Safety and Security in Megacities
Lewis M. Branscomb
Harvard University
… unlike biological communities … [the city is] a kind of artificial ecosystem dominated by technology, sustained by natural life support systems and motivated by social behavior. It is a socioeconomic natural complex ecosystem.
—Lu Yongxiang, President, Chinese Academy of Sciences1
The world population is already concentrated in cities, and this concentration will continue. Populations around the world are migrating to the greatest cities, seeking economic opportunity and security. If the megacities are able to provide safety and security to their citizens, as well as economic opportunity and social services, there may be many benefits. Declining population in rural areas may reduce stress on natural environments. The efficient aggregation of resources and provision of social services may improve the quality of life. Megacities linked through shared experience and mutual support may emerge as a new pattern of social structures internationally, focused on human needs that nation states often address less effectively. However, the very richness of big city resources is itself a source of vulnerability to a broad range of kinds of disasters.
Big cities, with their high-density populations, are exposed to a variety of threats of disaster; they must be organized to prevent and respond to those disasters, large and small. Traditionally these have been either natural disasters (hurricanes, floods, earthquakes, tsunamis, and so forth) or technogenic2 disasters
resulting from human error and infrastructure that fails to be sufficiently robust. Russia3 and Japan4 have taken the view that the newest and most threatening form of disaster—terrorism—should be considered as an extension of the threats for which cities are historically organized. This is the right way to analyze the problem, that is, looking more broadly at safety and security, including terrorism, for two reasons: (1) The agencies and officials who are responsible for dealing with earthquakes, fires, power blackouts, and riots must, in most cases, use the same facilities and capabilities for coping with terrorism, and (2) only this approach allows an affordable and sustainable effort.
Megacities5 differ from smaller cities not only in their enormous size and high growth rates but also in both the depth and the range of their resources and the complexity of assuring the reliable functioning of all the services on which the city’s life depends. Megacities do enjoy concentrations of valuable human and physical resources, but while natural disaster response capability is extensive in many megacities, it is often not sufficient to prevent wide-scale destruction and loss of life. In some megacities neither resources nor political will are sufficient to make megacities significantly less vulnerable. Transportation facilities, for example, may not be adequate to provide for emergency evacuation when necessary. As cities have grown faster than municipal governments can build and adapt their infrastructure to cope with disasters, capabilities such as public transportation have failed to keep up with emergency requirements.
Now one must add to natural and technogenic disasters the threat of social violence, of which the most extreme form is catastrophic terrorism. Social unrest, and its extreme form, terrorism, are very old threats to established societies. In the wake of the end of the cold war, new forms of conflict have proliferated, stimulated by ethnic rivalries, political insurgencies, and religious bigotry, often with deep historic roots. From 1989 to 1999 major incidents of social violence took place in 34 major cities around the world, including some 15 in the Middle East and Asia. The character of the resulting conflicts has changed, however, with civilians as both the targets and the instruments of terrorism, and with new technologies (including the so-called weapons of mass destruction) dramatically expanding the potential for death and destruction.
MODELS OF MEGACITIES—CRITICAL INFRASTRUCTURES
The interdependent services provided by critical infrastructure make it possible for millions of people to live close together. To the extent the city can protect, control, and manage energy, water, communications, medical, transportation, and emergency services, and can manage the city’s resources of food, heavy equipment, and specialized technical skills, a city has many of the tools for responding to and recovering from a disaster of whatever cause.
On the other hand, all of these services, referred to as critical infrastructure, are both vulnerable and interdependent. Thus the social impact of an earthquake that knocks out electric power, blocks streets and rail lines, interrupts telecommunications, and ruptures the major conduits for gas and water, is not basically different from a terrorist attack on power stations, transportation facilities, water, and other infrastructure. The major difference between a natural disaster and an intentional terror attack is that the latter can be designed to target specific weaknesses in critical infrastructure and in emergency information and control organizations, and thus have a maximum disruptive effect on a city.
Attacks are likely to involve multiple complex systems. There are a number of dimensions to the systems engineering challenge of homeland security. The multiple critical industrial infrastructures are closely coupled. Almost all of the responses to terrorist threats require the concerned action of federal agencies, state and local authorities, private companies, and in some cases friendly na-tions. The technologies used in counterterrorism will themselves be coupled complex systems. An evident example is the notion of complex networks of sensors that are coupled to databases, within which the network output is fused with other information and from which sensible information must be provided that local officials in emergency operations centers (EOCs) can use. Thus, priority setting requires modeling and simulating attack and response, red teaming to test the effectiveness of proposed solutions.
