U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

36–615 PDF 2008

S. Hrg. 110–317

PRIVATE SECTOR PREPAREDNESS

HEARING

BEFORE THE

AD HOC SUBCOMMITTEE ON STATE, LOCAL, 

AND PRIVATE, SECTOR PREPAREDNESS 

AND INTEGRATION

OF THE

COMMITTEE ON 

HOMELAND SECURITY AND 

GOVERNMENTAL AFFAIRS 

UNITED STATES SENATE

ONE HUNDRED TENTH CONGRESS

FIRST SESSION

JUNE 21, 2007

PART I: DEFINING THE PROBLEM AND PROPOSING SOLUTIONS

JULY 12, 2007

PART II: PROTECTING OUR CRITICAL INFRASTRUCTURE

Available via http://www.access.gpo.gov/congress/senate

Printed for the use of the Committee on Homeland Security 

and Governmental Affairs

(

(II)

COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS 

JOSEPH I. LIEBERMAN, Connecticut, Chairman 

CARL LEVIN, Michigan 

DANIEL K. AKAKA, Hawaii 

THOMAS R. CARPER, Delaware 

MARK L. PRYOR, Arkansas 

MARY L. LANDRIEU, Louisiana 

BARACK OBAMA, Illinois 

CLAIRE McCASKILL, Missouri 

JON TESTER, Montana 

SUSAN M. COLLINS, Maine 

TED STEVENS, Alaska 

GEORGE V. VOINOVICH, Ohio 

NORM COLEMAN, Minnesota 

TOM COBURN, Oklahoma 

PETE V. DOMENICI, New Mexico 

JOHN WARNER, Virginia 

JOHN E. SUNUNU, New Hampshire

MICHAEL L. ALEXANDER, Staff Director 

BRANDON L. MILHORN, Minority Staff Director and Chief Counsel 

TRINA DRIESSNACK TYRER, Chief Clerk 

AD HOC SUBCOMMITTEE ON STATE, LOCAL, AND PRIVATE SECTOR 

PREPAREDNESS AND INTEGRATION 

MARK L. PRYOR, Arkansas, Chairman 

DANIEL K. AKAKA, Hawaii 

MARY L. LANDRIEU, Louisiana 

BARACK OBAMA, Illinois 

CLAIRE MCCASKILL, Missouri 

JON TESTER, Montana 

JOHN E. SUNUNU, New Hampshire 

GEORGE V. VOINOVICH, Ohio 

NORM COLEMAN, Minnesota 

PETE V. DOMENICI, New Mexico 

JOHN WARNER, Virginia

KRISTIN SHARP, Staff Director 

MICHAEL MCBRIDE, Minority Staff Director 

AMANDA FOX, Chief Clerk 

(III)

C O N T E N T S 

Opening statements: Page 

Senator Pryor .................................................................................................... 1

Senator Akaka .................................................................................................. 2

Senator Sununu ................................................................................................ 19

WITNESSES 

THURSDAY, JUNE 21, 2007

Alfonso Martinez-Fonts, Jr., Assistant Secretary, Private Sector Office, U.S. 

Department of Homeland Security ..................................................................... 4

Marko Bourne, Director of Policy and Program Analysis, Federal Emergency 

Management Administration, U.S. Department of Homeland Security .......... 7

F. Duane Ackerman, Former Chairman and CEO, BellSouth Corporation, 

Business Response Task Force, Business Executives for National Security 

(BENS) .................................................................................................................. 10

Hon. John Breaux, Former U.S. Senator from the State of Louisiana, CoChair, Business Response Task Force, Business Executives for National 

Security (BENS) ................................................................................................... 12

Richard Andrews, Ph.D., Senior Advisor for Homeland Security, National 

Center for Crisis and Continuity Coordination ................................................. 15

THURSDAY, JULY 12, 2007

Colonel Robert B. Stephan, Assistant Secretary for Infrastructure Protection, 

U.S. Department of Homeland Security ............................................................. 37

Eileen Regan Larence, Director, Homeland Security and Justice Issues, U.S. 

Government Accountability Office ...................................................................... 42

Lieutenant Colonel Kenneth C. Watson, (Retired), Vice Chairman, Partnership for Critical Infrastructure Security, Inc., and Senior Manager, Critical 

Infrastructure Assurance Group, Cisco Systems, Inc. ...................................... 45

ALPHABETICAL LIST OF WITNESSES

Ackerman, F. Duane: 

Testimony .......................................................................................................... 10

Prepared statement .......................................................................................... 85

Andrews, Richard, Ph.D.: 

Testimony .......................................................................................................... 15

Prepared statement .......................................................................................... 97

Bourne, Marko: 

Testimony .......................................................................................................... 7

Prepared statement .......................................................................................... 72

Breaux, Hon. John: 

Testimony .......................................................................................................... 12

Prepared statement .......................................................................................... 91

Larence, Eileen Regan: 

Testimony .......................................................................................................... 42

Prepared statement .......................................................................................... 115

Martinez-Fonts, Alfonso, Jr.: 

Testimony .......................................................................................................... 4

Prepared statement .......................................................................................... 59

Stephan, Colonel Robert B.: 

Testimony .......................................................................................................... 37

Prepared statement .......................................................................................... 104

Page

IV

Watson, Lieutenant Colonel Kenneth C.: 

Testimony .......................................................................................................... 45

Prepared statement .......................................................................................... 140

APPENDIX 

‘‘Getting Down to Business: An Action Plan for Public-Private Disaster Response Coordination,’’ The Report of the Business Response Task Force, 

January 2007 ........................................................................................................ 148

Responses to Questions for the Record from: 

Mr. Bourne ........................................................................................................ 208

Mr. Ackerman ................................................................................................... 223

(1)

PART I: DEFINING THE PROBLEM AND 

PROPOSING SOLUTIONS 

THURSDAY, JUNE 21, 2007

U.S. SENATE,

AD HOC SUBCOMMITTEE ON STATE, LOCAL, AND

PRIVATE SECTOR PREPAREDNESS AND INTEGRATION,

OF THE COMMITTEE ON HOMELAND SECURITY

AND GOVERNMENTAL AFFAIRS,

Washington, DC. 

The Subcommittee met, pursuant to notice, at 2:06 p.m., in Room 

SD–342, Dirksen Senate Office Building, Hon. Mark Pryor, Chairman of the Subcommittee, presiding. 

Present: Senators Pryor, Akaka, and Sununu. 

OPENING STATEMENT OF SENATOR PRYOR 

Senator PRYOR. Let me convene our inaugural meeting of the 

Subcommittee and welcome my colleagues. Senator Sununu is on 

his way. I want to thank the panel for being here today. 

This is a new Subcommittee of the Homeland Security and Governmental Affairs Committee. It was created with the start of this 

Congress to focus attention on the coordination between the American business community and the government in disaster preparedness and response. 

When you look at Hurricane Katrina, you see that some Federal 

agencies were prepared—for example, the National Guard and the 

Coast Guard—while others weren’t. We all remember stories about 

ice trucks driving around the country or people overpaying for 

things when they could have been given for free. We are not here 

to revisit all of that today, but we really want to learn lessons from 

the private sector to get ideas on how the government can be more 

prepared and also how we, as a Nation, can be more prepared for 

disasters. 

Hurricane Katrina was one of the most horrific natural disasters 

in our Nation’s history, but one of the good news stories that came 

out of it was that there were 254 different companies contributing 

$1 million or more in connection with Hurricane Katrina. WalMart, one of my home State companies, provided $13.5 million to 

employees affected by the storm, $17 million to non-employee disaster relief funds, and almost $4 million in merchandise and inkind donations. But like I said, there were 254 companies that 

made over $1 million of contributions in one way or the other, so 

the American business community has a lot that it can be proud 

of. 

2

And we have seen for years good working relationships in the 

business community with the government in various ways. One example is the Highway Watch Program, basically was started in the 

1990s when law enforcement agencies approached the trucking industry to help report road hazards, to be the eyes and ears out 

there on the roads when the law enforcement agencies weren’t 

around. And now, the American Trucking Association and Department of Homeland Security together train nearly every trucker on 

the road to watch for suspicious terrorist activity. 

So we know that public and private partnerships work. We know 

there is a great track record when we work together and I am very 

pleased to mention that in June 2006, a non-partisan business executive group, the Business Executives for the National Security 

(BENS), formed a task force to specifically address the integration 

of public and private preparedness. They came out with a report, 

which I think we all have copies of, called ‘‘Getting Down to Business: An Action Plan for Public-Private Disaster Response Coordination.’’

There is a lot in this report, but basically, there are three main 

findings. 

One, is that the private sector must be systematically integrated 

into national preparedness and response efforts. Two, is that commercial supply chains can provide a wider range of goods and services than government entities. And three, regulatory and 

credentialing improvements should be made, and these recommendations have sparked a lot of interest and discussion about 

public-private partnerships, which I think is very healthy. 

The hearing today will examine the current state of public-private collaboration. Our witnesses will talk about how they view the 

current state of public-private partnerships. It is my understanding 

that DHS and FEMA have embraced many of the recommendations 

and have taken some initial steps on that. The Subcommittee 

would love to have a progress report on how that is going and how 

you see that unfolding over the next few months. 

And I also hope that today’s review will help us determine 

whether the government and the private sector have the tools they 

need to continue to improve our response capabilities. 

Senator Akaka, would you like to make an opening statement? 

Go ahead. 

OPENING STATEMENT OF SENATOR AKAKA 

Senator AKAKA. Thank you very much, Mr. Chairman. I want to 

join you in welcoming our witnesses, all of you here, to this hearing. Also, I want to note my good friend and colleague John 

Breaux. John, will you please give my aloha to Lois. We have had 

many good years together here in the House and in the Senate. 

I want to thank you, Mr. Chairman, for organizing this important hearing to begin discussions on how the public and private 

sectors can collaborate more effectively to prepare for and respond 

to natural and manmade disasters. 

Despite the catastrophe of September 11, 2001, and the renewed 

focus on disaster planning in its aftermath, Hurricane Katrina 

starkly demonstrated that much more must be done at all levels 

3

of the government and the private sector to plan and prepare for 

disasters. We need innovative approaches to incident management. 

The government cannot succeed without forging a partnership 

with the private sector. The private sector owns approximately 85 

percent of our Nation’s critical infrastructure. The private sector 

has the expertise and the resources to play a leading role at every 

stage of response and recovery. With improved disaster planning 

and response, cooperation between the two will result in a reduction in the loss of life and property, which is the overall goal of 

emergency management. 

Because of its unique geography, my home State of Hawaii is at 

risk of many natural catastrophes. Just last year, an earthquake 

measuring 6.7 on the Richter Scale caused extensive property damage on the big Island of Hawaii as well as on Maui. I am acutely 

aware of the need for an all-hazards approach to disaster preparedness and response, and I believe that in order to be effective, this 

approach must include public, private, and non-profit cooperation 

in the development of guidance, standards, plans, and solutions. 

I hope today’s witnesses will address their agency and organizational efforts to ensure that disaster preparedness and emergency 

response planning is inclusive of all stakeholders affected by disasters. 

I also was interested in the conclusion of the BENS task force 

that the government should do a better job of tapping commercial 

supply chains to get relief to those in need after a disaster. This 

type of collaboration is especially important to Hawaii. Because of 

our separation from the mainland, it takes much longer for relief 

to be sent by other States to reach those in need. 

My Subcommittee on Oversight of Government Management, 

which recently held a hearing on procurement at DHS, has taken 

a keen interest in government procurement practices. It is essential 

that DHS work closely with FEMA to put contracts into place with 

the private sector that can ensure that when disasters strike, we 

have the resources necessary to respond and that we can move supplies quickly to where they are needed. I look forward to hearing 

more about this topic. Dialogues like this are an important part of 

ensuring that when the next major disaster strikes, we will have 

systems in place to provide needed relief in a way that is swift, 

comprehensive, coordinated, and cost-effective for the American 

people. 

Again, Mr. Chairman, I thank you for holding this hearing. I look 

forward to learning more about the private sector preparedness initiatives that are being considered and implemented. Thank you 

very much. 

Senator PRYOR. Thank you, Senator Akaka. Thank you for being 

here. We will have other Senators join us. We have a quorum call 

on the floor right now and they are trying to work out some amendments down on the floor, so it is a busy day, but hopefully we will 

have people coming in and out of the Subcommittee hearing. 

What I would like to do now is take a couple of minutes to introduce all five of our panelists and then I thought I would allow you 

all to make your opening statement, and then we will have questions. 

4

1The prepared statement of Mr. Martinez-Fonts appears in the Appendix on page 59. 

Our first witness will be Alfonso Martinez-Fonts, Assistant Secretary for the Private Sector Office at the Department of Homeland 

Security. Mr. Martinez-Fonts works to provide America’s private 

sector with a line of communication to the Department. 

Our second panelist will be Marko Bourne, Director of Policy and 

Program Analysis for the Federal Emergency Management Administration. He has had over 20 years of experience in governmental 

and legislative affairs, marketing, and the emergency services and 

management fields. 

Our next panelist will be Duane Ackerman, member of the BENS 

Business Response Task Force and former Chairman and CEO of 

BellSouth Corporation. Mr. Ackerman is the immediate Past Chairman of the National Council on Competitiveness and the National 

Security Telecommunications Advisory Committee. 

Next, the panelist who needs no introduction here, Senator John 

Breaux, a very respected member of the Senate family. He is a 

former Senator of Louisiana and Co-Chairman of the BENS Business Response Task Force. He is currently Senior Counsel at Patton Boggs, where he has provided strategic advice on public policy 

matters since his retirement from the U.S. Senate in 2005. 

And last but not least is Dr. Richard Andrews, Senior Advisor for 

Homeland Security at the National Center for Crisis and Continuity Coordination. Dr. Andrews is also a member of the President’s Homeland Security Advisory Council, the World Bank’s Disaster Management Operations Group, and former Director of the 

Office of Homeland Security for the State of California. 

Mr. Martinez-Fonts, we will turn it over to you. 

TESTIMONY OF ALFONSO MARTINEZ-FONTS, JR.,1 ASSISTANT 

SECRETARY, PRIVATE SECTOR OFFICE, U.S. DEPARTMENT 

OF HOMELAND SECURITY 

Mr. MARTINEZ-FONTS. Thank you, Mr. Chairman. Chairman 

Pryor, Members of the Subcommittee, thank you very much for the 

opportunity to appear before you today. 

My written statement goes into great detail on how the Department and specifically the Private Sector Office, which I head up, 

communications and collaborates with the private sector. We also 

illustrate how we work with the component agencies like FEMA to 

promote the creation and sustainability of public-private partnerships. 

In my remarks before you today, I would like to first give you 

some background on the statutory mandate of the Department of 

Homeland Security’s Private Sector Office. Then I will talk about 

how we approach partnership building with the private sector. And 

finally, I would like to conclude my remarks by illustrating how we 

work with FEMA, CVP, and ICE, 

IP, and other component agencies at the Department, encourage 

and foster public-private partnerships which assist in the integration of the private sector in emergency preparedness, response, and 

recovery while maintaining the economic health of the economy. 

To begin with, let me introduce to you the unique function of 

Homeland Security’s Private Sector Office. As part of the 2002 

5

Homeland Security Act, specifically Title I, Section 102(f), Congress 

created the position of Special Assistant to the Secretary for the 

Private Sector. Comprised of a staff of 14 employees, the Private 

Sector Office executes outreach, research, and analysis based on its 

statutory mandates to communicate, engage, and cultivate partnership-building with the private sector. We also act as an advocate 

for the private sector when we advise the Secretary on the impact 

of the Department’s policies, regulations, processes, and actions. 

In order to carry out our mission and to reach approximately 30 

million businesses in America, we must have partners. Our principal partners in this task are trade associations and Chambers of 

Commerce that businesses belong to. Without them, we really simply can’t do our job. These associations and Chambers of Commerce 

include the U.S. Chamber of Commerce, the Business Roundtable, 

the National Association of Manufacturers, Business Executives for 

National Security (BENS), National Federation of Independent 

Businesses, and hundreds of others. We believe partnership-building enhances our Nation’s ability to prepare for, respond, and recover from acts of terrorism and natural disasters. 

Public-private partnerships cover a range of purposes and members. They come together to exchange information, facilitate dialogue, or focus on a particular set of issues. They can be diverse 

in composition, ranging from individual businesses to non-governmental organizations. 

Partnerships, like organizations, have characteristics which lend 

to its success. We believe there needs to be a defined mutual goal, 

a champion on each of the two sides of the partnership, and a business case for action. 

As with any collaborative effort, there are challenges which can 

make a public-private partnership vulnerable. There are three 

areas that we consider to be potential risks. One is the issue of liability and who bears it. The second is the lack of commitment to 

the partnership. And the third one is a conflict of interest, which 

can be real or perceived, that prevents the private sector from fully 

engaging with the government for fear of losing an economic opportunity. 

Homeland Security actively promotes and coordinates public-private partnerships. 

It is woven into the very fabric of our mission. We reach out 

across our Department to our components, who assist them in the 

outreach efforts to the private sector. 

For example, we work with the Office of Infrastructure Protection and their Sector Coordinating Councils where private sector 

partners represent the 17 critical infrastructures and key resources. We also work with the Office of Intelligence and Analysis 

to encourage States to include private sector representatives in 

their Fusion Centers, and we have helped them to develop a model 

on how to include them. 

The Private Sector Office staff is assigned to a portfolio that 

cover all of the operating components, such as Customs and Border 

Protection, Immigration and Customs Enforcement, TSA, and 

Coast Guard within the Department of Homeland Security. The 

Private Sector Office often acts as a catalyst with Homeland SecuVerDate 0ct 09 2002 13:49 Mar 18, 2008 Jkt 036615 PO 00000 Frm 00009 Fmt 6633 Sfmt 6633 P:\DOCS\36615.TXT SAFFAIRS PsN: PAT
6

rity component agencies to cultivate and foster these public-private 

partnerships. 

We especially work with component agencies to assist in establishment of relationships, integration, and partnership building 

with the private sector. 

What I would like to do today is take FEMA as an example. We 

have detailed a senior staff person from our office to assist FEMA 

in their efforts to integrate the private sector into their communications, operations, and logistics. We currently are working to develop a Loaned Executive Program where FEMA can benefit from 

private sector expertise in logistics and other missions. 

We are implementing lessons learned. For example, the Private 

Sector Office created the National Emergency Resource Registry 

(NERR), as a result of the 2004 Florida hurricanes. This electronic 

system was created to manage offers of unsolicited goods and services. However, a year later during Hurricane Katrina, NERR was 

operational, but was unable to adequately handle all of the offers 

made to the system. To replace NERR and to address the need for 

a robust donation management system during a crisis, we assisted 

FEMA in reaching out to AIDMATRIX, a nonprofit organization 

who through a grant from FEMA has created a virtual superhighway for all levels of government, private sector, and nonprofits 

to connect and share unsolicited offers of products, services, and 

volunteers. Subsequently, the NERR framework has been retooled 

to create FEMA’s Debris Contractor Registry. We are also working 

with FEMA’s National Exercise Program to incorporate private sector in major exercises like TOPOFF 4. 

