Hearing of the House Government Reform Committee On the Ability of Federal Agencies To Function in the Wake of a Disaster - Transcript
HEADLINE: HEARING OF THE HOUSE GOVERNMENT REFORM COMMITTEE SUBJECT: CAN FEDERAL AGENCIES FUNCTION IN THE WAKE OF A DISASTER? A STATUS REPORT ON FEDERAL AGENCIES' CONTINUITY OF OPERATIONS PLANS
CHAIRED BY: REPRESENTATIVE TOM DAVIS (R-VA)
WITNESSES PANEL I:
LINDA D. KOONTZ, DIRECTOR, INFORMATION MANAGEMENT ISSUES, UNITED STATES GENERAL ACCOUNTING OFFICE;
PANEL II: MICHAEL BROWN, UNDER SECRETARY FOR EMERGENCY PREPAREDNESS AND RESPONSE DIRECTORATE, UNITED STATES DEPARTMENT OF HOMELAND SECURITY;
PANEL III:
JOHN KERN, DIRECTOR, NETWORK CONTINUITY, AT&T CORPORATION
LOCATION: 2154 RAYBURN HOUSE OFFICE BUILDING, WASHINGTON, D.C.
BODY:
REP. TOM DAVIS (R-VA): A quorum being present, the Committee on Government Reform will come to order. I'd like to welcome everyone to today's hearing on the status of the federal government's continuity of operations plans. Today on the House floor we're considering legislation laying out the framework of how Congress would continue operating in the event of a catastrophe. That's important but let's be honest: the real, tangible day-to-day work of the federal government doesn't happen here. It happens in agencies spread across the nation, and ensuring their continued operation in the wake of a devastating tragedy should be considered every bit as important.
Continuity of federal government operations planning became essential during the Cold War to protect the continuity of government in the event of a nuclear attack. COOP planning has attracted renewed significance after the terrorist attacks of September 11. Through a presidential decision directive and a federal preparedness circular, federal agencies are required to develop viable Continuity of Operations plans for ensuring the continuity of essential operations in emergency situations.
Although it is a classified document, PDD 67 reportedly also designates the Federal Emergency Management Agency, FEMA, as the executive agency for formulating guidance on executive departments' COOP plans, and coordinating and assessing their capabilities. In July of 1999 FEMA issued Federal Preparedness Circular 65, FPC 65, which confirms its coordinating agency role, contains criteria for agencies to develop their plans, and designates timelines for submission of agency plans.
Because of the critical nature of the ongoing threat of emergencies, including terrorist attacks, severe weather, and individual building emergencies, this committee requested the GAO to evaluate contingency plans of several federal agencies and review FEMA's oversight of those agencies' COOP plans. In February 2004, GAO issued a report that found a wide variance of essential functions identified by individual agencies. GAO attributed this lack of uniformity to several factors: lack of specificity of criteria to identify essential functions in FPC 65; lack of review by FEMA of essential functions during assessment of COOP planning; lack of testing or exercises by FEMA to confirm the identification of essential functions by agencies.
To remedy these shortcomings, GAO recommends that the secretary of the Department of Homeland Security direct the undersecretary for Emergency Preparedness and Response to ensure that agencies develop COOP plans by May 1, 2004, and correct deficiencies in individual plans. In addition, GAO recommends that the undersecretary be directed to conduct assessments of COOP plans that include independent verification of agency information, agencies' essential functions and their interdependencies with other activities.
The committee is concerned about the seeming lack of progress we have made in the area of federal continuity of operations. If 9/11 was the wake up call, then we haven't fully heeded the message when it comes to our planning. Although some progress has been made, and I commend Undersecretary Brown for his leadership on this, we still have a ways to go. We must do everything possible to address the COOP inconsistencies that exist across the board. Identifying and prioritizing essential functions with 100 percent compliance and accuracy is a must. Even if agencies can accomplish this, they still must be able to identify their key staffing requirements, lines of succession, resources needed and what mission-critical systems and data must be protected and, in many cases, be redundant.
