Blind Bats, Black Swans and Red Motorcycles: Reducing The Risk of Teaching Risk

1. Blind Bats, Black Swans andRed Motorcycles: Reducing The Risk of Teaching Risk Dr. David H. McIntyre Distinguished Visiting Fellow, Homeland Security Institute Director, Homeland Security Programs, National Graduate School 979-575-4552 dmcintyre@ngs.edu Alt mcintyredh@aol.com 1

2. EM Community and Higher Ed deserve credit • Per Claire Ruben: EM has responded to Δing times and requirements • From Galveston and the Dust Bowl • To Civil Defense & FEMA • To Hurricane Ike and recent Wildfires • Emergency Management: The American Experience, 1900-2005 • http://works.bepress.com/claire_rubin/7/ • EM Higher Ed has responded too – especially since 9/11 & Katrina • Invigorated EMI / FEMA Higher Ed program • “Principles of Homeland Security” • Expanded & Professionalized EM education community

3. EM is in danger of missing the train . . . again • EM missed the Δ in threat and scale in 1995 • Not ready to exert leverage • In 9/11 • In Katrina • In 2006-2011 EM took control of its own destiny • Now EM is missing 3 major developments . . . Again • Unified Theory/Strategy of HLS • Coherent Framework for HLS • Mechanism to Prioritize HLS resources / efforts

4. 1. Unified Theory/Strategy for NS/HLS Key element: Concept of Cause & Effect to achieve Homeland Security The Department's mission: is to ensure a homeland that is safe, secure, and resilient against terrorism and other hazards. http://www.dhs.gov/xabout/responsibilities.shtm So . . . How to achieve this mission?

5. 1. Unified Theory/Strategy for NS/HLS • National Security Strategy of the United States . . .for terrorism • Disrupt, Dismantle, Defeat overseas • For other national level issues • Develop a Sustainable Civil Society • For Homeland Security • Preparedness & Response

6. Homeland Security Strategy Pre-Event Event Post-Event • Reduce Cost: • Risk Management • Resilience  Preparedness Response Mitigation Response Recovery Prevention Protection Resilience Defacto Strategy: If we conduct adequate Preparedness and satisfactory Response, we can achieve the mission of HLS Example: National Response Framework Example: National Infrastructure Protection Plan

7. 2. Coherent Framework for Homeland Security • National Security Strategy of the United States – June 2010 • http://www.whitehouse.gov/sites/default/files/rss_viewer/national_security_strategy.pdf • Strategic National Risk Assessment – Nov 2011 • http://www.dhs.gov/xabout/structure/rma-strategic-national-risk-assessment-ppd8.shtm • Quadrennial Homeland Security Review 2009 • http://www.dhs.gov/xabout/gc_1208534155450.shtm • PDD List (Clinton); HSPD List (Bush 43); PPD List (Obama) • http://www.fas.org/irp/offdocs/pdd/index.html • http://www.dhs.gov/xabout/laws/editorial_0607.shtm • http://www.fas.org/irp/offdocs/ppd/index.html • National Preparedness Guidelines / National Preparedness System • http://www.dhs.gov/files/publications/gc_1189788256647.shtm • National Infrastructure Protection Plan (National Preparedness Framework TBD) • http://www.dhs.gov/files/programs/gc_1189168948944.shtm •  National Response Plan • National Response Framework Resource Center • http://www.fema.gov/emergency/nrf/ • Comprehensive Preparedness Guide 101, 201 • http://www.fema.gov/pdf/about/divisions/npd/CPG_101_V2.pdf

8. 3) Mechanism to Prioritize HLS resources / efforts Integrated Risk Management Cycle In Simple Terms: Risk = Threat x Vulnerability x Consequences Where Threat = Likelihood of Threat / Hazard / Natural Disaster • Task: Apply, Analyze, Evaluate . . . Using • DHS Risk Management aid • http://learnaboutrisk.com/ • Office of Risk Management and Analysis • http://www.dhs.gov/xabout/structure/gc_1287674114373.shtm • But there are other approaches – • Example: Texas Public Health Risk Assessment Tool • Residual Risk = Hazard Probability × Severity of Consequences / Mitigation • Severity of Consequences = Population Vulnerability × Impact on Health • Mitigation = Capability to Respond + Resources Available + Community Resilience

