Introduction
The Office of Infrastructure Protection (OIP) in the Department of Homeland Security (DHS) has been developing and maintaining a National Asset Database. The Database contains information on a wide range of individual assets, from dams, hazardous materials sites, and nuclear power plants to local festivals, petting zoos, and sporting good stores. The presence of a large number of entries of the latter type (i.e., assets generally perceived as having more local importance than national importance) has attracted much criticism from the press and from Members of Congress. Many critics of the Database have assumed that it is (or should be) DHS's list of the nation's most critical assets and are concerned that, in its current form, it is being used inappropriately as the basis upon which federal resources, including infrastructure protection grants, are allocated. According to DHS, both of those assumptions are wrong.
The purpose of this report is to discuss the National Asset Database: what is in it, how it is populated, what the Database apparently is, what it is not, and how it is intended to be used. The report also discusses some of the issues on which Congress could focus its oversight. This report relies primarily on a DHS Office of the Inspector General (DHS IG) report,1 released on July 11, 2006, but makes reference to other government documents as well.
A Short Review of the DHS IG Report
The genesis of the National Asset Database remains somewhat unclear. A list of critical sites was begun in the spring of 2003 as part of Operation Liberty Shield.2 The list contained 160 assets, including chemical and hazardous materials sites, nuclear plants, energy facilities, business and finance centers, and more. The assets were selected by the newly formed Protective Services Division within the Office of Infrastructure Protection, in what was then called the Information Analysis and Infrastructure Protection Directorate, Department of Homeland Security. The Secretary of DHS asked states to provide additional security for these sites.3
During the course of the year (2003), DHS continued to collect information on various assets from a variety of sources. By early 2004, DHS had accumulated information on 28,368 assets. Although Operation Liberty Shield was now considered over, the initial list of 160 critical assets, those judged to be in need of additional protection because of their vulnerability and the potential consequences if attacked, grew to 1,849 assets and became known as the Protected Measures Target List.4 It is not clear when the information being gathered became known as the National Asset Database.5
By January 2006, according to the DHS IG report, the Database had grown to include 77,069 assets, ranging from nuclear power plants and dams to a casket company and an elevator company. It also contains locations and events ranging from Times Square in New York City to the Mule Day Parade in Columbia Tennessee (which, according to the city's website, draws over 200,000 spectators each year for the week-long event).
The IG report categorized entries in the National Asset Database by critical infrastructure/key resource sector (see Figure 1).6 Additionally, the DHS IG report identified some of the entries with more specificity. For example, the Database contained, at the time, 4,055 malls, shopping centers, and retail outlets; 224 racetracks; 539 theme parks and 163 water parks; 1,305 casinos; 234 retails stores; 514 religious meeting places; 127 gas stations; 130 libraries; 4,164 educational facilities; 217 railroad bridges; and 335 petroleum pipelines.
|
Figure 1. National Asset Database Entries by Sector |
Source: Office of the Inspector General. Department of Homeland Security. Taken from Progress in Developing the National Asset Database. |
The DHS gets information for the Database from a variety of sources. According to the National Infrastructure Protection Plan (NIPP)7, sources include existing government and commercially available databases;8 sector-specific agencies and other federal entities; voluntary submittals by owners and operators; periodic requests for information from states and localities and the private sector; and DHS-initiated studies. The number of assets in the Database is expected to grow as additional information is gathered.
The DHS IG report focused much of its attention on information provided by states and localities as the result of two data requests made by DHS. According to the DHS IG report, the vast majority of the 77,069 entries was collected as a result of those requests.
According to the IG report, the first data call to the states, made by the Office of Domestic Preparedness in 2003, yielded poor quality data.9 The IG report described the guidance given states and localities as "minimal."10 The guidance apparently did tell states, however, to "consider any system or asset that, if attacked, would result in catastrophic loss of life and/or catastrophic economic loss."11 As a result, assets such as the petting zoos, local festivals and other places where people within a community congregate, or local assets ostensibly belonging to one of the critical infrastructure sectors, were among the assets reported. According to the IG report, many state officials were surprised to learn that additional assets from their states were added to the Database, which raises additional questions about how the information was collected.
