Gilmore Commission - Minutes
Panel to Assess the Capabilities for Domestic Response
to Terrorist Acts Involving Weapons of Mass Destruction
May 1, 2003
Arlington, VA
Present:
James Gilmore- Chairman
George Foresman
Jim Greenleaf
Mike Freeman
Jack Marsh
Bill Jenaway
Dallas Jones
AD Vickery
John Hathaway
John Lombardi
Ken Shine
Bill Reno
Pat Ralston
Bill Garrison
Patty Quinlisk
Paul Maniscalco
Jennifer Brower
Mike Wermuth
Guests:
Hillary Peck- RAND Staff
Information Technology for Counter-Terrorism Discussion
Gilmore: : I thought that the threat briefing from yesterday was suburb but it didn’t make me feel any better. We still have a basic geopolitical problem but it’s certainly a pretty remarkable threat assessment. Does anyone want to say anything about Poindexter? I will tell you what I thought; I was troubled by the sense that the presentation was very organizational about how they were going to make it work. I think the privacy concerns that he was discussing were all technological. I have to think a little bit about whether or not that actually makes me feel better or not. And I am not sure how we are going to get this across to the average person. Our job is to assess the issue side of this taskforce. My question is still how the money gets in the hands of the states and locals to do what they think should be done. I think the jury is out on this, I am trying to keep my prejudices aside and to judge this openly. I don’t want to approach it with a predetermined ideal. You may notice that the Q&A was unsatisfactory. None of the questions were really answered.
Wermuth: Let me offer construct for further discussion. Poindexter suggested without a lot of detail the potential for a protective mechanism and they seem to be open for a definition of what that might be. This would be a watch-dog mechanism, for a lack of a better term. It’s an outside entity that would constantly audit and inspect and would be away from that direct organization. This would make it certain that the line wasn’t being crossed. I was impressed on that score because right now they are using synthetic data because they realize the risk of crossing that line right now until they get it right. But it seems that to help them get this right a suggestion for this watch dog group would be helpful.
Brower: I think that the Defense Advanced Research Projects Agency (DARPA) approaches things very technically just in general. The panel might want to think of recommending something outside of DARPA because I think they are very focused on the technological aspect of this issue.
Shine: There is a clear separation between research capability and policy outline. Having the technological capability doesn’t mean that you necessarily use it. I am skeptical of the design where you simulate information and then skeptical of what they are getting out of it because it is artificial. I am worried about their capacity to evaluate the validity of their own work. Is this good science? And is this science relevant? You should have some entity that can address these and issues of civil liberties. Finally, I think that I am not reassured at all. From a civil liberties point of view I am not assured at all. Short of an oversight process, even at the research area, I am not assured.
Foresman: I have three questions. I thought organizationally he made a good point about making the connectivity. It was a nice flowchart but my first question is why we are so dedicated to one little aspect of the intelligence problem? Is DoD the right place to put this in the first place? They are not putting the state and local or the law enforcement issues on the table yet. It then raises the issue of what Ken said. You may have a technological solution but are you using it correctly? I still don’t think we are looking at the enterprise.
Marsh: I have been asked to serve on an evaluation panel that is still being organized. I am very interested if these comments because ours is only a temporary solution. If you go back and look at the issue, one of the major problems is not in government, it is the collection of data in the private sector. Privacy is not mentioned in the constitution or the bill of rights and nowhere is it defined. I think we are making a basic mistake and confusing privacy vs. liberty and privacy vs. security. How do you deal with private sector information? The government wants databases on who is buying what but how do you get industry and the private sector to give you that data.
Ralston: I just wanted to mention that the state and local levels were left out for now and at some point they will be critical in this process. How we prepare our states for these incidents is critical.
Greenleaf: I asked him what some of his sources were and he was reluctant to get into that. I would have liked to see more discussion of the resources. I also couldn’t understand who the customers were for this system and shouldn’t they be part of the process of the creation of the system? It seems that the bureau and the TTIC, who are sensitive to civil liberties should be part of the creation. They are going to be creating a tremendous amount of information that is not related to terrorism, a lot will be related to criminal activity. So what happens when criminal information spits out of the machine, what are the processes?
