Homeland Security
DHS Risk-Based Grant Methodology Is Reasonable, But Current Version's Measure of Vulnerability is Limited Gao ID: GAO-08-852 June 27, 2008Since 2002, the Department of Homeland Security (DHS) has distributed almost $20 billion in funding to enhance the nation's capabilities to respond to acts of terrorism or other catastrophic events. In fiscal year 2007, DHS provided approximately $1.7 billion to states and urban areas through its Homeland Security Grant Program (HSGP) to prevent, protect against, respond to, and recover from acts of terrorism or other catastrophic events. As part of the Omnibus Appropriations Act of 2007, GAO was mandated to review the methodology used by DHS to allocate HSGP grants. This report addresses (1) the changes DHS has made to its risk-based methodology used to allocate grant funding from fiscal year 2007 to fiscal year 2008 and (2) whether the fiscal year 2008 methodology is reasonable. To answer these questions, GAO analyzed DHS documents related to its methodology and grant guidance, interviewed DHS officials about the grant process used in fiscal year 2007 and changes made to the process for fiscal year 2008, and used GAO's risk management framework based on best practices.
For fiscal year 2008 HSGP grants, DHS is primarily following the same methodology it used in fiscal year 2007, but incorporated metropolitan statistical areas (MSAs) within the model used to calculate risk. The methodology consists of a three-step process--a risk analysis of urban areas and states based on measures of threat, vulnerability and consequences, an effectiveness assessment of applicants' investment justifications, and a final allocation decision. The principal change in the risk analysis model for 2008 is in the definition of the geographic boundaries of eligible urban areas. In 2007, the footprint was defined using several criteria, which included a 10-mile buffer zone around the center city. Reflecting the requirements of the Implementing Recommendations of the 9/11 Commission Act of 2007, DHS assessed risk for the Census Bureau's 100 largest MSAs by population in determining its 2008 Urban Areas Security Initiative (UASI) grant allocations. This change altered the geographic footprint of the urban areas assessed, aligning them more closely with the boundaries used by government agencies to collect some of the economic and population data used in the model. This may have resulted in DHS using data in its model that more accurately estimated the population and economy of those areas. The change to the use of MSA data in fiscal year 2008 also resulted in changes in the relative risk rankings of some urban areas. As a result, DHS officials expanded the eligible urban areas in fiscal year 2008 to a total of 60 UASI grantees, in part, to address the effects of this change to MSA data, as well as to ensure that all urban areas receiving fiscal year 2007 funding continued to receive funding in fiscal year 2008, according to DHS officials. Generally, DHS has constructed a reasonable methodology to assess risk and allocate funds within a given fiscal year. The risk analysis model DHS uses as part of its methodology includes empirical risk analysis and policy judgments to select the urban areas eligible for grants (all states are guaranteed a specified minimum percentage of grant funds available) and to allocate State Homeland Security Program (SHSP) and UASI funds. However, our review found that the vulnerability element of the risk analysis model has limitations that reduce its value. Measuring vulnerability is considered a generally-accepted practice in assessing risk; however, DHS's current risk analysis model does not measure vulnerability for each state and urban area. Rather, DHS considered all states and urban areas equally vulnerable to a successful attack and assigned every state and urban area a vulnerability score of 1.0 in the risk analysis model, which does not take into account any geographic differences. Thus, as a practical matter, the final risk scores are determined by the threat and consequences scores.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-08-852, Homeland Security: DHS Risk-Based Grant Methodology Is Reasonable, But Current Version's Measure of Vulnerability is Limited
This is the accessible text file for GAO report number GAO-08-852
entitled 'Homeland Security: DHS Risk-Based Grant Methodology Is
Reasonable, But Current Version's Measure of Vulnerability is Limited'
which was released on June 27, 2008.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
United States Government Accountability Office:
GAO:
Report to Congressional Committees:
June 2008:
Homeland Security:
DHS Risk-Based Grant Methodology Is Reasonable, But Current Version's
Measure of Vulnerability is Limited:
GAO-08-852:
GAO Highlights:
Highlights of GAO-08-852, a report to congressional committees.
Why GAO Did This Study:
Since 2002, the Department of Homeland Security (DHS) has distributed
almost $20 billion in funding to enhance the nation‘s capabilities to
respond to acts of terrorism or other catastrophic events. In fiscal
year 2007, DHS provided approximately $1.7 billion to states and urban
areas through its Homeland Security Grant Program (HSGP) to prevent,
protect against, respond to, and recover from acts of terrorism or
other catastrophic events. As part of the Omnibus Appropriations Act of
2007, GAO was mandated to review the methodology used by DHS to
allocate HSGP grants. This report addresses (1) the changes DHS has
made to its risk-based methodology used to allocate grant funding from
fiscal year 2007 to fiscal year 2008 and (2) whether the fiscal year
2008 methodology is reasonable. To answer these questions, GAO analyzed
DHS documents related to its methodology and grant guidance,
interviewed DHS officials about the grant process used in fiscal year
2007 and changes made to the process for fiscal year 2008, and used
GAO‘s risk management framework based on best practices.
What GAO Found:
For fiscal year 2008 HSGP grants, DHS is primarily following the same
methodology it used in fiscal year 2007, but incorporated metropolitan
statistical areas (MSAs) within the model used to calculate risk. The
methodology consists of a three-step process”a risk analysis of urban
areas and states based on measures of threat, vulnerability and
consequences, an effectiveness assessment of applicants‘ investment
justifications, and a final allocation decision. The principal change
in the risk analysis model for 2008 is in the definition of the
geographic boundaries of eligible urban areas. In 2007, the footprint
was defined using several criteria, which included a 10-mile buffer
zone around the center city. Reflecting the requirements of the
Implementing Recommendations of the 9/11 Commission Act of 2007, DHS
assessed risk for the Census Bureau's 100 largest MSAs by population in
determining its 2008 Urban Areas Security Initiative (UASI) grant
allocations. This change altered the geographic footprint of the urban
areas assessed, aligning them more closely with the boundaries used by
government agencies to collect some of the economic and population data
used in the model. This may have resulted in DHS using data in its
model that more accurately estimated the population and economy of
those areas. The change to the use of MSA data in fiscal year 2008 also
resulted in changes in the relative risk rankings of some urban areas.
As a result, DHS officials expanded the eligible urban areas in fiscal
year 2008 to a total of 60 UASI grantees, in part, to address the
effects of this change to MSA data, as well as to ensure that all urban
areas receiving fiscal year 2007 funding continued to receive funding
in fiscal year 2008, according to DHS officials.
Generally, DHS has constructed a reasonable methodology to assess risk
and allocate funds within a given fiscal year. The risk analysis model
DHS uses as part of its methodology includes empirical risk analysis
and policy judgments to select the urban areas eligible for grants (all
states are guaranteed a specified minimum percentage of grant funds
available) and to allocate State Homeland Security Program (SHSP) and
UASI funds. However, our review found that the vulnerability element of
the risk analysis model has limitations that reduce its value.
Measuring vulnerability is considered a generally-accepted practice in
assessing risk; however, DHS‘s current risk analysis model does not
measure vulnerability for each state and urban area. Rather, DHS
considered all states and urban areas equally vulnerable to a
successful attack and assigned every state and urban area a
vulnerability score of 1.0 in the risk analysis model, which does not
take into account any geographic differences. Thus, as a practical
matter, the final risk scores are determined by the threat and
consequences scores.
What GAO Recommends:
GAO recommends that DHS formulate a methodology to measure variations
in vulnerability across states and urban areas. In comments to our
draft report, DHS components concurred with our recommendation.
To view the full product, including the scope and methodology, click on
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-852]. For more
information, contact William O. Jenkins, Jr., (202) 512-8777,
jenkinswo@gao.gov.
[End of section]
Contents:
Letter:
Results In Brief:
Background:
Shifting to Urban Area Boundaries Defined by MSA was the Primary Change
to DHS's Risk-Based Methodology in 2008:
DHS's Risk-based Methodology is Generally Reasonable, But the
Vulnerability Element of the Risk Analysis Model Has Limitations that
Reduce Its Value:
Conclusions:
Recommendations:
Agency Comments:
Appendix I: Briefing for Congressional Committees, February 11-25,
2008:
Appendix II: Identifying Eligible Urban Areas:
Appendix III: DHS's Model is Robust for Tier 1 UASI Areas:
Appendix IV: Contacts and Staff Acknowledgments:
Table:
Table 1: Urban Areas Eligible for UASI Grants: Fiscal Year 2006
Footprint vs. 2008 by Metropolitan Statistical Areas (New UASI grantees
are in italics):
Figures:
Figure 1: Risk Management Framework:
Figure 2: Evolution of DHS's Risk-based formula:
Figure 3: Overview of the Grant Allocation Methodology for UASI and
SHSP:
Figure 4: DHS's Risk Analysis Model Used in Determining Relative Risk
Scores:
Figure 5: Chicago, IL Urban Area Footprint: Center City + 10 mile
radius vs. MSA.
[End of section]
United States Government Accountability Office:
Washington, DC 20548:
June 27, 2008:
The Honorable Robert C. Byrd:
Chairman:
The Honorable Thad Cochran:
Ranking Minority Member:
Subcommittee on Homeland Security: Committee on Appropriations:
United States Senate:
The Honorable David E. Price:
Chairman:
The Honorable Harold Rodgers:
Ranking Minority Member:
Subcommittee on Homeland Security: Committee on Appropriations:
House of Representatives:
Since 2002, the Department of Homeland Security (DHS) has distributed
almost $20 billion in federal funding through various DHS grant
programs that provide funding to public jurisdictions and private
owners/operators for planning, equipment, and training to enhance the
nation's capabilities to respond to terrorist attacks and, to a lesser
extent, natural and accidental disasters. In fiscal year 2007, DHS
provided approximately $1.7 billion to states and urban areas through
its Homeland Security Grant Program (HSGP) to prevent, protect against,
respond to, and recover from acts of terrorism or other catastrophic
events and plans to distribute approximately $1.6 billion under this
program in fiscal year 2008.
The majority of funding from the Homeland Security Grant Program is
provided through two of its five component programs: the State Homeland
Security Program (SHSP) and the Urban Areas Security Initiative (UASI).
SHSP supports building and sustaining capabilities at the state and
local levels through planning, equipment, training, and exercise
activities and helps states to implement the strategic goals and
objectives included in state homeland security strategies. SHSP
provides funding to all 56 states and territories based on a
combination of assessing relative risk, and determining the
effectiveness of states' proposed investments. UASI addresses the
unique multi-disciplinary planning, operations, equipment, training,
and exercise needs of high-threat, high-density urban areas. The
program provides funding to high-risk urban areas based on
determinations of risk and assessments of the effectiveness of the
plans for using the funds. DHS used this same risk-based methodology to
allocate $852 million in fiscal year 2008 under the Infrastructure
Protection Program, according to DHS.:
The distribution of HSGP funds, including UASI funding, has raised
congressional interest about DHS's methods in making such
determinations. For the third consecutive year, GAO has been mandated
as part of DHS's annual appropriation to review and assess the HSGP's
risk analysis model and risk-based allocation methodology for
determining risk and distributing funds. We responded to the mandate in
February 2008 by briefing the staffs of congressional committees on the
results of this review (see Appendix I). This report and the
accompanying appendices supplements and transmits the information
provided during those briefings.
In response to a mandate in the Consolidated Appropriations Act, 2008,
GAO reviewed the methodology used by DHS to allocate HSGP grants. This
report addresses the following questions:
1. How has the risk-based methodology DHS uses to allocate grant
funding changed from fiscal year 2007 to fiscal year 2008?
2. How reasonable is the fiscal year 2008 methodology?
To answer these questions, we analyzed DHS documents, including the
risk analysis models for fiscal years 2007 and 2008, grant guidance,
and presentations. To provide a basis for examining efforts at carrying
out risk management, we applied a framework for risk management that
GAO developed based on best practices and other criteria. We used our
risk management framework to examine DHS's risk-based methodology--
which includes its risk analysis model. Our analysis includes the
extent to which:
* Information used in DHS's methodology--such as specific measures and
weights--was sufficient and reliable;
* Attributes of DHS's methodology that potentially include both
government and non-government items were identified by a reasoned
process;
* DHS could justify the aggregation or calculations of these
attributes;
* DHS documented its processes and applied written criteria when using
methods to obtain scores or weights (i.e. peer review), or when ranges
or categories (i.e. tiers) are used;
* Relative risk rankings are sensitive to incremental changes in
assumptions or alternative perceptions related to grantee eligibility
or funding levels; and:
* DHS has procedures in place to update their methodology if new
information becomes available.
Finally, we interviewed DHS officials about the HSGP grant
determination process used in fiscal year 2007 and about changes made
to the process for fiscal year 2008. We performed this performance
audit from September 2007 through April 2008, in accordance with
generally accepted government auditing standards. Those standards
require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objectives. We believe that the evidence
obtained provides a reasonable basis for our findings and conclusions
based on our audit objectives.
Results In Brief:
For fiscal year 2008 HSGP grants, DHS is primarily following the same
methodology it used in fiscal year 2007, but incorporated metropolitan
statistical areas (MSAs) within the risk analysis model used to
calculate risk. The methodology consists of a three-step process--risk
analysis, effectiveness assessment, and final allocation decisions. The
principal change in the model for 2008 is in the definition of the
geographic boundaries, or footprint, of the UASI areas. In 2007, the
footprint was defined using several criteria, which included a 10-mile
buffer zone around the center city. Reflecting the requirements of the
Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11
Act), DHS assessed risk for the Census Bureau's 100 largest MSAs by
population in determining its 2008 UASI grant allocations. This change
altered the geographic footprint of the urban areas assessed, aligning
them more closely with the boundaries used by government agencies to
collect some of the economic and population data used in the model,
which may have resulted in DHS using data in its model that more
accurately estimated the population and economy of those areas. As a
result, DHS officials expanded the eligible urban areas in fiscal year
2008 to a total of 60 UASI grantees, in part, to address the effects of
this change to MSA data, as well as to ensure that all urban areas
receiving funding in fiscal year 2007 received funding in fiscal year
2008, according to DHS officials.