According to the IG report, the second request to the states for critical infrastructure information came from the Office of Infrastructure Protection in July 2004 and was "significantly more organized and achieved better results."12 Guidance was more specific, as was the information requested. DHS requested information for 17 data fields. Of those, DHS considered the following to be most important: address, owner, owner type, phone, local law enforcement point of contact, and latitude and longitude coordinates.13 States were also asked to identify those assets that they felt met a level of national significance. Criteria for identifying assets of national significance was provided by DHS. The criteria described certain thresholds, such as refineries with refining capacity in excess of 225,000 barrels per day, or commercial centers with potential economic loss impact of $10 billion or capacity of more than 35,000 people. Although the request was more specific, states were given much leeway as to what to include, and OIP accepted into the Database every submitted asset.14 As a result, additional assets of questionable national significance were added to the Database.15
The DHS IG report drew two primary conclusions. The first is that the Database contains many "unusual, or out-of-place, assets whose criticality is not readily apparent,"16 while, at the same time, it "may have too few assets in essential areas and may present an incomplete picture."17 The second conclusion was that the types of assets that were included and the information provided are inconsistent from state to state, locality to locality. For example, California entries included the entire Bay Area Regional Transit System as a single entry, while entries listed for New York City included 739 separate subway stations.18
The IG report made 4 recommendations:
- review the National Asset Database for out-of-place assets and assets marked as not nationally significant, and determine whether those assets should remain in the Database;
- provide state homeland security advisers the opportunity to review their assets in the Database to identify previously submitted assets that may not be relevant;
- during future data calls, provide States a list of their respective Database assets to reduce ... duplicate submissions; and
- establish a milestone for the completion of a comprehensive risk assessment of critical infrastructure and key resources and ensure they are accurately captured in the National Infrastructure Protection Plan.
The National Asset Database: What It Is and What It Is Not
The National Strategy for Homeland Security recognized that not all assets within each critical infrastructure sector are equally important, and that the federal government would focus its effort on the highest priorities.19 The National Strategy for the Physical Protection of Critical Infrastructure and Key Assets stated that DHS will develop a methodology for identifying assets with national-level criticality and using this methodology will build a comprehensive database to catalog these critical assets.20 Judging from the criticism leveled at it, many believe the National Asset Database is (or should be) DHS's list of assets critical to the nation.
However, in his written response to the IG report, then-Undersecretary for Preparedness, George Foresman, to whom the Office of Infrastructure Protection reported, stated that the National Asset Database is "not a list of critical assets...[but rather] a national asset inventory...[providing] the 'universe' from which various lists of critical assets are produced."21 According to the National Infrastructure Protection Plan, the National Asset Database is a comprehensive catalog with descriptive information regarding the assets and systems that comprise the nation's critical infrastructure and key resources.22 The Assistant Secretary for Infrastructure Protection, Robert Stephan, has called the Database a 'phonebook' of 77,000 facilities, assets and systems from across the nation, needed to facilitate more detailed risk analyses.23
Some may ask why there should be this difference in perception regarding the National Asset Database. One possible explanation is that, as noted above, the National Asset Database started out as the Protected Measures Target List, which was a prioritized list of assets considered critical at the national level. Also, as reported in at least one media source, when asked for its list of critical assets, Members of Congress were shown the expanded list containing the questionable assets.24 Based on subsequent response, Congressional interest appears focused on a prioritized list.
Also, what is meant by the term "critical infrastructure" continues to generate some confusion. The definition provided in the USA PATRIOT Act and in other policy documents refers to specific assets or systems within a selected set of sectors or categories. However, the term also is used often to identify the sectors and categories themselves. For example, the transportation sector is often called a critical infrastructure, when, according to the statutory definition, only those assets within the transportation sector whose loss would be debilitating to the nation should be called critical infrastructure. Given the varied usage of the term critical infrastructure, the National Infrastructure Protection Plan description of the National Asset Database above, is unclear. Is it a list of assets that are critical, or is it a list of assets that make up each of the critical sectors, with criticality to be determined later?
What Are Its Intended Uses?