Gilmore: I chaired the National Commission on the Internet sales tax issues and what they are trying to do is get information on how people buy and sell on the internet so that they can tax people on it. What is relevant to us is the privacy issues that came up when we were discussing this. These issues were that people just don’t want the government having access to what they buy and sell. We still need to have a trusted third party, someone who would get all this data and then distribute it out to those who need it. The second thought I had yesterday was about gun control. In Virginia when you buy a gun, if you have a criminal record you don’t get a gun. If you are okay, you can get a gun. What I wanted to ask him yesterday was the way that we got that gun law passed, we had to tell them that the data would only be held for 60 days and then it is erased. It is not a record. I wanted to ask him about what you do with all the noise that you are sifting through. Quickly he blew by the idea of a memory bank and it remains an unanswered question. He talked a long time yesterday but there was no substantive give and take, there was only organization and technological discussion.
Shine: Jim made the point that they were only supposed to monitor non citizens, a fundamental question is whether this group has the opinion to use the noise from citizens as well as non citizens. If you decide not to include noise from American citizens, it takes you down a different path than if you do.
Foresman: If you are going to get a true picture of the potential threats out there, you have to look at the entire universe.
Shine: I simply wanted to put on the table that he made the very clear distinction and wanted to ask if we think that is realistic and is there anything else we should be thinking about regarding who is covered and who isn’t?
Gilmore: Was the synthetic 2 million people all aliens?
Wermuth: First of all fundamentally DARPA is not an operator, they don’t own or operate anything and that was not clear in the presentation. At a point they would transition this operation to someone else. That is important to keep in mind. Someone else will have to make the policy decision and it won’t be in DARPA. It’s clear to me that they intend to include the law enforcement piece but they are just not there yet but clearly they will get there. They are still crawling before they walk even for the test bed. Dr. Shine is probably right that the scenario is probably not complete but it gives you a pathway to model future applications. The second thing I heard him say was that they have started to use pieces of information that the government already owns, fully constitutional, fully ethically and moral. That is where it gets to the difference between aliens and citizens. The other thing I thought I heard is that there is no intention to gather all the noise. The way he described it, when he said specific pattern of queries, that meant that he didn’t intend to gather all the noise. You wouldn’t gather all the noise and try to shift through it but you would go in with certain queries. The pattern queries would be devoted strictly to terrorism. John Poindexter and the people at DARPA will not implement this system.
Jones: I think the technology is the only way we will be able to get the sleeper cells. And inevitably you will get others who inadvertently bought the wrong things.
Reno: DARPA is an interesting organization and usually they have a sponsor and they do not guide and shape because usually they are right out front. This system is not creating new technologies, they are using old technologies without a sponsor. Who is going to have command and control and quality assurance over this system? They clearly don’t have a PR strategy to market this to the American people or even within the government or even to people like us and they need to do that. When I first heard of this structure and who was heading it, I thought that was a horrible PR move. When you develop a terrorist template, you reach in and pull out information on terrorism. But could you do that for different sectors, like pulling information about health? You can change the templates. I asked about the list of issues with language conversions. Can you link the database of terrorist collection from say Poland with ours? I thought that is what language conversion was but it isn’t. My assessment of it is that they have lousy PR and absolute uncertainty about who this is going to transfer to. My last two concerns are that this can be used for things other than terrorism and that they are not tapping into other countries databases. I am definitely pro-databases. I think they are important.
Marsh: We have a tendency to look at these things in a parochial way and the problem is that this is not just a US asset.
Vickery: It always bothers me when someone says I invented dynamite but I don’t use it. We need the tool but I don’t know how this thing is going to sell. We have to separate the technology from the policy. I don’t know how you would pick this group of saints that could act as a review board. Technology is only as good as those who put it together. I think the technology is important but the applicability should be in the international arena. If a sleeper cell can bury itself for a number of years and they are designed to stay unnoticed for years, what would kick up?
Gilmore: Looking at September 11 in retrospect we can see that there were clues but how would you do it the other way, what kind of clues should we be looking for before the next attack? American citizens seem to have this peace of mind that data is diffused. You give your tax information to the IRS, you give your license information to the DMV. A few weeks ago a company tried to get me to buy a product where you typed in anyone’s name and their picture from the license came up, their family, their associations, every record that they have on you. We can’t un-invent this.
Quinlisk: I don’t think that a lot of people DO know that we have access to data, even shopping data. Very few people know that this information is out there.