Generally, DHS has constructed a reasonable methodology to assess risk
and allocate funds within a given fiscal year. The risk analysis model
DHS uses as part of its methodology includes empirical risk analysis
and policy judgments to select the urban areas eligible for grants (all
states are guaranteed a specified minimum percentage of the grant funds
available) and to allocate SHSP and UASI funds. However, our review
found that the vulnerability element of the risk analysis model has
limitations that reduce its value. Measuring vulnerability is
considered a generally-accepted practice in assessing risk; however,
DHS did not measure vulnerability for each state and urban area.
Rather, DHS considered all states and urban areas equally vulnerable to
a successful attack and assigned every state and urban area a
vulnerability score of 1.0 in the risk model. Thus, as a practical
matter, the final risk scores are determined by the threat and
consequences scores. By not measuring variations in vulnerability, DHS
ignores differences across states and urban areas.
To strengthen DHS's methodology for determining risk, we are
recommending that the Secretary of DHS formulate a method to measure
variations in vulnerability across states and urban areas, and apply
this measure in future iterations of the risk analysis model. In email
comments on the draft report, FEMA and I&A concurred with our
recommendation that they formulate a method to measure vulnerability in
a way that captures variations across states and urban areas and apply
this vulnerability measure in future iterations of the risk-based grant
allocation model. FEMA, NPPD and I&A also provided technical comments,
which we incorporated as appropriate.
Background:
Risk management has been endorsed by Congress, the President, and the
Secretary of DHS as a way to direct finite resources to those areas
that are most at risk of terrorist attack under conditions of
uncertainty. The purpose of risk management is not to eliminate all
risks, as that is an impossible task. Rather, given limited resources,
risk management is a structured means of making informed trade-offs and
choices about how to use available resources effectively and monitoring
the effect of those choices. Thus, risk management is a continuous
process that includes the assessment of threats, vulnerabilities, and
consequences to determine what actions should be taken to reduce or
eliminate one or more of these elements of risk.
To provide a basis for examining efforts at carrying out risk
management, GAO developed a framework for risk management based on best
practices and other criteria. The framework is divided into five
phases: (1) setting strategic goals and objectives, and determining
constraints; (2) assessing the risks; (3) evaluating alternatives for
addressing these risks; (4) selecting the appropriate alternatives; and
(5) implementing the alternatives and monitoring the progress made and
the results achieved (see Fig.1).
Figure 1: Risk Management Framework:
[See PDF for image]
This figure is an illustration of the Risk Management Framework,
depicting the following information:
* Strategic Goals, Objectives, and Constraints;
* Risk Assessment;
* Alternatives Evaluation;
* Management Selection;
* Implementation and Monitoring.
Source: GAO.
[End of figure]
Because we have imperfect information for assessing risks, there is a
degree of uncertainty in the information used for risk assessments
(e.g., what the threats are and how likely they are to be realized). As
a result, it is inevitable that assumptions and policy judgments must
be used in risk analysis and management. It is important that key
decision-makers understand the basis for those assumptions and policy
judgments and their effect on the results of the risk analysis and the
resource decisions based on that analysis.
DHS has used an evolving risk-based methodology to identify the urban
areas eligible for HSGP grants and the amount of funds states and urban
areas receive (see Fig 2). For example, the risk analysis model used
from fiscal year 2001 through 2003 largely relied on measures of
population to determine the relative risk of potential grant
recipients, and evolved to measuring risk as the sum of threat,
critical infrastructure and population density calculations in fiscal
years 2004 and 2005.
Figure 2: Evolution of DHS's Risk-based formula:
[See PDF for image]
This figure is a timeline showing the evolution of DHS's risk-based
formula, as follows:
2001: Department of Justice-run grant program.
9/11/01 occurs.
FY 2001-2003:
Stage I: R = P;
10/26/01: USA Patriot Act;
11/25/02: Homeland Security Act.
FY 2004-2005:
Stage II: R = T+Cl+PD.
FY 2006:
Stage III: R = T*V*C.
FY 2007-2008:
Stage IV: R = T*"(V&C)".
08/03/07: 9/11 Act.
Source: GAO analysis based on Congressional Research Service.
Notes:
Definitions for the formulas above:
* R = P represents Risk = Population;
* R = T+CI+PD represents Risk = Threat plus Critical Infrastructure
plus Population Density;
* R = T*V*C represents Risk = Threat times Vulnerability times
Consequences; and:
* R = T* "(V&C)" represents DHS's presentation of the risk calculation
formula used in their risk analysis model for 2007 and 2008: Risk =
Threat times the combination of Vulnerability and Consequences.
However, in the 2007 and 2008 risk analysis models, the combination of
vulnerability and consequence is still calculated as the product of V
times C, or R = T*V*C.
Federal legislation affecting DHS's risk-based methodology:
* United and Strengthening America by Providing Appropriate Tools
Required to Intercept and Obstruct Terrorism Act (USA PATRIOT Act) of
2001: Legislated statutory minimum funding levels for states and
territories to receive under SHSP (0.75 percent of SHSP appropriations
for states, the District of Columbia and Puerto Rico; 0.25 percent for
territories).
* Homeland Security Act of 2002: Moved the Department of Justice's
Office for Domestic Preparedness grant programs into DHS.
* 9/11 Act: Legislated (a) minimum funding levels for state and
territories to receive under SHSP (0.375 percent of all funds
appropriated for SHSP and UASI for states, the District of Columbia and
Puerto Rico (0.008 percent for territories) for FY 2008 with the state
percentage decreasing each fiscal year down to 0.35 percent by FY2012,
(b) that DHS is to assess the risk for 100 most populous Metropolitan
Statistical Areas (MSAs), and (c) based on that assessment, designate
high-risk urban areas that may apply for UASI grants.
[End of figure]
The fiscal year 2006 process introduced assessments of threat,
vulnerability and consequences of a terrorist attack in assessing risk.
In addition to modifications to its risk analysis model, DHS adopted an
effectiveness assessment for fiscal year 2006 to determine the
anticipated effectiveness of the various risk mitigation investments
proposed by urban areas, which affected the final amount of funds
awarded to eligible areas. For the fiscal year 2007 allocation process,
DHS defined Risk as the product of Threat times Vulnerability and
Consequences, or "R= T* (V & C)" and applied a three-step risk-based
allocation methodology which incorporates analyses of risk and
effectiveness to select eligible urban areas and allocate UASI and SHSP
funds (see Fig. 3). The three steps include:
1. Implementation of a Risk Analysis model to calculate scores for
states and urban areas, defining relative Risk as the product of
Threat, Vulnerability and Consequences;
2. Implementation of an Effectiveness Assessment, including a process
where state and urban area representatives acting as peer reviewers
assess and score the effectiveness of the proposed investments
submitted by the eligible applicants. This process is also known as
peer review.
3. Calculation of a Final Allocation of funds based on states' and
urban areas' risk scores as adjusted by their effectiveness scores.
The Post-Katrina Emergency Management Reform Act places responsibility
for allocating and managing DHS grants with the Federal Emergency
Management Agency (FEMA) [Footnote 12]. While FEMA is responsible for
implementing the above 3-step process, FEMA relies on other DHS
components such as the National Protection and Programs Directorate
(NPPD) and the Office of Intelligence and Analysis (I&A) in the
development of the risk analysis model, which we will discuss in
greater detail below.
Figure 3: Overview of the Grant Allocation Methodology for UASI and
SHSP:
This figure is an illustration of the Grant Allocation Methodology for
UASI and SHSP, as follows:
UASI:
Funding allocation:
Tier 1: 55%;
Tier 2: 45%.
Relative risk: Number of urban areas.
Risk estimator: R = T x "(V & C)";
Yields relative risk estimate.
Phase I: Risk analysis: produces Risk score;
Phase II: Effectiveness assessment:
Peer review of Investment Justifications;
Yields effectiveness score.
Phase 3: Final allocation:
Utilizes Effectiveness/risk matrix.
SHSP:
Risk estimator: R = T x "(V & C)";
Yields relative risk estimate.
Relative risk: Number of states and territories.
Phase I: Risk analysis: produces Risk score;
Phase II: Effectiveness assessment:
Peer review of Investment Justifications;
Yields effectiveness score.
Phase 3: Final allocation:
Utilizes Effectiveness/risk matrix.
Statutory minimum = .375%[A]
Source: GAO analysis of DHS documents and information provided in
interviews.
[A] The statutory minimum of 0.375 percent of the total funds
appropriated for SHSP and UASI for fiscal year 2008. In fiscal years
2006 and 2007, the statutory per state minimum equaled 0.75 percent
of funds appropriated for SHSP.
[End of figure]
Risk Analysis Model:
DHS employs a risk analysis model to assign relative risk scores to all
states and urban areas under the SHSP and UASI grant programs. These
relative risk scores are also used to differentiate which urban areas
are eligible for UASI funding. These eligible areas are divided into
two tiers: Tier 1 UASI grantees and those eligible for Tier 2.
[Footnote 13] In fiscal year 2007, 45 candidates were eligible to apply
for funding under the UASI program, and eligible candidates were
grouped into two tiers according to relative risk. Tier 1 included the
six highest risk areas; Tier 2 included the other 39 candidate areas.
Figure 4 provides an overview of the factors that are included in the
risk analysis model for fiscal year 2007 and their relative weights.
The maximum relative risk score possible for a given area was 100. The
Threat Index accounted for 20 percent of the total risk score; the
Vulnerability and Consequences Index accounted for 80 percent.
Figure 4: DHS‘s Risk Analysis Model Used in Determining Relative Risk
Scores:
[See PDF for image]
This figure is an illustration of DHS‘s Risk Analysis Model Used in
Determining Relative Risk Scores, as follows:
Risk = Threat Index:
* Data: Credible plots, planning and threats from international
terrorist networks, their affiliates and those inspired by them.
* Source: Intelligence Community reporting.
Times:
Vulnerability and Consequence Index; V&C = (P+E+I+N);
Population Index:
* Data: Total population (nighttime, commuter, visitor, military
dependent) and population density (constrained to 50 percent impact);
* Source: Census, LandScan, Smith Travel, and DOD.
Economic Index:
* Data: Gross Metropolitan Product (UASI)/percent GDP (state analysis);
* Source: Global Insight/Department of Commerce, Bureau of Economic
Statistics.
National Infrastructure Index:
* Data: # Tier I Assets (x3) +# Tier II Assets;
* Source: DHS/OIP, SSAs, states and territories.
National Security Index:
* Data: Presence of Military Bases (yes/no) + # DIB + # international
border crossings;
* Source: DOD, DHS/CBP.
Source: DHS.
Note: ’DHS/OIP“ stands for DHS‘s Office of Infrastructure Protection.
’SSAs“ stands for Sector-Specific Agencies, which are Federal
departments and agencies identified in the National Infrastructure
Protection Plan as responsible for critical infrastructure protection
activities. ’DHS/CBP“ stands for the DHS‘s Customs and Border
Protection. ’DIB“ stands for ’defense industrial base,“ which includes
a count of Department of Defense, government, and private sector
industrial complex with capabilities to perform research and
development, design, produce, and maintain military weapon systems,
subsystems, components and parts to meet military requirements. ’GDP“
stands for Gross Domestic Product.
[End of figure]
The Threat Index accounted for 20 percent of the total risk score,
which was calculated by assessing threat information for multiple years
(generally, from September 11, 2001 forward) for all candidate urban
areas and categorizing urban areas into different threat tiers.
According to DHS officials, the agency‘s Office of Intelligence and
Analysis (I&A) calculated the Threat Index by (1) collecting
qualitative threat information with a nexus to international terrorism,
[Footnote 14] (2) analyzing the threat information to create threat
assessments for states and urban areas, (3) empaneling intelligence
experts to review the threat assessments and reach consensus as to the
number of threat tiers, and (4) assigning threat scores. This process,
according to DHS officials, relied upon analytical judgment and
interaction with the Intelligence Community, as opposed to the use of
total counts of threats and suspicious incidents to calculate the
Threat Index for the 2006 grant cycle. The final threat assessments are
approved by the Intelligence Community”the Federal Bureau of
Investigation, Central Intelligence Agency, National Counterterrorism
Center, and the Defense Intelligence Agency”along with the DHS Under
Secretary for Intelligence and Analysis and the Secretary of DHS,
according to DHS officials.
The Vulnerability and Consequences index accounts for 80 percent of the
total risk score. Because DHS considered most areas of the country
equally vulnerable to a terrorist attack given freedom of movement
within the nation, DHS assigns vulnerability a constant value of 1.0 in
the formula across all states and urban areas. Therefore, DHS‘s
measurement of vulnerability and consequences is mainly a function of
the seriousness of the consequences of a successful terrorist attack,
represented by four indices: a Population Index, an Economic Index, a
National Infrastructure Index, and a National Security Index.
Population Index (40 percent). This index included nighttime population
and military dependent populations for states and urban areas, based
upon U.S. Census Bureau and Department of Defense data. For urban
areas, factors such as population density, estimated number of daily
commuters, and estimated annual visitors were also included in this
variable using data from private entities. DHS calculated the
Population Index for urban areas by identifying areas with a population
greater than 100,000 persons and cities that reported threat data
during the past year, then combined cities or adjacent urban counties
with shared boundaries to form single jurisdictions, and drew a 10-mile
buffer zone around identified areas.
Economic Index (20 percent). This index is comprised of the economic
value of the goods and services produced in either a state or an urban
area. For states, this index was calculated using U.S. Department of
Commerce data on their percentage contribution to Gross Domestic
Product. For UASI urban areas, a parallel calculation of Gross
Metropolitan Product was incorporated. [Footnote 15]
National Infrastructure Index (15 percent). This index focused on over
2,000 critical infrastructure/key resource (CIKR) assets that were
identified by DHS‘s Office of Infrastructure Protection. These
particular critical infrastructure assets are divided into two rankings
that, if destroyed or disrupted, could cause significant casualties,
major economic losses, or widespread/long term disruptions to national
well-being and governance capacity. The Tier 2 CIKR assets include the
nationally-significant and high-consequence assets and systems across
17 sectors. [Footnote 16] Tier 1 assets are a small subset of the Tier
2 list that include assets and systems certain to produce at least two
of four possible consequences if disrupted or destroyed: (1) prompt
fatalities greater that 5,000; (2) first-year economic impact of at
least $75 billion; (3) mass evacuations with prolonged (6 months or
more) absence; and (4) loss of governance or mission execution
disrupting multiple regions or critical infrastructure sectors for more
than a week, resulting in a loss of necessary services to the public.