Continuity of operations means more than keeping your website up and running. What's really called for is a holistic approach, one that factors in people, places and things. What's really needed is agility. Because FEMA's role in COOP oversight is key for agency success, the committee will hear FEMA's assessment of the individual agencies' COOP plans. The committee will also assess FEMA's efforts to ensure that the COOP directives are carried out by each agency. This will include steps FEMA is taking to assess each of the executive agencies' COOP plans, what interaction FEMA has had and plans to have with those agencies about deficiencies in those plans, what steps FEMA will take to ensure agency compliance, and FEMA's assessment of the adequacy of Federal Preparedness Circular 65 and steps it is taking to overcome any deficiencies. The committee will also hear from GAO about its assessment of COOP planning and its recommendations for improvement, and we'll also hear how the private sector deals with this issue.
Finally, the committee has asked GAO to continue to monitor federal COOP planning to ensure that agencies are in compliance with the latest executive and congressional guidance. The committee expects to get an annual scorecard from GAO outlining how agencies are performing with regard to the many facets of COOP. This is an important issue and we will be very aggressive on our oversight.
We have three impressive witnesses before us to help us understand the current and future state of federal continuity of operations planning, the expected problems and what we can look forward to in ways of improvements. First, we will hear from the General Accounting Office, followed by the Department of Homeland Security, and finally we will hear from AT&T, which has a mature COOP plan in place. I want to thank all of our witnesses for appearing before the committee and I look forward to hearing your testimony.
Are there any other members who wish to-
BREAK IN TRANSCRIPT
REP. DAVIS: Thank you. Any other members wish to make opening statements? If not, we'll move to our first witness Linda Koontz, the director of Information Management Issues at the General Accounting Office, no stranger to this committee.
As you know, it's the policy of the committee that all witnesses be sworn in before they testify. So, Linda, if you'd rise and raise your right hand.
(Ms. Linda D. Koontz sworn to testify.)
REP. DAVIS: Let the record we note we have-the two of your aids behind you are also sworn in. Please proceed with your testimony. You know the rules. We have the buttons-the lights on here for five minutes and thank you for being with us again.
BREAK IN TRANSCRIPT
REP. DAVIS: Thank you. Linda, let me get started. The bottom line is: are our agencies really prepared for the worst?
MS. KOONTZ: Agencies do not have plans at this point that are fully compliant with the requirements of FPC 65, and therefore I'd have to conclude that there is no assurance that they are prepared for an emergency.
REP. DAVIS: In fact, some of them are fairly woefully prepared?
MS. KOONTZ: That is correct.
REP. DAVIS: The report -- 19 agencies failed to identify their interdependence with other agencies and how these interdependencies affect their essential functions. Was GAO provided with an explanation as to why these agencies didn't identify their interdependence in their Co-op plans?
MS. KOONTZ: I don't-I think part of the issue, that my staff is telling me, that the requirement to identify interdependencies we think would be a good practice. But that requirement is not specifically outlined in FPC 65, so that is most likely the reason.
REP. DAVIS: Do you get the feeling some of these agencies are just checking the box? This is just another requirement that they've got to do; this isn't really-this isn't part of their mission, but it's paperwork they've got to turn in so it's kind of-they're not utilizing their resources, including for other missions in the department?
MS. KOONTZ: It's hard for me to comment on specific agencies' motivations for what they do, but we have to say that in some cases we saw what we thought looked like sort of a rote, sort of template approach to the development of plans.
REP. DAVIS: Yeah. I think one of the difficulties both in the executive branch and the legislative branch, we put all of these different requirements on agencies and it's hard for them to pull down what their priorities are. If they do them all, they'd never be able to get anything done and so as a result of that, sometimes nothing gets done. You know, the role of this committee is to kind of highlight shortcomings in some of these areas.