9. First: Essential Definitions • RISK: potential for an unwanted outcome resulting from an incident, event, or occurrence, as determined by its likelihoodand the associated consequences • RISK ANALYSIS : systematic examination of the components and characteristics of risk • RISK ASSESSMENT : product or process which collects information and assigns values to risks for the purpose of informing priorities, developing or comparing courses of action, and informing decision making • RISK MANAGEMENT: process of identifying, analyzing, assessing, and communicating risk and accepting, avoiding, transferring or controlling it to an acceptable level considering associated costs and benefits of any actions taken • INTEGRATED RISK MANAGEMENT: structured approach that enables the distribution and employment of shared risk information and analysis and the synchronization of independent yet complementary risk management strategies to unify efforts across the enterprise For more definitions see DHS Risk Lexicon – MAKE THIS EM LEXICON

10. Bottom line Up Front • Risk Management (RM) can help “See the Threat” and “See the Solution” and thus prioritize • Without it we are Blind as a Bat • But RM can actually create additional Risk • By narrowing vision and promoting over confidence • Miss Black Swans: Low Probability but INEVITABLE High Consequence Disasters • Miss Red Motorcycles: Disasters you see but don’t recognize as a serious threat • Solution: • Use the tools of Risk Management in new ways • To BROADEN NOT NARROW leader understanding.

11. Conclusions developed during prep of White Paper Sponsor: HSI • Homeland Security Studies and Analysis Institute Note the Requirement from the Sponsor: Provide a New Perspective on an Enduring Problem: • How to apply Risk Management to problems of Homeland Security http://www.ngs.edu/strategies-and-methods-for-informing-risk-management/

12. Challenging Issues: The Language of Risk • RISK means too much • What kind of risk? Financial – Engineering – Health – EM – DOD – DHS . . . All use “Risk” to mean different things • Risk = Threat (Hazard) x Vulnerability x Consequence . . . says who? . . . There is no “approved solution” for calculating risk. • RISK means too little • For non-professionals it has little power • Hard to sell a positive (security) with two negatives (reduce risk) • Improving Safety & Security . . . is just right • Everybody gets it • Everybody can do it – Whole of Government The HSD/EM Enterprise should talk about Reducing Risk in terms of Improving Safety & Security

13. Unfortunately RM can Increase Risk • We do need a way to prioritize resources • We cannot afford to eliminate every Risk • Without some system of analysis, management, etc. we are “Blind as Bats” • But – High Risk Reductionism can  Black Swans • Unanticipated High Consequence Events • Underestimate Probability: Space Shuttle, Chernobyl, Bhopal • Underestimate Complexity: Flu, Electrical Grid, Deepwater Horizon • Underestimate Cascade: Hurricane Ike, Japanese Reactors • And High Risk Reductionism can  Red Motorcycles • See it in traffic, but it does not register as a danger • Air Attacks on the Pentagon • Mt. Pinatubo: Earthquake & Typhoon together • Haiti & Cholera • Result: Simplifying decision making can  bad decisions

14. How to Reduce Risk of RM? ANSWER: Better Inform Decision Makers What does RM do now? • Obscure uncertainty by aggregating data What else might Risk Management do? • Convey uncertainty (explain the Risk of Risk) by broader & more aggressive data presentation What should RM do differently? • Consider data in multiple ways • Use this process to change the understanding of problems and solutions • Aggregate data for simplicity • Disaggregate data for clarity • Visualize in order to Analyze

15. Some Examples: New ways to display data • RISK DISPLAY TABLE(s) • This is a simple list of 4 columns. • RISK = T x V x C • Then group by R, by T, by V, by C • TARGET LIST • Group by type: CIKR, people, recovery cost, government, private, etc. • TARGET MAP • Same as TARGET List but overlaid on GIS info • THREAT TABLE • Grouped by type of threats and hazards (CBRNE, Natural Disaster, 15 scenarios, etc.) • THREAT PROBABILITY TABLE • Grouped by Likelihood of threat (or hazard) (3 groups? 5? 7?) • THREAT PROBABILITY MAP • Display threat probability in colors and analyze geographic relationships • THREAT RESPONSE Table • Group threats and identify response capabilities - across jurisdictions. What do you need? What do you have? • THREAT RESPONSE MAP • Display Threat Response data showing geographic relationships, agreements, etc. The fundamental idea is to list and group data in a variety of ways to discover relationships – rather than simply rank ordering risk

