Washington, D.C. George Washington University Homeland Security Policy Institute March 16, 2005 (Remarks as Prepared)

Thank you, President Trachtenberg, and thank you, Provost Williams, for that kind introduction. Actually, Dr. Williams, your colleagues have advised me to call you "Skip."  And, Frank, Secretary Ridge has advised me to call you often. And I'm sure I will.

I thank all of you who join me today. This is the first of what I hope will be many discussions we'll share regarding our nation's security. The Homeland Security Policy Institute here at GW sets the stage for these vital discussions, so I'm especially grateful for the opportunity to introduce myself at such a distinguished forum.

When the President offered me the position of Secretary of Homeland Security, I recognized it to be the challenge - the privilege - of my professional career. For my father, World War II was the calling of his generation.

Now, winning this war against terror is the great calling of our generation. In ways large and small, we have enlisted in a cause larger than ourselves - the cause of responding against a dangerous and merciless evil with courage and determination and an unyielding defense of the values to which this nation has long subscribed.

I come to this responsibility therefore with the conviction that, as a nation, we have every reason to be resolute about our fight against terror; every reason to be optimistic about our ability to enhance our security while preserving our liberties; and every reason to act urgently in doing both.

Of course, as with the Cold War, we know that this struggle will not be won for many years to come. This is a marathon, not a sprint. Accordingly, we must lay out a vision of homeland security that is sustainable over the long run - a vision that balances durable and comprehensive security with the American way of life and the values we cherish.

What does that involve? It means that we must calibrate an approach to security that incorporates prevention and protection into our lives in a way that respects our liberty and our privacy, and fosters our prosperity.

One large element will be giving people options: If people want the shorter line at the airport or expedited processing at our borders they can achieve it by agreeing to provide some limited personal information that assures us of their good faith. That trade-off will be their choice. Another element is trust. We will earn public trust when we demonstrate that the information we do collect and the measures we implement are tailored to the goals of preserving security and do not creep beyond that mission.

Our ultimate goal is a time when security measures are a comfortable, convenient part of our routine; a time when people go about their daily lives mindful of risks but not encumbered by fear, unwavering in their resolve and full participants in their own protection.

How do we get there?

First, we must acknowledge that homeland security is one piece of a broader strategy the President has deployed to protect this nation. That strategy first involves bringing the battle to the enemy.

As the President said just last week, "Our immediate strategy is to eliminate terrorist threats abroad, so we do not have to face them here at home."  

And that is what we have been doing. To be blunt, we have forced terrorists to spend more time worrying about how to defend themselves against death and capture, leaving them less time to plot how to get by our own defenses. That strategy pays enormous dividends in terms of diminishing the threat. First, the intelligence we gain is a major tool in disrupting threat. Second, by taking the fight to our enemies, we keep them on the run - limit their abilities to plan, train and act.

But while one key to defense is offense, it is not the entirety of our security picture. For we also need a "defense in depth" as part of the strategic whole.

That means even as we pursue terrorists overseas, we work at home to prevent infiltration by terrorists and their weapons; to protect our people and places if infiltration occurs; and to respond and recover if an attack is carried out. This is embodied in our strategy of building multiple barriers to terrorist attacks.

What defensive action does not and cannot mean is that we shut down, board up, wall in or become a fortress. Because what we are trying to protect - and at the same time, preserve - is not only our lives, but also our way of life.

America is dynamic. Our strength as Americans is the sum of every generation that has ever been born in or immigrated to this great land.

Our wealth and livelihoods are advanced by the inspiredeas and innovation of our own people. We prosper through the vast opportunities that exist to interact with the global economic community.

A nation as vital and thriving as ours cannot become hermetically sealed. Even less can we afford to be overwhelmed by fear or paralyzed by the existence of threats.