Most nations with large cities fail to give adequate attention to the interdependence of the critical infrastructure services on which the city depends. In addition, governments have generally failed to address the realities of human behavior in response to severe disruption of those services and the panic, sickness, injury, and death that may occur on a large scale if more than one of the critical infrastructures fail. The consequences of disasters in megacities fall into six categories. Whether the result of natural, technogenic events, or deliberate attack by terrorists, disasters may be organized into these categories:
-
sickness and death from disease, including illness from contaminated food
-
loss of communications and information services, resulting in weakened decision making and command and control and perhaps panic among the people
-
loss of electric power and fuel supply, affecting all other elements of infrastructure that are not equipped with emergency power generators
-
failed or blocked transportation services (air, sea, and land) slowing evacuation from the city and preventing access to incoming medical aid, food, water, heavy equipment, and other resources
-
destruction or toxic contamination of buildings occupied by large numbers of people (especially modern office buildings with fixed windows and central ventilation)
-
vulnerability of people densely congregated in large numbers (in high-density urban neighborhoods or public facilities) to fire, communicable disease, toxic gases, loss of shelter, and panic from terror weapons such as radiation dispersal devices
Each of these threats represents a catastrophic failure in one or more of the city’s critical infrastructures. In natural disasters (such as earthquakes) all of these consequences may ensue simultaneously, and each may exacerbate the others. The appearance of an infectious disease, however, may be slow to exhibit symptoms and spread to other people. If the disease is diagnosed and the infected persons are isolated quickly enough, the consequences may be contained. However, many megacities are so densely populated and have such marginal medical facilities that a pandemic, once out of control, would spread very rapidly. With an electric power failure, all other activities may be severely disturbed, as in the 2003 power blackout for about a third of the population of the United States.6 However, in each case, the magnitude of the cascading of one failure to create the next depends critically on the design of each element of infrastructure.
UNIQUE VULNERABILITIES TO TERRORIST ATTACK
Cities have certain vulnerabilities that are unique to terror attack. The EOCs in many large U.S. cities are quite vulnerable, not only to a destructive physical attack but also to more indirect cyber- or electromagnetic pulse (EMP)7 attack on their ability to access data and to communicate. Remedying these vulnerabilities must have high urgency; in many cases the centers will have to be relocated.8
Much research is already under way to analyze the structural characteristics of high-rise buildings that may make them much more vulnerable than necessary. Without waiting for this research to result in revised building codes, an
expert panel of the U.S. National Academies recommended immediate adoption and extension where appropriate of European standards for fire and blast, which were much improved following World War II. Air intakes for large buildings need to be less accessible and should be equipped with better air filters, perhaps with chemical analysis sufficient to determine that toxic or infectious materials are present.
People are the ultimate targets of terror attacks: creating not only death but also fear and panic. The best protection against panic is a quick and accurate diagnosis of the situation, followed by prompt, appropriate, and effective action and clear, transparent information to the public. Effective disbursement of public information is difficult with dispersed authority and accountability.
THE COMPLEXITY, EFFICIENCY, AND VULNERABILITY OF URBAN INFRASTRUCTURES
Many studies of critical infrastructure in the United States have been made over the years. Each time the list grows. Table 1 illustrates the growth of the list of critical infrastructures in the United States from seven in a Congressional Budget Office study in 1983 to 13 in a 2002 White House strategy document. Examination of studies of critical infrastructure suggests that the economies of large, densely populated urban areas are characterized by a combination of independent enterprises, connected in networks of services on which they depend for their ability to deliver goods and services in a highly competitive way. By comparison, a rural agricultural area might be characterized by a high degree of self-sufficiency, with its own food production, the use of wind power for pumping water from wells, and substantial capability to repair machinery. It might have its own electric generators if far from power lines. The primary infrastructure dependencies would be the residual dependency on fossil fuels to operate trucks, tractors, and other machinery.
A 2002 report9 of the National Academy of Sciences, National Academy of Engineering, and Institute of Medicine attached a high priority to the establishment, within the new U.S. Department of Homeland Security, of a Homeland Security Institute to provide the systems analysis and decision support services to the senior officials in the department.10 This kind of institution might be a model for megacities as well, since it takes a holistic view of the city and all its interrelated systems: information, physical facilities, infrastructure services, and human behavior.