This area, the cyber security area. Again, another one similar where agencies check boxes but they don't really make this mission critical. And they may be able to escape it. This is one of those issues that, you know, hopefully we'll never see that kind of disaster and it will never happen. But if it does and we're not prepared, of course, the results are then worse by an exponential amount.
MS. KOONTZ: If I could add to that the fact that FEMA hasn't done the regular checking and oversight of the plans. I think that's created part of the situation that we see today. If agencies realize that someone is going to be routinely looking at these plans, I think that would provide greater incentives for providing resources for this activity.
REP. DAVIS: And there's no requirement, is there, that they send the plans to the Congress? Send them up --
MS. KOONTZ: No, sir.
REP. DAVIS: That might be something-I mean, that we could get access to that-that we look at to try and underscore the importance of this. I mean, hopefully then-this is something if you don't do it, if it never happens nobody will know the difference. But if you have a disaster, there we are. The report states that FEMA attributed lack of oversight of these plans in part to its limited number of personnel responsible for guidance. Now, as a result of your investigation can GAO concur with FEMA that inadequate personnel numbers significantly affected FEMA's ability to conduct oversight?
MS. KOONTZ: We didn't specifically evaluate the numbers of staff that would be necessary for FEMA to conduct this oversight activity. However, we do know that FEMA has, since we completed our work, undertaken a rather large effort to get many more people involved. So this should not be a problem going forward.
REP. DAVIS: Thank you very much.
Ms. Watson.
BREAK IN TRANSCRIPT
REP. DAVIS: Thank you very much.
The gentlelady from Tennessee?
BREAK IN TRANSCRIPT
REP. DAVIS: Thank you very much.
Ms. Norton.
BREAK IN TRANSCRIPT
REP. DAVIS: Well --
REP. NORTON: -- if there were an emergency, it could be handled.
REP. DAVIS: Didn't FPC 65 give out the basic guidance?
MS. KOONTZ: Yes, FPC 65 provides basic guidance on the eight elements of a viable capability. However --
REP. NORTON: Isn't that also from 1999?
MS. KOONTZ: Yes, that is from 1999.
REP. NORTON: That is my problem.
MS. KOONTZ: Mm-hmm.
REP. NORTON: That is my problem. I think the world has changed since September 11, 2001, and that was before 1999 -- that was after 1999.
REP. DAVIS: I was going to say --
REP. NORTON: I think that is a more radical critique than the GAO report, is what I'm trying to say.
REP. DAVIS: Ms. Koontz?
MS. KOONTZ: I would just say that one of the things that we point out, I think quite strongly, in our report is that the identification of essential functions is a very critical first step in doing effective continuity planning. If you don't do that right, it probably doesn't matter what you do after that because you haven't figured out what it is you need to deliver in an emergency. But we also point out that the guidance to agencies-although they've issued general guidance, it was not specific enough to agencies for them to identify really what an essential function was and get any consistency across agencies. And that was compounded by the fact that FEMA was not doing the regular kind of checking and oversight to provide their expertise, to lend their expertise to the development of these plans, and provide their broad view of what was going on government wide. So I think our report does address some of the issues that you're identifying here.
REP. NORTON: Thank you very much.
And thank you, Mr. Chairman.
REP. DAVIS: Thank you very much.
Ms. Davis.
BREAK IN TRANSCRIPT
REP. DAVIS: Okay. I think the Ms. Davis' idea of the telecommuting is something that-for agencies here it would-we need to do more of, and this committee will have follow up hearings on that. I would say if an office gets devastated, people don't need to be in the office in many cases to carry out their duties.
Mr. Van Hollen? No questions?
Ms. Maloney? No questions?
Thank you very much. This has been very helpful to us. We may have some follow up pending some of the others, but we appreciate your oversight on this and your analysis.
MS. KOONTZ: Thank you.
REP. DAVIS: Thank you very much.