In addition to working with FEMA, we also reach across the Department to find ways where we can encourage the use of standards and best practices just to get things done. 

We also work to encourage the adoption of the NFPA 1600 at the 

local level. For example, we recently held with the U.S. Chamber 

of Commerce a pilot initiative to create a Regional Business Preparedness Summit in Charlotte, North Carolina. This event 

brought together local leaders in the emergency management area, 

public health, and the private sector. 

We also collaborate with our Federal partners, for example, with 

the Office of Infrastructure Protection. We reached out to the Department of Energy to encourage owners and operators of gasoline 

stations to wire and install generators to operate fuel pumps in 

case of a power outage. 

Public-private partnerships are not disguised charity by the private sector. Good public-private partnership provides common 

ground towards working towards mutual goals. Public-private partnerships are not a means to shift the public burden away from the 

government. However, a partnership in its truest state is where 

both partners contribute their skills and services as a joint effort. 

This collaboration creates an environment which builds trust, communication, and cooperation. These results only enhance our Nation’s ability to better prepare for, respond to, recover from, and 

mitigate against an act of terrorism or natural disaster. 

This concludes my opening remarks. I look forward to answering 

any questions that you may have. 

Senator PRYOR. Thank you. Mr. Bourne. 

7

1The prepared statement of Mr. Bourne appears in the Appendix on page 72. 

TESTIMONY OF MARKO BOURNE,1 DIRECTOR OF POLICY AND 

PROGRAM ANALYSIS, FEDERAL EMERGENCY MANAGEMENT 

ADMINISTRATION, U.S. DEPARTMENT OF HOMELAND SECURITY 

Mr. BOURNE. Thank you, Mr. Chairman, Members of the Subcommittee, and thank you for the opportunity to appear here today 

on behalf of FEMA and the Department of Homeland Security. My 

written statement goes into a lot of detail on many of the new business and management processes that we are putting in place at 

FEMA in what Administrator Paulison calls the new FEMA. In my 

remarks to you, though, I would like to focus on some of the key 

elements of our strengthening relationships with the private sector 

and our other partners that we are already beginning to see the 

benefits of. 

We are working diligently to build a new FEMA that is stronger 

and more nimble. With expanded authorities and resources provided to us by this Congress and the Administration, we have implemented a reorganization which I had the privilege to lead, and 

that we have begun to strengthen our existing structure and fully 

incorporate the core elements of the former DHS Preparedness Directorate into our organization as part of the new FEMA. 

One of the first ways we used our relationships in the private 

sector can be seen in how we got the ball rolling on many of these 

organizational reforms. At the end of last year, Administrator 

Paulison instituted a series of 17 independent assessments. They 

were agency-wide and they reviewed our existing processes and 

business practices and included recommendations for reform that 

were built upon public and private sector best practices. FEMA has 

already instituted many of the recommendations and we are continuing to do so for the remainder of this year and into the next 

fiscal year. These assessments have also been an essential resource 

during our reorganization process. 

With our new structure in place, today, FEMA is focused on improving its relationships with the private sector in key areas, such 

as preparedness partnerships, internal organizational assessments, 

enhanced supply stream management, logistics, contracting, catastrophic planning, strong community coalition building, and industry fairs and outreach programs. 

As the Subcommittee considers private sector preparedness efforts and challenges, at FEMA, we are working closely with the 

Private Sector Office, the Office of Infrastructure Protection, the 

Office of Public Affairs, and others to strengthen the outreach to 

our critical partners in our response to any emergency. 

I am happy to note that it has been a two-way street. Many of 

the businesses that we reach out to and work with are taking active steps to implement recommendations contained in the Ready 

Business Program, which FEMA had a part in creating, and we are 

looking at more ways for business to reach out to emergency management at the community, State, and Federal level to participate 

in planning for disasters that may affect the cities and regions in 

which they work and serve. 

8

FEMA is also engaging the private sector to assist us in our efforts to build an even stronger emergency management system. We 

are doing so through our Infrastructure Protection Programs, 

which consists of legacy grants, namely the Port Security Grant 

Program, Transit Security Grant Program, the Inner City Bus Security Grant Program, and the Trucking Security Program, as well 

as through our exercises and training venues. The details of many 

of those programs are contained in my written testimony. 

Increasingly, we are leveraging the resources and expertise of 

our partners in the private sector and nonprofit world, even above 

and beyond the important role they played in the past. This increased reliance comes about because the new FEMA is developing 

some innovative ways to move forward to be forward-leaning, 

quicker to respond appropriately to disasters and emergencies as a 

partner to our State and local emergency management partners. 

One way we are doing this is through a dramatic increase in our 

pre-scripted mission assignments and our pre-negotiated contracts 

to provide the necessary resources. Since Hurricanes Katrina and 

Rita, FEMA has worked aggressively to award hundreds of pre-negotiated competed contracts and these are in place and ready for 

the 2007 hurricane season. This is allowing us to be prepared 

ahead of a disaster so we are not negotiating contracts in the heat 

of battle. Contract agreements are in place covering all aspects of 

FEMA’s disaster management, to include logistics, mitigation, individual assistance, recovery programs, management, and integration 

center support. 

Perhaps the most visible example of how the private sector has 

influenced FEMA’s reorganization is through the creation of our 

Logistics Management Directorate. Our goal is to have our logistics 

management look at business practices that are in place and understood by the community across the country rather than reinventing the wheel ourselves. We are moving towards an increased 

ability not only to track the commodities that we do keep and 

maintain, but to begin to shorten our supply chains and look to 

third-party logistics to handle the majority of the resource needs in 

a just-in-time delivery. We have looked at AIDMATRIX and adopted it to support our supply of donated goods and services. 

Through our Citizen Corps Program, we are bringing community 

and government leaders together in all-hazards emergency preparedness planning. There are 2,200 Citizen Corps Councils with 

a presence in every State and territory. Councils are encouraged to 

include business representation and to work with business to integrate those resources with community preparedness and response 

plans. 

As we look to FEMA’s preparedness efforts, we believe the private sector should continue to build upon their preparedness efforts 

in several key areas. First of all, to continue their development of 

strong business continuity plans for all of their locations and critical data centers. Develop employee support plans for their employees’ office locations that are damaged or if they have employees 

that have lost their homes. Part of the issue in quick recovery from 

a disaster, or quicker recovery, is the element of getting people 

back to work as soon as possible in the affected areas. 

9

We encourage them to engage in prudent risk management practices and have strong health and safety programs, working closely 

with their local emergency managers and first responders and 

elected officials to be involved in disaster planning that begins at 

the local level and builds to the State. To build protocols to assist 

with recovery efforts before a disaster strikes. 

Through business associations, we are continuing to work with 

State emergency management and FEMA to support preparedness 

planning, disaster response, and donation management. The private sector has also engaged FEMA and State emergency management and offered to provide liaisons to State Emergency Operations Centers, Joint Field Offices, and we are working with the 

Chamber of Commerce, BENS, and the Business Roundtable and 

others in developing a private sector association liaison, which we 

hope to be able to put into the National Response Coordination 

Center here in Washington. 

FEMA is also integrating the private sector in a myriad of initiatives across the agency. For example, we are working closely with 

Homeland Security’s Private Sector Office to utilize their concept 

of relationship and partnership building. We have welcomed the 

Homeland Security Private Sector Office Staff as part of our senior 

advisors. And a number of initiatives that we are undertaking will 

involve communications outreach and operations in mission critical 

areas, like logistics. 

Just a highlight of our new approach to the private sector include 

many things which also involves a meeting next week that we had 

scheduled prior with BENS, BRT, and the Chamber together to discuss new initiatives that we can take to move this agenda forward. 

We want to take a proactive approach to leading the way for the 

private sector to be incorporated in our emergency operations and 

especially working for ways to find access that we can bring in association representatives into the Joint Field Office and Regional 

Response Coordination Centers. 

We are incorporating private sector expertise by creating a new 

FEMA Loaned Business Executive Program. We hope to, in the 

next few days, close an agreement with a business foundation 

which we will name after we have the agreement finally signed 

which would bring a seasoned expert from the private sector into 

FEMA operations to serve as an advisor and collaborator on mission critical programs. This is a start of a program we hope to expand in the future after we have had an opportunity to see how 

it works. 

Private sector participation in our Regional Emergency Communication Coordination Groups, which we will be standing up over 

the next several months, is also critical. 

We are developing a Memorandum of Understanding with the 

Stadium Owners and Operators Association for sheltering. 

We have funded a pilot program in Denver with InfraGard and 

BENS to support a resource registry that can be utilized at the 

local level to improve the private-public partnership. 

We encourage mutual aid programs for businesses. We can provide mutual aid training through our online systems at the Emergency Management Institute, and we can provide a pilot website to 

serve as a repository to post information about all of the above acVerDate 0ct 09 2002 13:49 Mar 18, 2008 Jkt 036615 PO 00000 Frm 00013 Fmt 6633 Sfmt 6633 P:\DOCS\36615.TXT SAFFAIRS PsN: PAT
10

1The prepared statement of Mr. Ackerman appears in the Appendix on page 85. 

tivities, training opportunities, and business continuity programming. 

Our regional offices have been reaching out to the business community. For example, Verizon wire and wireless has met with our 

Region 1 office in the last 2 weeks with regard to hurricane planning, and our Region 5 office is working with ChicagoFIRST on 

preparedness planning for financial institutions. 

We are also going to be establishing a credentialing working 

group within the NIMS Integration Center to pinpoint some of the 

issues on credentialing and develop some viable options to address 

the credentialing concerns. 

There will certainly be a continuing role for the private sector in 

the future at FEMA. FEMA needs to ensure that we are adapting 

to new conditions and the ever-changing needs. It is important that 

as we build these relationships, we continue that effort so that it 

is understood by all parties that you can’t just show up on game 

day and expect to play without being part of the practices. Our job 

is to make those practices available, open, and valuable for both us 

and the private sector. FEMA realizes that a successful, robust, coordinated response is needed and that the private sector, both horizontally and vertically across the full spectrum of emergency management, is a partner. 

Thank you for the opportunity to be here today and I look forward to answering any questions you might have. 

Senator PRYOR. Thank you. Mr. Ackerman. 

TESTIMONY OF F. DUANE ACKERMAN,1 FORMER CHAIRMAN 

AND CEO, BELLSOUTH CORPORATION, BUSINESS RESPONSE 

TASK FORCE, AND MEMBER OF BUSINESS EXECUTIVES FOR 

NATIONAL SECURITY (BENS) 

Mr. ACKERMAN. Mr. Chairman, Members of the Subcommittee, I 

want to thank you for the opportunity to be here today. When I 

think about the work that has been done on the task force, I did 

have the privilege of serving on this task force and developing the 

report which you have had. And while we don’t have time to go 

through every single detail, I would like to just stipulate, or I 

would like to ask that my written testimony be submitted along 

with the complete report for the record. Then I would like to focus 

my time on this issue of the public-private partnership and some 

of the work that we did on the task force to look at the private sector and examine its role in disasters. 

First of all, we found that on a local scale, disasters do happen 

right regularly, and business routinely plans and interacts with 

first responders and collaborates on those disasters at the local 

level. We have also found that after securing their own businesses, 

they invariably turn towards the rest of the community because 

without community continuity and without business continuity, 

surely there is no recovery in that community and there is no business done. So it is clear that business does have an interest that 

goes beyond their own operations. 

We have dealt with many hurricanes, but indeed, Hurricane 

Katrina was different, as has been mentioned and talked about 

11

over the years. It was a terrible tragedy, but I think there are some 

very key issues that evolved from Hurricane Katrina that are instructive to us as we look forward to what may lie before us. 

It had many characteristics that a large natural and/or manmade 

disaster will have as we go forward. Major damage to critical infrastructure. Contamination—in the case of Hurricane Katrina, it was 

water. In the future, it could be other things, such as nuclear, biological, or chemicals. Overwhelmed law enforcement and the breakdown of civil order was present and Federal help was required; but 

there was no real plan for integrating all of the concerned entities 

for a response. The Federal Government has a plan. Certainly the 

State has a plan. Local has a plan. Business has a plan. But there 

is no plan for all of these entities in terms of how they are going 

to operate and function together at the time of crisis. 

I think all of the above conditions would be present in a disaster 

that impacted a significant portion of any major metro area, whether it is a natural disaster or manmade. 

Our Subcommittee looked at known problems from Hurricane 

Katrina. We looked at recommendations that came from over 100 

interviews that were made with the private sector. We drew on the 

knowledge of both the public and private sector in order to pull our 

study together. We conducted face-to-face meetings in Washington, 

DC. Various meetings were held and we brought all that back together in order to produce the report, ‘‘Getting Down to Business.’’

The overall conclusion was the private sector must be included 

in the planning, practice drills, and execution of a disaster response 

scenario. I would certainly like to emphasize practice in this regard, because I think it is one thing to have a plan, but until you 

have had the Federal Government, State government, and local authorities and the private sector at the table, certainly, I don’t believe we have accomplished the task, and there are a lot of reasons 

for this. 

First of all, the private sector owns much of the infrastructure. 

The private sector has experience, skills, information, and capabilities that are critical to a successful response to a major disaster. 

And we believe that once local and State capability is overwhelmed, 

the Federal Government always will be called on and will be expected to help, and when they come to help, that interface with the 

other entities and how they will make decisions and how they will 

partner becomes very important. 

We use this term public-private relationship frequently, but 

when you think about what it means in this case, it absolutely 

means that most of the States have an Emergency Operations Center and what we are suggesting with the BENS report is that there 

be a companion Business Operations Center either at the State or 

the regional level at the same time, and that needs to be able to 

expand to incorporate the Joint Field Office when it comes with the 

Federal agencies so that all parties can collaborate along with the 

private sector on the immediate challenges, threats, and the solutions that must be implemented. 

So we believe that the National Response Plan needs to include 

the private sector. It needs to support joint planning, joint practice 

drills, and when an event occurs, joint execution. Joint in this case 

means local, State, Federal, and the private sector. 

12

1The prepared statement of Mr. Breaux appears in the Appendix on page 91. 

Practice, again, is extremely important, because by conducting 

joint drills, we constantly turn up new issues, new problems that 

must be overcome and must be overcome together. 

It is my hope and the sincere recommendation of the BENS Task 

Force that you will acknowledge, encourage, and support the building and exercising of enduring public-private collaborative partnerships that integrate the private sector into the National Response 

Plan and the National Response Infrastructure. In turn, the private sector must have a reliable government partner, and the emphasis there is on the word ‘‘partner’’ because viable regional and 

Federal actors in all phases of the operations must relate to each 

other in balanced proportions in order to come out with a successful ending. 

If this structural reform is indeed adopted, it will greatly facilitate all of the other recommendations in the report of the BENS 

Business Response Task Force. Thank you. 

Senator PRYOR. Thank you. Senator Breaux. 

TESTIMONY OF HON. JOHN BREAUX,1 FORMER U.S. SENATOR 

FROM THE STATE OF LOUISIANA, CO-CHAIR, BUSINESS RESPONSE TASK FORCE, BUSINESS EXECUTIVES FOR NATIONAL SECURITY (BENS) 

Mr. BREAUX. Thank you very much, Chairman Pryor and Senator 

Akaka. Thank you for making time in your very busy schedules 

today for us to make this presentation, and also Senator Sununu, 

thank you for coming back. The place looks a lot better since the 

last time I was here. The chairs are much more comfortable, I want 

to tell everybody, but we will not overstay our welcome and make 

it as brief as we can. 

I would like to ask unanimous consent that my full statement be 

made part of the record. I will just try and summarize, if that is 

all right. 

Senator PRYOR. Sure. 

Mr. BREAUX. I accepted and volunteered after Duane Ackerman, 

our chairman, called me and asked me to volunteer, and you can’t 

tell Duane Ackerman no, to serve as co-chair with Newt Gingrich 

of this effort, which I think has been very productive and hopefully 

very helpful to the Members of Congress who are looking for ways 

to try and find out what we can learn from natural disasters that 

occur. 

A natural disaster, as bad as it is, is terrible, but if we don’t 

learn anything from it, it is a double disaster, and I think that now 

that we have had time to reflect on Hurricane Katrina as one of 

the largest natural disasters in the history of the United States, 

there are things that we can recommend that we know that can be 

done to make sure that the next time these things happen, that we 

can be in a better position to respond effectively and quickly and 

be helpful to the citizens of this country. 

We can work in Congress to prevent disasters like what happened on September 11 by having stronger national security, and 

by having a strong military. We can help prevent September 11s. 

But we can’t, no matter what we do, ever prevent another hurriVerDate 0ct 09 2002 13:49 Mar 18, 2008 Jkt 036615 PO 00000 Frm 00016 Fmt 6633 Sfmt 6633 P:\DOCS\36615.TXT SAFFAIRS PsN: PAT
13

cane. We can’t prevent another flood. We can’t prevent another 

earthquake. But we can, through Congress, try to make sure that 

we are better prepared to respond to these type of natural disasters 

when they occur, and I know your Subcommittee, Mr. Chairman 

and Senator Sununu, are working hard to come up with recommendations, and hopefully what we are presenting to you can be 

helpful in that regard. 

One of the things that I think that we would like to recommend 

is that this involvement of the private sector needs to be better institutionalized. Director Marko Bourne and Secretary Al MartinezFonts, I am delighted to hear what you all have done to integrate 

the private sector. That is real progress that they have talked 

about here this morning. 

But I think that, in addition to that, the process has to be more 

formalized. It has to be institutionalized. It has to be in writing. 

It has to be out there so that the private sector can know exactly 

what the rules and what the regulations are when a natural disaster occurs, and I think that this Subcommittee could be particularly helpful in focusing on institutionalizing an effective and sustainable role for the private sector, and that is incredibly important. 

We made recommendations in three principal, substantive areas. 

Mr. Ackerman talked about the public-private collaboration, incredibly important. Government can’t do this by ourselves. The private 

sector must be involved. After Hurricane Katrina, people talked 

about, well, what we ought to do is have government facilities, distribution centers by the government set up around the country. We 

don’t need government distribution centers. We have got private 

sector distribution centers. Senator Pryor, Wal-Marts are in every 

State in the Union. Whether it is a Wal-Mart or a Home Depot or 

a Lowe’s or any of the large distribution centers, they are already 

there. The challenge for government is to incorporate the government’s work with the private sector to make full utilization of the 

supplies that are already around the country located in key areas 

that are very accessible and already there. 

We also are making recommendations on surge capacity for the 

private sector goods and services. 