Jones: I think the point is that it’s here. I can run purchases from Sears and find out what size shirt you wear. I can find out your hobbies by your magazine subscriptions. The concern is that you need to run data on third parties and you can cull a lot of crime out through this system. A sleeper cell probably pays their rent in cash and so you would have to investigate the landlord.
Brower: There are people that are aware and paranoid about being watched.
Shine: Our charge is to make recommendations to protect Americans from domestic terrorism. I think most people accept the utility of large databases. The fundamental question is that if there is a big difference between all this data and the capacity to collect it, has the level of threat of domestic terrorism reached a point where we want the government to take this data? And I would argue that that case has not been made. There was one tragedy on 9-11, and on the basis of that one tragedy, do we as a group believe that the government should be able to collect data on everything?
Brower: In addition, do you as a group believe that the benefits outweigh the risks? Would this type of database have solved the problem before Sept. 11 anyway? Terrorists are people, and they are adaptive. Just because the government has access to ten databases, do they have the right to put it together? One thing we mentioned in the 4th report is that we have to acknowledge that a new threat is emerging from American citizens and will this system really help?
Gilmore: If this gets through the system, these issues will be addressed with legislation.
Foresman: I wanted to go back to Ken’s point and mention that this didn’t begin with 9-11. These discussions have been going on long before that. Who is the right structure for managing all this data out there? Part of where we may be able to help is to look at the broader issue of information as it relates to intelligence. We could recommend how we do a better job of dealing with these types of events. Just because we can do it, doesn’t mean we should do it. And there is no mechanism to make that decision.
Gilmore: Is this the right environment to make a decision like this? War and high tension creates threatening legislation. War is not exactly the right time to make these sorts of decisions.
Wermuth: I am not here to carry water for DARPA but there are things that were not represented in that briefing. I don’t think I ever heard an intention to build a master database. He said that specifically.
Shine: That is not reassuring Mike. I know he isn’t going to collect every bit of data but within his system he can still collect data on banking, and whatever they want to.
Reno: He was very careful to state that they weren’t going to do this but said that they could.
Garrison: The government doesn’t have the ability to do a pattern analysis to collect information on terrorism. We are away from 9-11 and now we are coming back to homeostasis. The government can already collect the data so we can’t say that we are going to change that, its here. The question is if we want the government to be able to do a pattern analysis regarding terrorism. Would we be looking at a recommendation on where the operationally of this DARPA system should go? Should it go to the FBI? The DoD? John Ashcroft?
Wermuth: Is there anyone who believes that we don’t have the constitutional power to do what we are talking about on non-US citizens? It is clear that we do have that authority and we are already doing that.
Gilmore: If they did this with immigration, and they required immigrants to register with a database the PR might work better.
Shine: You think you know all the undocumented aliens in California or Texas?
Maniscalco: I wanted to make the point about the end user. I have concerns that we are spending vast amounts of money on a system that is so state of the art and how is that funding going to maintain surveying a sector that is constantly changing? Technology doubles every 8 months or something and how is this system going to keep with that, who is going to fund it?
Vickery: I don’t want to get stuck on one presentation. These are questions that shouldn’t be answered by one person. Obviously to everyone around this table there is a lot of concern.
Jones: The change in technology, this is just one factor, they will be looking at wire taps and other things. The red team will change as terrorist activity changes. The issue on rights is an important one. When you sign your credit card you are waiving your right to your identity. There is a move under food to create legislation to share that information and I think it will run headlong into those kinds of movements. This is a fluid situation but we want to look at it. I believe that we need this tool in the fight against terrorism.
Jenaway: I heard no cost benefit to anything that was discussed here. I don’t think they have established parameters to anything they have designed. I am okay with this. My concern is the end user issue. They have not talked to one person who actually has to respond to a situation. I think he has something good here but he didn’t mention WMD or the ability to respond yesterday. He seemed to miss his target audience completely.
Marsh: I am of a view that ultimately we will find the answers in history. We have raised the ancient issues of security and liberty. This was discussed by Locke. In order for society to have security, you will have to give some liberty up. And the nature of the loss of liberty will be dependent on the nature of the security needs.