We'll proceed now to our second panel. I want to thank Undersecretary Michael Brown-the Honorable Michael Brown, the undersecretary for Emergency Preparedness and Response Directorate in the U.S. Department of Homeland Security for being with us today. Why don't we take a-we could take a minute recess probably. There he is.
Mr. Secretary, thank you for being with us. I'll swear you in, our policy as always.
(Mr. Michael Brown sworn to testify.)
REP. DAVIS: Thank you very much for being with us today. We'll have some lights in front of you on the panel. After four minutes an orange light will come up, give you a minute to make it five. If you feel you need to go over it, we're not pressed for time; you can do that. But your entire testimony is part of the record and our questions have been based on that. But thank you very much for being with us today and thank you for the job you're doing.
MR. MICHAEL D. BROWN: (Off mike.)
REP. DAVIS: You have to make sure the microphone is on, the toughest part of the whole thing.
MR. BROWN: I'm not used to coming in second. I guess you're just ready to go ahead and start then, right? Okay. Good morning, Chairman Davis and members of the committee. My name is Michael D. Brown and I am the undersecretary for Emergency Preparedness and Response of the
REP. DAVIS: Mr. Brown, let me just say the reason we had you second is we have GAO first and we give you the last word.
MR. BROWN: Sure. Right.
REP. DAVIS: (Cross talk.)
MR. BROWN: All right.
REP. DAVIS: So it's really to your advantage to be in that position.
BREAK IN TRANSCRIPT
REP. DAVIS: Thank you very much. Just to start off, I was pronouncing it CO-OP plans, you're pronouncing it the COOP plans. And the reason I called it CO-OP is because chickens are in charge of the coop and I didn't want anyone in the administration to cry "fowl" at what I was doing, because that's "eggs-actly" what they do. Obviously, I didn't want --
MR. BROWN: (Laughs.) I can't compete with that.
REP. DAVIS: I didn't want the agencies to wing it on their COOP plans. So we're going to risk ruffling some feathers here today. But I think it's fair to say the administration's proposal so far is nothing to crow about. Let me ask a few questions.
MR. BROWN: Okay. (Laughs.) I'm ready to fly the coop, so --
REP. DAVIS: (Laughs.) Well, everybody acknowledges that the first and most critical element of any COOP planning is the identification of every essential function that an agency performs and will attempt to maintain in case of an emergency. But GAO reports that individual agencies' identification of the essential functions really vary widely. Can you just kind of review in brief for us what steps FEMA has taken to assure that the critical functions are accurately carried out by every federal agency?
MR. BROWN: Absolutely, Mr. Chairman. FEMA has a coordination role and provides guidance and assistance, but it is really up to the departments and agencies themselves to determine what's essential for their COOP plans.
We do such things as have a monthly forum the interagency COOP working group for the departments and agencies to address those issues and share best practices. I also believed that the revised Preparedness Circular that is soon to be released at the end of the fourth quarter will provide better decision making guidance to the departments and agencies, that it will also ensure consistency across the federal government. Moreover, through a readiness reporting system that FEMA is now implementing, we will be in a better position to provide more accurate and timely information regarding each department or agency's COOP activities.
But I believe it's important to note-particularly important to note that for the first time ever, as I said in my oral statement FEMA exercised its headquarters' COOP plan. It involved actual notification and actual deployment of our Emergency Location Group to our alternate facility. This is the first time ever that FEMA has done that, and that we will now oversee for the first time ever a federal government wide COOP exercise that will allow us to establish the baseline for future exercises that we continue-that we want to have now on an annual basis.
REP. DAVIS: I guess when-I asked this question of the previous panel: are agencies prepared for the worst today? Or are we getting there?
