has adopted voluntary standards yet remains highly vulnerable. The risk is so high that if a worst-case scenario occurred at any of 123 US chemical plants, the resulting release of toxic gases could put 1 million people at risk of exposure, the Government Accountability Office (GAO) reported in April.

While the GAO noted some progress in chemical security, it reported that only one-sixth of 15,000 facilities with large quantities of dangerous chemicals are covered by federal security requirements. And the Department of Homeland Security (DHS) has no authority to require minimum standards. In March, DHS Secretary Michael Chertoff told Congress he needed legislative authority to mandate minimum standards.

Federal standards would create a "level playing field," says Mr. Hamilton, who calls the move long overdue. At the moment, companies that adopt tough security measures put themselves at a cost disadvantage to those who do not.

"Everyone in the business community knows that we're just a single event away from the federal government jumping in with both feet to tell us how to do it," Dr. Flynn says. So taking unilateral steps, which might not square with future federal mandates, looks risky, he adds. "No sector is going to make a substantial investment under these conditions. If they don't see the government on board with it, they're not in a position to do anything."

There are also legal liability reasons businesses may hold back. How much security is enough to avoid a jury verdict after an attack? It's hard to know without a standard.

"The government needs to be able to say 'This is what is required – A,B,C, but not D – and if you fail to do D, we recognize your good faith effort,' " Flynn says.

One industry that has broadly taken the initiative is railroads. Companies have drawn up their own emergency response plans and have even conducted war games using their own prioritized list of crucial infrastructure. Yet, without federal leadership, states have been reluctant to supply national guard troops for practice sessions and some key infrastructure goes lightly guarded, crimping preparedness, a senior railroad official says.

Those shortfalls and others were again hammered home in a major review of national preparedness unveiled Friday. Conducted in 56 states and territories and 75 urban areas over the past six months, that review envisioned hurricane, influenza, and terror attack scenarios and analyzed some 2,800 emergency operations plans along with interviews with first responders.

While the US is generally prepared for tornadoes and other localized, and even statewide emergencies, the nation is not prepared for catastrophes that strike multiple states at once. Just 13 percent of states and 7 percent of urban areas had plans for mass evacuations rated as "sufficient." Among state plans in the hurricane belt, less than 65 percent were rated sufficient.

A key problem, experts say, is that government and first responders at all levels need to practice their complex response plans. But less than one-fifth of the $18 billion spent just on disaster preparedness has gone toward training, the bulk going toward communication and detection equipment, said George Foresman, DHS undersecretary for preparedness, at a press conference Friday.

That lack of practice has led to foul-ups. During hurricane Katrina, for instance, the Federal Emergency Management Agency "had an empty passenger train parked at Baton Rouge for three to four days after it hit," says the railroad official, who asked not be named because he is not authorized to speak to the press. "It was used maybe once to evacuate people, but could have been used a lot more if there was more decisiveness. The role of the government, as we see it, is to set priorities. That's what we need."

Federal failure to prioritize critical infrastructure has also contributed to some key assets remaining unguarded, the railroad official says.

"There is infrastructure we've pinpointed that, if it were destroyed, would be a major problem for the country," the official says. "These assets aren't as well protected as they should be."

Preparedness is also lagging in certain other key areas. A flu pandemic could knock out a third of the nation's rail capacity. Yet without priorities set by government for what must be carried on remaining rail capacity, the results could be a mess.

"Do we need more Nintendos hauled to stores – or more coal and grain?" the railroad official asks. "We can't make that decision. Someone in government has to make those decisions as to what's a priority."

Slowly, that is happening. A just completed federal plan for dealing with a bird-flu pandemic includes a range of tools for setting such priorities, points out Mr. Foresman in a phone interview last week. Authority of governors and the president to mandate essential services ensures coal will travel ahead of Nintendos, he notes. Foresman favors risk-based, minimum performance standards rather than spelling out to industry specific technologies that must be adopted.

Prioritizing the nation's critical infrastructure remains a challenge. The list of crucial sites ballooned from 143 shortly after 9/11 to more than 270,000 today.

"Do we have a fully prioritized list yet? No. But we have a robust list," Foresman says. "We are getting better."

Standards alone are no panacea. Security gaps remain even in areas where government has imposed them. For example: the US still doesn't screen all airline passengers against a comprehensive terrorism "watch list," says Clark Kent Ervin, former inspector general of DHS and author of "Open Target," a book strongly critical of the nation's preparedness.

Nearly two years after 9/11, soon after he started at DHS, Ervin sent undercover teams to airports to try to sneak weapons aboard aircraft – knives, mock explosives, and real guns. Despite billions of dollars spent over the past three years on various initiatives including luggage-scanning systems, airport screeners at many airports were no better at detecting weapons in 2003 or again in 2004 than they were in 2001, Mr. Ervin says. Even now, not all cargo luggage is scanned for explosives, he adds.

The GAO report in April echoed the sentiment. Despite progress measuring the effectiveness of its screening systems, covert testing shows, it found that "weaknesses and vulnerabilities continue to exist" in airline passenger weapons screening.

Overall, "we're much more secure than we used to be," says Foresman, citing hardened cockpit doors, air marshalls and federalized passenger screening. "For every one [weapon] that does get through, hundreds or thousands don't."

Critics disagree. "Unless the federal government is willing to take responsibility as well as accountability for setting minimum security requirements within these [port, rail, hazardous material trucking and chemical] sectors, we're not going to see much progress," says Flynn.

Even among those willing to grant the administration points for progress, there is a sense the job is only a bit better than halfway done.

"It took the US a decade to get things in place to fight the cold war," says James Carafano, an analyst at the Heritage Foundation in Washington. "We have a layered, risk-based approach to security this time, and it will take time to implement. It's a good approach. I would argue it is kind of working."