U.S. Homeland Security Strategy: Comparing Three Key Documents

Introduction

Several government-written strategies addressing terrorism in the United States have been produced since the terrorist attacks of September 11, 2001, and all of them are required to complement one another if the nation's defense against a terrorist attack is to be effective and efficient. This paper selects three strategy documents and compares and contrasts the objectives of each. The three documents examined are:

The National Strategy for the Physical Protection of Critical Infrastructures and Key Assets, published in February 2003 by the White House, Washington, DC; the National Strategy for Secure Cyberspace, published in February 2003 by the White House, Washington, DC; and the DHS Intelligence Enterprise Strategic Plan, published in January 2006 by the U.S. Department of Homeland Security, Washington, DC.

National Strategy for the Physical Protection of Critical Infrastructures and Key Assets

According to the White House, the National Strategy for the Physical Protection of Critical Infrastructures and Key Assets identifies strategic objectives that "underpin our national critical infrastructure and key asset protection effort." These objectives are: (1) identifying and assuring the protection of those infrastructures and assets deemed most critical in terms of national-level public health and safety, governance, economic and national security, and public confidence; (2) providing timely warning and assuring the protection of those infrastructures and assets that face a specific, imminent threat; and (3) assuring the protection of other infrastructures and assets that may become terrorist targets over time by pursuing specific initiatives and enabling a collaborative environment in which federal, state, and local governments and the private sector can better protect the infrastructures and assets they control (White House, 2003).

The document further relates that homeland security — especially in relation to critical infrastructure and key asset protection — is a shared responsibility that the federal government alone cannot accomplish. Instead, it requires "coordinated action on the part of federal, state, and local governments; the private sector; and concerned citizens across the country" (White House, 2003). Possible terrorist attacks are described in three categories: (1) direct infrastructure effects — cascading disruption of critical infrastructure through direct attacks on a critical node, system, or function; (2) indirect infrastructure effects — cascading disruption and financial consequences for government, society, and the economy through public- and private-sector reactions to an attack; and (3) exploitation of infrastructure — use of elements of a particular infrastructure to disrupt or destroy another target (White House, 2003).

The guiding principles for protection of critical infrastructure and key assets are: (1) assure public safety, public confidence, and services; (2) establish responsibility and accountability; (3) encourage and facilitate partnering among all levels of government and between government and industry; (4) encourage market solutions wherever possible and compensate for market failure with focused government intervention; (5) facilitate meaningful information sharing; (6) foster international cooperation; (7) develop technologies and expertise to combat terrorist threats; and (8) safeguard privacy and constitutional freedoms (White House, 2003).

The federal government's leadership role involves: (1) taking stock of the most critical facilities, systems, and functions and monitoring their preparedness across economic sectors and governmental jurisdictions; (2) assuring that federal, state, local, and private entities work together to protect critical facilities and systems that face an imminent threat; (3) providing and coordinating national-level threat information, assessments, and warnings that are timely, actionable, and relevant to state, local, and private-sector partners; (4) creating and implementing comprehensive, multi-tiered protection policies and programs; (5) exploring options for incentives to encourage stakeholders to devise solutions to their unique protection challenges; (6) developing cross-sector and cross-jurisdictional protection standards, guidelines, criteria, and protocols; (7) facilitating the sharing of best practices, processes, and vulnerability assessment methodologies; (8) conducting demonstration projects and pilot programs; (9) seeding the development and transfer of advanced technologies while leveraging private-sector expertise; (10) promoting national-level critical infrastructure protection education and awareness; and (11) improving the federal government's ability to work with state and local responders and service providers (White House, 2003).

The Department of Homeland Security is designated as "the primary liaison and facilitator for cooperation among federal agencies, state and local governments, and the private sector" and bears responsibility for "the detailed refinement and implementation of the core elements of this strategy" (White House, 2003). Notably, the strategy acknowledges that the largest portion of the country's critical infrastructures and key assets are owned and operated by the private sector, and that private firms "prudently engage in risk management and planning and invest in security as a necessary function of business operations and customer confidence" (White House, 2003).

Planning and resource allocation identifies eight primary initiatives: (1) creation of collaborative mechanisms for government-industry critical infrastructure protection planning; (2) identification of key protection priorities and development of appropriate supporting mechanisms; (3) fostering increased risk-management expertise sharing between the public and private sectors; (4) identification of incentive options for private organizations that proactively enact enhanced security measures; (5) coordination and consolidation of federal and state protection plans; (6) establishment of a task force to review legal impediments to reconstitution and recovery after an attack; (7) development of an integrated critical infrastructure and key asset geospatial database; and (8) conducting critical infrastructure protection planning with international partners (White House, 2003).