MR. BROWN: We're certainly getting there. And my --
REP. DAVIS: I --
MR. BROWN: My hesitation is not about preparedness. My hesitation, Mr. Chairman, is about what is the worst? Because the worst in my world, unfortunately, is the detonation, for example, of a nuclear device or a dirty bomb or a bioterrorist event which will result in catastrophic casualties and a catastrophic disaster of proportions that will overwhelm all of us. So that-these are my hesitation. I believe that every department and agency has a very good, robust COOP plan in place that we just now need to fine tune. I mean, I just --
REP. DAVIS: The experience of this committee as we go through little emergencies that come across the city-for example, regionally as we had Tractor Man, who had a gun in a tractor, hold up traffic and tie up this city for three rush hours. And there was-the planning that took-there was no planning. There was-you had the vision of what the priorities were: well, to make sure that the person escaped-I mean, that he wasn't injured and was apprehended but no one was injured. Nobody looked at the-and so some of this stuff gets very contradictory as we start to have to go down the path to decide what are the priorities. You can't anticipate any and all bad things that can happen.
MR. BROWN: No. But I think based on the template that we've put together and the revision of the Federal Preparedness Circular that we will be able to provide them with a template that allows them to respond to almost any kind of disaster.
REP. DAVIS: Ms. Norton's concern in the previous panel was that we were dealing with a circular from the executive that came-was a 1999 circular, before 9/11. On 9/11 I can tell you we certainly weren't prepared on Capitol Hill. We didn't know who to call. We're kind of irrelevant to the process, though. But basically, I mean, I don't like to think of it that way, but the government went on fine. Everybody-people-the military does their job, the police do their job, other agencies kick in. It's a lot more important than what happens here.
And I guess my question is as we look at different agencies, we see different levels of planning for this. That's not unusual. What you usually find is we put so many requirements on these different agencies and secretariats and the like, that they have to sort it out and some take it more seriously than others. And in fact some of them, how they plan is going to be more important to the American people than others. And so as you look over this, in terms of your planning and the checklists and everything else, what are we doing to check on this?
There is an allegation at GAO that maybe you didn't have enough people to really implement this job. This is a contingency plan and so it may never happen and some agency leaders, I think, think, "Well, I don't have to do this because it will never happen and then I can put my resources somewhere else and accomplish something that everybody"-"that I know will happen." What's your reaction to that?
MR. BROWN: Let me go-three things I want to respond to, Mr. Chairman. First of all, your comment about the ability of the federal-the ability of the executive branch to be able to actually COOP and respond in times of an emergency. The good news, I believe, out of this hearing should be that all of the major departments and agencies-in fact, all of the departments and agencies have a COOP plan in place that we have reviewed and we have looked at. Do those need to be fine tuned? Absolutely. Do we need to continue to improve those? Absolutely. But there is no place in the executive branch-the departments and agencies where there is the lack of a COOP plan. So that's the good news.
GAO is correct in that we have been concerned about the staffing levels. But one of the priorities that I've put in since becoming undersecretary was to increase the staffing in our National Security Coordination Office, and we have increased the staff levels. Additionally, we have received incredible support from President Bush and the administration and in the '05 budget there is a $12 million increase specifically for COOP activities.
REP. DAVIS: One other criticism that came out of the GAO report-I wouldn't call it a criticism, but one of their observations was that some of the COOP reports that came in really didn't talk about how they interact with other agencies; that they'd simply look at what they did, and it was almost like a checklist-which, by the way, is not uncommon. I'm not trying to be overly critical here, I'm just trying to make sure that as we look forward we can continued to improve.
MR. BROWN: And that is exactly one of the things that we want to test in Exercise Forward Challenge. It's not just their ability to pick up and leave and go to their alternate sites, but how do they interact? How are the interdependencies? How is the interoperability of communications among the different Ds and As and working to improve that. So you have identified exactly one of the areas that we intend to push in an exercise. And I would just take this opportunity also to caution anyone about the exercise, because it is my philosophy and it's one that I'm trying to push all the way through FEMA in the entire department, is that we don't do exercises to make things look good. We do exercises to push the envelope to find out where the vulnerabilities are, to find out where the weaknesses are so that we can come back and improve upon them. So I fully expect after Exercise Forward Challenge, of course, the interagency working group to get back together and find places where interdependencies didn't exist and they need to improve those.
