Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 1 How DHS Currently Manages Risk Alyson Wilson, Ph.D. Statistical Sciences Group Los Alamos National Laboratory

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Disclaimers I am not a Department of Homeland security employee or contractor. I am speaking from publicly available information based on my experience working with the Departments of Defense and Energy, and as a member of the National Research Council’s Panel on Methodological Improvements to the Department of Homeland Security's Biological Agent Risk Analysis. This talk is intended to provide background for understanding the complex risk analysis issues in defense and security. Slide 2

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D DHS has adopted a “risk-based approach” to homeland security “Risk management must guide our decision-making as we examine how we can best organize to prevent, respond, and recover from an attack.... Our strategy is, in essence, to manage risk in terms of these three variables – threat, vulnerability, consequence. We seek to prioritize according to these variables, to fashion a series of preventive and protective steps that increase security at multiple levels.” DHS Secretary Michael Chertoff, March 16, 2005 Slide 3

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D DHS Strategic Goals Awareness – Identify and understand threats, assess vulnerabilities, determine potential impacts and disseminate timely information to our homeland security partners and the American public. Protection – Safeguard our people and their freedoms, critical infrastructure, property and the economy of our Nation from acts of terrorism, natural disasters, or other emergencies. Slide 4

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Risk Management Risk experts appear to agree that all communities have some level of risk from terrorism. Yet, homeland security officials acknowledge that it is impossible to protect every target and harden every community to the extent that they become impervious to future attacks. It seems clear that it is necessary, from a national perspective, to identify the areas and entities across the country most at risk and to work to reduce that risk. What is less clear is the best way to evaluate relative homeland security risk, and establish an acceptable level of risk while attempting to close the most dramatic gaps between risk and capabilities. Congressional Research Service 2007 Slide 5

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Risk Definition Risk = Threat*Vulnerability*Consequence Slide 6

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Risk Definition Details Threat: The probability that a specific target is attacked in a specific way during a specified time period, or Threat = P(attack occurs) Vulnerability: The probability that damages (where damages may involve fatalities, injuries, property damage, or other consequences) occur, given a specific attack type, at a specific time, on a given target, or Vulnerability = P(attack results in damage | attack occurs) Consequence: The expected magnitude of damage (e.g., deaths, injuries, or property damage), given a specific attack type, at a specific time, that results in damage to a specific target, or E[damage | attack occurs and results in damage] Willis, RAND Center for Terrorism Risk Management Policy (2006) Slide 7

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Homeland Security Presidential Directive 10 Biodefense for the 21 st Century, April 2004 “Biological weapons in the possession of hostile states or terrorists pose unique and grave threats to the safety and security of the United States and our allies.” “Another critical element of our biodefense policy is the development of periodic assessments of the evolving biological weapons threat. First, the United States requires a continuous, formal process for conducting routine capabilities assessments to guide prioritization of our on-going investments in biodefense-related research, development, planning, and preparedness. Slide 8

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Homeland Security Presidential Directive 18 Medical Countermeasures against Weapons of Mass Destruction, February 2007 “Weapons of Mass Destruction (WMD) – chemical, biological, radiological, and nuclear agents (CBRN) – in the possession of hostile states or terrorists represent one of the greatest security challenges facing the United States.” “The Secretary of Homeland Security shall develop a strategic, integrated all-CBRN risk assessment that integrates the findings of the intelligence and law enforcement communities with input from the scientific, medical, and public health communities. Not later than June 1, update those findings when appropriate, but not less frequently than every 2 years.” Slide 9

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D 2006 Bioterrorism Risk Assessment The first DHS Bioterrorism Risk Assessment (BTRA) was completed on January 31, 2006, and the report documenting the analysis was published on October 1, How did this report address Risk = Threat*Vulnerability*Consequence? Risk Management? Slide 10

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Slide 11 National Research Council’s Panel on Methodological Improvements to the Department of Homeland Security's Biological Agent Risk Analysis Greg Parnell - (Chair) David L. Banks U.S. Army Military Academy Duke University Luciana L. BorioGerald G. Brown University of Pittsburgh School of MedicineU.S. Naval Postgraduate School Tony CoxJohn Gannon Cox AssociatesBAE Systems Eric HarvillHoward C. Kunreuther Pennsylvania State University University of Pennsylvania, Wharton School of Business Stephen S. Morse Marguerite Pappaioanou Columbia University, School of Public Health University of Minnesota, Minneapolis Stephen M. PollockNozer D. Singpurwalla University of Michigan The George Washington University Alyson G. Wilson Los Alamos National Laboratory

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D 2006 BTRA Methodology Assess the risk in the U.S. from bioterrorism Twenty-eight bioagents Fatality, illness, and direct economic impact BTRA divides the spectrum of possible events into a discrete set of scenarios. For each scenario, s i Estimate consequence, C i Estimate probability, p i Aggregate the risk from the set of all triplets Slide 12