That's why we need to adopt a risk-based approach in both our operations and our philosophy. Risk management is fundamental to managing the threat, while retaining our quality of life and living in freedom. Risk management must guide our decision-making as we examine how we can best organize to prevent, respond and recover from an attack. For that reason, the Department of Homeland Security is working with State, local, and private sector partners on a National Preparedness Plan to target resources where the risk is greatest.

We all live with a certain amount of risk. That means that we tolerate that something bad can happen; we adjust our lives based on probability; and we take reasonable precautions.

Let me give you a simple example. The perfect way to avoid the risk of a car accident is never to leave your house. But very few people pursue this kind of perfect security because we understand that it is self-defeating. We all have to live with a certain amount of risk if we don't want to become prisoners in our own homes. When we get into our cars, we take reasonable precautions, but we also go about our lives: We go to work; we drive our children to school; we visit friends. We are managing risk.

We must manage risk at the homeland security level. That means developing plans and allocating resources in a way that balances security and freedom when calculating risks and implementing protections.

The most effective way, I believe, to apply this risk-based approach is by using the trio of threat, vulnerability and consequence as a general model for assessing risk and deciding on the protective measures we undertake.

Here I inject a note of caution because the media and the public often focus principally on threats. Threats are important, but they should not be automatic instigators of action. A terrorist attack on the two-lane bridge down the street from my house is bad but has a relatively low consequence compared to an attack on the Golden Gate Bridge. At the other end of the spectrum, even a remote threat to detonate a nuclear bomb is a high-level priority because of the catastrophic effect.

Each threat must be weighed, therefore, along with consequence and vulnerabilities.

As consequence increases, we respond according to the nature and credibility of the threat and any existing state of vulnerabilities.

Our strategy is, in essence, to manage risk in terms of these three variables - threat, vulnerability, consequence. We seek to prioritize according to these variables, to fashion a series of preventive and protective steps that increase security at multiple levels.

When I say multiple levels, I'm speaking, of course, of layered security. Many of you have seen a layered system of protective measures at land borders, seaports and as you make your way across the skies overhead. Layering is a strong force multiplier. Taken together, a "system of systems" cannot deliver perfect security, but it can increase the effectiveness of our efforts.

Let's look at how we work to keep dangerous people from hijacking airplanes.

As we vividly recall, on September 11th, nineteen terrorists, many traveling to the United States with expired visas, used phonyentification, boarded aircraft and then turned them into missiles.

Since then, we have erected several layers of defense against such attacks.

In less than one year, the President and Congress initiated US-VISIT.

That is one defense layer that allows us to weigh threat, vulnerability and consequence. US-VISIT uses biometrics - fingerscans and digital photographs - toentify and cross-check those wishing to enter the United States. It spans more than 130 high-volume airports and seaports and the 50 busiest land ports-of-entry. And since its inception, US-VISIT has processed more than 21 million passengers and stopped nearly 500 criminals and visa violators in their tracks.

It is impossible to monitor every single person who enters the country, but, with this system, we can pull the welcome mat from those who come packed with evil intentions.

US-VISIT can add a powerful layer to what we want to be a holistic system of security. But there are other layers of defense against terrorists: Enhanced screening for air passengers, federal standards forentification, air marshals on our aircraft and hardening of our cockpit doors. This layered approach is designed to assure that if a threat is missed at one layer, it will be caught at the next. At the same time, each layer must be efficient and flexible in order to allow the free and convenient flow of innocent citizens and visitors.

Of course, airline security is one obvious place where consequence, vulnerability and threat drive us to a layered strategy of managing risk.

What about other areas where we need to respond not only to past events but also prepare for future dangers? How do we avoid becoming beguiled by the risks we have already experienced, and distracted from those that our enemy might be planning in the future?

The first thing we have to do is examine the mission and work of all elements of DHS through the template of consequence, vulnerability and threat. Have we fully defined our missions? How far have we gone in carrying them out? What more needs to be done?

To answer these and other questions, I have initiated a comprehensive review of the organization, operations and policies of the Department as a whole.