Tier 1 assets were weighted using an average value three times as great
as Tier 2 assets.
The National Security Index (5 percent). This index considered three
key national security factors: whether military bases are present in
the state or urban area; how many critical defense industrial base
facilities are located in the state or urban area; and the total number
of people traversing international borders. Information on these inputs
comes from the Department of Defense and DHS.
Effectiveness Assessment:
In addition to determining relative risk using the risk analysis model,
DHS added an effectiveness assessment process in fiscal year 2006 to
assess and score the effectiveness of the proposed investments
submitted by grant applicants. To assess the anticipated effectiveness
of the various risk mitigation investments that states and urban areas
proposed, DHS required states and urban areas to submit investment
justifications as part of their grant applications. The investment
justifications included up to 15 ’investments“ or proposed solutions to
address homeland security needs, which were identified by the states
and urban areas through their strategic planning process. DHS used
state and urban area representatives as peer reviewers to assess these
investment justifications. The criteria reviewers used to score the
investment justifications included the following categories: relevance
to national, state and local plans and policies such as the National
Preparedness Guidance states‘ and urban areas‘ homeland security plans,
anticipated impact, sustainability, regionalism, and the applicants‘
planned implementation of each proposed investment. Reviewers on each
panel assigned scores for these investment justifications, which,
according to DHS officials, were averaged to determine a final
effectiveness score for each state and urban area applicant.
In fiscal year 2007, DHS provided states and urban areas the
opportunity to propose investment justifications that included regional
collaboration to support the achievement of outcomes that could not be
accomplished if a state or urban area tried to address them
independently. States and urban areas could choose to submit multi-
state or multi-urban area investment justifications which outlined
shared investments between two or more states or between two or more
urban areas. Such investments were eligible for up to 5 additional
points on their final effectiveness score, or up to 8 more
effectiveness points for additional proposed investments, although
these additional points would not enable a state‘s or urban area‘s
total effectiveness score to exceed 100 points. These proposed
investments were reviewed by one of two panels established specifically
to consider multi-applicant proposals. Points were awarded based on the
degree to which multi-applicant investments showed collaboration with
partners and demonstrated value or outcomes from the joint proposal
that could not be realized by a single state or urban area.
Final Allocation Process:
DHS allocated funds based on the risk scores of states and urban areas,
as adjusted by their effectiveness scores. DHS officials explained that
while allocations are based first upon area risk scores, the
effectiveness scores are then used to determine adjustments to states
and urban areas allocations based on an ’effectiveness multiplier.“
States and urban areas with high effectiveness scores received an
additional percentage of their risk-based allocations, while states and
urban areas with low effectiveness scores had their risk-based
allocations lowered by a percentage. [Footnote 17]
In addition to determining funding by risk score as adjusted by an
effectiveness multiplier, urban areas that received funds through the
UASI grant program were subject to an additional tiering process that
affected funding allocation. For example, in fiscal year 2007, the 45
eligible urban area candidates were grouped into two tiers according to
relative risk. The Tier 2 UASI grantees included the 6 highest-risk
areas; Tier 2 UASI grantees included another 39 candidate areas ranked
by risk. The 6 Tier 1 UASI grantees were allocated fifty-five percent
of the available funds, or approximately $410.8 million, while the 39
Tier 2 UASI grantees received the remaining forty-five percent of
available funds, or approximately $336.1 million.
Shifting to Urban Area Boundaries Defined by MSA was the Primary Change
to DHS‘s Risk-Based Methodology in 2008:
DHS‘s risk-based methodology had few changes from fiscal year 2007 to
2008. DHS changed the definition it used to identify the UASI areas
included in the risk analysis model in 2008 from an urban area‘s center
city plus a ten-mile radius to metropolitan statistical areas (MSAs) as
defined by the Census Bureau. [Footnote 18] DHS made this change in
response to the 9/11Act requirement to perform a risk assessment for
the 100 largest MSAs by population. [Footnote 19] Because the change in
definition generally expanded the geographic area of each potential
UASI grant recipient, the change had an effect on the data used to
assess threat and consequences, and it may also have resulted in the
use of more accurate data in the risk analysis model. The change to the
use of MSA data in fiscal year 2008 also resulted in changes in the
relative risk rankings of some urban areas. As a result, DHS officials
expanded the eligible urban areas in fiscal year 2008 to a total of 60
UASI grantees, in part, to address the effects of this change to MSA
data, as well as to ensure that all urban areas that received fiscal
year 2007 funding also received funding for fiscal year 2008, according
to DHS officials.
Changing the boundaries had an effect on the data by which risk is
calculated because the change in boundaries resulted in changes in the
population and critical assets within the new boundaries. Figure 3
below uses the Chicago, IL urban area to illustrate this change. One
benefit of the change to MSAs was that the UASI boundaries align more
closely with the boundaries used to collect some of the economic and
population data used in the model. Consequently, the fiscal year 2008
model may have resulted in more accurate data. Because the 2007
boundaries were based on distance, areas inside the boundaries may have
included partial census tracts or partial counties, each of which would
have required DHS to develop rules as to how to handle the partial
areas. By contrast, the MSAs are based on counties and allow DHS to use
standard census data instead of developing an estimated population
within the defined boundaries. Additional information describing the
boundaries of UASI urban areas for fiscal year 2007 versus fiscal year
2008 is presented in Appendix II.
Figure 5: Chicago, IL Urban Area Footprint: Center City + 10 mile
radius vs. MSA:
[See PDF for image]
This figure is a map of the Chicago, IL Urban Area Footprint, with the
following areas highlighted:
* City of Chicago;
* Chicago-Naperville-Joliet, IN-IN-WI Metropolitan statistical area;
* 10-mile radius.
Source: GAO analysis.
[End of figure]
DHS calculated the Population Index of MSAs by: (1) using census data
to determine the population and population density of each census
tract; (2) calculating a Population Index for each individual census
tract by multiplying the census tract‘s population and population
density figures; and (3) adding together the population indices of all
of the census tracts making up the MSA. DHS did not use average
population density because using an average resulted in losing
information about how the population is actually distributed among the
tracts. Using averages for population density over census tracts with
dissimilar densities could have yielded very misleading results,
according to DHS officials.
The change to MSAs for fiscal year 2008 resulted in an increase of
almost 162,000 square miles across the total area of urban area
footprints. While 3 urban areas actually lost square mileage because of
the change, the other areas all increased their square mileage
footprint by almost 2,700 square miles on average. The increased size
of urban areas‘ footprints increased the number of critical
infrastructure assets that were counted within them. We analyzed the
number of Tier 1 and Tier 2 critical infrastructure assets associated
with UASI areas between fiscal year 2007 and 2008, and found a higher
number of total Tier 1 and Tier 2 critical infrastructure assets
assigned to urban areas in 2008, and–individually”almost all urban
areas increased the number of assets assigned to them.
This change to the use of MSAs also resulted in changes in urban areas
rankings, including the increase of the relative risk scores for such
urban areas as Albany, Syracuse and Rochester, NY, and Bridgeport, CT.
As a result, DHS officials expanded the eligible urban areas in fiscal
year 2008 to a total of 60 with the top seven highest risk areas
comprising UASI Tier 1 grantees, and the 53 other risk-ranked UASI Tier
2 grantees. As in fiscal year 2007, the top seven UASI Tier 1 grantee
areas will receive fifty-five percent of the available funds, or
approximately $429.9 million, and the remaining 53 UASI Tier 2 grantees
will receive forty-five percent of the available funds, or
approximately $351.7 million. According to DHS officials, the decision
to expand the eligible urban areas to a total of sixty was a policy
decision largely driven by two factors: the 9/11 Act requirement that
FEMA use MSAs; and the desire to continue to fund urban areas already
receiving funding.
DHS‘s Risk-based Methodology is Generally Reasonable, But the
Vulnerability Element of the Risk Analysis Model Has Limitations that
Reduce Its Value:
The risk-based methodology DHS uses to allocate HSGP grant dollars is
generally reasonable. It includes and considers the elements of risk
assessment”Threat, Vulnerability, and Consequences”and, as DHS‘s risk-
based methodology has evolved, its results have become less sensitive
to changes in the key assumptions and weights used in the risk analysis
model. [Footnote 20] Furthermore, the indices that DHS uses to
calculate the variable constituting the greatest portion of the risk
analysis model”Consequences”are reasonable. However, limitations such
as the absence of a method for measuring variations in vulnerability
reduce the vulnerability element‘s value. Although DHS recognized and
described the significance of Vulnerability in its FY 2006 model, the
model DHS used for fiscal years 2007 and 2008 used a constant value of
1.0 in its formula, rather than measuring variations in vulnerability
across states and urban areas.
DHS‘s Risk Analysis Model is Reasonable Because it Contains the Key
Elements of Risk Assessment, Relies on Reasonable Indices to Measure
Consequences, and is Less Sensitive to Changes in Variables:
One measure of the reasonability of DHS‘s risk-based methodology is the
extent to which DHS‘s risk analysis model provides a consistent method
to assess risk. Risk assessment helps decision makers identify and
evaluate potential risks facing key assets or missions so that
countermeasures can be designed and implemented to prevent or mitigate
the effects of the risks. [Footnote 21] In a risk management framework,
risk assessment is a function of Threat, Vulnerability, and
Consequences, and the product of these elements is used to develop
scenarios and help inform actions that are best suited to prevent an
attack or mitigate vulnerabilities to a terrorist attack. Threat is the
probability that a specific type of attack will be initiated against a
particular target/class of targets, and analysis of threat-related data
is a critical part of risk assessment. The Vulnerability of an asset is
the probability that a particular attempted attack will succeed against
a particular target or class of targets. It is usually measured against
some set of standards, such as availability/predictability,
accessibility, countermeasures in place, and target hardness (the
material construction characteristics of the asset). The Consequences
of a terrorist attack measures the adverse effects of a successful
attack and may include many forms, such as the loss of human lives,
economic costs, and adverse impact on national security. The risk
analysis model used by DHS is reasonable because it attempts to capture
data on threats, vulnerabilities, and consequences”the three types of
information used in evaluating risk.
Because DHS considered most areas of the country equally vulnerable to
a terrorist attack given freedom of movement within the nation, DHS
assigns vulnerability a constant value of 1.0 in the formula across all
states and urban areas. Therefore, DHS‘s measurement of vulnerability
and consequences is mainly a function of the seriousness of the
consequences of a successful terrorist attack. Because the risk
analysis model is consequences-driven, another measure of the model‘s
overall reasonableness is the extent to which the indices used to
calculate the consequences component of the model are reasonable. As
previously described, the consequences component of the model is
comprised of four indices – a Population Index, an Economic Index, a
National Infrastructure Index, and a National Security Index – each
assigned a different weight. These indices are generally reasonable.
Both the population and economic indices are calculated from data
derived from reliable sources that are also publicly available,
providing additional transparency for the model. For example, according
to DHS officials, the fiscal year 2008 analysis used Gross Metropolitan
Product (GMP) estimates prepared by the consulting firm Global Insight
for the United States Conference of Mayors and the Council for the New
American City that were published in January 2007, and reported on the
GMP for 2005. In addition, the National Infrastructure Index focused on
over 2,000 Tier 1and Tier 2 critical infrastructure/key resource assets
identified by DHS‘s Office of Infrastructure Protection (IP). For both
fiscal years 2007 and 2008, DHS used a collaborative, multi-step
process to create the Tier 2 CIKR list. First, IP works with sector-
specific agencies to develop criteria used to determine which assets
should be included in the asset lists. Second, these criteria are
vetted with the private-sector through sector-specific councils, who
review the criteria and provide feedback to IP. Third, IP finalizes the
criteria and provides it to the sector-specific agencies and State and
Territorial Homeland Security Advisors (HSAs). Fourth, IP asks states
to nominate assets within their jurisdiction that match the criteria.
Fifth, assets nominated by states are reviewed by both the sector-
specific agencies and IP to decide which assets should comprise the
final Tier 2 list. For example, to identify the nation‘s critical
energy assets, IP will work with the Department of Energy to determine
which assets and systems in the energy sector would generate the most
serious economic consequences to the Nation should they be destroyed or
disrupted. Further, in the fiscal year 2008 process, IP added a new,
additional step to allow for the resubmission of assets for
reconsideration if they are not initially selected for the Tier 2 list.
In addition, the National Security Index comprises only a small
fraction of the model – 5 percent – and has also evolved to include
more precision, such as counting the number of military personnel
instead of simply the presence or absence of military bases. To
identify the nation‘s critical defense industrial bases, the Department
of Defense analyzes the impact on current warfighting capabilities,
recovery and reconstitution, threat, vulnerability, and consequences of
possible facility disruption and destruction, and other aspects.
DHS‘s approach to calculating threat, which accounts for the remaining
20 percent of the model, also represents a measure of the model‘s
overall reasonableness. DHS uses analytical judgments to categorize
urban areas‘ threat, which ultimately determines the relative threat
for each state and urban area. DHS has used written criteria to guide
these judgments, and DHS provided us with the criteria used in both of
these years for our review. The criteria are focused on threats from
international terrorism derived from data on credible plots, planning,
and threats from international terrorist networks, their affiliates,
and those inspired by such networks. The criteria provided guidance for
categorizing areas based on varying levels of both the credibility and
the volume of threat reporting, as well as the potential targets of
threats. Results of this process are shared with the DHS Undersecretary
for Intelligence and Analysis, the FBI, and the National
Counterterrorism Center, all of whom are afforded the opportunity to
provide feedback on the placements. Additionally, DHS develops written
threat assessments that indicate whether states are ’high,“ ’medium,“
or ’low“ threat states. States can provide threat information that they
have collected to DHS, but in order for that information to affect a
state‘s tier placement and threat level, the information must be
relevant to international terrorism, according to DHS officials. We
reviewed several examples of these assessments from 2007, which
included key findings describing both identified and potential threats
to the state. The classified assessments addressed potential terrorist
threats to critical infrastructure in each of the 56 states and
territories. However, DHS shared assessments only with state officials
who had appropriate security clearances. According to DHS officials,
states without officials with sufficient clearances will receive an
unclassified version of their state‘s assessment for the fiscal year
2009 grant process. DHS is also developing a process by which they can
share the threat assessments with UASI areas, including those UASI
areas whose boundaries cross state lines; however, currently the
assessments are transmitted only to the DHS state representatives and
state officials, and the states and representatives are responsible for
sharing the information with the UASI areas, according to DHS
officials.