16. Examples: Better Inform Decision Makers • RISK MATRIX (High/Low) • 4 cell matrix with Vulnerability x Consequence on the X axis, and Threat on the Y axis. • VULNERABILITY REDUCTION DISPLAY • How selected measures reduce grouped Vulnerabilities • CONSEQUENCE REDUCTION DISPLAY • How Whole of Community Actions can reduce Contagion / Cascade • IMPACT TABLE • By Target and Type of Attack Show Variety of IMPACTS ($, Health, Legal, Long Term Recovery, Environment, etc) • CASCADE MATRIX • Show how loss of one target impacts others • SEVERITY TABLE • Show Risk + Cost of Prioritized Response • CORRELATION EXPECTATION TABLE • For every coordinated action proposed, How it will influence Consequence, Vulnerability, Threat and Risk Overall? • RISK REDUCTION TABLE • For Plans Show: Target, Risk, Planned Action, Anticipated Change to Risk • For Evaluation Show: Target, Old Risk, Action Taken, Actual Risk Reduction, New Risk

17. An Example of Aggressive Use of Data

18. So . . . What to do? How to avoid Blind Bats, Black Swans and Red Motorcycles? How to Reduce the Risk of Risk Management? • Continue to use Risk Management to calculate and prioritize risk • But PREVENT narrow focus and overconfidence by decision makers • By using the data and tools of Risk Management in innovative ways to promote a broader vision.

19. Strengthen IRM in DHS/EM – TEACH RISK • See Recommendations from previous studies • Professional Career Field • Progressive Sequential Education • Executive Leader Training & Ed • Training across the Enterprise • DHS produce its own Tng/Ed materials – on line – use modern techniques (example: Gaming) • Coordinate with Higher Ed community • Exploit FEMA, EMI, FEMA Higher Ed • Special focus areas (Intel, Exercises, Comms) • Sr Ldrs incorporate RISK into daily operations

20. Also --Build Risk Management Culture • Establish a Sense of Urgency • Include crises, potential crises and opportunities • Create a Guiding Coalition • Charge a group WITH POWER to push the change as a team • Develop a Vision and Strategy • What does success look like? What path will get there • Communicate the Vision and the Change Required • The actions of leaders speak louder than their words • Give people in the system the power to make the changes work • Find out what gets in the way of risk management, and get rid of it • Plan for some short term wins • Show examples of successes and give credit where it is due • Leverage these gains to encourage more change • Use the credibility gained to repeat the success • Anchor the changes into the long term culture • By planning for succession From: John Kotter Leading Change

21. Build Risk Management Culture – thru Ed • Establish a Sense of Urgency • DONE!! By PDD-8 -- “the greatest risks to our national security” -- FEMA grant requests. • Create a Guiding Coalition • DONE!! Risk Steering Committee. Now . . . Principals lead • Develop a Vision and Strategy • MISSING BUT EASY TO DO. RMA/HIS w/ NPPD develop case studies • Communicate the Vision and the Change Required • THIS REQUIRES THE SECRETARY’S PERSONAL ACTION • Give people in the system the power to make the changes work • Briefings on improvements to the QHSR in terms of risk management • Plan for some short term wins • EASY – use National Risk Assessment, National Exercise Program, S&T, etc. • Leverage these gains to encourage more change • Practice on 2013 Budget , use IRM, NRA, NPS to inform 2014 budget. • Anchor the changes into the long term culture • Use to inform Congress / defend 2013 & 2014 budgets Apply to HLS Ed

22. Blind Bats, Black Swans andRed Motorcycles: Reducing The Risk of Teaching Risk Dr. David H. McIntyre Distinguished Visiting Fellow, Homeland Security Institute Director, Homeland Security Programs, National Graduate School 979-575-4552 dmcintyre@ngs.edu Alt mcintyredh@aol.com 22