Gilmore: Let us come back to this at a later time. Lets turn back to the fifth report outline. Yesterday we had the technical presentation on the bio-terrorism issue. The draft outline is founded on the conference call right Mike?
Fifth Report Discussion
Wermuth: It was started prior to the conference call but it was altered based on the comments during the conference call.
Brower: I think the panel wants to focus on specific issues but overall we want a lasting idea of what homeland security should look like in 5 or 10 years. This takes into account the return to normalcy. And so one of the projects that we could do is to come up with a set of three or four alternative futures of how homeland security could look in 5 or 10 years. RAND has some information about information warfare and we could use it to help us think about future homeland security. Another thing is the burden sharing. Do you want to leave a legacy about how to fund all these efforts, at all levels? I thought we could look (through the survey and through case studies) at needs assessments. Dallas told me California already has a needs assessment and other states have done the same. Maybe we could look at some other cases. We are going to look at the Patriot Act and the research agenda for homeland security. Should we put together priorities of research?
Gilmore: Its my opinion that most of the research agenda is in the private sector.
Wermuth: The private sector usually does near-term research, I think we are talking about longer term R&D needs and capturing those pieces that would lead to national standards. I think that is what we are talking about here.
Hathaway: We need to start with the basics…what is the threat? What will it be in 5 year? 10 years? We have yet to hear anyone tell us what these threats are. And then we need to determine where we need to go as a panel in response to those threats.
Brower: The one area that we haven’t done a lot of research on is the threat to critical infrastructure to both the physical and cyber arenas and I feel that that would be very valuable for the panel to look at with RAND’s help. Unless we see a significant change in the domestic threat, then I don’t think we need to do a whole other threat chapter.
Jenaway: We should reinforce the all-hazards issue. We have a developing problem of the long-term respiratory effects of 9-11. There has to be thoughts about long-term respiratory issues. We have to build in this all-hazards concept.
Gilmore: The beauty of all-hazards is that it gives a good reason to spend this money. Even without the WMD threat. If the US government concludes that they will put a lot of money behind preparation for threats that most people will think that is a good use of money. I would like to know if everyone is comfortable with this table of contents and whether this looks too much like the 4th report? The new concepts are the recognition that we haven’t answered the question of how we get the funds out to the localities and states and the other question is how do we know what is needed?
Wermuth: This doesn’t have to be in this order. We might start with the new concepts; the steady state, the end game and then get into the other issues later. We just want to get the issues on the table and we will go through our typical editing processes.
Gilmore: I want to make sure that as the panel if you do not like this agenda or want to see something else, you know you have the power to change it.
Brower: This in essence is a laundry list of what we heard on the phone.
Freeman: I have two questions…a return to normalcy, I have heard it and I am concerned. Is that really clearly what we want to say? The other thing is where is this headed? Where is all this money and risk headed? We are buying equipment that we threw away fifteen years ago. Is this a perpetual circle? This goes back to what the message is; what is preparedness? What is normalcy? Not down to how many bullets should be in a weapon but the basic things. As the money has grown in budget, so has the interest of the government. If there is not some way to project this, what is the end? Is the normalcy now frenzy?
Quinlisk: When I think of normalcy, I think of the public. One of the things that we are starting to talk about is not how do we prepare for terrorism but how do we prepare for terror? We have terror in the public and how do you deal with this? I think having something in our report about this in the terms of an all-hazards approach would be beneficial. I know people who even think that SARS is manmade just because 9-11 has made them so terrified.
Vickery: We stated that we wanted a ‘new normalcy’ not ‘normalcy’ It’s a return to a new normal.
Jones: I want to put a new issue on the table and that is the need for a national warning and alert system. The more you get into it the more you realize that you have a very poor system of alerting.
Ted Maklin and Corey Gruber- Topoff 2 Discussion
Wermuth: These guys are no longer officials of the Department of Justice (DoJ) they are now officials of the ODP to the DHS. Now embedded in the border and transportation security under-secretariat.