Another measure of the overall reasonableness of DHS‘s risk analysis
model is the extent to which the model‘s results change when the
assumptions and values built into the model, such as weights of
variables, change. A model is sensitive when a model produces
materially different results in response to small changes in its
assumptions. Ideally, a model that accurately and comprehensively
assesses risk would not be sensitive, and such a model exhibiting
little sensitivity could be said to be more robust than a model with
more sensitivity to changes in assumptions underlying the model. A
robust calculation or estimation model provides its users greater
confidence in the reliability of its results. For both fiscal years
2007 and 2008, substantial changes had to be made to the weights of any
of the indices used in the risk model to calculate state and urban area
risk scores before there was any movement in or out of the top 7 (or
Tier 1) ranked UASI areas. In other words, the model provides DHS with
a level of assurance that the highest at-risk areas have been
appropriately identified. While Tier 1 UASI areas were similarly robust
in both FY 2007 and FY 2008, the sensitivity of Tier 2 UASI areas to
changes in the weights of indices used to calculate risk scores was
significant in FY 2007, but improved in FY 2008. In FY 2007, very small
changes in the weights for the indices used to quantify risk (for Tier
2 UASI areas at the eligibility cut point) resulted in changes in
eligibility; however, FY 2008 results are more robust, as eligibility
of urban areas is much less sensitive to changes in the index weights
in the FY2008 model than it was in the FY2007 model. Appendix III
provides an in-depth description of the sensitivity of the model to
specific changes in the relative weights of each index for Tier 1 and
Tier 2 UASI areas.
Vulnerability Element of the Risk Analysis Model Has Limitations that
Reduce Its Value:
Although the methodology DHS uses is reasonable, the vulnerability
element of the risk analysis model”as currently calculated by DHS”has
limitations that reduce its value for providing an accurate assessment
of risk. DHS considered most areas of the country equally vulnerable to
a terrorist attack in the risk analysis model used for fiscal years
2007 and 2008 and assigned a constant value to vulnerability, which
ignores geographic differences in the social, built, and natural
environments across states and urban areas. Although DHS recognized and
described the significance of vulnerability in its FY 2006 model, the
model used for fiscal years 2007 and 2008 did not attempt to measure
vulnerability. Instead, DHS considered most areas of the country
equally vulnerable to a terrorist attack due to the freedom of
individuals to move within the nation. As a result, DHS did not measure
vulnerability, but assigned it a constant value of 1.0 across all
states and urban areas.
Last year we reported that DHS measured the vulnerability of an asset
type as part of its FY2006 risk analysis. [Footnote 22] DHS used
internal subject matter experts who analyzed the general attributes of
an asset type against various terrorist attack scenarios by conducting
site vulnerability analyses on a sample of sites from the asset type in
order to catalog attributes for the generic asset. These experts
evaluated vulnerability by attack scenario and asset type pairs and
assigned an ordinal value to the pair based on 10 major criteria. In
describing its FY 2006 methodology, DHS acknowledged that because all
attack types are not necessarily applicable to all infrastructures, the
values for threat must be mapped against vulnerability to represent the
greatest likelihood of a successful attack. DHS also acknowledged that
vulnerability of an infrastructure asset was also a function of many
variables and recognized that it did not have sufficient data on all
infrastructures to know what specific vulnerabilities existed for every
infrastructure, what countermeasures had been deployed, and what impact
on other infrastructures each asset had. At that time, DHS noted it
would require substantial time and resource investment to fully develop
the capability to consistently assess and compare vulnerabilities
across all types of infrastructure.
Vulnerability is a crucial component of risk assessment. An asset may
be highly vulnerable to one mode of attack but have a low level of
vulnerability to another, depending on a variety of factors, such as
countermeasures already in place. According to our risk management
framework, the vulnerability of an asset is the probability that a
particular attempted attack will succeed against a particular target or
class of targets. It is usually measured against some set of standards,
such as availability/predictability, accessibility, countermeasures in
place, and target hardness (the material construction characteristics
of the asset). Each of these four elements can be evaluated based on a
numerical assignment corresponding to the conditional probability of a
successful attack. Additionally, other research has developed methods
to measure vulnerability across urban areas. For example, one study
described a quantitative methodology to characterize the vulnerability
of U.S. urban centers to terrorist attack for the potential allocation
of national and regional funding to support homeland security
preparedness and response in U.S. cities. [Footnote 23] This study
found that vulnerability varied across the country, especially in urban
areas. The study noted that ’place matters,“ and a one-size-fits all
strategy ignores geographic differences in the social, built, and
natural environments. Furthermore, in February of 2008 the Secretary of
DHS said that ’as we reduce our vulnerabilities, the vulnerabilities
change as well.“ However, while earlier iterations of the risk analysis
model attempted to measure vulnerability, DHS‘s risk analysis model now
considers the states and urban areas of the country equally vulnerable
to a terrorist attack and assigns a constant value to vulnerability,
which ignores geographic differences.
Conclusions:
In fiscal year 2008, DHS will distribute approximately $1.6 billion to
states and urban areas through its Homeland Security Grant Program – a
program that has already distributed approximately $20 billion over the
past six years – to prevent, protect against, respond to, and recover
from acts of terrorism or other catastrophic events. Given that risk
management has been endorsed by the federal government as a way to
direct finite resources to those areas that are most at risk of
terrorist attack under conditions of uncertainty, it is important that
DHS use a reasonable risk-based allocation methodology and risk
analysis model as it allocates those limited resources. Conclusions
DHS‘s risk-based allocation methodology and risk analysis model are
generally reasonable tools for measuring relative risk within a given
fiscal year, considering its use of a generally-accepted risk
calculation formula; key model results‘ decreased sensitivity to
incremental changes in the assumptions related to Tier 1 UASI grantees
or the eligibility for Tier 2 UASI funding, the reliability of the
consequence variable component indices, and its adoption of MSAs to
calculate urban area footprints. However, the element of vulnerability
in the risk analysis model could be improved to more accurately reflect
risk. Vulnerability is a crucial component of risk assessment, and our
work shows that DHS needs to measure vulnerability as part of its risk
analysis model to capture variations in vulnerability across states and
urban areas.
Recommendations:
To strengthen DHS‘s methodology for determining risk, we are
recommending that the Secretary of DHS take the following action:
* Instruct FEMA, I&A, and NPPD - DHS components each responsible for
aspects of the risk-based methodology used to allocate funds under the
Homeland Security Grant Program - to formulate a method to measure
vulnerability in a way that captures variations across states and urban
areas, and apply this vulnerability measure in future iterations of
this risk-based grant allocation model.
Agency Comments:
We requested comments on a draft of this report from the Secretary of
Homeland Security, FEMA, I&A, and NPPD, or their designees. In email
comments on the draft report, FEMA and I&A concurred with our
recommendation that they formulate a method to measure vulnerability in
a way that captures variations across states and urban areas and apply
this vulnerability measure in future iterations of the risk-based grant
allocation model. FEMA, I&A, and NPPD also provided technical comments,
which we incorporated as appropriate.
We are sending copies of this correspondence to the appropriate
congressional committees, and the Secretary of Homeland Security.
Contact points for our Offices of Congressional Relations and Public
Affairs may be found on the last page of this report. For further
information about this report, please contact William Jenkins, Jr.,
Director, GAO Homeland Security and Justice Issues Team, at (202)-512-
8777 or at jenkinswo@gao.gov. GAO staff members who were major
contributors to this report are listed in appendix IV.
Signed by:
William Jenkins, Jr., Director:
Homeland Security and Justice Issues Team:
[End of section]
Appendix I: Briefing for Congressional Committees, February 11-25,
2008:
For the third consecutive year, GAO has been mandated as part of DHS‘s
annual appropriation to review and assess the HSGP‘s risk analysis
model and risk-based allocation methodology for determining risk and
distributing funds. We responded to the mandate in February 2008 by
briefing the staffs of congressional committees on the results of this
review. During the course of our engagement, we had ongoing dialog with
DHS officials regarding the extent to which written criteria were used
in the development of the Threat Index. At that time, officials from
DHS‘s Office of Intelligence and Analysis stated that the criteria were
not documented. As a result, we noted in the accompanying presentation
slides that DHS‘s approach to measuring threat did not include
specific, written criteria to use when determining the threat tiers
into which states and urban areas are placed.
As part of GAO‘s agency protocols, we convened an exit conference with
DHS officials which occurred on April 14, 2008. We provided them with a
statement of facts to reflect the information gathered during our
engagement. At this exit conference an official from the Office of
Intelligence and Analysis said DHS had used criteria in 2007 and 2008
for categorizing cities and states based on threat, and in further
discussions with DHS we were able to independently review these
documents and confirm that such criteria were used in the development
of the Threat Index, which is reflected in the letter above. However,
we did not modify the accompanying presentation contained in this
appendix.
Homeland Security Grant Program (HSGP) Risk-Based Distribution Methods:
Briefing for Congressional Committees:
February 25, 2008:
Introduction:
According to the Department of Homeland Security (DHS), in fiscal year
2007:
* DHS provided approximately $1.7 billion to states and urban areas
through its Homeland Security Grant Program (HSGP) to prevent, protect
against, respond to, and recover from acts of terrorism or other
catastrophic events. DHS plans to distribute about $1.6 billion for
these grants in fiscal year 2008.
* The HSGP risk-based allocation process is used for the State Homeland
Security Program (SHSP) and Urban Area Security Initiative (UASI).
* In addition, DHS used this same approach to allocate $655 million in
fiscal year 2007 under the Infrastructure Protection Program.
Objectives:
In response to a legislative mandate and discussions with relevant
congressional staff, we addressed the following questions:
1. What methodology did DHS use to allocate HSGP funds for fiscal years
2007 and 2008, including any changes DHS made to the eligibility and
allocation processes for fiscal year 2008 and the placement of states
and urban areas within threat tiers, and why?
2. How reasonable is DHS‘s methodology?
Scope and Methodology:
We analyzed DHS documents including the FY2007 and FY2008 risk analysis
models, grant guidance, presentations, and interviewed DHS officials
about:
* The HSGP grant determination process in FY07”and any changes to the
FY08 process”including:
- The process by which DHS‘s risk analysis model is used to estimate
relative risk: Risk = Threat*(Vulnerability & Consequences);
- How the effectiveness assessment process is conducted;
- How final allocation decisions are made.
* DHS‘s methodology for ranking grantees by tiered groups and the
impact of this ranking on funding allocations.
We did our work from September 2007 and February 2008, in accordance
with generally accepted government accounting standards (GAGAS).
Background:
We‘ve reviewed this program for the last 3 years. In previous reviews
we reported:
* DHS has adopted a process of ’continuous improvement“ to its methods
for estimating risk and measuring applicants‘ effectiveness.
* Inherent uncertainty is associated with estimating risk of terrorist
attack, requiring the application of policy and analytic judgments. The
use of sensitivity analysis can help to gauge what effects key sources
of uncertainty have on outcomes.
Results in Brief:
This year, in our review of DHS‘s allocation methodology, we found:
* For FY 2008, DHS is using the same 3-step process –Risk Analysis,
Effectiveness Assessment, and Final Allocation decisions –that includes
empirical analytical methods and policy judgments, to select eligible
urban areas and allocate SHSP and UASI funds.
* Generally, DHS has constructed a reasonable methodology to assess
risk and effectiveness and allocate funds within that given year.
However, DHS could take an additional step to evaluate the reliability
and validity of the peer review process.
Overview of the Grant Determination Process for UASI and SHSP for FY
2007 and FY 2008:
In both years, DHS applied a 3-step process–using empirical analytical
methods and policy judgments–to select eligible urban areas and
allocate SHSP and UASI funds:
1. Use of a Risk Analysis formula –R = T*(V&C) –with the same indices
and weights--except for the Population Index used.
2. Implementation of an Effectiveness Assessment, including a peer
review process, to assess and score the effectiveness of the proposed
investments submitted by the eligible applicants.
3. Calculation of a Final Allocation of funds based on states and urban
areas‘ risk scores as adjusted by their effectiveness scores.
Overview of the Grant Allocation Methodology for UASI and SHSG:
This figure is an illustration of the Grant Allocation Methodology for
UASI and SHSP, as follows:
UASI:
Funding allocation:
Tier 1: 55%;
Tier 2: 45%.
Relative risk: Number of urban areas.
Risk estimator: R = T x "(V & C)";
Yields relative risk estimate.
Phase I: Risk analysis: produces Risk score;
Phase II: Effectiveness assessment:
Peer review of Investment Justifications;
Yields effectiveness score.
Phase 3: Final allocation:
Utilizes Effectiveness/risk matrix.
SHSP:
Risk estimator: R = T x "(V & C)";
Yields relative risk estimate.
Relative risk: Number of states and territories.
Phase I: Risk analysis: produces Risk score;
Phase II: Effectiveness assessment:
Peer review of Investment Justifications;
Yields effectiveness score.
Phase 3: Final allocation:
Utilizes Effectiveness/risk matrix.
Statutory minimum = .375%[A]
[End of figure]
Risk Analysis: DHS‘s Model Used in Determining Relative Risk Scores:
This figure is an illustration of DHS‘s Risk Analysis Model Used in
Determining Relative Risk Scores, as follows:
Risk = Threat Index:
* Data: Credible plots, planning and threats from international
terrorist networks, their affiliates and those inspired by them.
* Source: Intelligence Community reporting.