How do you gear up quickly for a natural disaster? I think the 

two government witnesses have made good comments in that. 

I would like to focus quickly on the legal and regulatory environment. I think that is important. Businesses require some type of 

a predictable legal regime before they get involved in helping. We 

had people that came down from Arkansas and people that came 

down from all over the country. They didn’t know what the rules 

were in Louisiana. They didn’t know what the laws were in Mississippi or along the coast. They didn’t know what they could do 

and how they could do it. There has to be some type of a system 

in place for these private sector groups, and when they want to 

come down and help, they know what the rules are going to be. 

We also have to, I think, reform to a large extent the legal allocation of risk to private companies when they are willing to help. We 

heard from a lot of companies, Mr. Ackerman, that said, look, we 

wanted to be involved, but we didn’t know what our liability was. 

So if we come down there and we do something not quite right, 

14

what is our legal responsibility? As a result, some private sector 

companies said, well, we are not going to do it because we don’t 

know what the risks are. It is not a reasonable risk for us to accept 

on behalf of our stockholders. 

I will give you a real example of that. When New Orleans was 

under water with about seven, eight, to ten feet of water throughout the city, contracts were issued by the government to do what 

we call de-watering of the city, and what they were ordered to do 

was to take the water in the city and pump it out into Lake Pontchartrain. Nobody got a permit. There wasn’t an EPA permit or a 

Corps of Engineers permit to do that. And the companies were saying, well, what if we do it, we don’t have a permit, and somebody 

is going to sue us after for polluting the lake? Well, there is a question of priorities. The city was under ten feet of water and people 

were drowning and you are going to say, well, we can’t do it until 

we get a permit from the government and go through the permitting process? That can’t be done. 

But companies, when they approach these emergency situations, 

have to have a very clear understanding of what the legal requirements are when they become involved, as a volunteer in many 

cases or as a private contractor in others, but they have to know 

what their legal exposure is and so they will have a clear ability 

to make the right decision. I think that is something that we could 

do very well with amendments to some of the laws that are in 

place. 

We would like to, in other words, enact a national disaster law. 

We have the Stafford Act, a great program, and all of you folks and 

the staff are very familiar with it. But we would like to suggest 

that the Stafford Act also has to include the private sector. It can’t 

just be local governments and State governments. The private sector ought to be incorporated and brought into the Stafford Act so 

they will know under that Act of Congress exactly what their roles 

can be, what their exposure can be, and how they can be greater 

involved. 

I think it would be just absolutely terrific if this Subcommittee 

could focus on some hearings on the Stafford Act. You can’t do it 

really quickly. You have to do it carefully. This is a law that has 

been around for a long time. I served with Senator Stafford when 

he was here and wrote this and I think that it served us greatly, 

but it ought to be changed in order to bring in the private sector 

and make it a part of the Stafford Act, as well. It covers State and 

local. It needs to cover private sector, as well. 

Finally, let me just suggest that a lot of the things that we are 

talking about to get the locals and the States involved, I mean, you 

could require that when you get a Federal grant under FEMA that 

a State have in place, without any cost to Congress right now, a 

mechanism to incorporate the private sector. Every State ought to 

have a clearly defined plan that when a natural disaster occurs, 

and we know it will, that they have a plan in place to bring in the 

private sector to help them solve the problem. That can be a requirement for getting any kind of a Federal grant. If they don’t 

have the plan in place, they are not eligible for Federal grants, and 

you wouldn’t be surprised how fast States would move in that direction if they knew their Federal assistance was dependent on 

15

1The prepared statement of Mr. Andrews appears in the Appendix on page 97. 

having a well-established, clearly thought out local plan on the 

State and local level to involve the private sector. 

One thing that we found, Mr. Chairman and Members, in all of 

our meetings that we had is that you have in place a private sector 

community that is ready, willing, and very able to help our Federal 

Government address these natural disasters. We need to clean up 

some of the laws and some of the provisions in order to make it 

possible, but I think that this Subcommittee certainly has the great 

leadership and great capacity to make that happen. 

Senator PRYOR. Thank you. Dr. Andrews. 

TESTIMONY OF RICHARD ANDREWS, PH.D.,1 SENIOR ADVISOR 

FOR HOMELAND SECURITY, NATIONAL CENTER FOR CRISIS 

AND CONTINUITY COORDINATION 

Mr. ANDREWS. Thank you, Mr. Chairman, Members of the Subcommittee, and thank you for the opportunity to testify today. I 

served as a member of the BENS Task Force that developed the 

report that has been referenced in the previous testimony. I am 

also Chair of the Private Sector Committee of the National Emergency Management Association (NEMA), which is the association of 

all the State Emergency Services Directors, and served as former 

Director of the California Governor’s Office of Emergency Services 

and Homeland Security Advisor to Governor Schwarzenegger. 

My testimony today focuses on my work as Chair of a public-private sector task force that was formed following the release of the 

BENS report to start working on implementing what I think is one 

of the key recommendations from the BENS report which has been 

referenced by both Mr. Ackerman and Senator Breaux, and that is 

to try to develop a systematic process for incorporating private sector resources into the response to a major disaster. 

Hurricanes Katrina and Rita created the largest demand for 

emergency resources in our history, and each of the major after-action reports cited the Emergency Management Assistance Compact 

(EMAC), which is the compact formally adopted by all the State 

legislatures for which NEMA serves as the executive agent, they all 

cited EMAC for its success in mobilizing tens of thousands of National Guard, search and rescue, medical and emergency management personnel. 

The BENS report identified also an obvious shortfall of the 2005 

hurricane response, and again, it has been referenced in previous 

testimony, namely the absence of a systematic process to utilize 

private sector resources. A number of different efforts, especially 

the creation, as Mr. Martinez-Fonts mentioned, especially the creation of the National Resource Registry by DHS’s Office of the Private Sector Coordinator laudably attempted to fill this gap, and 

while there were some successes, there was a great deal of frustration both within the public and the private sectors. Each recognized 

the need for greater collaboration, but the absence of a commonly 

understood process to match needs with available resources, whether those were donated resources or contracted resources, proved to 

be a major obstacle. 

16

Among the recommendations in the BENS report was the idea of 

building a Business Emergency Management Assistance Compact 

(BEMAC), modeled essentially on the EMAC system that proved so 

successful during the 2005 hurricane season. By expanding EMAC, 

it might be possible to weave together a fabric of State-based Business Operations Centers where private sector representatives 

trained in the State’s operations system would work alongside 

emergency management leaders to coordinate government and private sector resources. 

Earlier this year, the NEMA Private Sector Committee began to 

explore whether this concept could be implemented. BENS supported this effort by assigning staff resources, and my own company, NC4, endorsed my chairing this effort. Representatives from 

eight national corporations, many of which have been mentioned in 

earlier testimony, along with the EMAC leadership—this is the Directors of State Emergency Management who oversee the EMAC 

process—served as members of the task force. 

One of the task force’s basic premises was to build on existing 

State and local initiatives and to focus, like EMAC, on the interstate deployment of resources. In order to establish an understanding of existing State and local initiatives, NEMA conducted a 

survey of all the States. The survey identified a number of very 

promising initiatives at the State level to work with the public and 

private sectors, and a few examples stand out and are worthy of 

mention. 

The Florida Office of Emergency Management has formally established Emergency Support Function 18, Business, Industry, and 

Economic Stabilization. ESF 18 works with the Florida Retail Association to address strategic supply chain issues, projected impacts 

on businesses, and the timely restoration of commercial services. 

Texas, in the aftermath of Hurricane Rita, has developed an extensive Private Sector Operations group consisting of 28 companies 

to support immediate mass care, special needs, power, aviation, 

and fuel challenges. This group will work alongside State emergency management to identify shortfalls in public sector capacity 

that could be most effectively met by private sector resources. 

Utah is organizing sector-specific coordinating councils and is 

working with local Chambers of Commerce and trade associations 

to enhance communications, resource management, and emergency 

operations assignments. 

The New York City Office of Emergency Management has fully 

integrated the private sector into their processes at their new 

Emergency Operations Centers. There are also important initiatives underway in the State of New Jersey, the State of Georgia to 

create a Business Operations Center that Mr. Ackerman referenced, in the State of Massachusetts, and also a beginning initiative in the State of California. 

Nevertheless, a number of significant challenges remain, especially related to using private sector resources in interstate 

responses. Only four States have statutory provisions that enable 

private sector resources to be used as agents of the State in outof-State deployments. Those are Delaware, Michigan, Maine, and 

North Carolina. Other States have specific statutory or procurement regulations that appear to preclude such arrangements. 

17

A fundamental premise of EMAC is that personnel and equipment deployed out-of-State must act as agents of the providing 

State. Other States have stringent restrictions on what pre-event 

contracts and arrangements can be negotiated with the private sector, and in many cases, apparent prohibitions against applying 

those contracts to a response into another State. 

The BEMAC Task Force has identified several next steps that we 

believe will help create a more clearly understood process by which 

the private sector can be mobilized across State boundaries, and I 

would emphasize that these are really the initial steps, and much 

like the starting of EMAC in the aftermath of Hurricane Andrew 

in 1992, we believe it is important to take small but real steps as 

we move towards a more robust and systematic national process. 

BENS has agreed that in cooperation with the U.S. Chamber of 

Commerce and the Business Roundtable, they will work with the 

Department of Homeland Security to identify the point of contact 

for each of the critical sectors. NEMA, in turn, will brief the critical 

sector points of contacts on the EMAC process and will promote the 

use in each State of the points of contact to coordinate requests for 

private sector resources. 

NEMA will also develop a document detailing best practice procedures by State and local governments for working with the private 

sector and will distribute this report to State Emergency Services 

Directors as well as to the various sector coordinators. 

NEMA will work with our task force to define in detail mission 

critical packages of resources projected to be needed during an 

emergency response, and again, this is to try to create the anticipated need in advance so that we are not trying to put these packages together on the fly. 

And NEMA and the BEMAC Task Force will work with FEMA 

to address issues related to reimbursements for private sector resources and compensation for services used through an EMAC-like 

process. 

These steps, we believe, will advance the use of private sector resources by State and local entities and help clarify for the private 

sector a process to be used in requesting resources. States will remain the primary coordinating point for inclusion of the private 

sector under this paradigm. 

Clearly, FEMA needs to be an active partner in this process. The 

scale and variety of risks facing this Nation from natural and manmade emergencies necessitate that we make full use of our public 

and private sector resources. Only through such cooperation partnerships can we accelerate individual and community economic restoration and recovery. 

Again, thank you very much for having me here today. I look forward to your questions. 

Senator PRYOR. Thank you. 

We are going to go out of order today and we are going to let 

Senator Akaka go first. Senator Akaka. 

Senator AKAKA. Thank you very much, Mr. Chairman. 

Mr. Ackerman, I believe strongly that we need an all-hazards approach to preventing, responding to, and recovering from disasters. 

I am pleased with your written testimony and pleased with the 

BENS report emphasizing planning for both natural and manmade 

18

disasters. In your experience, has the Federal Government been as 

aware as the private sector of the need for all-hazards disaster 

planning, and if not, what should the government be doing? 

Mr. ACKERMAN. Thank you. When I think about the many years 

I have spent in disaster recovery because of the telecom industry, 

many of these disasters have been local or have been able to be 

handled at the State level, so there has been a great deal more 

practice at a State, private sector, local response. In the area which 

I am very accustomed to, which is the Southeast Coast, we have 

had a lot of practice. We have had, probably in my 40 years, over 

50 hurricanes that have come on that coast and it seems to work 

very well because of the relationships that have been built over 

time. 

When a disaster overwhelms local capability, which we could expect in either natural or manmade at Hurricane Katrina-scale or 

larger, that is the point in which the Federal Government then 

comes to the location. And so it is as important to drill and practice 

with the private sector and plan as it is with the Federal Government because often, it is new relationships, it is different operating 

procedures, and it is day-to-day decisions that have to be worked 

out . . . how the Federal Government works as a full partner with 

the State, with the local, and with the private sector. 

FEMA is a big part of this, but it is not just FEMA. North Command is a part of this. DHS obviously is a part of this. So as you 

create the Business Operating Center and integrate that with the 

State and local, there also needs to be the ability to bring in and 

interface the Federal Government, both at North Command, 

FEMA, as well as DHS, whatever agencies are there. And that collaborative whole hand needs to be able to drill scenarios and practice scenarios to determine how one would work out issues as opposed to trying to work that out when the actual disaster occurs. 

Mr. Bourne talked about credentialing. Well, that was born out 

in the case of Hurricane Katrina when North Command came to 

town and set up a perimeter. We needed to cross that perimeter 

in order to work on facilities, but a new perimeter was there and 

then the question was, what credentials proved that you were a 

valid communications worker and what credentials would the Federal Government accept as opposed to what credentials the State 

and what credentials you would find at the local level? 

So there are numerous issues that will need to be worked out 

with all parties at the table before the next event. So I think that 

it is a disaster of scale, one where local capability is overwhelmed, 

where everyone has to come to the table and to try to work through 

how we accomplish our task, deliver our missions, and assist each 

other to enable the recovery of that local area as opposed to just 

having the Federal Government come in with a plan. 

As I stated in my testimony, I think everybody has a plan. The 

lacking plan is how we all work together when the Federal Government comes to town, short of martial law, which no one really 

wants to declare. So I think this issue is one of full integration, 

planning, practice, as well as execution, including the private sector, local, State, and the Federal agencies that will be involved in 

disaster response. 

19

Senator AKAKA. We really appreciate the BENS report, ‘‘Getting 

Down to Business: An Action Plan for the Public-Private Sector 

Disaster Response Coordination,’’ and your experience really makes 

a difference in how we move that. 

Senator Breaux, you testified that DHS grant programs currently 

are geared to funding one-off exercises rather than long-term collaborations. Project Impact, which was established in 1997 but 

eliminated in 2001, focused on long-term continuity projects to 

identify risks and vulnerabilities and develop programs to lessen 

those risks. These projects involved both the public and private sectors in disaster planning. Although FEMA now provides pre-disaster mitigation grants, as you stated, these are focused competitive grants not directed toward ongoing collaboration. 

Senator, do you believe that Congress should restore funding for 

programs such as Project Impact that focus more on long-term collaborative planning? 

Mr. BREAUX. I think that anything that gets the Federal Government four-square behind additional cooperation between local governments, State governments, with the private sector would be 

very helpful. I have thought of suggesting that grants to States 

under FEMA be conditioned on the States having in place a plan 

for involvement of the local business community so that the business community will know what to do, and that wouldn’t cost anybody any additional money. The grants are already going to the 

States. I think the Federal Government could insist that the State 

have in place a workable private sector continuity program that 

would immediately kick in in the event of a natural disaster. I 

think that would be one way to accomplish this. 

I mean, this is something this Subcommittee and Congress could 

insist on, that Federal grants would be conditioned on the State 

and local government having a plan to involve the local private sector. It wouldn’t cost you any additional Federal money, but I guarantee you the State and local government would follow that recommendation from Congress very quickly. 

Senator AKAKA. Thank you. My time is expired, Mr. Chairman. 

Senator PRYOR. Senator Sununu, thank you for being here today 

and being a great Co-Chair. I look forward to working with you on 

this. 

OPENIN STATEMENT OF SENATOR SUNUNU 

Senator SUNUNU. Thank you. 

Mr. Ackerman and Senator Breaux, a question for both of you relating to the BENS report. One of the things that was recommended were changes to the Stafford Act. I am curious to know, 

one, what specific changes need to be made and is changing the 

Stafford Act intended to address a specific recommendation or just 

a few recommendations or are all of the recommendations that you 

call for sort of encompassed by the Stafford Act? And are there potential unintended consequences to changing the Act, because you 

also emphasized the need to be deliberative about this. Is there any 

particular unintended consequence about which you are most concerned? Mr. Ackerman. 

Mr. ACKERMAN. Yes, Senator. I can give you an example of the 

kind of thing that sort of generated an early focus on the Stafford 

20

Act and it had to do with security. Security is offered to certain 

government entities, to the Red Cross, and to others. It is a little 

bit more questionable as to how that relates to the private sector. 

Again, if you have a disaster that takes out some piece of a large 

metropolitan area, there is a likelihood that you will have some 

civil disorder go along with that if it overwhelms local capability. 

In the case of Hurricane Katrina, we needed to move into the 

city to work in some areas that had a problem and there was a 

question about does the Stafford Act include or cover providing the 

private sector, especially emergency responders, not first responders, but power company, telephone company, computer company, 

does it provide us security going into an area where citizens are 

hostile or armed or just bands of people who are horribly upset? 

And so that caused some delay, caused some consternation, and indeed, there was a very real and a very significant issue. So that 

is the example of the kind of thing that needs to be addressed in 

the Stafford Act. 

I cannot assure you that there would not be unintended consequences, but it definitely needs to be examined because I think 

from a response point of view, it is clear that there are some issues 

that hamper response and that appear not to totally cover the 

issues that could crop up in a serious large disaster. 

Senator SUNUNU. Senator Breaux. 

Mr. BREAUX. Yes. I can only add a little bit. Mr. Ackerman hit 

it right on the head. But, there were some classic examples of 

trucks being denied access to disaster sites because they weren’t a 

government truck. You are bringing ice down there. Well, you can’t 

cross the line because you are a private sector delivery system. You 

are not approved to go into that area. And a lot of the local officials 

and State officials don’t understand what is to be allowed and what 

is not to be allowed. 

You all last year amended the Stafford Act to at least prevent 

under the SAFE Port Act, prevent any Federal agency from denying essential services from the private sector. That is a big improvement, that they can’t deny essential services coming from the 

private sector. 

But I think the main thing we are advocating is just bring the 

private sector into the process. Make sure the States and local governments have a mechanism that the private community is involved in helping to solve the problem. And then that clears up—

if they are at the table from the very beginning, helping to devise 

the plan as part of the team, then these type of problems can go 

away. 

Senator SUNUNU. Mr. Bourne, I think, as of April 1, there was 

a reorganization at DHS that created the National Preparedness 

Directorate within FEMA. How specifically is that directorate being 

used or going to be used to enhance outreach and coordination with 

the private sector? 

Mr. BOURNE. The National Preparedness Directorate is specifically designed as both not only internal preparedness efforts at 

FEMA and our Federal partners, but really heavily focused on assisting preparedness at State and local levels and private sector. 

Doing that through—certainly they manage the grant programs 

that are available, but at the same time—the Citizen Corps ProVerDate 0ct 09 2002 13:49 Mar 18, 2008 Jkt 036615 PO 00000 Frm 00024 Fmt 6633 Sfmt 6633 P:\DOCS\36615.TXT SAFFAIRS PsN: PAT
21

gram and the Community Preparedness Division within National 

Preparedness, their job is to reach out to State and local governments, find ways to build collaborative partnerships between the 

private sector, State, and local governments. 