Maklin: 60 days ago we went from the DoJ to the DHS. We have been working hard with the DHS and the new Homeland Security Council to ensure that they are as embedded as much as they can be within the Topoff 2 (T2) exercise. It is an exercise, a practice, a rehearsal. We have draft plans already. It is important to be reminded of the innovative aspect of this exercise; Canada is participating, that is new. All 56 territories can participate. The national capitol region is participating. We have embedded a red team in this exercise, this is new. All the policies and procedures are different because of the move from DoJ to DHS. NORTHCOM will be playing, at a low level. Those are some of the ideas of the new and innovative challenges for T2. We started planning T2 on June 11, 2001. Since then we have had some major events, the terrorist attacks on 9-11, the anthrax attacks, the creation of a homeland security department…etc. Insert Gruber/Maklin Power Point Presentation
Brower: Can you explain what it means to be an observer?
Gruber: When we are talking about distinguished visitors, they are just there to watch, to observe certain activities. Participants are different, they are the ones doing the exercise.
Jones: Are the federal resources used on the scene?
Gruber: We have lain out in the scenario that realistic funds will be used. Some things have been done in advance because I have to take into consideration safely. There are predisposed resources for the exercise.
Shine: As far as the biological events are concerned, who is the incident commander?
Gruber: The DHS will deploy to the two venues who they consider the two principal federal officials who will assist the unified command group and will represent the secretary.
Shine: I am trying to understand who is in charge.
Gruber: I think the appropriate question is who is in charge of what? We know unified command is a decision making process where we respect everyone’s jurisdiction.
Shine: If there is a difference of opinion between your person in the Humphreys building and the guy in Chicago, how do you resolve that in 15 minutes?
Gruber: The homeland security coordination group is in charge of that.
Gilmore: Are you going to do a postmortem hot wash?
Gruber: Yes, there will be a sequence of those.
Gilmore: Can we be involved in those hot washes? Can I come to the Monday morning meeting?
Quinlisk: Last week in Iowa we did all of this and basically the way it ran was that CDC took 12 hours to get their base initially. And then once CDC arrived, they still weren’t in an advisory role but it was still going up to the leadership panel and the governor. CDC was taking that advice and I thought that worked very well.
Gruber: The beauty of this is that we don’t script what happens. We don’t script how the participants react.
Foresman: It would be valuable to get us into the hot washes.
Reno: You mentioned that NORTHCOM will be involved, will there be any play of activating active guard or reserve?
Gruber: The states will determine that. NORTHCOM would not be the most active place to be for the exercise.
Classified Discussion- TTIC, John Brennan
Fifth Report Discussion
Gilmore: We can continue our discussion of what our issues are.
Shine: I agree entirely with the concern to a return to normalcy. I would like to see a different title, maybe call it ‘sustained vigilance’. Something is needed that shows that it is long term. I would like to see the first part of the report organized so that it hits the big issues and the later part of the report follow from the big issues. The first portion I would like to see is what is sustainable vigilance and how does that work? The second part I would like to see is an extension of what we said about risk in the first few years. We made some proposals earlier about the nature of the risks. Then I would go on and have a section on how we know if we are ready to meet those risks. Then what are the principal requirements what we do we need to meet in order to be ready? Finally what are the principal gaps? All I am arguing is that I would like to see the first part of the report around the conceptual areas. The one area where I would like to see us do more work is to ask a number of people on the committee who are at the state and local level to create a series of bullets from their perspective on what works or doesn’t work. This will include problems of flows of money, lack of resources etc… I think the rest of us could validate that against the survey and then come up with some principals from that. And finally, I think that I would support the idea of looking at the research agenda in terms of the public and private sectors. Some areas are fine but there are issues that we are not doing enough in like the communications and public health sectors for example.
Gilmore: Yesterday we heard about the impact of psychology on people during an event. I concur with what you are thinking about this issue. I think we all agree with the risk piece. I think we need to define preparedness and readiness, we all agree on that. I am going to point out that the idea of a return to normalcy is one of the most thought provoking ideas we can draft. I am concerned that as a result of 9-11 and then this war, that we are creating a mindset where we are taking panic and institutionalizing that into government policies. My view is that 9-11 changed things. There will be more of a concern of security and I think that’s right but whether or not the Patriot Act has to continue or whether or not we have to pull little old ladies out of lines to frisk them etc…is that necessary and have the terrorists won if we do this? I think we are on the cusp of fundamentally changing this nation and that is strange. These are the things that concern me. It may be that I am just wrong about this and all of the stuff that we have seen over the past years is normal.
