Progress in Developing the National Asset Database

More documents

Recommendations

Info

$J1L(lO~ \~ ~~ - Center for Investigative Reporting$

Enhancing Prioritization CapabilityTo effectively prioritize the NADB, DHS needs to be able to objectivelycompare each asset’s criticality. Accordingly, IP intends to establish valueswith respect to human health and safety, economic value, iconic or symbolicvalue, and substitutability to model the value of dissimilar assets. Weighingthese concerns, or normalizing assets, requires subjective determinations, forexample, quantifying the symbolic value of the Statue of Liberty, and wouldrequire significant deliberation to develop tools to support a comprehensivenational risk analysis.IP has several ongoing tasks that should enhance its ability to prioritize assetsacross sectors. Specifically, IP is acquiring more and better data bypurchasing or licensing data, directing SSAs to identify their most importantassets, conducting gross consequence of attack analysis on the NADB,gathering expert panels to evaluate CI/KR data in the NADB, developing astandard risk assessment tool, and studying interdependencies across sectors.IP also seeks to collect as much data as possible in order to help develop acommon operational picture (COP) via geospatial mapping of CI/KR. Thisincludes integrating consequence, vulnerability, and threat information toprovide a single risk analysis. By linking conditional risk with real timeintelligence in the National Threat Incident Database, the NADB will supportoperational risk assessments. Analysts in DHS’ Homeland InfrastructureThreat and Risk Analysis Center (HITRAC) are responsible for fusingcredible threat information received from the Office of Intelligence andAnalysis (IA) with consequence assessments and vulnerability informationprovided by IP. HITRAC passes the results of its analysis back to IA andIP. 40These are meaningful steps toward producing a comprehensive national riskanalysis, and they attest to the complexity of developing the NADB. IP hasbeen planning or working on these measures for months and we hesitate topredict when DHS will have a functional and useful NADB. IP’s progress indeveloping the NADB may affect key implementation milestones of the NIPP.Acquiring Data. Significant amounts of data have already been incorporatedinto the NADB, and as we reported earlier, there may be too many lowerpriority assets. However, there is also concern that the NADB may have toofew assets in essential areas and may present an incomplete picture. IP faceschallenges in developing a comprehensive inventory due to both varying state40 Draft NIPP, p.58.Progress in Developing the National Asset Database18
eports and reluctance of the private sector to share proprietary informationdue to privacy concerns. Data protection issues have hindered IP’s ability toexpand the NADB; most asset identification activity has depended oncooperation from states and federal agencies. The private sector has concernsthat information provided for security purposes will expose them tocompetitive or legal scrutiny. Sectors with significant government oversightand national security concerns, such as nuclear and chemical industries, havebeen responsive to requests for data. Entities in other sectors such as businessand finance, the defense industrial base, and telecommunications have beenless forthcoming due to concerns about sensitive information, despite thecreation of the Protected Critical Infrastructure Information (PCII) program. 41Still other sectors such as emergency services and agriculture/food are highlydistributed; different perspectives exist on how to best determine at-risk assetsin a complex system. IP continues to seek, and license where necessary, datafrom numerous sources including its own institutional expertise, federalagencies, Industry Sector Advisory Councils, commercial entities selling data,and the private sector. IP is planning future data calls to states, and agenciesare still in the process of identifying CI/KR.Top 100 Lists. In May 2005, IP solicited each federal SSA for its mostimportant CI/KR to create a consequence-driven dataset to help prioritize theNADB. Not all sectors have submitted responses. As of January 2006, threesectors (emergency services, information technology and agriculture/food)had not responded to IP’s call for such a list. Furthermore, IP has integratedonly five Top 100 lists into the NADB: three sectors (national monuments andicons, government facilities and postal and shipping), and two subsectors(drinking water and wastewater). IP has not finished processing responses for10 other sectors. The submissions IP did receive varied in their utility. Somesectors have problems similar to those discussed above, including insufficientdetail, information withheld due to security concerns, and a poorunderstanding of assets within a sector that cannot be reconciled with theNADB taxonomy. IP will continue to work with those sectors to ensureuniform and usable data as to the most important assets in each sector.Gross Consequences of Attack. Led by a contractor., IP has been developingseveral complex methodologies for conducting a consequence-based analysisof a large number of targets. They are known as the Gross Consequences of41 The Protected Critical Infrastructure Information program solicits voluntary critical infrastructure information fromproprietors by protecting such information from disclosure.Progress in Developing the National Asset Database19
Page 1 and 2: DRAFTDEPARTMENT OF HOMELAND SECURIT
Page 3 and 4: ContentsExecutive Summary..........
Page 5 and 6: Executive SummaryOn December 17, 20
Page 7 and 8: such as prominent national, state,
Page 9 and 10: Chart 1: NADB Totals by SectorAgric
Page 11 and 12: Chart 2: NADB Totals by Stages of D
Page 13 and 14: IP officials view the new taxonomy
Page 15 and 16: assets (such as schools) should be
Page 17 and 18: all but Indiana) and identified sev
Page 19 and 20: mortuaries, 571 nursing homes, and
Page 21: capability to be queried in a varie
Page 25 and 26: development in other sectors, and a
Page 27 and 28: that not only does the department n
Page 29 and 30: Recommendation #3: For ongoing and
Page 31 and 32: Appendix APurpose, Scope, and Metho
Page 33 and 34: Appendix BPreparedness Response to
Page 39 and 40: Appendix CRoles/Responsibilities wi
Page 45 and 46: Appendix DCritical Infrastructure a
Page 47 and 48: Appendix EGuidelines for Identifyin
Page 49 and 50: Appendix EGuidelines for Identifyin
Page 51 and 52: Appendix FCritical Infrastructure/K
Page 53 and 54: Appendix HReport DistributionDepart

Progress in Developing the National Asset Database

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?