Times:
Vulnerability and Consequence Index; V&C = (P+E+I+N);
Population Index:
* Data: Total population (nighttime, commuter, visitor, military
dependent) and population density (constrained to 50 percent impact);
* Source: Census, LandScan, Smith Travel, and DOD.
Economic Index:
* Data: Gross Metropolitan Product (UASI)/percent GDP (state analysis);
* Source: Global Insight/Department of Commerce, Bureau of Economic
Statistics.
National Infrastructure Index:
* Data: # Tier I Assets (x3) +# Tier II Assets;
* Source: DHS/OIP, SSAs, states and territories.
National Security Index:
* Data: Presence of Military Bases (yes/no) + # DIB + # international
border crossings;
* Source: DOD, DHS/CBP.
Source: DHS.
[End of figure]
Risk Analysis Model: Calculating Threat:
Threat Index: Reflects the Intelligence Community‘s best assessment of
areas of the country and potential targets most likely to be attacked.
According to DHS officials, for FY2007 and FY2008, the DHS calculated
the threat index by:
1. Collecting qualitative threat information having a nexus with
international terrorism or its affiliates (and not, for
example,domestic terrorists or separatist groups);
2. Analyzing the threat information to create threat assessments for
states and urban areas;
3. Empaneling intelligence experts to review the threat assessments and
reach consensus as to the number of threat tiers and the placement of
urban areas within threat tiers; and;
4. Assigning threat scores to states and each urban area based on their
threat tier placement.
DHS /HITRAC officials characterized the general approach to measuring
threat as empaneling senior intelligence experts who:
* Consider threat information in four categories –detainee reporting,
ongoing plot lines, credible reporting, and relevant investigations;
and;
* Use analytical judgment and discussion to reach consensus as to the
number of threat tiers and the placement of urban areas within threat
tiers.
According to DHS officials, final threat assessments are approved by
the Intelligence Community - FBI, CIA, NCTC, DIA, the DHS
Undersecretary of I&A and the Secretary of DHS.
This general approach has no written criteria, and DHS program
officials expressed concerns about their confidence in the existing
threat information.
The threat tiering system is a method for organizing the threat
information for the grant risk calculation model. The application of
threat data to the risk determination methodology is process of
assigning numbers to qualitative data according to DHS officials.
Given their concerns about the available threat data, DHS officials
expressed limited confidence in the formula‘s ability to adequately
represent threat (T).
Consequently, threat has a weight of only 20% in the model used to
determine relative risk.
Risk Analysis Model: Calculating Vulnerability & Consequence (V&C):
* Population Index: this variable included nighttime population and
military dependent populations for states and urban areas, based upon
U.S. Census Bureau and Department of Defense inputs. In addition, for
urban areas, population density, commuters, and visitors were also
factored into this variable, using data from private entities.
* National Infrastructure Index: this variable focused on approximately
2,100 Tier I and Tier II critical infrastructure/key resource (CI/KR)
assets that were identified by the DHS Office of Infrastructure
Protection. Tier I assets or systems are those that if attacked could
trigger major national or regional impacts similar to those experienced
during Hurricane Katrina or 9/11. Tier II assets are other highly-
consequential assets with potential national or regional impacts if
attacked.
* Economic Index: this variable considered the economic value of the
goods and services produced in either a state or an urban area. For
states, this index was calculated using U.S. Department of Commerce
data on their percentage contribution to Gross Domestic Product. For
UASI urban areas, a parallel calculation of Gross Metropolitan Product
was incorporated based on data from Global Insight.
* National Security Index: this variable considered the presence of
three key national security factors: whether military bases are present
in the state or urban area; how many critical defense industrial base
facilities are located in the state or urban area; and the total number
of people traversing international borders. Information on these inputs
comes from the Department of Defense and DHS.
Population Index:
* For FY 2007, Urban Areas were defined as: Center city boundary +10-
mile radius.
* For FY 2008, DHS used Metropolitan Statistical Areas (MSAs) from the
Census Bureau, as provided under the Implementing Recommendations of
the 9/11 Commission Act of 2007.[A]
* Consequently, there were a number of changes in the rankings that
were driven by the required change in FY2008 to use the MSAs, according
to DHS officials.
[A] 6 U.S.C. § 601(5).
National Infrastructure Index:
* Critical infrastructure assets are divided into 2 tiers that, if
destroyed or disrupted, could cause significant casualties, major
economic losses, or widespread/long-term disruptions to national well-
being and governance capacity.
* Tier 2 includes the nation‘s highest consequence critical
infrastructure and key resources across 17 sectors.
* Tier 1 is a small subset of Tier 2 and includes the most nationally
significant assets/systems certain to produce at least two of four
consequences:
1. Prompt fatalities greater than 5,000;
2. First-year economic impact of at least $75 billion;
3. Mass evacuations with prolonged (6 months or more) absence;
4. Loss of governance or mission execution disrupting multiple regions
or critical infrastructure sectors for more than a week, resulting in a
loss of necessary services to the public.
National Infrastructure Index: Asset Identification Process:
According to DHS, it used a collaborative, multi-step process to create
the Tier 2 asset list:
* Step 1: DHS‘s Infrastructure Protection office (IP) works with sector-
specific agencies (SSAs) to develop criteria used to determine which
assets should be placed in a threat tier;
* Step 2: The criteria is vetted with private-sector companies through
sector-specific councils who review the criteria and provide feedback
to IP;
* Step 3: IP finalizes the criteria list and provides the list to the
sector-specific agencies;
* Step 4: IP asks states to nominate assets within their jurisdiction
that match the criteria;
* Step 5: Nominated assets are reviewed by IP and the SSAs to decide
which assets comprise the final Tier 2 list.
IP has recently added a new process so SSAs can resubmit for
reconsideration assets that are not initially selected for the list.
Sensitivity of the risk analysis:
In FY 2007, DHS had developed a greater understanding of the
sensitivity of the risk model as a result of its changes to the model.
GAO‘s analysis of the FY 2007 model:
* It takes sizable changes to the weights of these indices used to
quantify risk to change the areas that compose the Tier 1 list.
* For those urban areas ranked near the bottom of Tier 2 list, very
small changes in the weights for the indices used to quantify risk can
result in changes in eligibility.
According to DHS officials, there were a number of changes in the
rankings, and these changes were driven by the required change in
FY2008 to use MSAs.
Effectiveness Assessment:
For fiscal year 2007 DHS assessed the applications submitted by states
and eligible urban areas.
DHS used a peer-review process to assess and score the effectiveness of
proposed investments by:
* Engaging the states in identifying and selecting peer reviewers;
* Having peer reviewers individually score investments, and;
* Assigning peer reviewers to panels to make final effectiveness score
determinations.
FY 2007 Effectiveness Assessment:
[See PDF for image]
This figure is an illustration of the FY 2007 Effectiveness Assessment,
as follows:
Effectiveness score (100 points);
* Portfolio score (20 points);
* Multi-applicant bonus, where applicable (up to 8 points);
* Average of investment scores, 1 up to 15 (80 points);
Investment scores:
* Comprehensive Investment score (80 points) plus:
* Investment categories score (80 points):
- Strategy (15%);
- Milestones (10%);
- Investment challenges (5%);
- Impact (10%);
- Program management (25%);
- Impact (35%);
[Published in fiscal year 2007 HSGP grant guidance].
Source: DHS.
[End of figure]
Effectiveness Assessment: Peer Review Process Quality Assurance and
Inter-rater Reliability:
As a quality control step, DHS analyzed the results of the peer review
process to assess whether the process was affected by human bias.
* DHS analyzed all FY 2007 panels‘ scores and found no panel‘s average
was more than 2 standard deviations from the mean.
* DHS concluded, from this finding, that their peer review process
adequately mitigated human bias.
However, based on GAO‘s review of DHS documentation, the analysis DHS
used did not apply a generally-accepted method to ensure inter-rater
reliability.
* One way to effectively assess the potential for human bias is to have
a sample of the same applications independently rated by multiple
panels to provide a measure of inter-rater reliability.
Final Allocation Process: FY 2007 Grants Based on Both Risk and
Effectiveness Scores:
DHS allocated funds based on the risk scores of states and urban areas,
as adjusted by their effectiveness scores.
SHSP provided a minimum allocation, ensuring no state or territory‘s
allocation falls below the minimum levels established by the USA
PATRIOT Act.[A]
For UASI, DHS established maximum and minimum allocation to minimize
variations in some urban areas‘ final allocations between years.
[A] For FY2007 this minimum was 0.75 percent of funds appropriated for
SHSP for states and 0.25 percent for territories. FY 2008 statutory
minimum = 0.375% of all funds appropriated for SHSP and UASI.
Final Allocation Process: Ranking UASI Grantees by Tiered groups:
Fiscal year 2007, 45 eligible candidates were grouped into two tiers
according to relative risk.
Tiering was established from a policy judgment by DHS leadership,
according to DHS grant officials.
Tier I included the 6 highest risk areas; Tier II included the other 39
candidate areas ranked by risk.
* FY 2007 Tier I Urban Areas = 6 Urban Areas, $410,795,000 allocated
(55 percent of available funds).
* FY 2007 Tier II Urban Areas = 39 Urban Areas, $336,105,000 allocated
(45 percent of available funds).
Final Allocation Process: Risk Estimates Used to Inform Eligibility
Decisions for the UASI Grant Program”Fiscal Year 2008:
60 eligible UASI areas in FY 2008:
* Tier I = 7 highest risk areas and eligible for 55 percent of
available funds --$429,896,500.
* Tier II = 53 areas (14 more than FY 2007) and eligible for 45 percent
of available funds --$351,733,500.
According to DHS officials, the expansion to 60 eligible UASI areas for
FY2008 is a policy decision largely driven by two factors:
1. The new requirement that FEMA use MSAs;
2. The desire to remain consistent with the funding.
Observations on the Reasonableness of the HSGP Grant Distribution
Methodology:
As inherent uncertainty is always associated with estimating risk of
terrorist attack, policy and analytic judgments are required.
DHS has adopted an overall risk assessment approach that consists of
risk factors, and in implementing this approach has made judgments in
an attempt to address inherent uncertainties.
Generally, DHS has constructed a reasonable methodology to assess risk
and effectiveness and allocate funds within that given year.
DHS could take an additional step to evaluate the reliability and
validity of the peer review process.
* One way to effectively assess the potential for human bias is to have
a sample of the same applications independently rated by multiple
panels to provide a measure of inter-rater reliability.
* DHS identified resource constraints as a reason for not measuring
inter-rater reliability.
[End of section]
Appendix II: Identifying Eligible Urban Areas:
As we reported in 2007, DHS first had to determine the geographic
boundaries or footprint of candidate urban areas within which data were
collected to estimate risk in order to determine the urban areas that
were eligible to receive UASI grants. In fiscal year 2005, the
footprint was limited to city boundaries (and did not include the 10-
mile buffer zone). DHS chose to further redefine the footprint for
fiscal year 2006, on the basis of comments from state and local
governments. DHS took several steps to identify this footprint; these
included:
* Identifying areas with population greater than 100,000 persons and
areas (cities) that had any reported threat data during that past year.
For fiscal year 2006, DHS started with a total of 266 cities.
* Combining cities or adjacent urban counties with shared boundaries to
form single jurisdictions. For fiscal year 2006, this resulted in 172
urban areas.
Drawing a buffer zone around identified areas. A 10-mile buffer was
then drawn from the border of that city/combined entity to establish
candidate urban areas.[Footnote 24] This area was used to determine
what information was used in the risk analysis, and represents the
minimum area that had to be part of the state/urban areas defined grant
application areas.
According to DHS, for fiscal year 2006, it considered other
alternatives such as a radius from a city center, although such a
solution created apparent inequities among urban areas. DHS
incorporated buffer zones at the suggestion of stakeholders, although
this action resulted in making the analysis more difficult, according
to a DHS official. In addition, DHS officials told us the steps taken
to determine the footprint were based on the ’best fit,“ as compared
with other alternatives. DHS did not provide details on what criteria
this comparison was based on.
A principal change between fiscal year 2007 and 2008 was the method
used to identify the footprint, or boundaries, of UASI areas for the
purposes of calculating relative risk. In fiscal year 2008, DHS used
Metropolitan Statistical Areas (MSAs) from the Census Bureau, as
required under the Implementing Recommendations of the 9/11 Commission
Act of 2007. [Footnote 25]
Table 1 below provide additional information listing the urban areas by
its prior geographic area captures, and the areas captured by MSAs.
Table 1: Urban Areas Eligible for UASI Grants: Fiscal Year 2006
Footprint vs. 2008 by Metropolitan Statistical Areas (New UASI grantees
are in italics):
State: Arizona;
Eligible urban area/Geographic area captured in the data count: Phoenix
Area: Chandler, Gilbert, Glendale, Mesa, Peoria, Phoenix, Scottsdale,
Tempe, and a 10-mile buffer extending from the border of the combined
area.
Metropolitan Statistical Areas used in FY2008[A]: Phoenix-Mesa-
Scottsdale, AZ Metropolitan Statistical Area; Principal Cities:
Phoenix, Mesa, Scottsdale, Tempe; Maricopa County, Pinal County.
State: Arizona;
Eligible urban area/Geographic area captured in the data count: [Empty]
Metropolitan Statistical Areas used in FY2008[A]: Tucson, AZ
Metropolitan Statistical Area; Principal City: Tucson; Pima County.
State: California;
Eligible urban area/Geographic area captured in the data count: Anaheim
/Santa Ana Area: Anaheim, Costa Mesa, Garden Grove, Fullerton,
Huntington Beach, Irvine, Orange, Santa Ana, and a 10-mile buffer
extending from the border of the combined area.
Metropolitan Statistical Areas used in FY2008[A]: Santa Ana-Anaheim-
Irvine, CA Metropolitan Division Orange County.
State: California;
Eligible urban area/Geographic area captured in the data count: Los
Angeles/Long Beach Area: Burbank, Glendale, Inglewood, Long Beach, Los
Angeles, Pasadena, Santa Monica, Santa Clarita, Torrance, Simi Valley,
Thousand Oaks, and a 10-mile buffer extending from the border of the
combined area.