There appear to be two primary uses for the Database: as a first step in a prioritization process that eventually will help focus risk reduction activities; and, to provide a degree of situational awareness. According to Assistant Secretary Stephan, the Database "does not drive the Department's funding decisions."25
First Step in Identifying Critical Assets and Prioritizing Risk Reduction Activities
Taking an inventory of one's assets is a standard first step for most risk management processes used to prioritize the protection of those assets.26 The second step is to screen this initial list for those assets considered critical to the organization (or country) using specific criteria. Further analysis is focused on these critical assets. The National Infrastructure Protection Plan establishes DHS's risk management process. According to the NIPP, identifying the assets that comprise the nation's 17 critical infrastructure sectors and key resources within the National Asset Database represents the first step in its process.
As envisioned by the NIPP, DHS will then select those assets from the Database it considers critical to the nation as a whole.27 If the asset is judged not to be critical from a national perspective, DHS does not require any further information. If the asset does have the potential to be critical, DHS will ask for more information, which includes information that will support further risk and risk mitigation analysis (e.g., vulnerability to specific forms of attack or natural disasters and more detailed analysis of the consequences associated with the loss of the asset, including interdependencies with other assets). Vulnerability, consequences, and threat information then will be integrated to yield a risk score. According to the NIPP, those assets that pose the greatest risk are further analyzed to identify potential risk reduction initiatives, which are then prioritized (i.e., the risk reduction initiatives) based on their cost-effectiveness. According to the IG report, DHS officials acknowledge that many of the assets currently in the Database "will never be analyzed in depth or used to support any program activity."28
According to the Assistant Secretary, DHS has identified a shorter list of assets that it considers high priority, based on its analysis of vulnerability to attack or natural events and the possible consequences.29 This list is apparently prioritized further.30 The Assistant Secretary asserted that this shorter list does not contain petting zoos, popcorn factories or other such facilities.31
While it may be common practice to take an initial inventory of one's assets as a first step in a risk management process, detailed information on individual assets is not necessarily needed to determine their criticality. The presence of gas stations listed in the National Asset Database is a case in point.
Gas stations could be considered a part of the oil and gas infrastructure, a subsector of the energy sector. In assessing the oil and gas infrastructure, one may want to identify, in general, all the assets that make up that infrastructure from production fields, to refineries, to distribution, and all the transport elements in between. Gas stations would be on that list, at the very end of the distribution chain. In determining which assets are the most critical, one does not need specific information on individual gas stations to determine that the loss of any individual gas station would have a minimal effect on the distribution of gasoline throughout the country, or on the economy, or national public health, beyond the immediate vicinity of the gas station itself. Yet the National Asset Database contains 127 gas stations. Unless these 127 specific gas stations have some unique characteristics (perhaps being located next to an identified critical asset which could be damaged if there were a loss of the gas station), maintaining specific information on those gas stations seems unnecessary to determine their criticality.32
Situational Awareness
DHS justifies keeping assets that have not been judged as being critical at the national level in the Database as a way to provide a degree of situational awareness.33
Undersecretary Foresman noted in his response to the IG report that, "Many assets not 'critical' are, in fact, critical depending upon the circumstances...."34 For example, as noted in the NIPP, "... the information may be used to quickly identify those assets ... that may be the subject of emergent terrorist statements or interest or that may be located in the areas of greatest impact from natural disasters."35 According to the NIPP, having this information (apparently regardless of the criticality level of the asset) will help inform decisions made regarding preparedness, response, and recovery to a wide range of incidents and emergencies.36 In defense of the contents of the National Asset Database, Assistant Secretary Stephan is quoted as saying: "What happens the very first day that al-Qaeda attacks a convenience store chain times a dozen across the country? ... we better have some of those things in the database so that we know what that universe of things is that we have to worry about."37
According to the FY2007 Congressional Budget Justification for the Infrastructure Protection and Information Security (IP/IS) Program,38 the Database will deliver something called the Risk/Readiness Dashboard to DHS management. The budget justification identified the Risk/Readiness Dashboard as a planning and management tool that will eventually fuse threat streams with critical infrastructure vulnerability information and consequences, and will visually present a risk profile for critical infrastructure assets. According to the budget justification, such a capability will provide real-time knowledge that can be used to support rapid decision-making during periods of heightened threats.