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Agents Considered in 2006 BTRA with CDC Categories Slide 13

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Simple (Binary) Event Tree Slide 14

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Threat Slide 15 Event #Event HeadingPhase 1Frequency of Initiation by Terrorist Group Agent/Target/Dissemination Selection 2Target Selected 3Bioagent Selected 4Mode of Dissemination (also determines wet or dry dispersal form) 5Mode of Agent Acquisition Acquisition 6Interdiction during Acquisition 7Location of Production and Processing Production and Processing 8Mode of Agent Production 9Preprocessing and Concentration 10Drying and Processing 11Additives 12Interdiction During Production and Processing 13Mode of Transport and Storage Transport and Storage 14Interdiction during Transport and Storage 15Interdiction during Attack Attack 16Potential for Multiple Attacks 17Event DetectionResponse

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Event Tree Branches Slide 16 Event #Event HeadingBranchesEvent Dependencies 2Target Selection2.1 Large Open Building Small Enclosure 2.3 Large “Divided” Building 2.4 Large Outdoor Spaces 2.5 Water Pathway 2.6 Food Pathway 2.7 Human Vectors 2.8 Contact (letters) 4Mode of Dissemination (also determines wet or dry dispersal form) 4.1 Ground-level point release from stationary sprayer 1,2,3 4.2 Ground-level point release from stationary fogger 4.3 Ground-level release from mobile sprayer (outdoor only) 4.4 Ground-level release from mobile fogger (outdoor only) 4.5 Aerial release from mobile sprayer (outdoor only) 4.6 Aerial release from mobile fogger (outdoor only) 4.7 Ground-level point release of explosive with slurry 4.8 Ground-level point release of explosive with powder Other Targets – (food, water, human vector, or contact dissemination) Branch 4.1 has unit probability.

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Threat Scenario Probabilities Each pathway through the tree is a “scenario” Each event has multiple branches, rather than two For a single agent (B. anthracis, the causative agent of anthrax), the complete event tree results in more than 35 million scenarios 2.2 million scenarios are non-interdicted 870,000 scenarios are non-interdicted and have non-zero probability Only the non-interdicted and non-zero end-nodes are associated with consequence distributions. Each branch probability (split fraction) is represented by a distribution, rather than a single probability These distributions represent uncertainty in knowledge of terrorist capabilities and their likely actions Slide 17

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Vulnerability and Consequence Slide 18

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D 19 Vulnerability and Consequence Modeling Release and Dispersion Major categories considered Inhalation – Outdoor and Indoor Food Water Medical Mitigation Time delay between exposure and initiation of treatment Event identification Transfer and distribution of treatment measures Effectiveness of countermeasures Antibiotic, vaccine, antiviral, antitoxin, supportive care Mortality rates for treated and untreated diseases Treatment alone does not guarantee survival

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Basic Consequence Equations (All Terms are Distributions) Slide 20 MRE = MR * QFA * QFR * QADD MRE = effective mass release QFA = active fraction after dissemination (inhalation modes) QFR = respirable fraction after dissemination (inhalation modes) QADD = dry aerosol dissemination efficiency due to additives CI = II|MRE * MEI|II CI = number of illnesses II|MRE = index illnesses given effective mass released MEI|II = epidemiological illness factor given index illnesses CF = CI * RF|MRE * MFI CF = number of fatalities RF|MRE = deaths per illness given effective mass release MFI = medical mitigation/epidemiological factor DEC|MRE Decontamination Costs given effective mass released

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D The principal product of the 2006 BTRA was the ranking of the risk of bioagents Slide 21 Normalized mean, 5 th, and 95 th percentiles of risk distribution

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Unique Challenges for Terrorism Risk Analysis for Homeland Security Slide 22 Natural HazardsTerrorism Historical DataSomeVery limited Risk of OccurrenceReasonably well- defined Considerable ambiguity Geographic RiskSpecific areasAll areas InformationInformation sharingAsymmetric information Event TypeNo influenceGovernment influence Preparedness and Prevention Well-known mitigation Numerous threats, adaptive adapted from Kunreuther (2007)

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D Issues Risk management Tradeoff between “fidelity,” available information, and sheer size of analysis Adversarial risk analysis Slide 23

Operated by Los Alamos National Security, LLC for NNSA U N C L A S S I F I E D References T. Masse, S. O’Neil, J. Rollins (2007). The Department of Homeland Security’s Risk Assessment Methodology: Evolution, Issues, and Options for Congress. Congressional Research Service Report RL H. Willis (2006). Guiding Resource Allocations Based on Terrorism Risk. Working Paper, RAND Center for Terrorism Risk Management Policy. Slide 24