Our other role is to provide a planning framework. Part of the 

problem is that we all do planning. We do planning in our own circles. We do planning within our own expertise. What we don’t have 

across the Nation is truly a planning community that involves all 

the folks that need to be involved. That is an evolving and growing 

thing. 

Part of what we are doing as we rewrite the National Response 

Plan is taking a look at preparedness and planning as an integral 

part of understanding how a planning community needs to be developed. There needs to be some basic framework so that we are 

planning to similar objectives, similar principles. We can’t all plan 

exactly alike. We have different capabilities and different needs. 

But we need to be planning jointly and collaboratively at all levels. 

It is very critical, and the National Preparedness Directorate is 

focused on this, that the planning effort and the relationships that 

are first and primary are the ones between local business, the private sector, NGOs, and the State and local governments. That is 

where 90 percent of all disasters happen. It is also, however, critical that FEMA have a good understanding, working through the 

business associations and other private sector experts, in how we 

can involve them in our planning, training, and exercise activity. 

National Preparedness is directly responsible for that effort. 

Senator SUNUNU. Mr. Andrews, in your work for the National 

Emergency Management Association, you obviously come in pretty 

close contact with people at the State level and some of the State 

Directors. What do you see the States being most concerned about, 

and is it your opinion that the States are looking for more Federal 

mandates for integrating the private sector into their preparedness 

plans, or are they hopeful that we can do this with a little bit more 

flexibility and with an approach that recognizes that there are 

going to be some unique individual needs among the States? 

Mr. ANDREWS. In the survey that we did of all the States, and 

asked them a number of questions about their working relationships, where they were in the process of working with the private 

sector, 44 of the States indicated that they had some degree of 

working relationship with the private sector, and again, it ranged 

from very formal processes, like in the State of Florida, to those 

States that are essentially just beginning the effort. And I think 

this really represents a real sea change. I think 5 years ago, the 

numbers would have been dramatically different. 

I don’t think that the States are looking for mandates in this 

area at all. I think that they recognize, for the most part, that 

there is an advantage to them, and Hurricane Katrina clearly 

brought home the fact that we can have a disaster that initially appears to be a regional disaster that, in fact, involves all of the 

States. 

And so there has been a lot of work to enhance the EMAC system, and again, EMAC is kind of a cornerstone of the Nation’s 

emergency management capability. All of the National Guard 

troops that were mobilized to the Gulf Coast, over 60,000 of them, 

22

were done under the authority of EMAC and the enactments of all 

50 State legislatures of the EMAC proposal. 

I think the States would welcome some additional encouragement from DHS and FEMA to move ahead with this, but I don’t 

think that specific mandates to the States to try to accomplish this 

are really necessary. 

Senator SUNUNU. I appreciate that very much. Thank you, Mr. 

Chairman. 

Senator PRYOR. Thank you. 

Let me ask you, Mr. Ackerman, if I can, about some of the things 

that your company did during the Hurricane Katrina disaster. As 

I understand it, you opened your Operations Center to many of the 

major wire line, wireless, and cable providers in the impacted area. 

I don’t know if that was exactly unprecedented, but it sounds like 

it may have been. I am curious about why you did that and how 

that worked out and why you felt like that was important. 

Mr. ACKERMAN. Thank you. 

The primary cause for taking that action was the seriousness of 

the outage. We knew that with the flood, we were going to have 

serious outages, landline outages inside the Bowl, or inside the city 

itself because of the flood. We knew that the wireless carriers were 

going to have serious problems because many of their links from 

one location to another were in facilities that were also in the 

Bowl. And we knew the interexchange carriers were going to have 

problems. 

So we knew that getting signal or communications capability 

back into the city was of the most—was just of the highest importance, and therefore, we decided the best thing to do, since we were 

managing and responding to the need to fix local facilities, was to 

get the carriers into the Operations Center to help us prioritize 

what was indeed the most important. So we worked hand-in-hand 

with the wireless carriers. We had representatives from each one 

of the wireless carriers. We did the same thing by phone with the 

interexchange carriers. They were a little bit more concerned about 

being together. But it enabled us to prioritize and get back those 

facilities that were most important to restoring the most communications back to the local community. 

And so seriousness drove it, and we felt the best way was to put 

everything on the table, get everybody in the room. Again, it is this 

collaborative effort at the point in time when you do have a disaster of this magnitude that enables success. The more knowledge 

you have together, the more ability you have to prioritize and make 

on-the-spot decisions about what goes next. I think that is just incredibly important to restoring service. 

Senator PRYOR. And how did that work out? Were you pleased 

with the way it went? 

Mr. ACKERMAN. I think it optimized the process. The damage 

was significant enough that I think it took us a long time to get 

facilities back where we would like to have had them. But it did 

enable us to optimize the process and I think it did enable us to 

get those most important things back first. 

Senator PRYOR. Before Hurricane Katrina occurred, was that 

part of your plan or did you make that decision on the spot, recognizing the seriousness of the situation? 

23

Mr. ACKERMAN. It was not part of our plan. We made that decision on the spot. 

Senator PRYOR. And did the government help you at all on that, 

or was that private sector initiative? 

Mr. ACKERMAN. That was private sector. 

Senator PRYOR. Let me ask about private sector logistics and 

planning. You mentioned the word ‘‘practice,’’ and you emphasized 

that and how important it is to practice, but let me also ask about 

logistics, delivering goods and services, planning. Your group recommends that the private sector be much more involved with the 

government in planning. I think that is a great concept and it is 

very logical to me and it seems like it is something that should be 

done, but how do we do that and not create a conflict of interest 

or an advantage for companies who are participating in that planning and that logistical effort? 

Mr. ACKERMAN. I don’t have a pat answer for that question. It 

is a good question. What I do know is that we have got to find 

some way to deal with it because there is such a significant need 

to be able to run these drills or practice ahead of time. Invariably 

when we run a practice run on a disaster response scenario, we 

find something that we had not thought of before and we are able 

to clear that problem out before we get into the actual event. 

So I put an extremely high importance on finding a way to do 

that. I believe that there are always issues about whether or not 

that advantages one company versus the other, but at the same 

time, when the ox does get in the ditch and our citizens are in the 

situation that they are in, finding a way to be as expeditious as 

possible is a big help. 

It was mentioned earlier today that there is a great deal of work 

going on on pre-approving vendors and putting contracts into place. 

I think it was mentioned by Mr. Andrews, also. I think that is an 

important issue. I think that everyone cringes when the word 

‘‘price’’ comes up, but at the end of the day, we need to deal with 

that ahead of time, not during the middle of the disaster. Again, 

it is something that begins to slow the progress down. 

So it is difficult and it is tough slugging, but I think it needs to 

be done, and again done in practice drills before we get into the 

disaster and not after. 

Mr. BREAUX. Can I add just a real quick thought to what Mr. 

Ackerman said? 

Senator PRYOR. Sure. 

Mr. BREAUX. The ox in the ditch is a good analogy because when 

a city is underwater, you have to respond immediately, when people are drowning or a fire is going on or right after a hurricane. 

And there is a difference between getting people in immediately to 

help in an immediate situation as opposed to the long-term construction and rebuilding. Those things need to be bidded out in 

competitive bidding. But you have to have a system in place before 

the disaster to get people in in the immediate aftermath of a disaster and for the first week or so, get the work done that has to 

be done. Then you can look at the long-term work that needs to be 

done that has to be competitively bid out and have everybody at 

the table. But you can’t do that when you are waiting to dewater 

24

a city that is underwater. Those people have to be ready to go as 

soon as the hurricane passes through. 

Senator PRYOR. Mr. Bourne, you also were kind of nodding your 

head during the question and answer there. Did you have a comment on the process? I think I mentioned conflict of interest or advantage—

Mr. BOURNE. It is problematic, and it is problematic for all levels 

of government. The General Counsel’s Office loves to accuse me of 

playing lawyer without a license. They are rightly concerned that 

there are regulations and laws that limit how much we can do. 

FEMA has taken a very proactive approach to some of this. We 

have looked at the preplanned contracts that we have done, that 

we have competed ahead of time to deal with those issues that we 

anticipate in the first 72 hours and the immediate days following 

rather than that longer term. There are longer-term recovery contracts that we already do. Readiness costs money, and a lot of 

times folks blanch at the idea of spending money in the event of 

something that may not happen. But it is like that insurance policy 

we all end up buying anyway for our home, which we hope we 

never have to use. 

So FEMA has put in place a lot of these readiness contracts so 

that we have access to the resources we need to support State and 

local. But it is also more important, and many State and local governments have begun to do this, that they begin to look at advance 

contracting and planning, as well, whether it be for debris removal, 

whether it be for evacuation purposes, for transportation and other 

items that they may need. 

They may never use them. We hope they don’t. But the simple 

fact of the matter is that that work in advance saves a tremendous 

amount of time and headache in the end. Also, under the current 

level and regulatory restrictions that all levels of government are 

under, it is the most efficient way to move resources quickly without getting into an area that we don’t want to go back to, and that 

is no-bid contracts or contracting over a barrel during a disaster. 

Senator PRYOR. One last question before I turn it back over to 

Senator Akaka. My question is for you, Mr. Bourne, and that is 

what about small business’s role? I mean, it is one thing to have 

these large Fortune 500 companies. They are all great and they can 

do a lot of things logistically, etc., but what about small business? 

How do you include small business in the planning phase? 

Mr. BOURNE. We have done this in several ways. Certainly, we 

encourage State and local governments when they look at their 

planning to bring small businesses in. Most communities, the vast 

majority of the workforce works for small business. And those kind 

of critical jobs and critical businesses need to be brought back up 

to speed in part of the planning process. That has to be done 

through planning. Also, they are contracting at the State and local 

level, whether it is pre-contracting or post-contracting. It is a small 

business. They need to look at small businesses as well as the larger ones. 

What we have done for FEMA, and specifically with the contracts 

we are putting in place ahead of disasters and the ones that we 

have for long-term recovery, we have actually put in significant 

small business requirements, localized small business requirements 

25

that will come into play should something happen and they are activated, where if it is a larger company that has the contract, they 

have to give a large percentage of the work, anywhere from 50 to 

75 percent of the work, to local businesses in the affected area. 

Our goal is to get people working back in the area that are affected as opposed to a company coming in from halfway across the 

country to do the work. Simply put, for FEMA’s needs, there are 

some things that FEMA needs to do that only large business has 

the capacity to achieve on a short notice. But what we have done 

is encourage them to utilize small businesses in that process. 

Senator PRYOR. Right. 

Mr. MARTINEZ-FONTS. Sir, if I can just add one comment on that. 

On the small business side, I agree with everything Mr. Bourne 

has said, but also the preparedness side of it is what really needs 

to be the key. I mean, there are so many businesses that are just 

so small that what they need to do is just have the right preparation, and through the Ready.gov, Ready Business type of outreach, 

we have been trying to get businesses to make sure that they have 

backed up their records, got a place to have follow-up plans. So 

really, the focus there, while I appreciate the question was really 

more on what happens in the aftermath—and by the way, our office held the first small business event in New Orleans after Hurricane Katrina—but really, it is an issue of preparedness that needs 

to be—more emphasis needs to be put on. 

Senator PRYOR. Senator Akaka. 

Senator AKAKA. Thank you very much, Mr. Chairman. 

Mr. Martinez-Fonts, the Nation faces a very real possibility of a 

pandemic influenza outbreak which would affect the operations of 

everyone, large and small businesses, as well as communities, 

schools, and government and people, especially. In the event of a 

pandemic flu, private sector partners could serve as a powerful tool 

for tracking and locating employees, disseminating incident information, and coordinating response efforts. 

Your written testimony discusses the Department’s efforts to increase business owners’ awareness of the importance of pandemic 

flu preparedness, business community planning and emergency response coordination. How is DHS incorporating private sector input 

and feedback into the Department’s pandemic flu planning? 

Mr. MARTINEZ-FONTS. Sir, if I could answer that question, I had 

the honor to go around the country last year with Secretary Leavitt 

and the Department of Health and Human Services representing 

Secretary Chertoff at their outreach on pandemic influenza. What 

that led to, the tour took in all 50 States as well as territories. I 

attended about 15 of them. There was a request for what I like to 

refer to as the two lanes in the pandemic issue. One is the medical 

side or the epidemiology of the disease. The other one is the critical 

infrastructure side of it. 

HHS is clearly in charge of the epidemiology of it, making sure 

eventually that there will be a vaccine, that there are antivirals, 

that the hospitals are operating, etc. But those hospitals and the 

community isn’t going to be able to operate without critical infrastructure. 

So through a pilot program that we have done with the U.S. 

Chamber of Commerce and with a not-for-profit called Safe AmerVerDate 0ct 09 2002 13:49 Mar 18, 2008 Jkt 036615 PO 00000 Frm 00029 Fmt 6633 Sfmt 6633 P:\DOCS\36615.TXT SAFFAIRS PsN: PAT
26

ica, we have been going around the country, in addition to speaking 

to specific groups, and I happen to have a list, if you are interested, 

of all the outreach literally done. I didn’t actually count them, but 

I would say it gets up to close to 100 between what we did with 

HHS and what we have done reaching out to both critical infrastructure and businesses of all sizes and making sure that they 

have made their plans, because unlike Hurricane Katrina, where 

as awful as that was, resources were able to be brought in from all 

around the country. In a pandemic influenza, if it looks something 

like the 1918 pandemic, it will hit the country equally all around 

and so there will not be very much shifting of resources around. 

So we have an awful lot of lessons learned that have been shared 

in that. There is an excellent website that was started by HHS, but 

now 17 agencies are putting information on it, called 

PandemicFlu.gov. There is an infrastructure protection out of DHS, 

a program called Critical Infrastructure and Key Resources, Continuity of Operation Essential, which is available on the web. It is 

available on PandemicFlu.gov, and it really helps businesses, 

whether they are actually part of critical infrastructure or even if 

they are not, the types of preparations they need to do, because although much of the preparation that could be done for a hurricane 

or a flood is useful, in a pandemic, we are looking at a very extended period of time and we are really looking at not the destruction of the actual infrastructure, but having people just not be 

available. 

Mr. ANDREWS. If I might add, one of the other initiatives that 

BENS has undertaken that relates to your question, Senator, is 

through their Business Force efforts, particularly in the State of 

New Jersey and in Georgia, they have run exercises utilizing the 

private sector for assistance in the distribution of the Nation’s 

Strategic Pharmaceutical Stockpile. So using private sector resources both as facilities to help distribute it, using personnel within the private sector to help distribute the resources, which will 

probably overwhelm the capabilities of local government to do so. 

So I think it speaks to the point that Mr. Ackerman made about 

the importance of practicing these. We need to do this more extensively across the country, but I think the lessons that have been 

learned in those exercises could prove valuable in a number of different regions. 

Senator AKAKA. Thank you. 

Senator Breaux, your written testimony states that the BENS 

Task Force recommended that Congress amend the Stafford Act 

and enact a nationwide body of disaster law to preempt the patchwork of State law in the narrow context of disaster response. The 

BENS Task Force report describes your recommendations in some 

detail. Has your task force developed a specific legislative proposal 

for a natural disaster law? 

Mr. BREAUX. We don’t have legislative language or a legislative 

proposal, Senator Akaka, but I think that what we have concluded 

is that the Stafford Act, which has served this country very well 

since Bob Stafford authored it a number of decades ago, was meant 

to help the Federal Government assist local and State governments, but the private sector really wasn’t part of that mix at that 

time. I think what we are suggesting is that this Subcommittee 

27

and the appropriate committees take the time, don’t run through 

it and do it overnight, but take the time to look at what you all 

could do to improve the operational dictates of the Stafford Act and 

get local and State governments to have a plan that incorporates 

the private sector from the very beginning. 

We have outlined some of the difficulties that private entities 

have had in responding to disasters, some of the legal and regulatory problems that they have had, some of the transportation 

problems that they have had, and if the Stafford Act could be 

amended to bring them into the planning process from the very beginning, require that FEMA grants go to States that have adopted 

a private sector plan into their emergency preparedness operations, 

I think those type of suggestions, I think that this Subcommittee 

could look at as potential amendments to the Stafford Act. Don’t 

throw it out the window because it has worked very well. Just fix 

it up around the edges and it would be a real service. 

Senator AKAKA. Thank you for that. I was interested in how far 

you have gone in that, because any kind of help we can get from 

you will certainly—

Mr. BREAUX. I do think that we have got a very talented staff 

over there and I think that they would be more than willing and 

able and very anxious to participate with your staff in the process 

of making those suggestions for you all to consider. 

Senator AKAKA. Thank you very much. My time has expired. 

Senator PRYOR. Thank you, Senator Akaka. 

Let me follow up there, if I may, with Senator Breaux. You mentioned the national disaster law, which is a good concept for us to 

think about and put on the table and see if we can come up with 

something that makes sense. But do you think that part of that 

should include a good samaritan provision? 

For example, when I was in the State legislature in Arkansas, 

we had a bill before us which I voted for that basically said doctors 

couldn’t be sued—I can’t remember exactly how it was structured—

it was basically if they happened upon an accident scene or they 

were providing some free service. They couldn’t be sued for malpractice for trying to help somebody. 

I know Arkansas has other good samaritan-type laws and there 

are many other States that have some variation of those laws. But 

do you think that the national disaster law that you talk about 

should include some sort of good samaritan provision? 

Mr. BREAUX. Yes. I think the short answer would be yes, with 

the caveat that obviously you just can’t waive all the laws that protect citizens from being damaged by the negligence of someone trying to provide assistance or doing it in an incompetent manner. 

But I think when you are dealing with a time of emergency, if 

providers of services know that they would be protected in those 

unique situations if they exercise their best judgment, that would 

be something that I think would be extremely helpful. It would encourage people to participate. 

I mean, how many times have we heard people who have hesitated to participate in an emergency, even a small one, somebody 

collapsing on an airplane, ‘‘Well, I don’t want to get involved.’’ ‘‘I 

am a doctor. If I treat him, I may do the wrong thing. I will probably get sued.’’

28

I think that type of emergency protection would be very worthwhile. People could respond in those difficult situations. I mean, 

people may die if they don’t, and yet they may not because they 

fear being sued. So in those narrow situations, exercising your best 

judgment, I think, should be encouraged and that would certainly 

do that. 

Senator PRYOR. Mr. Ackerman, in your experience with Hurricane Katrina and other disasters in corporate America, have you 

had those same liability concerns in various contexts? 

Mr. ACKERMAN. I think we do. Obviously, we worry about those 

exposures. What we have found, in general, is oftentimes business 

will go ahead and assume that risk, but it is never easy because 

one knows the exposure that is out there. So these situations do 

come up. Individuals, companies, managers, people have to make 

those decisions. I don’t think that there is any given pattern to how 

it comes out, but I do think that people who are not risk averse 

generally follow that pattern, but then we have to worry about the 

litigation outcomes afterwards, so it is a constant issue. 