Also, while a particular asset may not be critical at the national level, it may still be critical at the state or local level. Since DHS plans to allow many stakeholders eventually (with appropriate clearances) to have selected access to the Database, and the information in it or linked to it, the Database represents a common picture (i.e., a standard format and taxonomy) for all to use.39 Also, according to the Undersecretary, DHS does not support purging the Database of these non-nationally critical assets, because it is important to the Department to be informed about what is important to the states and localities.40
The statements above raise a number of issues. First, that assets may be critical under some circumstances and not others, or become critical because they have been identified by intelligence as possible targets, seems to conflict with the statutory definition of critical infrastructures. Under the conditions stated above, just about any asset could be considered critical and setting and implementing priorities would become even more complicated than it is now. Many would expect DHS to respond to such intelligence as part of its counter-terrorism efforts, which might include quickly deploying critical infrastructure resources such as sending out vulnerability assessment teams and establishing buffer zone protection plans. However, such efforts seem to lie beyond the fundamental goal of the critical infrastructure protection program, which is to identify those assets most critical to the nation as a whole.
Also, if the National Asset Database is meant to be a comprehensive list of the nation's infrastructure assets, regardless of criticality, it is incomplete. As noted in the previous section, only 127 gas stations are in the Database. There are over 167,000 gas stations in the United States.41 Similarly, the Database contains only 140 defense industrial base assets, 417 postal and shipping sites, 669 banking and financial assets, and 7,542 agriculture and food assets. According to the National Strategy for the Physical Protection of Critical Infrastructures and Key Assets, DHS estimated that there are 250,000 defense industrial firms, 137 million postal and shipping delivery sites, 26,600 FDIC insured institutions, and almost 2 million farms and 87,000 food processing plants.42 To identify only a few a these assets, perhaps in some states, but not in others, limits the utility of the current National Asset Database to support situational awareness to those relatively few instances where the Database may have the appropriate information.
The position that the National Asset Database holds data on those assets that states and localities have identified as important to them is contradicted by the DHS IG report. According to the report, state officials were repeatedly surprised to learn about the assets that were added as part of the ODP data call and which remain in the Database.43 The Database includes many assets not selected by the states.
Basis for Allocating Critical Infrastructure Protection Grants
The role that the National Asset Database plays in allocating federal resources to states and localities for infrastructure protection is of obvious interest to Congress. In FY2006, allocations of Urban Area Security Initiative grants saw some significant changes based on new risk calculations by the DHS. A number of cities saw their grant levels drop. Some Members believe that allocations were based on what they consider to be a flawed National Asset Database.
Over the last two grant cycles, according to the DHS IG report, ODP has made increased use of information in the National Asset Database to support its allocation of various critical infrastructure protection grants to states and localities. However, according to the Assistant Secretary, the National Asset Database does not drive DHS's funding decisions. The exception is the Buffer Zone Protection Plan grants, which were initiated to support the protection efforts associated with the original Protected Measures Target List and Operation Liberty Shield.
The relationship between the ODP's grant-making process, the National Asset Database, and the NIPP is not explicitly stated in DHS documents. The NIPP risk assessment process was finalized June 30, 2006, but ODP has had some form of risk assessment process in place for determining initial grant allocations for programs such as the Urban Area Security Initiative since 2003. Also, for the FY2006 cycle, ODP indicated it had evaluated over 120,000 specific infrastructure assets,44 but the National Asset Database only contained 77,069 assets as of January 2006. It would appear that ODP's grant-making process operates independently from both the National Asset Database and the National Infrastructure Protection Plan.45
Issues
Assuming that the Undersecretary is not changing the definition of critical infrastructure, and accepting DHS's argument that the National Asset Database is not a prioritized list of critical assets, and that it is not the basis for determining grant allocations, two issues remain: the quality of the information contained in the Database; and, whether the value of keeping low criticality assets in the Database warrant the costs associated with maintaining them in the Database. Another potential issue could arise if the current voluntary nature of the Database changes. Congress may ultimately focus its oversight of the National Asset Database on these areas.
Quality
Data quality is always an issue in generating any database. In the case of the National Asset Database, quality includes accuracy, consistency, and completeness. The quality of the information gathered early in the development of the Database has been questioned. For example, early in the evolution of the list, certain electric utility operators were presented with a list of critical electric power assets drawn up by DHS and noticed that some of the entries were not currently in use.46 Also, one Member of Congress noted that the location for Disneyland was incorrect.47 According to the IG report, DHS itself determined that the early Protected Measures Target List was unreliable.48
DHS has taken a number of steps to improve the quality of the information contained in the Database. The IG report noted that during the second data call to the states, DHS hired contractors to put the information it received into a consistent format, to research missing information, and to verify the accuracy of the information. DHS has approved a taxonomy which everyone submitting information can use to categorize and subcategorize assets. DHS plans to use this taxonomy in future data calls. The IG report also stated that DHS intends to use expert panels to review information in their sector of expertise. According the FY2007 budget justification, one of the responsibilities of the Protective Security Advisors49 is to verify critical infrastructure information.