Shine: I don’t disagree for a minute on anything that you just said. But if it is going to be sustainable then it has to meet certain requirements to fit with the society that we live in. Whatever system we create here has to be consistent with our values as a nation.
Gilmore: This is a complicated concept that we are arguing here. I think that we have a possibility of fundamentally changing what it is that makes us Americans and if we do that, I would like to see someone out there say that, so that this is a conscience decision and not just a reflex decision.
Foresman: Its seems to me the half way in between is that we define the post 9-11 normalcy and make it as close to September 10 as we can, but it will obviously be different. There is a premium right down the middle. Some people are looking for pre 9-11 and some people are looking for a very secure society.
Reno: Ken and I talked during the break and I have a different view. I think this report above all others should be strategic. Jack Marsh said we should go back to history. In all of our reports we have given little attention to the annexes, to the attachments. We took them as ways to skim down the main report so people would read them. I think we should take a strategic approach and make the report the main source document for the government for the next decade and shape the debate with that report. Somebody has got to get strategic to shape the debate, otherwise we will flounder along with the budget issues and everything else and never move anywhere. If we had a document that laid out the vision and then a series of annexes that were rich and comprehensive, it could be pulled out for years in the future. I would not endorse copying the format of the fourth report. We really have a major change from what we have done to what we should do.
Gilmore: I said a while ago that the table of contents looked similar to the fourth report. I think we should take some time and structure this. I absolutely agree.
Freeman: I believe the discussion that led off this session now, your assessment of where we might go or might not go- maybe that is the way we start off the fifth report. We can talk about both ends of the spectrum. I think most Americans, aside from when they go to an airport, are at a pre 9-11 normalcy. I don’t see my neighbors wearing gas masks. Maybe we should touch on both ends of the spectrum, what you pointed out frightens all of us as Americans. That also addresses what Ken was suggesting.
Reno: Much of the new normalcy would have occurred without the automation.
Jones: My concern is the Patriot Act, its all too reminiscent of the enternment camps after Pearl Harbor Day. The knee-jerk reaction is always too much. We will never get to normal until the people of America decide that normal outweighs the risks. This can only be done by public outreach programs from trustworthy officials. Right now I think we are still in a knee-jerk type of situation, only this time it was with duct tape. In Israel and Northern Ireland they have to deal with terrorism all the time and they deal with it. But the difference is that they know the parameters of an attack, we don’t know that yet. Until we put a matrix out there to the people we are going to continue to do this knee-jerk dance.
Foresman: Do you think Freeman that your neighbors are just unturned to the changes in government?
Freeman: I think a lot of it is ignorance of what is going on. A lot of the things behind the scenes they don’t know anything about. The average American is reliant on the media, in whatever form. I don’t think the average citizen is even aware of what the government is trying to do in response to the terrorism issue.
Shine: While I think there is an amount of ignorance in some places, the desire of most people that they don’t want to change their attitude might be even stronger than this.
Wermuth: We can articulate the fact that this is a new normalcy. If I were to name the fifth report, I would call it ‘toward a steady state’. It won’t be pre 9-11 but something that is a more deliberate and not a reactionary state. It would include sustainment issues and suggest that it be done in a less reactive fashion and in a more deliberate fashion- so that people can actually conceptualize this. What has been normal in America in the last 100 years? Two world wars, Vietnam and Korea? After we define the steady state, lets move on. As the governor says, we will never defeat these folks, we might get attacked again but lets move on.
Jones: Didn’t we go through this with the Cold War? There was all this policy being created but the average American learned how to deal with it themselves. We lost a couple thousand people in a building collapse, but do we really need to recreate our whole government?
Reno: I understand everything you said but a steady state doesn’t resonate in the markets and in communications. Someone who is smart in marketing should pick a term so that it resonates. How do you go back and reset the institutions? Strategic to me means that I look at where we want to be in terms of making an organizational model. You put it in the annexes.
Shine: I don’t think there is a disagreement about that.
Classified Discussion- Robert Mueller, FBI Discussion
Closing Remarks
Gilmore: Any last roundups?
Brower: We need to approve the minutes from both the November meetings and the conference call in March. (passed).
Wermuth: Remember that the next meeting will be June 16-17 here at RAND. We want to continue to receive input on the outline and survey. If you have other basic things you want to put into the report, please let us know so we can begin doing the background research.
Adjournment
Back to Top