Senator PRYOR. Yes. 

Mr. MARTINEZ-FONTS. Mr. Chairman, if I could add, I was a 

banker for 30 years prior to joining the Administration, and since 

my last 5 years in government, I have been watching and I believe 

that liability issue will literally stop a private sector company in 

its tracks as they are concerned now. As Mr. Ackerman just said, 

many people will go out there and be very forward-leaning with it 

and will take the chance, but I have also seen a lot of cases where 

people have just sort of stopped and said, ‘‘I am not sure what it 

is going to do to me and so I am not going to go forward with it.’’

Senator PRYOR. It is a real concern. 

Mr. Martinez-Fonts, if I can stay with you just for a moment. 

Last February, Secretary Chertoff told the Senate Homeland Security Committee that DHS needed an integrated Incident Command 

Center. I think you maybe mentioned this in your opening statement, but could you again give us a status report on this Incident 

Command Center? 

Mr. MARTINEZ-FONTS. Sir, I am not sure I mentioned it in my 

statement, but we have a National Operations Center (NOC), 

where we have a common plan, a common operating picture that 

comes together and has the ability to now, for the Department of 

Homeland Security, bring together all of those incidents and is able 

to bring up to the Secretary’s level all the information and then 

have it filter down to the right operational people within the Department. 

Senator PRYOR. So do you feel like that Incident Command Center he referred to is in place? 

Mr. MARTINEZ-FONTS. I think it is, if I am thinking of the right 

thing, sir. I would say, yes, that it is, and it has really become a 

much more robust program than anything we have had before. 

Senator PRYOR. Has it been tested? 

Mr. MARTINEZ-FONTS. It is tested very regularly, and not only 

have—I would say have they tested their own performance, but 

they have now performed on behalf of the Department in other external exercises and, therefore, in effect, tested themselves in the 

29

ability to interact with the rest of the first responder community 

and the rest of the country. 

Senator PRYOR. So it sounds like what Mr. Ackerman was talking about, you have done some practice with it, but have you also 

used it in disasters, yet, do you know? 

Mr. BOURNE. I can answer that. 

Senator PRYOR. Go ahead. 

Mr. BOURNE. National Response Coordination Center, which 

FEMA manages, is actually a module, a node, a part of the National Operations Center. We routinely, with the National Operations Center, keep track of ongoing disasters and emergencies 

that happen across the country. There have been a number of incidents that have taken place, especially since Hurricane Katrina, on 

average, 50, 60 disasters a year of which we are in both FEMA’s 

operations facility and the NOC are providing the Secretary with 

situational awareness on what is happening, helping to make resource allocation decisions, assisting us in obtaining additional information to help our operations on the ground. So there have been 

a number of declared events, Stafford Act events, in which the National Operations Center has been an integral part of our activities. 

Senator PRYOR. Okay. And one last question for you, Mr. Martinez-Fonts, and that is, as I understand it, DHS has done some 

public-private initiatives and partnerships with the airlines, shipping, chemical industry. Are there lessons learned there that you 

can apply to other sectors and maybe expand on? 

Mr. MARTINEZ-FONTS. Yes, sir. A very good example of what I 

had brought up earlier was the critical infrastructure. The industries that you just talked about are all critical infrastructures, and 

as you know, those are all under the direction of Assistant Secretary Bob Stephan. There are Sector Coordinating Councils, in effect, one Sector Coordinating Council for each one of the critical infrastructures, and that group is just constantly—it has two sides. 

It has a private sector side and a government side, Sector Coordinating Council, Government Coordinating Council. They are constantly testing and proving and providing information. Those lessons learned are then spread out between the Sector Coordinating 

Councils, between the Government Coordinating Councils, and 

among all of those. 

An example was the Critical Infrastructure Key Resources Guide 

that I mentioned earlier for pandemic. That has been distributed 

widely because it just really is something that is very useful. In 

other words, if the largest of companies could do this kind of thing, 

what lessons can be learned or could be utilized and applied for a 

smaller company? And so that distribution has been very widespread, and yes, in fact, those lessons learned are being shared all 

across. 

Senator PRYOR. Great. That is what we want to hear. 

Dr. Andrews, let me ask you about—I believe Senator Sununu 

asked about EMAC and there has been some discussion about a 

Business Emergency Management Assistance Compact. Some people call it BEMAC. Is there such an entity now? Is there a 

BEMAC? 

Mr. ANDREWS. There is not a formal BEMAC system across the 

country. 

30

Senator PRYOR. Should there be, and if so, how do we structure 

that? Does it make sense to do it State-by-State, region-by-region, 

industry-by-industry? Tell us your thoughts on what a BEMAC 

might look like and how it should function. 

Mr. ANDREWS. Well, the task force that I chair, we have looked 

very carefully at this, and again, trying to be as practical as we 

possibly can in terms of the recommendations that we make. Many 

of the ideas and, I think, elements of this have been outlined in the 

BENS report and it really starts with having in each of the States 

a Business Operations Center, that is, someone within the various 

critical—people within the various critical sectors who have been 

identified in advance, who understand the processes that are used 

by that State when an emergency occurs, and who will report either physically or will be in communications with the State’s Emergency Operations Center when it is activated representing their 

sector. 

If this exists across the country in the various sectors and requests are made through the EMAC system for resources that cannot be filled within the impacted State, then they would have 

reach-back into the other States that might be able to provide that 

source where in turn you would also have representatives from the 

business community. 

It is an interesting situation, where there are some States, for 

example, North Carolina, where they do use private sector resources as agents of the State in out-of-state responses. And, in 

fact, legal opinion from, for example, the private medical community is that it is only under this structure that they can really respond out-of-state. 

I think as part of a review of the Stafford Act, this might be 

something that we need to take a look at, because some States do 

have specific provisions that prohibit the use of private sector resources as agents of the State, whereas other States allow it. If 

there was some national ability where States could, in fact, use private sector resources as agents of the State, understanding the liability and reimbursement issues, I think it would be possible to 

formally align the business community with the EMAC system. 

And again, given the fact that the EMAC legislation has been approved by all 50 State legislatures, I think this is something that 

continues to be a kind of linchpin that we need to build on. Right 

now, I see the system operating essentially in parallel with the 

EMAC structure, but NEMA and the State Emergency Directors 

are committed over the course of the next year to continuing to 

work with our task force to try to resolve any issues that remain. 

Senator PRYOR. Thank you. 

Mr. Bourne, as you well know, in February 2006, the White 

House released its report called ‘‘The Federal Response to Hurricane Katrina: Lessons Learned.’’ One of those recommendations 

was to establish the system that allows for direct delivery of goods 

from private sector vendors to customers and, therefore, bypassing 

the need for storage sites, and other reports, think tanks, groups, 

etc., have made similar recommendations. 

However, and maybe I misunderstand this, but my understanding is that FEMA has decided to rely more on forward-basing 

31

of products in government-run storage sites. Do I misunderstand 

that? 

Mr. BOURNE. No. Actually, while we do have a number of logistics centers across the country for certain commodities that we 

move very quickly into areas, we are actually looking at long-term, 

over the next year or so, developing a third-party logistics system 

where we are not the ones owning, storing commodities that would 

be used in various responses. We would have, essentially, a system 

where we would have access to those through contracts, pre-arranged third-party logistics management where the folks out there 

who do this all the time, whether it be the trucking companies, the 

Wal-Marts of the world, the Home Depots, etc., are the ones managing that for us with us having full visibility into where those 

commodities are and where they are going. 

Our Logistics Management Directorate is taking an active look 

at this right now. There has been an assessment done on it. We 

are moving away from purely maintaining our own stocks of things. 

We always run into the issues of, is it available when we need it? 

How far do we have to move it? We want to shorten supply lines 

and the best way to do that is to tap the industries that have them 

in the areas that are affected, and that is the direction we are 

headed in. 

Senator PRYOR. And let me ask about the TOPOFF 4 exercise. 

Can you tell me a little bit about that? 

Mr. MARTINEZ-FONTS. TOPOFF 4 is the fourth of a series of Top 

Officials exercises that take place every 2 years. I believe it has 

now been rescheduled—I forget the exact date for this year, but I 

think it is October or so in the fall, and it is an exercise wherein 

something will happen, whether it is a—it could have been—during 

TOPOFF 3, we had some chemical agents being dispersed. It took 

place on the East Coast. It was in New Jersey. It was up in Connecticut, Rhode Island, and the like, and we actually exercise in 

place the events and coordinate with both the private and the public sector, State and local and everyone that is involved. So the 

coming-up event will take place in Seattle, Arizona, and Guam. 

Senator PRYOR. So the private sector is involved in that? 

Mr. MARTINEZ-FONTS. Yes, sir, they will be. 

Senator PRYOR. And when Administrator Paulison testified before the House Homeland Security Committee on May 14, I think 

he had 13 pages of testimony, but he did not mention one time the 

private sector, as I understand his testimony. You guys probably 

weren’t there. That just raises a concern in my mind that here you 

have the FEMA Director explaining to the House, explaining to the 

Congress different things that they are doing. I think he talked 

about the playbook, pre-scripted mission assignments, etc. But apparently during that testimony, at least in his prepared remarks, 

he didn’t mention the private sector. 

From your standpoint—I will just ask you, if I may, Mr. Bourne, 

do you think the private sector is sufficiently involved in, as they 

say, pre-scripted scenarios? 

Mr. BOURNE. We are just beginning this relationship, quite 

frankly. We have done a lot of work. We have got a lot more to do. 

FEMA has been engaged in doing a reform top to bottom which involves a lot of moving parts. Never mind the fact that we have also 

32

brought in programs that had not been in FEMA prior. So we are 

beginning this relationship. That is why we are bringing BENS and 

BRT and the Chamber together next week to further this relationship and figure out what other avenues that we can take. 

We have spent a tremendous amount of time over the last several months in the rewrite process of the National Response Plan 

to take in private sector concepts and ideas as part of that writing 

process, and I think that the Subcommittee will see as we begin 

to roll that out in the next several weeks for comment that a lot 

of the—that there has been private sector involvement in that 

planning, in the document, but that much more needs to be done 

and we are embarked on that. 

Senator PRYOR. Great. 

Mr. BOURNE. One of the things I will just add to your prior question, if I could, our staff tells me that we are planning a logistics 

briefing next week and certainly will make that available to your 

staff. 

Senator PRYOR. Great. Thank you. 

In the Post-Katrina Reform Act, we mandated Regional Strike 

Teams. Are you familiar with those? Is the private sector involved 

in the establishment of those Strike Teams? 

Mr. BOURNE. Not directly, and I will tell you why. The way the 

legislation was crafted and the way that we have had to build the 

teams, they are Federal responders. FEMA traditionally in its response puts out folks that are, quite frankly, it is a pick-up team 

in many respects in the past. They are folks in our regional offices 

and from headquarters that have other responsibilities day-to-day. 

They are formed into what they call Emergency Response Teams 

and then they are sent to disasters. 

We are changing that model. We don’t call them strike teams 

now. We are calling them Incident Management Assistance Teams. 

We are building them now, and they are going to be full-time Federal disaster experts working for FEMA. They are not going to be 

there to supplant local or State emergency responders or incident 

command. They are going to be that initial response. Their job is 

going to be to respond to disasters, and when they are not responding to disasters, to train, equip themselves, train and exercise with 

State and local governments. 

Now, is there a role for a relationship for them with the private 

sector? Quite possibly. We are going to have to look at what that 

means, and I think the most effective way to achieve that is after 

we have developed a relationship between these teams and the 

State and local government emergency management folks and see 

how they want to see that interaction take place. 

Senator PRYOR. I want to thank my colleagues and thank the 

panel for coming here today and answering a long list of questions 

that we have and thank you for your actions to prepare America 

to meet the next set of challenges in the world of disasters and response. 

We are going to leave the record open for 2 weeks if colleagues 

want to submit written questions. If Senators do that, I would love 

for all of you to respond to those as quickly as possible. Additionally, several of you mentioned inserting your statements as part of 

the record. Those will be included in the record, or if any of you 

33

on the panel have any documents or other items to add to the 

record, we will be glad to include those, as well. 

So again, I want to thank you all for being here at our inaugural 

meeting of our Subcommittee and we look forward to working with 

you. Thank you. 

[Whereupon, at 3:55 p.m., the Subcommittee was adjourned.] 

(35)

PART II: PROTECTING OUR CRITICAL 

INFRASTRUCTURE 

THURSDAY, JULY 12, 2007

U.S. SENATE, AD HOC SUBCOMMITTEE ON STATE, LOCAL, AND

PRIVATE SECTOR PREPAREDNESS AND INTEGRATION, OF THE COMMITTEE ON HOMELAND SECURITY

AND GOVERNMENTAL AFFAIRS, Washington, DC. 

The Subcommittee met, pursuant to notice, at 2:03 p.m., in room 

342, Dirksen Senate Office Building, Hon. David Pryor, Chairman 

of the Subcommittee, presiding. 

Present: Senator Pryor. 

OPENING STATEMENT OF SENATOR PRYOR 

Senator PRYOR. Let me go ahead and call us to order. Thank you 

all for being here. I thank the members of the public who are in 

the back there, as well. We appreciate your interest. 

Welcome to the Ad Hoc Subcommittee on State, Local, and Private Sector Preparedness and Integration. I want to welcome everyone here today and thank you for taking time out of your busy 

schedules to be here. 

This hearing is a continuation of an ongoing dialogue we are having on the Subcommittee and here in the Senate with the private 

sector focusing on the importance of making sure that the government and the private sector are working together to protect our 

critical infrastructure. 

Simply put, critical infrastructure is defined as capabilities and 

services that secure our country and make it livable. We all know 

this, but it includes everything from highways to communications 

to financial services to electricity and we use it to accomplish everything we do throughout the day. For example, we wouldn’t be 

here today if we didn’t all rely on critical infrastructure to get here 

and to utilize what we have here in this hearing room even. 

Critical infrastructure assets are so interconnected that one accident or natural disaster could potentially cause a massive upheaval. The nuclear reactor accident in Chernobyl, Ukraine, for instance, exposed 6.6 million people to radioactive fallout and forced 

the evacuation of almost 400,000 people. In this country, Hurricane 

Katrina damaged oil refineries and spiked gas prices across the 

country. The disaster also disrupted Internet access, clean water 

supplies, telecommunications, and on and on and on. 

Because disruption of our critical infrastructure would cause 

mass chaos and fear, these systems are prime targets for terrorists. 

36

1The chart referred to appears in the Appendix on page 227. 

In early May of this year, the FBI and an attentive store clerk stymied an attempt by six men to ‘‘kill as many soldiers as possible,’’ 

at Fort Dix Army Base in New Jersey. The men were in the process of making bombs and accumulating weapons. Once their plan 

was fully developed, they intended to storm the base, firing on and 

bombing our men and women in uniform. 

Just last month, authorities foiled a terrorist plot to blow up JFK 

International Airport, its fuel tanks, and a jet fuel artery. Terrorists are focused on critical infrastructure and they understand how 

critical it is in the United States that we keep those things operational, even under adverse circumstances. 

In this Ad Hoc Subcommittee, we are moving into a new era in 

terms of homeland security and national security. These terrorist 

plots that I have been talking about are living proof that extremist 

groups want to try to inflict pain on our citizens and on our economy and they are trying to do as much damage as they can to our 

country and they think they know how to do it. 

For all these reasons, it is crucial to have an effective, well 

thought-out plan for protecting our infrastructure. Now, last year, 

the Department of Homeland Security released a plan called the 

National Infrastructure Protection Plan (NIPP). The NIPP was to 

set out a standard for industries to identify and prioritize critical 

infrastructure assets. It required each of the 17 critical infrastructure sectors to submit a plan dealing with the unique protection 

challenges that industry faces, and we have a chart here with those 

sectors listed.1

So for our efforts to be effective, we must make sure that both 

government agencies and the private sector are involved in creating the protection plans. In our hearing today, we will review the 

process of creating the plans, discuss the challenges and successes 

in public-private partnerships, and look at how the overall effort 

contributes to preparedness. 

With that in mind, understand that today is a very busy day in 

the Senate. We have DOD authorization on the floor and there are 

lots of amendments and lots of Senators have committee hearings, 

so we don’t know how many Members will be able to attend, but 

certainly when colleagues show up, we will try to accommodate 

them and get them in and let them ask questions and move on to 

their next stop. 

What I would like to do is go ahead and introduce our panel. We 

have your backgrounds already and we will submit those for the 

record. Each of you will have 8 minutes to give an opening statement. If you want to just submit that for the record and summarize, that is up to you. 

Let me just run through the panel very quickly and just say a 

few words about each person and then I will open it up and let you 

all give your opening statements. 

Our first witness will be Bob Stephan. He is the Assistant Secretary for the Office of Critical Infrastructure Protection at the 

U.S. Department of Homeland Security. He is responsible for 

DHS’s efforts to catalog our critical infrastructure and resources 

37

1The prepared statement of Colonel Stephan appears in the Appendix on page 104. 

and coordinate risk-based strategies to secure them from terrorist 

attack or natural disasters. 

Eileen Larence will be the second witness. She is the Director of 

the Homeland Security and Justice Issues Division at the U.S. Government Accountability Office. She manages investigations, issues 

reports, and makes recommendations, and handles Congressional 

requests for work on homeland security issues. 

And then Ken Watson will be third. He is Vice Chairman of the 

Partnership for Critical Infrastructure Security. He established the 

Critical Infrastructure Insurance Group with the goal of driving 

Cisco’s contribution to the security of worldwide critical infrastructure. 

So Mr. Stephan, if you would lead off for us. 

TESTIMONY OF COLONEL ROBERT B. STEPHAN,1 ASSISTANT 

SECRETARY FOR INFRASTRUCTURE PROTECTION, U.S. DEPARTMENT OF HOMELAND SECURITY 

Colonel STEPHAN. Mr. Chairman, thank you very much for the 

kind invitation to appear before you today. I sincerely appreciate 

the opportunity to address you on the role of the Department’s Office of Infrastructure Protection and ensuring robust coordination 

with the private sector as we work actually together as a team to 

protect our Nation’s critical infrastructures from terrorist attack 

and also enable their quick recovery in the wake of a terrorist attack or a natural disaster because we have another terrorist to deal 

with in our mission space and she is called Mother Nature. 

My staff and I are keenly aware of the importance of fully integrating and working with our private sector partners across our 

mission space as well as with our State and local government partners. As a point of departure for your team, it is important that 

we note that the vast majority of our Nation’s critical infrastructures, about 85 percent or so, those are owned and operated by the 

private sector in some way, shape, or form. Hence, our comprehensive work with the private sector represents a very key component 

of our national protection network as well as our national information sharing network. 