Of particular concern is the completeness of the information included. Beyond the issue that there appears to be an incomplete inventory of the less than critical assets, as noted above, the IG was particularly concerned that the Database does not include assets that one might conclude should be included. The IG attributed part of this problem to reluctance on the part of private sector owner/operators to share certain information with DHS, notwithstanding the Protected Critical Infrastructure Information Program.50
Insuring the quality of the information in the Database is likely to require a continuous effort, since quality also implies currency. If a particular site closes, moves, or changes ownership, the changes would logically need to be captured in the Database.
The consideration of quality could include also the accessibility, flexibility, and security of the database. The NIPP suggested that the Database would be accessible to many type of queries, by many types of stakeholders. However, it is not clear that the Database yet has these capabilities. DHS intends to develop a second generation Database, one that includes the integration of vulnerability, risk, threat, and other relevant information. According to the IG report, DHS does not expect the second generation Database to be ready for two more years. In regard to security, the Undersecretary, in his response to the IG report, asserted that the Database currently "exceeds all security and protection standards."51 Assessing the accuracy of this assertion is beyond the scope of this report.
What to Keep
The IG report asserted that maintaining unusual and out-of-place entries in the Database may:
- complicate efforts to develop a useful database;
- make resource allocation more challenging;
- obscure desired data;
- waste time and money in repeatedly filtering them out of analyses or trying to prioritize them; and
- taint credibility.
The DHS IG report, however, does not explain how these entries would necessarily complicate, challenge, and obscure efforts. While the Database may not yet be as accessible or as searchable as eventually planned, it is not clear why less critical (or more critical) data could not be tagged as such. However, the presence of this data does involve cost in time and resources. At the very least, as discussed above, the information collected on all assets must be entered and verified (even the less critical ones) and missing data also may have to be located. Also, additional costs would likely be incurred if any further analysis (such as vulnerability assessment or more detailed consequence analysis) were done on these entries.52 The budget justification documents do not present data on how much money DHS spends on the Database, or how that expense is broken down. However, Congress did appropriate $20 million for the Database in FY2006.53
While the argument could be made that the costs might be marginal, the DHS IG report noted that, currently, those entries identified as not being critical at the national level outnumber, by 3 to 1, those that are identified as critical at the national level. Currently, DHS considers only about 2,500 assets as being the most critical, indicating that less than critical sites could actually dominate the cost of maintaining the Database.
It is not clear how to evaluate the value of maintaining these non-critical assets in the Database, especially if their numbers are under-represented and the risk associated with them is relatively low.
A Potential Change in Status for the Database
Currently the presence of a particular asset in the Database carries with it no specific obligations on the part of the owner/operator. They are not required by statute or regulation to provide information to the Database, per se, or to take any specific actions as a result of having an asset listed.54 Information solicited by DHS is voluntarily given. Presumably, publicly available information does not require the permission of the owner/operator for it to be included in the Database. However, if ever having an asset on the National Asset Database carries with it some legal or regulatory requirements, then what is in and not in the Database, or adding or removing assets from it, might result in much greater consequences for both the owners/operators and DHS.
Congressional Action
Implementing the 9/11 Commission Recommendations
The House of Representatives, as part of the 110th Congress's first 100 hours of legislation, passed H.R. 1, Implementing the 9/11 Commission Recommendations Act of 2007. Title IX of this act includes a section (Sec. 902) dealing with the National Asset Database. The Section did a number of things. It amended the Homeland Security Act to include the requirement that the Secretary of Homeland Security establish a National Asset Database. It also required the Secretary to establish within this Database a subset of assets that the Secretary determines are most at risk. This subset of assets shall be called the National At-Risk Database. This requirement indicated that the House disagrees with the Undersecretary that the National Asset Database should not include a prioritization of assets.