REP. DAVIS: Well --
MR. BROWN: That's the purpose of the exercise.
REP. DAVIS: Right. And you do provide information about Exercise Quiet Strength, which was FEMA's December 2003 exercise to test its headquarters' COOP plan. But that is an isolated exercise of one agency. And in reality of course, particularly with you all, an actual emergency would involve government wide functions. Is there a network to test some of that later on and the interaction of some of the agencies?
MR. BROWN: There absolutely is. But before we can go out and be a good leader and convince all the other departments and agencies to do this, we have to show that we're willing to do it too.
REP. DAVIS: Okay.
MR. BROWN: And since FEMA had never done this exercise, I was very pleased that we were able to pull it off and be as successful as we were.
REP. DAVIS: Thank you very much.
Ms. Watson.
BREAK IN TRANSCRIPT
REP. DAVIS: Well, Ms. Watson, let me just say-to state, stick with the puns but to keep them on subject. And the birds and the wires is we can't do this on the cheap.
(Laughter.)
REP. DAVIS: Can't do it on the cheap.
MR. KERN: You know, I was going to in my opening remarks mention as my extra kind of capacity in my-I have seven acres in New Jersey. I have about nine hens and a rooster, so I am familiar with coops both at a business level and at a personal level, but that didn't seem right. But now the chair has thrown cheap into the bargain, well maybe. But, you know, definitely-you know, we're definitely going to assist the government wherever we can.
You know, we have over the 100 years that we've been around as an enterprise, AT&T has developed a very comprehensive set of standards around things like physical infrastructure, how do you power an enterprise that's important to you? How do you back that power up? What do you do around cyber security, physical security?
How do you have continuity of operations plans that really take into effect where you can bring your people to, what kind of work they're going to need to do. Impacts of things like telecommuting.
All those of things, you know, we have a great expertise at and are definitely willing to help the government wherever we can, either through our technology, our standards or expertise, or just the experience that we've developed over in some cases the last 12 years for business continuity, but in other cases 100 years in operating a rather large infrastructure, a rather critical infrastructure that provides the network service everybody relies on.
REP. WATSON: Mr. Chairman, if I can just take one more minute? We are going to have a bill on the floor, the Sensenbrenner bill, and we read the fine print-you know, this is where policymakers come in. You know, we read the fine print, we don't go on our experience. And it says that if there is an extraordinary circumstance and the speaker of the House of Representatives announces vacancies. Well, if the plane has succeeded in hitting the Capitol, it might have wiped everyone out, including the speaker. So if we're going to put law in the books and make a policy, we're going to have to think beyond the words here. So it should be a designate, someone who-and who does the designating, because the speaker and all the rest of us will probably perish if that would occur?
And so the point I'm making is that we have to think differently than we have in the past. And as a policymaker, this becomes the law, you know, it can be adjudicated in the courts. So how do we think in a way that will address these unusual circumstances? And those of you out in the field, in terms of the way agencies work and operations work and utilities work and so on, have to benefit-we have to benefit from your experience and you have to suggest to us. Now, whether we make policy based on the input is left up to us. But I really invite your recommendations.
And with that, I want to thank you, Mr. Chairman.
REP. DAVIS: Ms. Watson, thank you very much.
Mr. Ruppersberger, do you have any questions?
BREAK IN TRANSCRIPT
REP. DAVIS: Thank you very much. I want to thank the members for attending, thank our panelists.
Mr. Kern, thank you very much. This has been very, very helpful to us and we wish you luck in your future endeavors as well. Again, I want to thank our witnesses for attending. I'd like to add that the record will be kept open for two weeks to allow witnesses to include any other information in the record.
The hearing is adjourned.
END