Both the Congress and the President of the United States have 

recognized that full support, cooperation, and engagement of government and private sector partners at all levels is required to prevent terrorist attacks, mitigate natural disasters, restore essential 

services after an incident, and to generally maintain the American 

way of life. 

Our partnership with the private sector spans the diverse spectrum of the 17 sectors that are identified in Homeland Security 

Presidential Directive No. 7. You have those catalogued there in 

your chart. This partnership also extends very importantly in a 

boots-on-the-ground-type construct to high-risk communities across 

the country, where my staff and I have put a great deal of focus 

and effort to bring together Federal, State, and local government 

partners and the private sector to engage in vulnerability assessments, security planning, information sharing, best practices exchanges, risk reduction and incident management activities. 

38

Since the creation of my office in March 2003, our mission has 

been very clear. Our overall approach focuses on establishing and 

sustaining a risk-based unified program to protect and enhance the 

resiliency of our Nation’s infrastructures. The key to this approach 

is a layered defense constructed of physical protection, cyber security, and resiliency within the sectors as tailored to the requirements of each of those sectors. This again, sir, is a long-term effort 

that involves a comprehensive government and private sector engagement inside and outside of regulatory space at various levels 

across our national risk landscape. 

The private sector has made significant investments to strengthen both physical and cyber security to boost resiliency, increase redundancy, and develop contingency plans since the September 11 

attacks. Of equal importance, State and local agencies have 

stepped up to this mission plate and have strengthened infrastructure preparedness within their jurisdictions. Supporting these efforts, in one example, DHS has provided nearly $2 billion in infrastructure-targeted risk-based grant funding over the past several 

years, to include $445 million this year. 

Our partnerships across various levels of government and with 

the private sector form the operational core of our National Infrastructure Protection Plan—sir, we do affectionately refer to that as 

the NIPP, and thank you for highlighting that—and, as well, the 

supporting 17 Sector-Specific Plans (SSPs), in each of the sectors. 

Through the NIPP and these supporting plans, we now have a unified national game plan and an ever-expanding arsenal of tools to 

implement our mission. 

The NIPP base plan establishes the overall risk-based approach 

that defines the unified way we are going to protect the enhanced 

resiliency of our critical infrastructure sectors across the board. Organizationally, the heart of the NIPP is bringing people together in 

some kind of construct? It is akin to bringing good Super Bowl 

teams to the playing field at the end of football season. Establishing Sector Coordinating Councils on both the government side 

of the house and on the private sector side of the house, bringing 

the right people to the table in a legally protected framework to get 

the job done, whether it is policy recommendations, planning, looking at risk assessment methodologies, planning for incidents and 

actually conducting incident management operations. 

Within the NIPP, the NIPP partnership models encourages private sector owners and operators to establish Sector Coordinating 

Councils as a principal entity for coordinating with the government 

across a wide variety of issues. These entities are self-run and selfgoverned and their specific membership varies from sector to sector, including owners and operators, associations, and other entities, corporations, or individual companies, both large and small. 

The finalization and release of the NIPP Sector-Specific Plans used 

this framework in terms of its development and will be an essential 

piece of implementing and integrating those plans across the 17 

sectors. 

Developed under the umbrella of the NIPP partnership model, 

the Sector-Specific Plans represent adaptations of the NIPP baseline risk analysis and risk management framework, its governance 

structure and information sharing protocols, as tailored, once 

39

again, to the specific needs and requirements of each of the 17 sectors, which are very different in and amongst themselves. 

This undertaking represents the very first time that government 

and private sector entities have come together on such a large scale 

across every sector of the economy to develop joint plans to better 

protect and ensure the resiliency of our critical infrastructures 

against both terrorist incidents and natural disasters. Each plan 

contains concrete deliverable milestones and timelines that define 

the road ahead for each of these sectors. 

In a series of parallel undertakings, we are leveraging the NIPP 

sector partnership model and coordinating council structure to finalize a comprehensive annex to the National Response Plan that 

deals with infrastructure protection and restoration; to develop sector-specific guidelines for pandemic influenza preparedness; establish infrastructure protection research, development, modeling, 

simulation, and analysis requirements; and building a National Infrastructure Protection Awareness and Training Program, to include exercises such as the upcoming TOPOFF Officials 4 exercise, 

which will be conducted in October of this year. 

Our partnership framework enables more progress in another 

important area, information sharing, where we use the NIPP partnership framework to share information of a risk-based nature on 

a day-to-day basis that includes operational information, situational awareness of incidents that are occurring across our infrastructure sets around the country every day, and we use that same 

incident management information sharing network to collaborate 

and integrate with one another during crisis, incidents, or emerging threat scenarios. 

Another important advancement in our relationship with the private sector is the establishment of our Homeland Infrastructure 

Threat and Risk Analysis Center, or HITRAC. This is an infrastructure and intelligence fusion center that we operate in a joint 

partnership with Charlie Allen, the Assistant Secretary for Intelligence and Analysis at DHS. Through this center, we provide access to classified information. We enable members of the private 

sector leadership to obtain security clearances to the tune of about 

900 so far across the sectors and using the tear-line concept are 

able to share very broadly important emerging threat products 

with the private sector at a tactical and strategic level. 

Through the HITRAC and our National Infrastructure Coordinating Center, which maintains an operational status or pulse of 

the Nation’s infrastructure on a day-to-day basis, or private sector 

partners receive real-time threat situation and status information 

and analyses, which is in turn used to inform security and operational planning, resource investments, and key risk mitigation activities. 

Coordinating with other key stakeholders through our partnership model is fundamental to the success and it has also been a key 

enabler to allow us to push out the door very important boots-onthe-ground activities that are having a very noticeable impact in 

terms of improving our security posture across the private sector 

infrastructure landscape. Through our comprehensive review program, we provide a structured joint analysis, Federal, State, and 

local capabilities, private sector capabilities needed to enhance the 

40

security of our highest-risk national infrastructures. Today, we are 

virtually through, and we will be through in September, walking 

across the chemical sector and the nuclear energy sector in terms 

of a comprehensive review process, bringing lots of inside and outside defense equities to the table. 

Through our Buffer Zone Program, we have a DHS-administered 

grant approach that is designed to assist local law enforcement and 

private sector critical infrastructure owners and operators increase 

security within the buffer zone, or the area outside a facility that 

can be used by an adversary to conduct surveillance or launch an 

attack. Through this process, we have completed more than 2,200 

individual site visits in locations across the United States, pushing 

approximately $190 million out the door to State and local law enforcement to provide connectivity to specifically identified critical 

infrastructure facilities and boost their reinforcing capability for 

prevention through protection to response and recovery. 

Our Protective Security Advisors represent a cadre of 78 folks 

right now in place across the country in key urban areas, rural 

areas of the country, places where we have a nexus of population 

and critical infrastructures. These Protective Security Advisors 

(PSAs), foster partnerships, facilitate collaboration, conduct vulnerability assessments, facilitate training and exercise programs, provide general situational awareness back to me on a day-to-day 

basis. They have conducted about 15,000 liaison visits with private 

sector owners and operators over the past 2 years and they are my 

first boots on the ground in terms of the infrastructure protection 

Federal mission subset during any incident, and they have a very 

comprehensive and solid list of Rolodex contacts across the Federal, 

State, and local community and the private sector community in 

their geographic areas of responsibility. 

Through them and others, we have conducted soft target awareness courses and surveillance detection training programs across 

the country. The soft target piece is a week-long course that provides private sector owners and operators and security personnel 

with a venue to receive and share baseline terrorism awareness, 

prevention, and protection information and is intended to enhance 

individual and organizational security awareness. Our surveillance 

detection course provides a guideline for mitigating risk to infrastructures by developing, applying, and deploying protective measures in the creation of a surveillance detection plan within facilities 

such as shopping malls, arenas, stadiums, public access, and gathering sites. We have conducted 284 surveillance training awareness 

courses across the country as well as an additional increment of 

the same number of our soft target awareness training packages. 

Our TRIPwire program, bombing prevention, is highlighted by 

the recent events in London and Glasgow, a very important part 

of our day-to-day business. This is an online web-based tool that 

provides the latest and greatest information to bomb squad, private 

sector security folks, law enforcement officials across the country in 

terms of terrorist tactics, techniques, and procedures relative to 

IEDs, VBIEDs, and maritime-based improvised explosive devices. 

To this date, we have got about 40 Federal departments and agencies, 28 military units, 365 State and local law enforcement agencies, and 35 private sector companies hooked into this website, and 

41

in the last year since it has been operational, we have had nearly 

four million site hits. 

Finally, with respect to the demands of incidents caused by 

Mother Nature, we have put into place through our Protective Security Advisor Network out in the field and through infrastructure 

specialists here at the Department headquarters and in cooperation 

with our national ops center and FEMA headquarters a very robust 

set of experts that are manning watch 24/7 and are prepared to respond and organize a team of specialists around any type of incident that involves the downing of our infrastructures, that would 

involve follow-on security assessments, restoration and recovery operations, or any type of assistance or information sharing requirements that we need to bring to the table. 

In terms of my remaining time with you today, looking toward 

the future, we are finalizing our office’s long-term strategy for continued program growth and evolution. We are finalizing our 2008 

to 2013 strategic plan—I hope to have that done within the next 

couple of weeks—that identifies a very significant number of primary goals essential to implementing our national mission and continuing to build out this very important public-private sector partnership framework. This effort is being conducted in tandem with 

our sector annual reporting process under the National Infrastructure Protection Plan. Our goal is to continue our risk-based approach to infrastructure protection, tailored again to the needs and 

requirements of the individual 17 sectors. As we move into the future, the NIPP partnership framework and the tens of thousands 

of security partners across the public and private sector that it 

brings to the table will continue to drive our national approach. 

Certainly, no one can predict the future with 100 percent accuracy, but certain things are a given. Technology, the way in which 

owners and operators do business, and their supply chain dependencies and interdependencies will certainly evolve, and vulnerabilities and consequences will change accordingly. We can also 

count on our risk calculation changing over time. 

Another fact is very clear. We face a very clever, flexible, patient, 

determined terrorist adversary. The path forward provided by the 

NIPP, the Sector-Specific Plans, and the partnership framework allows us to act collaborative as together we adapt to a very dynamic 

risk environment, a very dedicated and very ingenious enemy 

through a national unity of effort that we have begun to build and 

will continue to build out over time. 

Success over time means making commitments and following 

through on them. We will approach our collaborative implementation of the NIPP and the SSPs with this in mind and continue to 

refine and enhance our solid partnership with the private sector, 

State and local governments. 

I will leave you with one more important observation. The more 

we utilize the sector partnership model, the stronger and more effective it gets. We will continue to incorporate lessons learned, 

strive to constantly improve and adapt our partnership, communications, and coordination with the changing times and risk landscapes at the national level. Continued support of our focused activities in concert with all of our partners will help ensure our Nation’s preparedness in my mission area. 

42

1The prepared statement of Ms. Larence appears in the Appendix on page 115. 

Sir, thank you for this important opportunity to discuss the infrastructure protection mission area, and the public-private sector 

partnership framework that truly lies at its core. I would also like 

to thank you for your continued support and the support of this 

Subcommittee and the larger Committee of which you are a part 

for your dedication to the success of this vital component of our 

overarching homeland security mission, and I would be happy to 

answer questions following my colleagues. And sir, thank you for 

your time today. 

Senator PRYOR. Thank you. 

Our second witness, whom I introduced a few moments ago, is 

Eileen Larence. I suspect that I have mispronounced your name. 

Ms. LARENCE. That is right. 

Senator PRYOR. Is that right? 

Ms. LARENCE. No ‘‘W’’. 

Senator PRYOR. OK, thank you. Go ahead. 

TESTIMONY OF EILEEN REGAN LARENCE,1 DIRECTOR, HOMELAND SECURITY AND JUSTICE ISSUES, U.S. GOVERNMENT 

ACCOUNTABILITY OFFICE 

Ms. LARENCE. Mr. Chairman, I appreciate the opportunity to discuss the results of GAO reviews of the Department of Homeland 

Security’s efforts to ensure the Nation’s most critical infrastructure, 

from power plants and health care workers to the Internet, is protected from terrorist attacks and disasters, a daunting and complex 

challenge as Hurricane Katrina demonstrated and you pointed out 

in your opening statement. It is also an important mission, as DHS 

estimates infrastructure influences about 50 percent of our GDP, 

and as my colleague mentioned, about 85 percent is owned by the 

private sector, meaning DHS must depend on partnerships with 

this sector to voluntarily pay for added protection. DHS also recognizes the Nation cannot afford to protect everything, so it has devised a risk management model for infrastructure investments, an 

approach GAO generally endorses. 

As you pointed out, sectors were to create Sector-Specific Protection Plans. These plans were due to DHS by the end of December 

and released on May 21 of this year, and sectors recently submitted 

status reports on where they are against these plans to DHS. In 

terms of these plans, it is important to realize that they are separate from emergency response plans. We also found that they tend 

to be what we would call plans to plan, meaning that they describe 

how or what processes the sectors are going to use to identify their 

critical assets and resources, assess their vulnerabilities and risks, 

prioritize their resources, and select protective measures for them. 

And while owners and operators may to date have implemented 

protective measures for some of their individual assets to maintain 

business continuity or to comply with existing regulations, sector 

plans are to go beyond individual assets and take a more comprehensive national look at vulnerabilities and gaps across the sectors. 

GAO has reviewed the stand-up of the Coordinating Councils, the 

NIPP, and nine of the sector plans, as well as interviewed the 

43

chairs of each council, and has drawn several findings from this 

work. 

First, while sector plans are very useful to DHS in providing a 

consistent baseline, sectors had mixed opinions about the value of 

the plans and some were not as detailed and complete as others, 

which could limit their usefulness. 

Second, sectors have faced several challenges moving forward as 

plans and implementation evolves. 

Third, it appears that relatively few sectors are close to completing all of the systemic steps called for in the NIPP and will continue to evolve, as well. 

To further elaborate on each of these points, the sector plans are 

useful to DHS by providing it a baseline and consistent approach 

to protection, and a number of private sector representatives said 

that developing the plans was helpful for providing collaboration, 

information sharing, and common strategies. But for several other 

sectors, ones that were more mature, more homogeneous, or regulated, the plans are not as useful because these sectors had prior 

plans they were already implementing, such as in response to the 

Y2K scare, or because they did not think the private sector had 

been sufficiently involved in the process. 

While all the plans met DHS guidance and NIPP requirements, 

the comprehensiveness and potential usefulness of the plans that 

we reviewed were also mixed. They all included protection goals 

and objectives and sector intentions for assessing, prioritizing, and 

protecting assets. But the plans varied in the extent to which they: 

First, discussed protective measures in detail, since some sectors 

were not ready to do so or chose not to; second, recognized how sectors depended on each other, such as for electricity, telecommunications, or water to continue operations, and laid out these dependencies in their plans and in implementation; third, comprehensively assessed not only their physical assets, such as buildings, 

but also their cyber and human assets, a gap that could deter sectors’ readiness; and fourth, discussed possible incentives they could 

use to encourage private sector protection efforts, even though sectors depended on such efforts. 

And while plans acknowledged the need for metrics to determine 

how much protection we are achieving, some are going to rely on 

qualitative measures of progress, such as tests accomplished, instead of outcome measures of protection achieved. We recognize 

that assessing outcomes will be very difficult, but as you know, 

measures drive performance, so addressing this and other gaps in 

the plans will be important moving forward. 

As to our second finding, most private sector representatives 

spoke positively of their lead Federal agencies, including DHS, and 

the support provided, especially contractor support, but to varying 

degrees identified some challenges that they face: First, dealing 

with DHS reorganizations, staff turnover, and lack of expertise 

about some sectors; second, getting full council representation for 

some sectors that have a widely diverse membership, such as the 

health and agricultural sectors; third, having infrastructure that 

was primarily systems, networks, or people rather than buildings, 

and this complicated their planning, and according to the IT sector 

44

representatives, also complicated qualifying for some of the grant 

programs, as well. 

Another challenge was getting State and local players involved, 

in part because of the costs and time commitments, even though 

they are critical to protection efforts, and also, getting buy-in to the 

plans from all individual owners, operators, and private sector 

members. So marketing these plans will be important. This will 

also help to ensure that the plans don’t simply sit on the shelf. And 

a final challenge was private sector reluctance to provide DHS with 

information on assets and vulnerabilities for fear that their proprietary information would not be protected, including from possible 

terrorists, or they would lose competitive advantage or face litigation. 

As a result, most sectors still rely on their own voluntary information sharing advisory councils to share information and we are 

optimistic about the Critical Infrastructure Protection Advisory 

Council DHS initiated because it provides for closed meetings with 

the private sector. But others were still cautious about using DHS’s 

program to protect critical infrastructure information and we had 

identified such reluctance in a report last year and proposed recommendations for improvements, and also using DHS’s Homeland 

Security Information System because it lacks certain security features that were important to the private sector. 

As for our last finding, according to the sector plans we reviewed 

and representatives we contacted, it appears that only a few sectors, especially more mature ones, are relatively far along in completing all steps in the sector-wide NIPP process, and several 

newer sectors, such as health care, were still in the early stages. 

The recent status reports that the sectors submitted to DHS may 

give us a more accurate picture of this progress. 

DHS has made a lot of progress and has opportunities to promote 

this progress going forward. For example, it could target its support to the sectors that have made less progress. It can ensure that 

the critical gaps in the plans and the challenges we discussed are 

addressed. It can help sectors market these plans to get by in an 

implementation. It can streamline its review process in the future 

and provide the private sector more time for input, a problem a 

number of the private sector representatives identified in speaking 

with us. 

Maintaining momentum and timelines for implementation will 

also be important. Continued Congressional oversight, such as assessing sector status reports to determine progress, assessing the 

threat information and risk assessments that sectors use, since 

they drive the investment decisions, and what sectors have 

achieved with grant funding can also provide momentum and GAO 

stands ready to support this oversight. 

Finally, longer-term policy questions can include, does DHS have 

enough leverage to ensure the private sector will meet protection 

goals? Can we rely on market incentives or do we need other incentives, such as more targeted funding, tax incentives, or innovative 

R&D investments? Who will pay for any gaps between protection 

the private sector is willing to fund and any added protection needed to meet national security goals? And are we focused on the right 

goal, protection versus resiliency? Some in the private sector argue 

45

1The prepared statement of Mr. Watson appears in the Appendix on page 140. 

the end game should be resiliency, which means how quickly can 

operations be restored after an incident, rather than protection, 

which they characterize as adding more guns, guards, and gates, 

because resiliency is measurable and perhaps more affordable. 

What is the right balance between these two goals? 

This concludes my statement and I would be happy to answer 

any questions. Thank you. 

Senator PRYOR. Thank you. Ken Watson. 