Section 902 also established a National Asset Database Consortium, made up of representatives from at least two, but no more than four, national laboratories along with officials from other federal agencies with appropriate experience in working with and identifying critical infrastructure. The Consortium is to advise the Secretary on how to identify, generate, organize, and maintain the National Asset Database. In addition, the Secretary is to solicit comments from the Consortium on the appropriateness of the risk methodologies employed by the National Infrastructure Protection Plan and alternative methods for defining risk and identifying specific criteria by which to set priorities. The Secretary is to secure recommendations from the Consortium 60 days after this act is enacted.
The Section also required the Secretary to annually review the Database to examine assets in the Database to determine if the information on these assets is incorrect or if they do not meet national asset guidelines used by the Secretary to determine which assets should remain in the Database. It required the Secretary to remove from the Database any asset whose information is not verifiable or which does not meet the nation asset guidelines. The requirement disagrees with the Undersecretary's position that less-than-nationally-critical assets should remain in the Database.
Also, the Secretary is to provide the Database to states for review and to meet annually with the states to discuss guidelines their submissions of information for the Database. This requirement is in agreement with recommendations made by the Inspector General. Section 902 also required the Secretary to ensure that the information contained in the Database can be organized by sector, state, locality, and region.
Section 902 required the Secretary to report to Congress annually on those assets in the Database considered to be most at risk. The report is to include name, location, and sector of each asset. It is also to include any changes in the criteria used to define or identify critical infrastructure and any changes in the compiling of the Database. It is also to include the extent to which the Database has been used as a tool for allocating resources. It is likely that DHS would classify much of the information specific to particular assets in the Database.
Title XI in the Senate's companion bill, S. 4, Improving America's Security Act of 2007, although not mentioning a National Asset Database, also required the Secretary to develop a risk-based prioritized list of critical infrastructure and key resources. The list should consider those assets or systems that, if destroyed or disrupted, by attack or natural catastrophe, would cause significant loss of life, severe economic harm, mass evacuations, or lead to the loss of vital public services. The list should reflect a cross-sector analysis to determine priorities for prevention, protection, recovery, and reconstitution. The act also instructed the Secretary to report to Congress annually the criteria used to create the list, the methodology used to solicit and verify information submitted to the list, and how the list will be used in program activities, including grant making.
In the compromise bill, Implementing the 9/11 Commission Recommendations Act of 2007 (P.L. 110-53), the Senate agreed with the House with some modification. Title X established the National Asset Database in statute and instructed the Secretary of Homeland Security to establish and maintain a classified prioritized critical infrastructure list of systems and assets included in the Database that the Secretary determines would cause regional or national "catastrophic effects" if destroyed or disrupted. It instructed the Secretary to annually update the Database, including establishing data collection guidelines, reviewing those guidelines with State officials, and to work with State officials before finalizing what should be included in the Database. The Secretary was also instructed to identify and evaluate methods for soliciting relevant information on assets from the private sector, including use of the Protected Critical Infrastructure Information Program. The bill also required the Secretary to submit an annual report, that, among other items, should include the name, location, and sector classification of those assets listed in the classified prioritized list, those assets that are most at risk of terrorism, and the extent to which Database and/or the prioritized list have been used to allocate federal funds. This report shall be unclassified, although a classified annex may be included.
The compromise bill also required an annual report on the comprehensive assessments carried out in each sector and should include any countermeasures or actions recommended or taken to address issue identified in those assessments. This report may be classified. The Secretary was also required to report annually on the actions taken by the federal government to ensure the preparedness of the private sector to reduce interruptions in the operations of critical infrastructures associated with acts of terrorism or natural catastrophe, or other national emergency, in accordance with the Defense Production Act of 1950. This report is to go to the House Financial Services Committee and the Senate Banking, Housing, and Urban Affairs Committee, in addition to the respective homeland security committees.
The compromise bill left the Consortium concept proposed by the House to the Secretary's discretion.
Homeland Security Appropriations
The House version of the FY2008 Department of Homeland Security Appropriations Bill, H.R. 2638, contained report language directing the National Protection and Programs Directorate to remove from the National Asset Database items it deems insignificant, and encouraged the Directorate to provide states and local partners the opportunity to review their assets listed in the Database and to recommend items for removal. The language also stated that the Directorate should clarify its guidance when soliciting information to ensure uniform and accurate information. The Senate version (S. 1644) contained no similar language.