Information sharing, indications, and warnings encompass six identified initiatives: (1) defining protection-related information sharing requirements and establishing effective, efficient sharing processes; (2) implementing the statutory authorities and powers of the Homeland Security Act of 2002 to protect sensitive private-sector information; (3) promoting the development and operation of critical sector Information Sharing and Analysis Centers; (4) improving processes for domestic threat data collection, analysis, and dissemination to state and local government and private industry; (5) supporting the development of interoperable secure communications systems for state and local governments and designated private-sector entities; and (6) completing implementation of the Homeland Security Advisory System (White House, 2003).

Personnel surety, human capital, and awareness initiatives include: (1) coordinating the development of national standards for personnel surety; (2) developing a certification program for background screening companies; (3) exploring establishment of a certification regime or model security training program for private security officers; (4) identifying requirements and developing programs to protect critical personnel; (5) facilitating the sharing of public- and private-sector protection expertise; and (6) developing and implementing a national awareness program for critical infrastructure and key asset protection (White House, 2003). Technology research and development identifies four primary initiatives: (1) coordinating public- and private-sector security research and development activities; (2) coordinating interoperability standards to ensure compatibility of communications systems; (3) exploring methods to authenticate and verify personnel identity; and (4) improving technical surveillance, monitoring, and detection capabilities (White House, 2003).

National Strategy for Secure Cyberspace

The National Strategy for Secure Cyberspace states that its strategic objectives are "consistent with the National Strategy for Homeland Security" and include: (1) prevention of cyber attacks against America's critical infrastructure; (2) reduction of national vulnerability to cyber attacks; and (3) minimization of damage and recovery time from cyber attacks that do occur (White House, 2003). The report also identifies the private sector as best equipped and structured to respond to constantly evolving cyber threats, stating that "public-private engagement is a key component of our Strategy to secure cyberspace" and that "public-private partnerships can usefully confront coordination problems" and "significantly enhance information exchange and cooperation" (White House, 2003).

The Department of Homeland Security, established by legislation on November 25, 2002, is a cabinet-level department that unites 22 federal entities for the common purpose of improving homeland security. The Secretary of DHS bears responsibility for: (1) developing a comprehensive national plan for securing key resources and critical infrastructure; (2) providing crisis management in response to attacks on critical information systems; (3) providing technical assistance to the private sector and other government entities regarding emergency recovery plans; (4) coordinating with other federal agencies to provide specific warning information and advice about protective measures to state, local, and nongovernmental organizations, including the private sector, academia, and the public; and (5) performing and funding research and development to support homeland security (White House, 2003).

Five national priorities identified by the strategy are: (1) a National Cyberspace Security Response System; (2) a National Cyberspace Security Threat and Vulnerability Reduction Program; (3) a National Cyberspace Security Awareness and Training Program; (4) securing governments' cyberspace; and (5) National Security and International Cyberspace Security Cooperation (White House, 2003).

Eight major actions and initiatives for cyberspace security response are: (1) establishing a public-private architecture for responding to national-level cyber incidents; (2) providing for the development of tactical and strategic analysis of cyber attacks and vulnerability assessments; (3) encouraging the development of a private-sector capability to share a synoptic view of the health of cyberspace; (4) expanding the Cyber Warning and Information Network to support DHS in coordinating crisis management; (5) improving national incident management; (6) coordinating processes for voluntary participation in the development of national public-private continuity and contingency plans; (7) exercising cybersecurity continuity plans for federal systems; and (8) improving and enhancing public-private information sharing involving cyber attacks, threats, and vulnerabilities (White House, 2003).

Eight major actions and initiatives to reduce threats and vulnerabilities are: (1) enhancing law enforcement's capabilities for preventing and prosecuting cyberspace attacks; (2) creating a process for national vulnerability assessments to better understand potential consequences of threats; (3) securing the mechanisms of the Internet by improving protocols and routing; (4) fostering the use of trusted digital control systems and supervisory control and data acquisition (SCADA) systems; (5) reducing and remediating software vulnerabilities; (6) understanding infrastructure interdependencies and improving the physical security of cyber systems and telecommunications; (7) prioritizing federal cybersecurity research and development agendas; and (8) assessing and securing emerging systems (White House, 2003).

Conclusion

Each of the documents reviewed in this study sets out particulars of protection and security for American citizens, and each notes the role that individuals play in the successful implementation of these safeguards within their communities. All three strategies further emphasize that collaboration and coordination between federal, state, and local governments is a fundamental requirement for the successful, proactive protection of individual security, cyberspace, and the physical protection of critical infrastructures and key assets.