TESTIMONY OF LIEUTENANT COLONEL KENNETH C. WATSON, 

(RETIRED),1 VICE CHAIRMAN, PARTNERSHIP FOR CRITICAL 

INFRASTRUCTURE SECURITY, AND SENIOR MANAGER, CRITICAL INFRASTRUCTURE ASSURANCE GROUP, CISCO SYSTEMS, INC 

Mr. WATSON. Mr. Chairman, thank you for inviting the Partnership for Critical Infrastructure Security (PCIS) to participate in today’s hearing on America’s private sector preparedness to protect 

our critical infrastructure. 

The NIPP designated PCIS as the private sector cross sector coordinating council for protecting critical infrastructure, but in fact, 

we have been fulfilling that role for the last 8 years, since we 

formed in 1999. Our council consists of the Sector Coordinating 

Councils (SCCs), the private sector components of the designated 

critical infrastructure sectors. Most of the sectors have also established Information Sharing and Analysis Centers (ISACs), to manage the daily information sharing needs of the sectors. 

In October 1997, the President’s Commission on Critical Infrastructure Protection published its seminal Critical Foundations report, which identified two irreversible trends: Increasing privatization of critical services; and increasing migration of core business 

and government operations to networks, including the Internet. 

The Federal Government called for a public-private partnership 

and we responded by founding the PCIS in 1999 in response to that 

call. 

We have made tremendous progress. I believe we are on a very 

solid path and the Nation’s critical infrastructure is far more resilient to potential attacks or natural disasters than we were 8 years 

ago. 

The PCIS Business Plan identifies four broad goals, each with its 

own objectives and metrics: First, partnership leadership on critical 

infrastructure issues and policy that reflect the consolidated all-sector perspective; second, cross-sector leadership in cross-sector interdependency issues; third, sector assistance to increase the value to 

the sectors and the SCCs; and fourth, PCIS effectiveness, improving the organizational effectiveness and value of the PCIS itself. 

Our members see value in understanding issues common to multiple sectors, unique challenges or solutions from a single sector, 

and the ability to jointly approach DHS and other government organizations. In addition, because of our sector-specific subject matter expertise, the National Infrastructure Advisory Council, or 

NIAC, calls on us from time to time to help develop policy advice 

for the President. Two notable recent efforts studied pandemic vacVerDate 0ct 09 2002 13:49 Mar 18, 2008 Jkt 036615 PO 00000 Frm 00049 Fmt 6601 Sfmt 6601 P:\DOCS\36615.TXT SAFFAIRS PsN: PAT
46

cine prioritization for critical infrastructure protection workers and 

issues surrounding public-private sector intelligence coordination. 

Chief among our recent successes is the development of the NIPP 

and its 17 Sector-Specific Plans. This level of collaboration would 

have been impossible without the Critical Infrastructure Partnership Advisory Council framework provided by the Congress in the 

Homeland Security Act of 2002 and implemented by Secretary 

Chertoff more than a year ago. This CIPAC framework allowed us 

to work side-by-side with our government counterparts to write 

these plans. This collaboration improved the NIPP’s approach to 

risk management. The initial DHS draft proposed a bottom-up approach for all the sectors which focused on physical assets. After 

considerable engagement between DHS and functionally-based sectors, such as electricity, IT, and communications, the NIPP Risk 

Management Section evolved to accommodate top-down risk management models, permitting multiple approaches. 

Developing the Sector-Specific Plans (SSPs), was not a perfect 

process. Most sectors were pleased with the collaboration of their 

sector-specific agencies, but for others, a learning curve still remains. I see these as growing pains as all partners embrace the 

new framework. 

The list of sector successes is long and growing. My written testimony highlights six sample success stories and I encourage you to 

review them at your earliest opportunity. For example, in the financial services sector, several Regional Partnership Councils have 

formed, allowing members to collaborate on disaster management 

matters with Federal, State, and local partners. Meanwhile, the 

rail and water sectors have begun meeting quarterly with key intelligence personnel to build trust, increase knowledge, and raise 

awareness. Using a competitive DHS grant, the commercial facilities sector created a training course to help managers of stadiums, 

arenas, performing arts centers, and convention centers to implement a DHS web-based security awareness and vulnerability assessment tool. 

Removing barriers to private sector participation is a key initiative of DHS and the PCIS. The Subcommittee asked me to comment today on three specific areas of concern: First, issues of competitive advantage; second, fear of sharing sensitive information; 

and third, worries the partnership might exclude smaller operators. 

I understand competition is cited frequently as a barrier to partnership, but I believe Greg Jones, the Chief Administrative Officer 

for Greenberg Traurig, LLP, summed it up best when he wrote recently, ‘‘We are competitors, not enemies.’’ The same holds true for 

the collaborative approach embraced by the SCCs and the ISACs. 

Regarding sharing sensitive information, we work closely with 

the Protected Critical Infrastructure Information Program Office 

(PCII), and the Information Sharing Environment (ISE), under the 

CIPAC framework to develop a simplified, rational approach to protecting information. As long as statutory protections for this information remain, the PCII Program should function within the 

newly-proposed Controlled Unclassified Information (CUI), environment. 

Despite these efforts, some sectors still have serious and legitimate concerns. First, sectors are unclear about what sensitive inVerDate 0ct 09 2002 13:49 Mar 18, 2008 Jkt 036615 PO 00000 Frm 00050 Fmt 6601 Sfmt 6601 P:\DOCS\36615.TXT SAFFAIRS PsN: PAT
47

formation DHS needs. Second, sectors worry this information might 

be disclosed publicly, making it available to competitors or used in 

litigation. 

SCCs include all relevant trade associations, a provision we insisted upon and DHS incorporated into the CIPAC framework to 

ensure inclusion of smaller operators. The food and agriculture 

SCCs, for example, has 119 separate entities representing the entire sector, from farm to table. The financial services SCCs has 34 

associations and companies representing banks, brokerages, and insurers. In addition, Homeland Security Assistant Secretary Bob 

Stephan and others regularly travel around the country encouraging companies and associations to join their SCCs and ISACs, 

and we appreciate that. 

Finally, please allow the PCIS to make a few suggestions that 

we, its members, feel would enhance the partnership and improve 

the ability of the United States to manage exceptional events. 

First, let the partnership mature. We have accomplished a great 

deal with DHS since its inception and even more since Secretary 

Chertoff exercised the Section 871 exemption to create CIPAC a 

year ago. While we welcome Congressional involvement, we must 

continue building a trusted environment that allows us to work 

freely with our government partners on sensitive safety and security issues. Moving forward, we would be happy to work with you 

as you consider standards and risk assessments. 

Second, the PCIS asks you to help us educate all Federal partners about the nature and value of this partnership because it has 

not been executed uniformly across all sectors. Some in the Federal 

Government still fail to understand the model’s merits. Many we 

work with in the DHS IT and Communications Operations Group 

and the Partnership and Outreach Division embrace the structure, 

but the farther you travel from those offices, the less understanding and appreciation of the sector partnership framework you 

will find. 

Third, it is time to review the National Response Plan to include 

more proactive private sector participation in response actions. 

This is crucial in the cyber dimension, as PCIS considers all cyber 

incidents international by default. The private sector has multiple 

collaborative mechanisms to deal with significant cyber incidents. 

Many Internet service providers, for example, collaborate through 

the informal ‘‘nsp-sec’’ community. Multiple public and private sector incident response teams also belong to the more formal Forum 

of Incident Response and Security Teams (FIRST). These two organizations are really the global cyber first responders. In turn, the 

NRP should direct proper authorities to these and other like-minded organizations during a cyber incident of national significance. 

Finally, the government must do a better job of sharing timely 

and useful information with the private sector. It is often difficult 

to determine exactly who needs to know sensitive information, but 

this partnership framework includes enough trust to err on the 

need-to-share side of the equation. Complex interdependencies, a 

lack of sector familiarity, and complex collocation of assets argue 

for a proactive sharing of alerts and warnings with the PCIS and 

the relevant ISACs. Many ISACs can transmit and store classified 

48

material and many sectors have cleared individuals who can be 

trusted with sensitive information. 

That concludes my remarks. Thank you again for the opportunity 

to be with you today on behalf of PCIS. I would be happy to answer 

any questions you have. 

Senator PRYOR. Thank you. Mr. Watson, let me start with you, 

if I may. Just by way of background, tell me a little bit about your 

organization, the Partnership for Critical Infrastructure Security. I 

think you said it started in 1999. Why did it start? How does it 

work? 

Mr. WATSON. The way it started, as you remember, the President’s Commission on Critical Infrastructure Protection (PCCIP), 

or the Marsh Commission, reported its Critical Foundations report 

on the vulnerability of critical infrastructures and a plan forward 

in October 1997. The government responded with PDD–63, Presidential Decision Directive 63, in May 1998, which created a lot of 

government organizations including the CIAO, the NIPC, and a few 

others that were scattered around the Federal departments. 

At the time, the Critical Infrastructure Assurance Office (CIAO), 

was in the Department of Commerce. The Department of Commerce put out a call for public-private partnership because that 

was the view of the Marsh Commission, that the only path forward 

because of these irreversible trends that I mentioned was publicprivate partnership. We responded by calling, I think over 200 companies to come to the table to form the PCIS, and our first meeting 

was actually in the Windows on the World restaurant at the top 

of the World Trade Center in December 1999. Since then, we created committees to look at research and development, information 

sharing, public policy, and any other areas that might be important 

to all the sectors or multiple sectors and began to coordinate with 

the Federal Government. 

When DHS was formed, all of the offices that were dealing with 

critical infrastructure assurance moved into the Department, so we 

had a single face now to work with—to coordinate most efforts 

across the sectors. Now, we understand that many of the sectorspecific agencies are not in DHS. DHS has the overall coordination 

role and we are comfortable with that. For example, the financial 

services sector had a long relationship with the Treasury Department and they want that to continue and we support that, and 

similar relationships exist for the other sectors. 

Senator PRYOR. OK. And you have been asked to help coordinate 

the various sectors. What is your role there? 

Mr. WATSON. Currently, I am the Vice Chairman of the PCIS. I 

am also on the Executive Committee for the IT Sector Coordinating 

Council. 

Senator PRYOR. You obviously work very closely with DHS. Is 

there an arms-length relationship with DHS? Are you independent 

of them? 

Mr. WATSON. We are very independent. At first, the funding 

model was donations from founding member companies. We got 

away from that because we believed that the business model that 

included payment of dues was exclusive and eliminated some of the 

smaller players, and so we eliminated the dues requirement. DHS 

stepped up to the plate after they were formed to help provide adVerDate 0ct 09 2002 13:49 Mar 18, 2008 Jkt 036615 PO 00000 Frm 00052 Fmt 6601 Sfmt 6601 P:\DOCS\36615.TXT SAFFAIRS PsN: PAT
49

ministrative support as long as—and we made sure that they 

couldn’t have access to private sector-only information, but if they 

wanted to provide information, that is what we are still doing admirably now. They support us in terms of coordinating conference 

calls, printing, organization support, meeting support, those kinds 

of things, and that relieves us of the burden of a lot of expenses. 

We do have a Board of Directors and we pay for our own Directors and Officers insurance and our own budgeting, but it is so 

minimal that it is not a burden to anybody that would like to participate. 

Senator PRYOR. Great. Now, let me ask, you mentioned in your 

testimony about the trust level with the private sector and the government, and I understand that sometimes the government is very 

reluctant to share classified information. Sometimes the private 

sector is very reluctant to share some of their proprietary information. I understand that. But what is the best way to balance national security and the need for the interested parties to be fully 

informed and have all the information they need? Do we have that 

balance yet? What do we need to do to improve that? 

Mr. WATSON. We are making a lot of progress. We are not completely there yet. I think that the effort of the information sharing 

environment is a good one. It is not mature yet. We haven’t really 

defined whether PCII will work within the framework. We think it 

will, but it hasn’t been tested yet. Now, this is the ability to share 

sensitive information with the government. The private sector 

would like to share information with the government because the 

government has a role in helping us protect ourselves and the 

country from attacks and natural disasters. 

On the sharing of sensitive government information, including 

classified information, HITRAC is a step in the right direction. It 

is the Homeland Infrastructure Threat and Risk Analysis Center—

the DHS fusion center that brings in all of the threat and law enforcement information, and they have opened up HITRAC to private sector participants, which we think is a very positive step. 

Now there is an opportunity to get private sector expertise in the 

door to help train government analysts on what is important and 

what is not important, so we are making progress, but there is 

more to do. 

Senator PRYOR. Let me ask, I want to get to you in just a moment, but let me ask while I have you, Mr. Watson, there are 15 

national planning scenarios that cover a wide range of disasters—

earthquakes, floods, cyber attack——

Mr. WATSON. Right. 

Senator PRYOR [continuing]. Pandemic flu, etc. To the layperson, 

it seems that we are covering the waterfront there, but is there 

anything that you think we are missing? Are there any scenarios 

that we really haven’t thought of or something that might fall in 

the gaps that we are really not preparing ourselves for? 

Mr. WATSON. That list of scenarios is pretty thorough. They are 

also plugged into the National Exercise Program, either one at a 

time or in combination, and I think that is the right thing to do. 

It is going to take an awful long time to get through all 15 if you 

do them one at a time. I think the nightmare scenario would be 

a large physical attack in combination with a cyber attack that disVerDate 0ct 09 2002 13:49 Mar 18, 2008 Jkt 036615 PO 00000 Frm 00053 Fmt 6601 Sfmt 6601 P:\DOCS\36615.TXT SAFFAIRS PsN: PAT
50

ables the emergency response. That is the one that keeps us up at 

night. So if we could exercise that and make sure that the first responders—firefighters, police, emergency medical, and local government decision makers—work through the degraded communication 

that would happen in those kinds of things and had alternate 

means of communications planned in advance, we would be much 

more resilient to that kind of a combined attack. 

Senator PRYOR. Let me ask about the cyber attack, because that 

is a relatively new phenomenon that a lot of people don’t know a 

lot about. They may get a virus on their computer or something 

like that, but they really don’t understand. In your estimation, how 

bad could a cyber attack be? I have heard some people talk about 

a digital Pearl Harbor. What is kind of the worst case scenario for 

a cyber attack, in your estimation? 

Mr. WATSON. Well, first of all, it is not as good or as bad as you 

see in a lot of the press. You can see comments all over the spectrum. The Internet is probably the most resilient and redundant 

communications means that we have ever developed. It would be 

very unlikely that it would be disabled because—for many reasons. 

It is resilient. It is redundant, as I have said. But the bad guys use 

the Internet like we do, to share information or to spread information or to gather information. So they don’t want to take down the 

infrastructure on which they depend any more than we would want 

it to come down. 

That said, if terrorists had the wherewithal to delay or confuse 

a 911 response system while they were conducting a physical attack, they could theoretically increase the number of casualties and 

delay the response to protect those citizens, and that is the one 

that would worry me. 

Senator PRYOR. OK. Do you feel like we are taking steps to avoid 

that scenario? 

Mr. WATSON. We are taking a lot of steps. The sectors are very 

engaged and we are improving the security responses in everything 

from control systems, all the way through communications and 

interdependencies. 

One area I think we could work better on is regional interdependency exercises so that every region and every city knew who 

the stakeholders were in all the sectors and they had exercised 

through all these options and knew the backup plans they need to 

put in place. 

Senator PRYOR. In your view, is that something that could be coordinated by the Department of Homeland Security? 

Mr. WATSON. I believe it is and I think it is in their plan to do 

that. 

Senator PRYOR. OK. Thank you. 

Mr. Stephan, let me turn to you. I know it looked like a couple 

of times you wanted to chime in there and maybe add a little something. Did you want to add anything before I ask you questions? 

Colonel STEPHAN. No, sir. I am pretty much in agreement with 

Mr. Watson’s response. He has been a great partner and his leadership has been personally very effective in building a lot of bridges 

and certainly they are not shy in bringing problems and issues to 

us through the PCIS and at the individual sector level. That is 

what the partnership is all about and we continue to solicit that 

51

feedback. Every suggestion that these folks pass up or issue they 

pass up, I take action on or explain to them why I am not able to 

do it so at least we have that very positive and direct feedback loop 

going back and forth. 

Senator PRYOR. Good. Let me ask about these sectors that we 

have talked about here, these 17 sectors. One of the first questions 

I have is when you try to get information from them, who do you 

get information from? For example, the food sector is such a broad, 

wide-ranging sector. Who do you get information from and how do 

you manage that information? 

Colonel STEPHAN. Sir, there are two different levels of information and collection, if you will. One is sector-level information in 

terms of strategic risk concerns for the sector, general concerns, 

how each sector does incident management. We work through the 

Sector Coordinating Council framework, sometimes through the 

PCIS if it is an issue that crosses multiple sectors. Using that approach, again, that is more for strategic-type information needs. 

Then we have another level that is a little bit more challenging 

because we need individual vulnerability and consequence information that we need to draw in many cases from individual companies 

or corporations across the 17 sector landscapes. I get information 

from them, sometimes again using the Sector Coordinating Council 

framework, but more importantly and probably most importantly, 

my direct information venue now is my Protective Security Advisor 

cadre, those 17 folks representing my boots on the ground, my eyes 

and ears forward in very critical locations across the country that 

have developed trusted relationships with State and local partners 

as well as private sector partners down to the individual facility 

level. 

Cracking this nut is tough in terms of risk. We are using a tiered 

approach and we have identified through our partnership model 

approximately 2,500 things out of the tens and tens of thousands 

of things that represent infrastructure nodes across the country, 

things that we would classify as a tier one or tier two by sector, 

meaning certain consequence and threat and vulnerability criteria. 

We work through the Sector Partnership model, through the Coordinating Councils, and with individual facilities to gather information relative to their vulnerabilities and consequences and how 

a threat vector of a particular nature might affect them. That process was kick-started a couple of years ago to drill down so we could 

focus on those things that we all considered to be mutually important. 

Senator PRYOR. OK. Let me ask a similar question to what I 

asked Mr. Watson a few moments ago about information going 

back and forth between the government and the private sector. 

Again, I know sometimes the government is very reluctant to share 

classified information. That is understandable and I understand 

why the private sector is reluctant to share proprietary information 

or just very sensitive information, whatever it may be. But do you 

feel like that the government is doing an adequate job in sharing 

classified information under the right circumstances and do you 

feel like you are getting enough information from the private sector? 

52

Colonel STEPHAN. Sir, on the classified piece first, we have enabled about 900 private sector leaders across the 17 sectors to get 

a secret-level security clearance, so they come into our classified 

world and actually give us advice and recommendations as we are 

building the intel products that affect their world and help us 

translate from intel speak into private sector speak, if you will. 

That is one important piece. 