Metropolitan Statistical Areas used in FY2008[A]: Los Angeles-Long
Beach-Santa Ana, CA Metropolitan Statistical Area; Principal Cities:
Los Angeles, Long Beach, Glendale, Irvine, Pomona, Pasadena, Torrance,
Orange, Fullerton, Costa Mesa, Burbank, Compton, Carson, Santa Monica,
Newport Beach, Tustin, Montebello, Monterey Park, Gardena, Paramount,
Fountain Valley, Arcadia, Cerritos Los Angeles-Long Beach-Glendale, CA
Metropolitan Division Los Angeles County.
State: California;
Eligible urban area/Geographic area captured in the data count:
Sacramento Area: Elk Grove, Sacramento, and a 10-mile buffer extending
from the border of the combined area.
Metropolitan Statistical Areas used in FY2008[A]: Sacramento”Arden-
Arcade”Roseville, CA Metropolitan Statistical Area; Principal Cities:
Sacramento, Arden-Arcade, Roseville, Folsom, Rancho Cordova, Woodland;
El Dorado County, Placer County, Sacramento County, Yolo County.
State: California;
Eligible urban area/Geographic area captured in the data count: San
Diego Area: Chula Vista, Escondido, and San Diego, and a 10-mile buffer
extending from the border of the combined area.
Metropolitan Statistical Areas used in FY2008[A]: San Diego-Carlsbad-
San Marcos, CA Metropolitan Statistical Area; Principal Cities: San
Diego, Carlsbad, San Marcos, National City; San Diego County.
State: California;
Eligible urban area/Geographic area captured in the data count: Bay
Area: Berkeley, Daly City, Fremont, Hayward, Oakland, Palo Alto,
Richmond, San Francisco, San Jose, Santa Clara, Sunnyvale, Vallejo, and
a 10-mile buffer extending from the border of the combined area.
Metropolitan Statistical Areas used in FY2008[A]: San Francisco-San
Jose-Bay Area: San Francisco-Oakland-Fremont, CA Metropolitan
Statistical Area Principal Cities: San Francisco, Oakland, Fremont,
Hayward, Berkeley, San Mateo, San Leandro, Redwood City, Pleasanton,
Walnut Creek, South San Francisco, San Rafael; Oakland-Fremont-Hayward,
CA Metropolitan Division Alameda County, Contra Costa County; San
Francisco-San Mateo-Redwood City, CA Metropolitan Division; Marin
County, San Francisco County, San Mateo County; San Jose-Sunnyvale-
Santa Clara, CA Metropolitan Statistical Area ; Principal Cities: San
Jose, Sunnyvale, Santa Clara, Mountain View, Milpitas, Palo Alto,
Cupertino San Benito County, Santa Clara County.
State: California;
Eligible urban area/Geographic area captured in the data count: [Empty]
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area –
Riverside -San Bernardino-Ontario, CA Metropolitan Statistical Area
Principal Cities: Riverside, San Bernardino, Ontario, Victorville,
Temecula, Chino, Redlands, Hemet, Colton; Riverside County, San
Bernardino County.
State: Colorado;
Eligible urban area/Geographic area captured in the data count: Denver
Area: Arvada, Aurora, Denver, Lakewood, Westminster, Thornton, and a 10-
mile buffer extending from the border of the combined area.
Metropolitan Statistical Areas used in FY2008[A]: Denver-Aurora, CO
Metropolitan Statistical Area Principal Cities: Denver, Aurora; Adams
County, Arapahoe County, Broomfield County, Clear Creek County, Denver
County, Douglas County, Elbert County, Gilpin County, Jefferson County,
Park County.
State: Connecticut;
Eligible urban area/Geographic area captured in the data count: [Empty]
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area –
Hartford -West Hartford-East Hartford, CT Metropolitan Statistical Area
Principal Cities: Hartford, West Hartford, East Hartford, Middletown;
Hartford County, Middlesex County, Tolland County.
State: Connecticut;
Eligible urban area/Geographic area captured in the data count: [Empty]
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area ”
Bridgeport-Stamford-Norwalk, CT Metropolitan Statistical Area Principal
Cities: Bridgeport, Stamford, Norwalk, Danbury, Stratford; Fairfield
County.
State: District of Columbia;
Eligible urban area/Geographic area captured in the data count:
National Capital Region: National Capital Region and a 10-mile buffer
extending from the border of the combined area.
Metropolitan Statistical Areas used in FY2008[A]: Washington-Arlington-
Alexandria, DC-VA-MD-WV Metropolitan Statistical Area; Principal
Cities: Washington, DC; Arlington, VA; Alexandria, VA; Reston, VA;
Bethesda, MD; Gaithersburg, MD; Frederick, MD; Rockville, MD Bethesda-
Gaithersburg-Frederick, MD Metropolitan Division Frederick County,
Montgomery County; Washington-Arlington-Alexandria, DC-VA-MD-WV
Metropolitan Division District of Columbia, DC; Calvert County, MD;
Charles County, MD; Prince George‘s County, MD; Arlington County, VA;
Clarke County, VA; Fairfax County, VA; Fauquier County, VA; Loudoun
County, VA; Prince William County, VA; Spotsylvania County, VA;
Stafford County, VA; Warren County, VA; Alexandria city, VA; Fairfax
city, VA; Falls Church city, VA; Fredericksburg city, VA; Manassas
city, VA; Manassas Park city, VA; Jefferson County, WV.
State: Florida;
Eligible urban area/Geographic area captured in the data count: Fort
Lauderdale Area: Fort Lauderdale, Hollywood, Miami Gardens, Miramar,
Pembroke Pines, and a 10-mile buffer extending from the border of the
combined area.
Metropolitan Statistical Areas used in FY2008[A]: Fort Lauderdale-
Pompano Beach, FL Metropolitan Statistical Area; Principal Cities: Fort
Lauderdale, West Palm Beach, Pompano Beach, Boca Raton, Deerfield
Beach, Boynton Beach, Delray Beach; Broward County, Palm Beach, County.
State: Florida;
Eligible urban area/Geographic area captured in the data count:
Jacksonville Area: Jacksonville and a 10-mile buffer extending from the
city border.
Metropolitan Statistical Areas used in FY2008[A]: Jacksonville, FL
Metropolitan Statistical Area; Principal City: Jacksonville; Baker
County, Clay County, Duval County, Nassau County, St. Johns County.
State: Florida;
Eligible urban area/Geographic area captured in the data count: Miami
Area: Hialeah, Miami, and a 10-mile buffer extending from the border of
the combined area.
Metropolitan Statistical Areas used in FY2008[A]: Miami, FL
Metropolitan Statistical Area; Principal Cities: Miami, Miami Beach,
Kendall; Monroe County, Miami-Dade.County.
State: Florida;
Eligible urban area/Geographic area captured in the data count: Orlando
Area: Orlando and a 10-mile buffer extending from the city border.
Metropolitan Statistical Areas used in FY2008[A]: Orlando-Kissimmee, FL
Metropolitan Statistical Area; Principal Cities: Orlando, Kissimmee;
Lake County, Orange County, Osceola County, Seminole County.
State: Florida;
Eligible urban area/Geographic area captured in the data count: Tampa
Area: Clearwater, St. Petersburg, Tampa, and a 10-mile buffer extending
from the border of the combined area.
Metropolitan Statistical Areas used in FY2008[A]: Tampa-St. Petersburg-
Clearwater, FL Metropolitan Statistical Area; Principal Cities: Tampa,
St. Petersburg, Clearwater, Largo; Hernando County, Hillsborough
County, Pasco County, Pinellas County.
State: Georgia;
Eligible urban area/Geographic area captured in the data count: Atlanta
Area: Atlanta and a 10-mile buffer extending from the city border.
Metropolitan Statistical Areas used in FY2008[A]: Atlanta-Sandy Springs-
Marietta, GA Metropolitan Statistical Area; Principal Cities: Atlanta,
Sandy Springs, Marietta; Barrow County, Bartow County, Butts County,
Carroll County, Cherokee County, Clayton County, Cobb County, Coweta
County, Dawson County, DeKalb County, Douglas County, Fayette County,
Forsyth County, Fulton County, Gwinnett County, Haralson County, Heard
County, Henry County, Jasper County, Lamar County, Meriwether County,
Newton County, Paulding County, Pickens County, Pike County, Rockdale
County, Spalding County, Walton County.
State: Hawaii;
Eligible urban area/Geographic area captured in the data count:
Honolulu Area: Honolulu and a 10-mile buffer extending from the city
border.
Metropolitan Statistical Areas used in FY2008[A]: Honolulu, HI
Metropolitan Statistical Area; Principal City: Honolulu, Honolulu
County.
State: Illinois;
Eligible urban area/Geographic area captured in the data count: Chicago
Area: Chicago and a 10-mile buffer extending from the city border.
Metropolitan Statistical Areas used in FY2008[A]: Chicago-Naperville-
Joliet, IL-IN-WI Metropolitan Statistical Area; Principal Cities:
Chicago, IL; Naperville, IL; Joliet, IL; Gary, IN; Elgin, IL; Arlington
Heights, IL; Evanston, IL; Schaumburg, IL; Skokie, IL; Des Plaines, IL;
Hoffman Estates, IL ; Chicago-Naperville-Joliet, IL Metropolitan
Division; Cook County, DeKalb County, DuPage County, Grundy County,
Kane County, Kendall County, McHenry County, Will County ,Gary, IN
Metropolitan Division Jasper County, Lake County, Newton County, Porter
County Lake County-Kenosha County, IL-WI Metropolitan Division Lake
County, IL; Kenosha County, WI.
State: Indiana;
Eligible urban area/Geographic area captured in the data count:
Indianapolis Area: Indianapolis and a 10-mile buffer extending from the
city border.
Metropolitan Statistical Areas used in FY2008[A]: Indianapolis-Carmel,
IN Metropolitan Statistical Area; Principal City: Indianapolis city
(balance),[Footnote 26] Carmel; Boone County, Brown County, Hamilton
County, Hancock County, Hendricks County, Johnson County, Marion
County, Morgan County, Putnam County, Shelby County.
State: Kentucky;
Eligible urban area/Geographic area captured in the data count:
Louisville Area: Louisville and a 10-mile buffer extending from the
city border.
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area ”
Louisville/Jefferson County, KY-IN Metropolitan Statistical Area;
Principal City: Louisville/Jefferson County (balance), KY, [Footnote
27] Clark County, IN; Floyd County, IN; Harrison County, IN; Washington
County, IN; Bullitt County, KY; Henry County, KY; Jefferson County, KY;
Meade County, KY; Nelson County, KY; Oldham County, KY; Shelby County,
KY; Spencer County, KY; Trimble County, KY.
State: Louisiana;
Eligible urban area/Geographic area captured in the data count: Baton
Rouge Area: Baton Rouge and a 10-mile buffer extending from the city
border.
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area ”
Baton Rouge, LA; Metropolitan Statistical Area; Principal City: Baton
Rouge; Ascension Parish, East Baton Rouge Parish, East Feliciana
Parish, Iberville Parish, Livingston Parish, Pointe Coupee Parish, St.
Helena Parish, West Baton Rouge Parish, West Feliciana Parish.
State: Louisiana;
Eligible urban area/Geographic area captured in the data count: New
Orleans Area: New Orleans and a 10-mile buffer extending from the city
border.
Metropolitan Statistical Areas used in FY2008[A]: New Orleans-Metairie-
Kenner, LA; Metropolitan Statistical Area: Principal Cities: New
Orleans, Metairie, Kenner; Jefferson Parish, Orleans Parish,
Plaquemines Parish, St. Bernard Parish, St. Charles Parish, St. John
the Baptist Parish, St. Tammany Parish.
State:
Eligible urban area/Geographic area captured in the data count:
Metropolitan Statistical Areas used in FY2008[A]:
State: Massachusetts;
Eligible urban area/Geographic area captured in the data count: Boston
Area: Boston, Cambridge, and a 10-mile buffer extending from the border
of the combined area.
Metropolitan Statistical Areas used in FY2008[A]: Boston-Cambridge-
Quincy, MA-NH Metropolitan Statistical Area; Principal Cities: Boston,
MA; Cambridge, MA; Quincy, MA; Newton, MA; Framingham, MA; Waltham, MA;
Peabody, MA Boston-Quincy, MA Metropolitan Division; Norfolk County,
Plymouth County, Suffolk County Cambridge-Newton-Framingham, MA
Metropolitan Division Middlesex County, Peabody, MA Metropolitan
Division Essex County Rockingham County-Strafford County, NH
Metropolitan Division Rockingham County, Strafford County.
State: Maryland;
Eligible urban area/Geographic area captured in the data count:
Baltimore Area: Baltimore and a 10-mile buffer extending from the city
border.
Metropolitan Statistical Areas used in FY2008[A]: Baltimore-Towson, MD
Metropolitan Statistical Area; Principal Cities: Baltimore, Towson;
Anne Arundel County, Baltimore County, Carroll County, Harford County,
Howard County, Queen Anne‘s County, Baltimore city.
State: Michigan;
Eligible urban area/Geographic area captured in the data count: Detroit
Area: Detroit, Sterling Heights, Warren, and a 10-mile buffer extending
from the border of the combined area.
Metropolitan Statistical Areas used in FY2008[A]: Detroit-Warren-
Livonia, MI Metropolitan Statistical Area; Principal Cities: Detroit,
Warren, Livonia, Dearborn, Troy, Farmington Hills, Southfield, Pontiac,
Taylor, Novi Detroit-Livonia-Dearborn, MI Metropolitan Division; Wayne
County, Warren-Troy-Farmington Hills, MI Metropolitan Division Lapeer
County, Livingston County, Macomb County, Oakland County, St. Clair
County.
State: Minnesota;
Eligible urban area/Geographic area captured in the data count: Twin
Cities Area: Minneapolis, St. Paul, and a 10-mile buffer extending from
the border of the combined entity.