Over the course of the next 60 - 90 days, this comprehensive review will examine what we need to do and what we are doing without regard to component structures and programmatic categories.

Old categories, old jurisdictions, old turf will not define our objectives or the measure of our achievements. Because bureaucratic structures and categories exist to serve our mission, not to drive it.

What should drive our policies and operations and the way we are organized is this strategic matrix of threat, vulnerability and consequence. And so, we'll be looking at everything through that prism and adjusting structure, operations and policies to execute this strategy.

Now, as we begin looking at ways to integrate our strengths at the federal level, we need to rely on our partners in government and the public in working to their strengths as well.

Let me emphasize this: Homeland security does not simply rest upon federal action; it requires collective national action.

When it comes to the protection of our people, our infrastructure, our companies, our communities, our country, we all have a role to play if we are to frustrate the enemy's intentions.

For two years now, it has been the responsibility of Homeland Security to lead the unified national effort to daily and consistently improve our security and preparedness measures. The federal government has unique access to intelligence, powerful investigative tools, strong resources. But the federal government cannot fund or address all of the risks involved with terrorism on its own. To complete our mission, we must and do count heavily on partnerships with our state and local governments and the private sector.

The kind of true partnership that protecting the homeland requires means that we not only share information but also responsibility. It means that we not only exchange expertise but also expect accountability. It means that our partners must bear a part of the security burden as well as become part of the security solution.

For example, the federal government dispatches radiation detection portal monitors to scan high-risk cargo. At the same time, we are looking to the companies that ship this high-risk cargo to put into place their own security measures - their own tracking systems, inspection processes - in other words, their own layered system of security.

The same can be said of chemical plants, oil and gas refineries, nuclear power plants. We can provide our own level of security protection, reconnaissance and expertise, but our partners that own these pieces of critical infrastructure must work hard to secure them. We must guide and create incentives for enhanced security, things like perimeter security personnel, internal and external alarm systems, pathogen detectors that can pinpoint explosive residues, containment shields and, again, multi-layered security systems that can protect against unfortunate human error and guard against evil human intentions.

Partnership occurs not only here at home. We also want to look more closely at how we can align with our international allies to build common security plans. It's in our mutual interest to strengthen relationships with other countries so that together we continue to find common ground in areas such as security, intelligence sharing and other issues of shared concern.

I look forward to meeting tomorrow with Deputy Prime Minister McLellan in Canada. In the weeks and months ahead, I'll be meeting with my counterparts in Mexico, Europe and Asia.

In all these exchanges, I offer this assurance to our international partners: From day one, this Department has looked to create a complementary, mutually reinforcing system of security for international travel and trade. Like you, we believe that we cannot live in liberty without security, but we would not want to live in security without liberty.

This Department will continue to work collaboratively with our friends and allies around the globe in pursuing these shared goals.

Finally, the individual citizen has to be a significant part of our overall security approach. Managing risk requires managing expectations. That means we must engage the public in a thoughtful and serious national discussion. We cannot pretend that nothing bad can ever happen and that perfect safety is within reach. The American people understand this; we must respect that understanding.

The plain truth is that there is no 100-percent solution. We cannot protect every person in every place at every moment. We cannot look in every container and every box. What we can do is use intelligent risk-based analysis, advanced technology and enhanced resources to manage risk. Again, we along with people all over the world live with risk every day; it's part of human existence.

That is an accepted expectation of life that must be translated to the war against terror.

Think of last month's train derailment in California. It was evidently caused by a man contemplating suicide. Suppose he had been a terrorist? It would not have changed the event and unfortunate outcome. But would it have changed how we reacted psychologically? It might have - and that psychological difference is important. Terrorists seek to exploit psychological vulnerability in order to leverage their force, to control and manipulate our behavior.

We win the war against terrorism by rejecting terror as a tool of intimidation. We triumph when we take account of real threats and risks but do not become hyper-sensitive or overly responsive to them. We want to live