But I think the most important piece is working with the intelligence and law enforcement community, the CIA, the FBI, and 

others, kind of ingraining within those organizations the need to 

declassify using the tear-line construct, tearing off sources and 

methods, normally the facts and figures associated with threat information or maybe at the ‘‘for official use only’’ or at the completely unclassified level. 

I have been with the Department since day one. It was a very 

difficult process 4 years ago to declassify information in real time 

to get it to the private sector. We can do that now, for example, 

in this emerging threat scenario with respect to the London and 

Glasgow events, the JFK events, the events associated with the 

group that was going to be focused on Fort Dix in New Jersey, very 

quickly, I mean, within a matter of hours, declassifying information, forming tear-line pieces of it, using our information network 

to blast it out through the PCIS and the individual Sector Coordinating Councils across the United States to our various private sector partners. That is dealing with government to private sector information exchange. 

On the flip side, information that we require of the private sector, the key is trust, trust that we will be able to protect the information that the private sector provides to us that is of a proprietary nature or that is of a very specific vulnerability or consequence nature so that they, in fact, don’t actually focus terrorists 

on them through this process. 

Before we published the final Protective Critical Infrastructure 

Information Rule, I think we had a whopping total of 48 vulnerability submissions from the private sector, about a year and a half 

ago. Since the publication of the final rule, since now everybody 

knows what the real deal is and they can study it, they can have 

their lawyers focus on it, we now are over 5,400 individual vulnerability assessment submissions in the span of the last 18 months. 

So we continue to climb the chart now in a geometric fashion instead of trickling them in a few dozen or so maybe in a year’s time 

frame. That is very important. 

Getting education and awareness through the Sector Coordinating Councils, through the PCIS, down to the companies that 

this is how your information will be protected is very important, 

but the true test of time of all of this will be when PCII hits the 

judicial process for the first time and we have a successful court 

case that will show the private sector that this will withstand judicial scrutiny and we will get a favorable ruling. Until that happens, 

there will be a shadow of doubt in the private sector’s mind that 

the court system will allow this information regime that we have 

put in place to stand. 

So again, doing everything we can to work with the folks, help 

them understand why we need the information, how it will be proVerDate 0ct 09 2002 13:49 Mar 18, 2008 Jkt 036615 PO 00000 Frm 00056 Fmt 6601 Sfmt 6601 P:\DOCS\36615.TXT SAFFAIRS PsN: PAT
53

tected, final rule out the door, building up that trust through my 

PSAs and others at the individual jurisdiction or company level, 

and finally, this will have to go through the court process to make 

a 100 percent determination. 

Senator PRYOR. In the last few days, Secretary Chertoff has been 

in the news about perhaps increased threat level in the summer 

months, and the Department of Homeland Security, a couple years 

ago established this color-coded threat level. Do you incorporate 

that in what you are doing? In other words, do you look at various 

infrastructure and say, well, this may be a red, this may be a yellow, this may be a green? Do you make that independent assessment? 

Colonel STEPHAN. Sir, we make that assessment, but not independently, in concert with State and local government officials, 

principally the State Homeland Security Advisory Network, and 

again, through the Sector Coordinating Councils for each of the sectors. I have a general level of protective measures in place that 

people will go to depending on where we are in the color scale. 

That has been coordinated over time over the past 3 years. 

We used that set of protocols specifically with the transportation 

sector, the aviation subsector last August when we went from yellow to orange in the aviation subsector, putting in place mutually 

agreed-to protocols. Some of those responsibilities lie with the Federal Government through TSA. Lots of them, and most of them, in 

fact, lie with the airports and the airlines through that network. 

Senator PRYOR. So in other words, you feel like you have the 

flexibility—just say, for example, Secretary Chertoff says we generally are in an orange——

Colonel STEPHAN. Yes, sir. 

Senator PRYOR [continuing]. But you look at your sectors and you 

say, well, these couple of sectors are probably more to red and 

these others may be more to yellow, but nonetheless, you have the 

flexibility to——

Colonel STEPHAN. We have the flexibility to go up by color by individual sector or subsector, or if we want to not do that, we can, 

by virtue of our Executive Notification System, our Information 

Sharing Network, our Sector Partnership Council framework, 

bringing the folks together and say, based on Intel, we feel it is 

prudent that this sector, without raising necessarily to orange or 

red, take additional steps such as the following, and we push those 

recommendations out the door. But again, we do that in a collaborative fashion via phone conference or face-to-face meetings sector 

by sector. 

Senator PRYOR. All right. Let me ask one last question for you, 

Mr. Stephan, if I can, and that is, I think it was both you and Ms. 

Larence testified that the private sector controls about 85 percent 

of the critical infrastructure in this country. Who controls the other 

15 percent, and are we doing something similar with that 15 percent? 

Colonel STEPHAN. I would say probably the lion’s share of the remaining 15 percent is under State and local government control. 

For example, a lot of the water sector, municipal governments own 

water systems throughout the United States. And then probably 

less than 1 percent is an asset that is owned and operated and proVerDate 0ct 09 2002 13:49 Mar 18, 2008 Jkt 036615 PO 00000 Frm 00057 Fmt 6601 Sfmt 6601 P:\DOCS\36615.TXT SAFFAIRS PsN: PAT
54

tected by the Federal Government. So our Federal departments 

and agencies have the least amount of responsibility by ownership 

across the board, State and local governments next in line, and finally the big lion’s share of all this is through the private sector. 

We have a similar arrangement. We have a State, Local, Tribal, 

Territorial Government Coordinating Council, about 30 individuals 

that represent Homeland Security advisors, emergency managers, 

law enforcement, public health officials, food and agriculture officials, regulatory officials at the State and local government level. 

We use them as a sounding board and as an information sharing 

network much as we do the Private Sector Coordinating Councils. 

And, of course, all the grant programs directed at infrastructure 

essentially provide money that go to State and local communities 

in concert with infrastructures that happen to reside within their 

jurisdictions. For example, my buffer zone program that IP owns, 

$191 million over the past 4 years, 2,200 to 2,400 individual plans 

that tie inside defense and outside defense considerations together 

that unite State and local government, law enforcement with private sector security people to have a web of security that extends 

beyond the fence line or perimeter of a facility. That is how we 

need to collaborate together. 

Senator PRYOR. OK. Let me ask one other follow-up. When the 

Department of Homeland Security was founded, the Critical Infrastructure Assurance Office (CIAO), is that what you call it? 

Colonel STEPHAN. Yes, sir. 

Senator PRYOR. It migrated from Commerce to DHS. 

Colonel STEPHAN. Yes, sir. 

Senator PRYOR. CIAO has started to try to get an assurance program for each U.S. department, is that right? 

Colonel STEPHAN. Sir, the CIAO in its form 4 years ago no longer 

exists. Those individual entities, five or six of them that came forward into the Department of Homeland Security no longer exist as 

individual entities. They are now interspersed among the divisions 

of the Infrastructure Protection Office or the Cyber Security and 

Communications Office. That early work by the CIAO has been 

superceded by the 17 Sector-Specific Plans, and a principal component for the Federal departments and agencies is the Government 

Facilities Sector-Specific Plan, where a lot of that pioneer work by 

the CIAO has been embedded or integrated. 

Senator PRYOR. OK, great. That sort of ties up a loose end for 

me, because I didn’t know how that worked. Thank you. 

Ms. Larence, let me ask you a few questions here. I believe in 

either your testimony or report, you talk about the turnover rate 

at Homeland Security and its effect on trust, just human nature 

being what it is, when you have a lot of new people and you 

haven’t had a chance to build those relationships. What do you 

think we can do or should do, or how can we help alleviate that 

problem and build that trust? What do we need to do there? 

Ms. LARENCE. I don’t know if I can address the turnover rate, but 

in terms of trust, this is an issue that we continue to identify in 

our reports over probably about the last 4 years. Some of the sectors did report to us that it has been improving, that they have 

been building effective relationships with their counterparts within 

DHS and that has helped the sectors progress. I think not only the 

55

turnover, but the lack of expertise about the sectors and how their 

businesses operate is also another gap that might be something 

that DHS could address, perhaps through additional arrangements 

with contractors or intergovernmental personnel arrangements 

where you could bring folks in to learn about the industries’ business. 

Senator PRYOR. Let me ask, in your testimony a little bit earlier, 

you talked about plans to plan, and as I understand, what you 

were saying is that sometimes these efforts really result in plans 

to make a plan, but they never really get to the plan. Is that what 

you mean by that? 

Ms. LARENCE. The NIPP process is really about describing the 

process that sectors will use to get to the end point of identifying 

their critical assets and making sure they are protected, and so the 

NIPP was really just requiring the sectors to identify how they 

would go through that process. 

Senator PRYOR. And, by the way, do you think that has been successful so far? 

Ms. LARENCE. All of the sectors have met those baseline criteria. 

Senator PRYOR. OK. 

Ms. LARENCE. But if you look at the plans, some of the sectors 

that are more mature, for example, banking and finance, if you 

read their plans, they will indicate that they have identified a lot 

of their critical assets. They have risk and vulnerability assessments in place. They have been regulated. Their examiners have 

been doing risk assessments on a wide part of the industry. 

And so you can tell some sectors have gone through more of 

those steps, whereas if you look at, for example, public health or 

food and agriculture, they are really just getting their sectors organized and they are still at the very front end of that process where 

they are trying to make sure they have the right people at the 

table, quite frankly, and then begin to determine what criteria they 

would use to figure out what their most critical assets are across 

a widely diverse base. I think food and agriculture points out that 

they have millions of farmers, two million farmers, and 150 meat 

packing processing plants that they have to bring to the table. 

Health care has 13 million health care professionals, 6,000 hospitals and a number of other facilities and labs. So just trying to 

get their arms around what their sector looks like and how to manage that diversity is a real challenge for them. 

Senator PRYOR. You apparently testified before the House Homeland Security Committee, 3 weeks ago, something like that? 

Ms. LARENCE. We did a member briefing yesterday, sir, and before Appropriations several months ago. 

Senator PRYOR. OK. Let me ask about the plan-to-plan idea and 

how some sectors are further ahead than others. Overall, what is 

your overall assessment of how we are doing in this effort? I mean, 

are we halfway there? Are we a quarter of the way there? Are we 

almost there? What is your general assessment of how we are 

doing? 

Ms. LARENCE. Well, in terms of actually designing and implementing the plans, we asked the chairs of each of the Private Sector Councils for their opinions, their own opinions of where they 

were, and I would say that most of them characterize themselves 

56

pretty much at, on a scale of one to five, at about a three. I think 

they feel that their large, most critical facilities or assets, were at 

least doing risk assessments or had them under control. They still 

have a lot of work to do to really get that sector-wide perspective. 

A couple of sectors felt that they were at a one or a two, that 

they had pretty much moved through the process and really had 

identified their assets and had conducted risk assessments and had 

protection measures in place, and a couple of the other sectors, as 

I mentioned, the public health and food and agriculture, some of 

those that are newer, recognized that they were probably more at 

stages three, four, or five, where they had a ways to go. 

That doesn’t mean that those sectors’ assets, however, are not 

protected, because as we mentioned, individual owners and operators, because of simply business operations or continuity of operations, or maybe the regulatory requirements for security, have 

taken some steps to make sure their assets are protected. So we 

don’t want to mislead that the assets in those sectors are, in fact, 

unprotected. It is just trying to figure out as a whole, across the 

sector, where are we. 

Senator PRYOR. Given your analysis and your review of the situation as it currently stands, if most of the sectors right now would 

give themselves maybe a three on a scale of five, if we were to have 

this same hearing a year from now, would they come in at fours 

and fives or would they still be at about a three? 

Ms. LARENCE. I think we are trying to get them to ones or twos, 

but I think a lot of them, if you look at their sector plans and the 

milestones that they had set out for them, have a pretty ambitious 

plan, I think, over the next year or two to move through that 

model. So I think we would see a lot more progress. 

Senator PRYOR. OK. Good. Did anybody want to follow up on 

anything the other witnesses have said? 

Colonel STEPHAN. Sir, just one. I hardly ever am in disagreement 

with my colleagues from GAO, because they do a wonderful job. 

They have a significant amount of challenges. I would just question 

the phrase, ‘‘plan to plan.’’ I think that where we are is that every 

sector now has a baseline plan, and as you see from that list, these 

sectors—the only thing they share in common is that they are all 

different, all very unique. Most of them are huge, with the exception probably of the nuclear energy sector. There is a fairly tight, 

very tight, closely knit circle of friends there with a very small 

number of facilities that is under a security-regulated environment. 

I would say that all of these plans represent plans that have 

deliverables, milestones, and timelines that are concrete that set a 

baseline. These plans will be reviewed and updated on an annual 

basis, as required. But all of them have tangible things that they 

have signed up to with metrics to measure their performance embedded inside the plans that they have agreed to as a public-private sector partnership, and I would characterize them in that context as opposed to plans to plan, because I feel pretty strongly, I 

am not in this business to plan anymore. I am in this business to 

implement. We have a year and a half left in this Administration, 

and for my mission responsibility, no more planning except for, for 

example, in the case of avian flu, where we do have a few more 

57

steps to make at the sector level to put the final loops into that and 

close them. 

These things are a baseline. Some sectors are higher than others 

in terms of where they are in progress. That is by virtue of the fact 

of who they are, what their risk landscape looks like, how many 

actors are in there, how dispersed are they, so on and so forth. So 

I would just add that to my testimony. 

Senator PRYOR. Ms. Larence, did you have any comment on that? 

Ms. LARENCE. Two, if I may, sir. Just one following up on cyber. 

I promised my colleague in our IT team to plug, as a separate effort, that they went through all the sector plans specifically looking 

to what extent they identified cyber issues, as Mr. Watson was referring to, and they will be releasing that report probably later 

next week. 

Similarly to our findings, they determined that to some extent it 

varied, the extent to which sectors considered their cyber assets in 

their sector plans. For example, as he mentioned, control systems. 

It is important that sectors think about where their critical cyber 

assets are and integrate those into their plans. So I think we still 

have some work to do with some of the sectors on that. 

The other thing I would just mention under information sharing, 

something to watch that is developing at the State level are State 

information or intelligence fusion centers, and each State has been 

creating those now to fulfill, I think, a gap that they found within 

their State jurisdictions to have information that their governors 

and that their State and local folks could use. We have been doing 

some work looking at those fusion centers and they are now beginning to look, some of them, at how they can bring the private sector 

into those fusion centers, as well, which would give them some 

more direct access to intelligence and information. 

Senator PRYOR. Right. We have been talking about that on the 

Subcommittee, as well, so that is good. 

Does anybody else want to comment? 

Mr. WATSON. I might have one more point, just to reemphasize 

the need to look at the regional interdependency issue. Terrorists 

and Mother Nature don’t attack sectors, they attack individual 

areas, and this has been a very valuable exercise to develop sectorwide principles and guidelines for security measures. It has been 

valuable for us. In the IT sector, the first thing we had to do was 

define the sector. Who are the members and what are the key functions? How do we look at the dependencies of those functions, and 

what are the cross-sector interdependencies? So that has been very 

valuable for us. 

But we need to always keep in the forefront of our minds that 

it is a regional emphasis. We need to build from there and look at 

the multiple sectors that are uniquely connected in each region of 

the country. 

Senator PRYOR. Good. Well, listen, I want to thank the witnesses 

again. We will keep the record open for 15 days. All of our colleagues on the Ad Hoc Subcommittee may submit questions in 

writing. If they do submit any questions, I would like you all to respond to those as quickly as you could. 

I want to thank you all and let you know that your written statement will be made part of the record, and if you have other docuVerDate 0ct 09 2002 13:49 Mar 18, 2008 Jkt 036615 PO 00000 Frm 00061 Fmt 6601 Sfmt 6601 P:\DOCS\36615.TXT SAFFAIRS PsN: PAT
58

ments or studies that you want to be part of the record, we will 

be glad to include those, as well. 

So thank you again for being here and thank you for your testimony. 

[Whereupon, at 3:17 p.m., the Subcommittee was adjourned.] 

(59)

A P P E N D I X 


36615.001
60


36615.002
61


36615.003
62


36615.004
63


36615.005
64


36615.006
65


36615.007
66


36615.008
67


36615.009
68


36615.010
69


36615.011
70


36615.012
71


36615.013
72


36615.014
73


36615.015
74


36615.016
75


36615.017
76


36615.018
77


36615.019
78


36615.020
79


36615.021
80


36615.022
81


36615.023
82


36615.024
83


36615.025
84


36615.026
85


36615.027
86


36615.028
87


36615.029
88


36615.030
89


36615.031
90


36615.032
91


36615.033
92


36615.034
93


36615.035
94


36615.036
95


36615.037
96


36615.038
97


36615.039
98


36615.040
99


36615.041
100


36615.042
101


36615.043
102


36615.044
103


36615.045
104


36615.046
105


36615.047
106


36615.048
107


36615.049
108


36615.050
109


36615.051
110


36615.052
111


36615.053
112


36615.054
113


36615.055
114


36615.056
115


36615.057
116


36615.058
117


36615.059
118


36615.060
119


36615.061
120


36615.062
121


36615.063
122


36615.064
123


36615.065
124


36615.066
125


36615.067
126


36615.068
127


36615.069
128


36615.070
129


36615.071
130


36615.072
131


36615.073
132


36615.074
133


36615.075
134


36615.076
135


36615.077
136


36615.078
137


36615.079
138


36615.080
139


36615.081
140


36615.082
141


36615.083
142


36615.084
143


36615.085
144


36615.086
145


36615.087
146


36615.088
147


36615.089
148


36615.090
149


36615.091
150


36615.092
151


36615.093
152


36615.094
153


36615.095
154


36615.096
155


36615.097
156


36615.098
157


36615.099
158


36615.100
159


36615.101
160


36615.102
161


36615.103
162


36615.104
163


36615.105
164


36615.106
165


36615.107
166


36615.108
167


36615.109
168


36615.110
169


36615.111
170


36615.112
171


36615.113
172


36615.114
173


36615.115
174


36615.116
175


36615.117
176


36615.118
177


36615.119
178


36615.120
179


36615.121
180


36615.122
181


36615.123
182


36615.124
183


36615.125
184


36615.126
185


36615.127
186


36615.128
187


36615.129
188


36615.130
189


36615.131
190


36615.132
191


36615.133
192


36615.134
193


36615.135
194


36615.136
195


36615.137
196


36615.138
197


36615.139
198


36615.140
199


36615.141
200


36615.142
201


36615.143
202


36615.144
203


36615.145
204


36615.146
205


36615.147
206


36615.148
207


36615.149
208


36615.150
209


36615.151
210


36615.152
211


36615.153
212


36615.154
213


36615.155
214


36615.156
215


36615.157
216


36615.158
217


36615.159
218


36615.160
219


36615.161
220


36615.162
221


36615.163
222


36615.164
223


36615.165
224


36615.166
225


36615.167
226


36615.168
227

Æ


36615.169