Metropolitan Statistical Areas used in FY2008[A]: Minneapolis-St. Paul-
Bloomington, MN-WI Metropolitan Statistical Area; Principal Cities:
Minneapolis, MN; St. Paul, MN; Bloomington, MN; Plymouth, MN; Eagan,
MN; Eden Prairie, MN; Minnetonka, MN; Anoka County, MN; Carver County,
MN; Chisago County, MN; Dakota County, MN; Hennepin County, MN; Isanti
County, MN; Ramsey County, MN; Scott County, MN; Sherburne County, MN;
Washington County, MN; Wright County, MN; Pierce County, WI; St. Croix
County, WI.
State: Missouri;
Eligible urban area/Geographic area captured in the data count: Kansas
City Area: Independence, Kansas City (MO), Kansas City (KS), Olathe,
Overland Park, and a 10-mile buffer extending from the border of the
combined area.
Metropolitan Statistical Areas used in FY2008[A]: Kansas City, MO-KS
Metropolitan Statistical Area [Footnote 28]; Principal Cities: Kansas
City, MO, Overland Park, KS, Kansas City, KS Franklin County, KS;
Johnson County, KS; Leavenworth County, KS; Linn County, KS; Miami
County, KS; Wyandotte County, KS; Bates County, MO; Caldwell County,
MO; Cass County, MO; Clay County, MO; Clinton County, MO; Jackson
County, MO; Lafayette County, MO; Platte County, MO; Ray County, MO.
State: Missouri;
Eligible urban area/Geographic area captured in the data count: St.
Louis Area: St. Louis and a 10-mile buffer extending from the city
border.
Metropolitan Statistical Areas used in FY2008[A]: St. Louis, MO-IL
Metropolitan Statistical Area [Footnote 29]; Principal Cities: St.
Louis, MO; St. Charles, MO; Bond County, IL; Calhoun County, IL;
Clinton County, IL; Jersey County, IL; Macoupin County, IL; Madison
County, IL; Monroe County, IL; St. Clair County, IL; Crawford County,
MO (part”Sullivan city);[Footnote 30] Franklin County, MO; Jefferson
County, MO; Lincoln County, MO; St. Charles County, MO; St. Louis
County, MO; Warren County, MO; Washington County, MO; St. Louis city,
MO.
State: North Carolina;
Eligible urban area/Geographic area captured in the data count:
Charlotte Area: Charlotte and a 10-mile buffer extending from the city
border.
Metropolitan Statistical Areas used in FY2008[A]: Charlotte-Gastonia-
Concord, NC-SC Metropolitan Statistical Area; Principal Cities:
Charlotte, NC; Gastonia, NC; Concord, NC, Rock Hill, SC; Anson County,
NC; Cabarrus County, NC; Gaston County, NC; Mecklenburg County, NC;
Union County, NC; York County, SC.
State: New Jersey;
Eligible urban area/Geographic area captured in the data count: Jersey
City/Newark Area: Elizabeth, Jersey City, Newark, and a 10-mile buffer
extending from the border of the combined area.
Metropolitan Statistical Areas used in FY2008[A]: Newark Metropolitan
Statistical Area; Principal Cities: Newark, Edison, Union, Wayne;
Bergen County, Essex County, Hudson County, Hunterdon County, Middlesex
County, Monmouth County, Morris County, Ocean County, Passaic County,
Somerset County, Sussex County , Union County , Pike County (PA).
[Footnote 31]
State: Nevada;
Eligible urban area/Geographic area captured in the data count: Las
Vegas Area: Las Vegas, North Las Vegas, and a 10-mile buffer extending
from the border of the combined entity.
Metropolitan Statistical Areas used in FY2008[A]: Las Vegas-Paradise,
NV Metropolitan Statistical Area; Principal Cities: Las Vegas,
Paradise; Clark County.
State: New York;
Eligible urban area/Geographic area captured in the data count: [Empty]
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area ”
Albany-Schenectady-Troy, NY Metropolitan Statistical Area; Principal
Cities: Albany, Schenectady, Troy; Albany County, Rensselaer County,
Saratoga County, Schenectady County, Schoharie County.
State: New York;
Eligible urban area/Geographic area captured in the data count: Buffalo
Area: Buffalo and a 10-mile buffer extending from the city border.
Metropolitan Statistical Areas used in FY2008[A]: Buffalo-Niagara
Falls, NY Metropolitan Statistical Area; Principal Cities: Buffalo,
Cheektowaga, Tonawanda, Niagara Falls; Erie County, Niagara County.
State: New York;
Eligible urban area/Geographic area captured in the data count: New
York City Area: New York City, Yonkers, and a 10-mile buffer extending
from the border of the combined area.
Metropolitan Statistical Areas used in FY2008[A]: New York-Long Island,
NY ” Metropolitan Statistical Area; Principal Cities: New York, White
Plains; Bronx County, Kings County, Nassau County, New York County,
Putnam County, Queens County, Richmond County, Rockland County, Suffolk
County, Westchester County.
State: New York;
Eligible urban area/Geographic area captured in the data count: [Empty]
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area ”
Rochester, NY Metropolitan Statistical Area; Principal City: Rochester;
Livingston County, Monroe County, Ontario County, Orleans County, Wayne
County.
State: New York;
Eligible urban area/Geographic area captured in the data count: [Empty]
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area ”
Syracuse, NY Metropolitan Statistical Area; Principal City: Syracuse;
Madison County, Onondaga County, Oswego County.
State: Ohio;
Eligible urban area/Geographic area captured in the data count:
Cincinnati Area: Cincinnati and a 10-mile buffer extending from the
city border.
Metropolitan Statistical Areas used in FY2008[A]: Cincinnati-
Middletown, OH-KY-IN Metropolitan Statistical Area; Principal Cities:
Cincinnati, OH; Middletown, OH; Dearborn County, IN; Franklin County,
IN; Ohio County, IN; Boone County, KY; Bracken County, KY; Campbell
County, KY; Gallatin County, KY; Grant County, KY; Kenton County, KY;
Pendleton County, KY; Brown County, OH; Butler County, OH; Clermont
County, OH; Hamilton County, OH; Warren County, OH.
State: Ohio;
Eligible urban area/Geographic area captured in the data count:
Cleveland Area: Cleveland and a 10-mile buffer extending from the city
border.
Metropolitan Statistical Areas used in FY2008[A]: Cleveland-Elyria-
Mentor, OH Metropolitan Statistical Area; Principal Cities: Cleveland,
Elyria, Mentor; Cuyahoga County, Geauga County, Lake County, Lorain
County, Medina County.
State: Ohio;
Eligible urban area/Geographic area captured in the data count:
Columbus Area: Columbus and a 10-mile buffer extending from the city
border.
Metropolitan Statistical Areas used in FY2008[A]: Columbus, OH
Metropolitan Statistical Area; Principal City: Columbus; Delaware
County, Fairfield County, Franklin County, Licking County, Madison
County, Morrow County, Pickaway County, Union County.
State: Ohio;
Eligible urban area/Geographic area captured in the data count: Toledo
Area: Oregon, Toledo, and a 10-mile buffer extending from the border of
the combined area.
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area ”
Toledo, OH Metropolitan Statistical Area; Principal City: Toledo;
Fulton County, Lucas County, Ottawa County, Wood County.
State: Oklahoma;
Eligible urban area/Geographic area captured in the data count:
Oklahoma City Area: Norman, Oklahoma City, and a 10-mile buffer
extending from the border of the combined area.
Metropolitan Statistical Areas used in FY2008[A]: Oklahoma City, OK
Metropolitan Statistical Area; Principal City: Oklahoma City; Canadian
County, Cleveland County, Grady County, Lincoln County, Logan County,
McClain County, Oklahoma County.
State: Oregon;
Eligible urban area/Geographic area captured in the data count:
Portland Area: Portland, Vancouver, and a 10-mile buffer extending from
the border of the combined area.
Metropolitan Statistical Areas used in FY2008[A]: Portland-Vancouver-
Beaverton, OR-WA Metropolitan Statistical Area; Principal Cities:
Portland, OR; Vancouver, WA; Beaverton, OR; Hillsboro, OR; Clackamas
County, OR; Columbia County, OR; Multnomah County, OR; Washington
County, OR; Yamhill County, OR; Clark County, WA; Skamania County, WA.
State: Pennsylvania;
Eligible urban area/Geographic area captured in the data count:
Philadelphia Area: Philadelphia and a 10-mile buffer extending from the
city border.
Metropolitan Statistical Areas used in FY2008[A]: Philadelphia-Camden-
Wilmington, PA-NJ-DE-MD Metropolitan Statistical Area; Principal
Cities: Philadelphia, PA; Camden, NJ; Wilmington, DE Camden, NJ
Metropolitan Division; Burlington County, Camden County, Gloucester
County 37964 Philadelphia, PA Metropolitan Division Bucks County,
Chester County, Delaware County, Montgomery County, Philadelphia County
Wilmington, DE-MD-NJ Metropolitan Division New Castle County, DE; Cecil
County, MD; Salem County, NJ.
State: Pennsylvania;
Eligible urban area/Geographic area captured in the data count:
Pittsburgh Area: Pittsburgh and a 10-mile buffer extending from the
city border.
Metropolitan Statistical Areas used in FY2008[A]: Pittsburgh, PA
Metropolitan Statistical Area; Principal City: Pittsburgh; Allegheny
County, Armstrong County, Beaver County, Butler County, Fayette County,
Washington County, Westmoreland County.
State: Puerto Rico;
Eligible urban area/Geographic area captured in the data count: [Empty]
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area ”
San Juan-Caguas-Guaynabo, PR Metropolitan Statistical Area; Principal
Cities: San Juan, Caguas, Guaynabo Aguas Buenas Municipio, Aibonito
Municipio, Arecibo Municipio, Barceloneta Municipio, Barranquitas
Municipio, Bayamón Municipio, Caguas Municipio, Camuy Municipio,
Canóvanas Municipio, Carolina Municipio, Cataño Municipio, Cayey
Municipio, Ciales Municipio, Cidra Municipio, Comerío Municipio,
Corozal Municipio, Dorado Municipio, Florida Municipio, Guaynabo
Municipio, Gurabo Municipio, Hatillo Municipio, Humacao Municipio,
Juncos Municipio, Las Piedras Municipio, Loíza Municipio, Manatí
Municipio, Maunabo Municipio, Morovis Municipio, Naguabo Municipio,
Naranjito Municipio, Orocovis Municipio, Quebradillas Municipio, Río
Grande Municipio, San Juan Municipio, San Lorenzo Municipio, Toa Alta
Municipio, Toa Baja Municipio, Trujillo Alto Municipio, Vega Alta
Municipio, Vega Baja Municipio, Yabucoa Municipio.
State: Rhode Island;
Eligible urban area/Geographic area captured in the data count: [Empty]
Metropolitan Statistical Areas used in FY2008[A]: Providence-New
Bedford-Fall River, RI-MA Metropolitan Statistical Area; Principal
Cities: Providence, RI; New Bedford, MA; Fall River, MA; Warwick, RI;
Cranston, RI; Bristol County, MA; Bristol County, RI; Kent County, RI;
Newport County, RI; Providence County, RI; Washington County, RI.
State: Tennessee;
Eligible urban area/Geographic area captured in the data count: Memphis
Area: Memphis and a 10-mile buffer extending from the city border.
Metropolitan Statistical Areas used in FY2008[A]: Memphis, TN-MS-AR
Metropolitan Statistical Area; Principal City: Memphis, TN; Crittenden
County, AR; DeSoto County, MS; Marshall County, MS; Tate County, MS;
Tunica County, MS; Fayette County, TN; Shelby County, TN; Tipton
County, TN.
State: Tennessee;
Eligible urban area/Geographic area captured in the data count: [Empty]
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area –
Nashville –Davidson, Murfreesboro, Franklin, TN Metropolitan
Statistical Area Principal Cities: Nashville-Davidson (balance),
[Footnote 32] Murfreesboro, Franklin; Cannon County, Cheatham County,
Davidson County, Dickson County, Hickman County, Macon County,
Robertson County, Rutherford County, Smith County, Sumner County,
Trousdale County, Williamson County, Wilson County.
State: Texas;
Eligible urban area/Geographic area captured in the data count: [Empty]
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area ”
Austin-Round Rock, TX Metropolitan Statistical Area; Principal Cities:
Austin, Round Rock; Bastrop County, Caldwell County, Hays County,
Travis County, Williamson County.
State: Texas;
Eligible urban area/Geographic area captured in the data count:
Dallas/Fort Worth/Arlington Area: Arlington, Carrollton, Dallas, Fort
Worth, Garland, Grand Prairie, Irving, Mesquite, Plano, and a 10-mile
buffer extending from the border of the combined area.
Metropolitan Statistical Areas used in FY2008[A]: Dallas-Fort Worth-
Arlington, TX Metropolitan Statistical Area; Principal Cities: Dallas,
Fort Worth, Arlington, Plano, Irving, Carrollton, Denton, Richardson,
McKinney Dallas-Plano-Irving, TX Metropolitan Division; Collin County,
Dallas County, Delta County, Denton County, Ellis County, Hunt County,
Kaufman County, Rockwall County Fort Worth-Arlington, TX Metropolitan
Division Johnson County, Parker County, Tarrant County, Wise County.
State: Texas;
Eligible urban area/Geographic area captured in the data count: [Empty]
Metropolitan Statistical Areas used in FY2008[A]: El Paso, TX
Metropolitan Statistical Area; Principal City: El Paso; El Paso County.
State: Texas;
Eligible urban area/Geographic area captured in the data count: Houston
Area: Houston, Pasadena, and a 10-mile buffer extending from the border
of the combined entity.
Metropolitan Statistical Areas used in FY2008[A]: Houston-Sugar Land-
Baytown, TX Metropolitan Statistical Area; Principal Cities: Houston,
Sugar Land, Baytown, Galveston; Austin County, Brazoria County,
Chambers County, Fort Bend County, Galveston County, Harris County,
Liberty County, Montgomery County, San Jacinto County, Waller County.
State: Texas;
Eligible urban area/Geographic area captured in the data count: San
Antonio Area: San Antonio and a 10-mile buffer extending from the city
border.
Metropolitan Statistical Areas used in FY2008[A]: San Antonio, TX
Metropolitan Statistical Area; Principal City: San Antonio; Atascosa
County, Bandera County, Bexar County, Comal County, Guadalupe County,
Kendall County, Medina County, Wilson County.
State: Utah;
Eligible urban area/Geographic area captured in the data count: [Empty]
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area ”
Salt Lake City, UT Metropolitan Statistical Area; Principal City: Salt
Lake City; Salt Lake County, Summit County, Tooele County.
State: Virginia;
Eligible urban area/Geographic area captured in the data count: [Empty]
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area ”
Richmond, VA Metropolitan Statistical Area; Principal City: Richmond;
Amelia County, Caroline County, Charles City County, Chesterfield
County, Cumberland County, Dinwiddie County, Goochland County, Hanover
County, Henrico County, King and Queen County, King William County,
Louisa County, New Kent County, Powhatan County, Prince George County,
Sussex County, Colonial Heights city, Hopewell city, Petersburg city,
Richmond city.
State: Virginia;
Eligible urban area/Geographic area captured in the data count: [Empty]
Metropolitan Statistical Areas used in FY2008[A]: Norfolk- Virginia
Beach-Newport News, VA-NC Metropolitan Statistical Area; Principal
Cities: Virginia Beach, VA; Norfolk, VA; Newport News, VA; Hampton, VA;
Portsmouth, VA; Currituck County, NC; Gloucester County, VA; Isle of
Wight County, VA; James City County, VA; Mathews County, VA; Surry
County, VA; York County, VA; Chesapeake city, VA; Hampton city, VA;
Newport News city, VA; Norfolk city, VA; Poquoson city, VA; Portsmouth
city, VA; Suffolk city, VA; Virginia Beach city, VA; Williamsburg city,
VA.
State: Washington;
Eligible urban area/Geographic area captured in the data count: Seattle
Area: Seattle, Bellevue, and a 10-mile buffer extending from the border
of the combined area.
Metropolitan Statistical Areas used in FY2008[A]: Seattle-Tacoma-
Bellevue, WA Metropolitan Statistical Area; Principal Cities: Seattle,
Tacoma, Bellevue, Everett, Kent, Renton Seattle-Bellevue-Everett, WA
Metropolitan Division; King County, Snohomish County Tacoma, WA
Metropolitan Division Pierce County.
State: Wisconsin;
Eligible urban area/Geographic area captured in the data count:
Milwaukee Area: Milwaukee and a 10-mile buffer extending from the city
border.
Metropolitan Statistical Areas used in FY2008[A]: Milwaukee-Waukesha-
West Allis, WI Metropolitan Statistical Area; Principal Cities:
Milwaukee, Waukesha, West Allis; Milwaukee County, Ozaukee County,
Washington County, Waukesha County.
Source: GAO analysis of DHS and OMB ” a OMB Bulletin No. 07-01,
announcing updates to metropolitan and micropolitan statistical areas
as of December 2006, based on the Census Bureau‘s July 1, 2004 and July
1, 2005 population estimates.
[End of table]
[End of section]
Appendix III: DHS‘s Model is Robust for Tier 1 UASI Areas:
Population Index: Neither maximizing nor minimizing the weight of the
Population Index resulted in the movement of an area into or out of
Tier 1 for either FY 2007 or FY 2008.
Economic Index: In FY 2007, minimizing the weight of the Economic Index
had no effect on Tier 1 placement, but increasing the weight of the
Economic Index by 12.8% resulted in a new area moving into Tier 1,
displacing an area that had previously been ranked in the top 7. In FY
2008, lowering the weight of the Economic Index by 15.25% resulted in a
new area moving into the top 7 ranked areas, displacing an area that
had been previously ranked as Tier 1, but maximizing the weight of the
Economic Index had no effect on Tier 1 placement.
National Infrastructure Index: In FY 2007, maximizing the weights of
the National Infrastructure Index did not result in any change in those
areas designated Tier 1, but lowering the National Infrastructure Index
by 5.53% resulted in a new area moving into the Tier 1 areas,
displacing an area that had been previously ranked as Tier 1. In FY
2008, increasing the weight of the National Infrastructure Index by
4.68% resulted in a new area moving into the top 7 ranked areas,
displacing an area that had been previously ranked as Tier 1.
Similarly, lowering the National Infrastructure Index by 15% resulted
in a new area moving into the Tier 1 areas.
National Security Index: In FY 2007, minimizing the weight of the
National Security Index also did not result in any change in those
areas designated Tier 1, but increasing the National Security Index by
7.5% resulted in a new area moving into Tier 1, displacing an area that
had been previously ranked as Tier 1. In FY 2008, lowering the weight
of the National Security Index by 3.73% resulted in a new area moving
into the top 7 ranked areas, displacing an area that had been
previously ranked as Tier 1. Increasing the National Security Index by
10% resulted in a new area moving into Tier 1, also displacing an area
that had been previously ranked as Tier 1.
Urban Area Sensitivity to Changes in Consequence Index Weights is
Reduced in FY 2008 for Funding Eligibility:
While Tier 1 areas were similarly robust in both FY 2007 and FY 2008,
the sensitivity of Tier 2 areas to changes in the weights of indices
used to calculate risk scores was significant in FY 2007, but improved
in FY 2008. In FY 2007, very small changes in the weights for the
indices used to quantify risk for Tier 2 urban areas at the eligibility
cut point resulted in changes in eligibility; however, FY 2008 results
are more robust, as eligibility of urban areas is much less sensitive
to changes in the index weights in the FY2008 model than it was in the
FY2007 model.
Population Index: In FY 2007, decreasing the weight of the Population
Index by 0.4% or increasing the weight of the Population Index by 4%
resulted in one area displacing another area with regard to
eligibility. However, neither maximizing nor minimizing the Population
Index resulted in one area displacing another area with regard to
eligibility in FY 2008.
Economic Index: In FY 2007, lowering the weight of the Economic Index
by 0.24% or increasing the weight of the Economic Index by 2.4%
resulted in one area displacing another area with regard to
eligibility. By contrast, FY 2008 required an increase in the weight of
the Economic Index by 12.33% or a decrease in the weight of the
Economic Index by 10.48% resulted in one area displacing another area
with regard to eligibility.
National Infrastructure Index: In FY 2007, changing the weight for the
National Infrastructure Index by 1.58% (either increase or decrease)
resulted in one area displacing another area with regard to
eligibility, while the FY 2008 National Infrastructure Index required
an increase in the weight by 5.67% or a decrease the weight by 4.54% to
result in one area displacing another area with regard to eligibility.
National Security Index: In FY 2007, increasing the weight for the
National Security Index by 0.08% resulted in one area displacing
another area with regard to eligibility, but FY 2008 required an
increase in the weight for the National Security Index by 2.34% or a
decrease in the weight of the National Security Index by 1.37% to
result in one area displacing another area with regard to eligibility.
[End of section]
Appendix IV: Contacts and Staff Acknowledgments:
For further information about this statement, please contact William O.
Jenkins Jr., Director, Homeland Security and Justice Issues, on (202)
512-8777 or jenkinswo@gao.gov.
In addition to the contact named above, the following individuals also
made major contributors to this report: GAO Homeland Security and
Justice Issues Team”Chris Keisling, Assistant Director; John Vocino,
Analyst-in-Charge; Orlando Copeland and Michael Blinde, Analysts; Linda
Miller and Adam Vogt, Communications Analysts. Other major contributors
to this report include: GAO Applied Methodology and Research Team”Chuck
Bausell, Jr., Economist, and Virginia Chanley; and GAO Office of
General Counsel”Frances Cook.
[End of section]
Footnotes:
[1] This figure includes such DHS grant programs as the Homeland
Security Grant Program, Infrastructure Protection Programs, and the
Emergency Management Performance Grants.
[2] In addition, HSGP encompasses three smaller grant programs: the Law
Enforcement Terrorism Prevention Activities, the Metropolitan Medical
Response System, and the Citizen Corps Program, which do not use a risk-
based methodology to allocate funds to grantees.
[3] Each state and territory receives a statutory minimum percentage of
available funds.
[4] The Infrastructure Protection Program supports specific activities
to protect critical infrastructure, such as ports, mass transit,
highways, rail and transportation. The grant programs included here are
Transit Security Grant Program, Port Security Grant Program, Buffer
Zone Protection Program, Trucking Security Program, and Intercity Bus
Security Grants.
[5] For example, GAO Homeland Security Grants: Observations on Process
DHS Used to Allocate Funds to Selected Urban Areas, [hyperlink,
http://www.gao.gov/cgi-bin/getrpt?GAO-07-381R] (Washington, D.C.: Feb
7, 2007)
[6] For the purposes of this report, we use ’risk analysis model“ to
refer to DHS‘s application of its risk calculation formula to score and
rank states and urban areas. We use ’risk-based allocation methodology“
to refer to the three-step process it uses in determining and making
grant fund allocations”risk analysis, effectiveness analysis, and final
allocation decisions.
[7] Pub. L. No. 110-161, 121 Stat. 1844, 2063 (2007).
[8] GAO Risk Management: Further Refinements Needed to Assess Risks and
Prioritize Protective Measures at Ports and Other Critical
Infrastructure, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-
91] (Washington, D.C.: Dec 15, 2005).
[9] 6 U.S.C. §§ 601(5), (8), 604(b).
[10] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-91].
[11] While DHS documents express their risk analysis model as a
function of Threat times the combination of Vulnerability and
Consequences,; mathematically, the 2007 risk analysis model was still
calculated as the product of T times V times C, or R = T*V*C. The risk
model considers the potential risk of international terrorism to
people, critical infrastructure, and the economy to estimate the
relative risk of terrorism faced by a given area. Risk is the product
of Threat, the likelihood of an attack occurring, and Vulnerability and
Consequence, the relative exposure to and expected impact of an attack.
[12] The Post-Katrina Emergency Management Reform Act of 2006 was
enacted as Title VI of the Department of Homeland Security
Appropriations Act, 2007, Pub. L. No. 109-295, 120 Stat. 1355, 1394
(2006).
[13] This tiering process was first used for the UASI grant program in
fiscal year 2007. Its effect on funding allocation will be discussed in
greater detail later in this report.
[14] This threat information does not consider either domestic
terrorism or natural hazards such as hurricanes or earthquakes,
according to DHS‘s Office of Intelligence and Analysis.
[15] For the urban areas in Puerto Rico, DHS split the total GDP of
Puerto Rico published in the CIA World Factbook into Puerto Rico‘s
constituent municipios according to the municipios‘ percentage of total
non-farm employees, a figure provided by the Bureau of Labor
Statistics.
[16] The 17 critical infrastructure sectors and key resources include
agriculture and food, banking and finance, chemical, commercial
facilities, dams, defense industrial base, emergency services, energy,
government, information and telecommunications, national monuments and
icons, postal and shipping, public health, transportation, and water
sectors.
[17] States are statutorily required to receive a minimum percentage of
the total funds appropriated for SHSP and UASI, and adjustments based
on their effectiveness cannot lower a state‘s risk-based allocation
below that threshold. UASI urban areas do not have a similar minimum.
[18] Additionally, fiscal year 2008 is the first year that FEMA has had
responsibility for the risk assessment and grant allocations for these
grants.
[19] In addition to the change to the definition DHS used to identify
the UASI areas, DHS also incorporated population density for the SHSP
risk analysis model and the presence of international waterways, based
on the language of the Implementing Recommendations of the 9/11
Commission Act of 2007.
[20] A model is sensitive when a model produces materially different
results in response to small changes in its assumptions. Ideally, a
model that accurately and comprehensively assesses risk would not be
sensitive, and such a model exhibiting little sensitivity could be said
to be more robust than a model with more sensitivity to changes in
assumptions underlying the model.
[21] A countermeasure is any action taken or physical equipment used
principally to reduce or eliminate one or more vulnerabilities.
[22] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-831R].
[23] See Society for Risk Analysis Benchmark Analysis for Quantifying
Urban Vulnerability to Terrorist Incidents Piegorsch, Walter W., Susan
L. Cutter and Frank Hardisty Risk Analysis Vol. 27, No. 6, 2007.
[24] Buffer zone extensions were considered for chemical plants (25
miles) and nuclear power plants (50 miles). According to DHS officials,
these distances were selected based on plume effects influenced by
research conducted by the Department of Energy.
[25] 6 U.S.C. § 601(5).
[26] Indianapolis (balance) refers to the portion of the consolidated
government of Indianapolis city and Marion County minus the separately
incorporated places of Clermont, Crows Nest, Cumberland, Homecroft,
Meridian Hills, North Crows Nest, Rocky Ripple, Spring Hill, Warren
Park, Williams Creek, and Wynnedale within the consolidated city. It
excludes the cities of Beech Grove, Lawrence, Southport, and Speedway
which are within Marion County, but are not part of the consolidated
city.
[27] Louisville/Jefferson County (balance) refers to the portion of the
consolidated government of Louisville city and Jefferson County minus
the separately incorporated places. For a complete listing of
jurisdictions, see OMB Bulletin No. 07-01, page 39 (Washington, DC.
Dec. 16, 2006).
[28] The title is pursuant to P.L. 98-369, Section 611 (July 18, 1984);
all counties specified in that legislation, plus five additional
counties, qualify under the 2000 standards and are included in the
definition of the Kansas City, MO-KS Metropolitan Statistical Area.
[29] The title and definition reflect the provisions of P.L. 98-473,
Section 119A (October 12, 1984), plus six additional counties that
qualify under the 2000 standards.
[30] Pursuant to P.L. 100-202, Section 530, the part of Sullivan city
in Crawford County, MO was added to the St. Louis, MO-IL Metropolitan
Statistical Area effective December 22, 1987.
[31] According to FEMA, for the purposes of DHS‘ risk analysis, a
policy decision was made to utilize the metropolitan division lines to
parse out the New Jersey metropolitan divisions from the NYC MSA. The
NJ metropolitan divisions of the NYC MSA were attributed to the Newark
MSA.
[32] Nashville-Davidson (balance) refers to the portion of the
consolidated government of Nashville city and Davidson County minus the
separately incorporated places of Belle Meade, Berry Hill, Forest
Hills, Goodlettesville, Lakewood, Oak Hill, and Ridgetop within the
consolidated city.
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office:
441 G Street NW, Room LM:
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