As economies improve, the richest cities may have more resources than
TABLE 1 Growth in Lists of Critical Infrastructures
1983 Congressional Budget Office |
2002 President’s Strategy for Homeland Security |
Roads |
Agriculture |
Transit |
Food |
Wastewater |
Water |
Water supply |
Public health |
Air traffic control |
Emergency services |
Airports |
Government |
Municipal water supply |
Defense industrial base |
|
Information and telecommunications |
|
Energy |
|
Transportation (people and product) |
|
Banking and finance |
|
Chemical industry |
|
Postal and shipping |
towns and villages, but big-city critical infrastructures may become more vulnerable to disasters. The physical facilities in which large numbers of people are concentrated are largely in big cities. So too are many of the industrial facilities whose destruction might inflict both economic damage and human injury if toxic substances were released. The responsibility for protecting critical facilities and infrastructure is distributed among private and government owners, and on the government side, among national, regional, and municipal authorities.
A large source of vulnerability of civil society arises from the very efficiency of a competitive economic system. The competitive drive for commercial efficiency creates linkages and vulnerabilities in the critical infrastructure industries. The mechanisms through which the quest for industrial efficiency may threaten an industry’s resilience to catastrophe include
-
single-point failures: when replacement costs are high, long delays may result from a failure (example: unique ultra-high-voltage transformers in electric power distribution)
-
excessive aggregation of production or service in the quest for scale economies (example: in the United States the concentration of chicken meat processing and distribution is in a handful of large firms; in Europe the new Airbus may carry up to 800 passengers)
-
coupling to other critical infrastructure systems to leverage their scale economies (example: dependence of transportation safety on availability of electric power and secure computer networks)
-
extensive substitution of automated decision systems based on software and networks vulnerable to penetration from remote locations (example: denial-of-service attacks, now familiar in all countries, may be aimed at command and control capability.)
Thus a competitive economy creates new vulnerabilities, which only government policy and industrial cooperation can reduce. If industry is to bear the cost of these investments, it must make those investments without any reliable means of evaluating risk, and thus the firm may not feel justified in spending the capital. So who will pay to make infrastructure more secure?
This is a serious question, since in the United States the federal government assumes the private sector will make the most important investments to reduce their vulnerability, while the firms, having no reliable way to estimate the risks they face, are reluctant to risk becoming uncompetitive by being first to make such investments. There are alternatives for federal policy to provide appropriate incentives, including
-
compulsion through regulation
-
subsidies of the research and development to assist in designing the hardening strategies through public-private research and development partnerships (This still leaves industry with the capital expense for implementing the strategy.)
-
voluntary commitments with antitrust exemption (The chemical industry in the United States has an excellent record of voluntary standards for plant safety, which might become a model for protection from terrorism.)
-
inducing the reinsurance industry to set a sliding scale of rates for terrorism-loss insurance, reflecting the extent to which client firms have invested in measures to reduce vulnerability to disasters
CENTRALIZATION VERSUS DECENTRALIZATION
As previously noted, the organization of critical infrastructure defenses is made complex by the need for government and private business to collaborate in strategy and response to disasters. In the United States there is an additional element of complexity: the presence in most metropolitan areas of multiple political jurisdictions, often quite independent of one another. A striking and perhaps extreme example of this is the Washington, D.C., metropolitan area. Five million people live in this area, but only 572,000 of them reside in the District of Columbia. The district is a federal enclave that functions as the federal seat of government, is legislatively treated for many purposes as a state, but is in fact a city. Within D.C. are found most of the critical targets for terrorists—the Capitol and White House among them. Responsibility for coordinating disasters resides in the D.C. Emergency Management Agency (DCEMA). Its challenge is that it has direct and sole authority over only one disaster response resource—the D.C. fire department. All other resources are controlled by either federal authority or the two states, Virginia and Maryland, that surround it. Counting the counties and cities imbedded in these states, there are 18 political jurisdictions with which
the DCEMA must work. Thus the DCEMA can only coordinate information about vulnerabilities, invite its neighbors to cooperate in training exercises, and seek to coordinate all their activities when a disaster strikes the city. To make matters worse, the DCEMA has a very modest budget and operates out of a modest space in a glass-walled building in the northern part of the city.11 The people who run this facility appear to have done a remarkably effective job, given these constraints, but lacking line authority over the resources required for emergencies, they preside over a highly decentralized structure for disaster response.
This raises an interesting question: What are the relative merits of centralized versus decentralized structures for responding to disasters in megacities? The contrast between the institutional structure in the Washington metropolitan area and in Tokyo, Japan, is striking.
Tokyo has a powerful city government that operates a very sophisticated EOC. The mayor of Tokyo is a powerful political figure in Japan, and he commands the center. The EOC covers two floors of a very large office building that is one of two city office buildings. It is on the seventh and eighth floors, high enough to walk to but out of reach of ground floor attackers. It is very well equipped and organized. I observed an exercise simulating a Richter 7.3 earthquake in downtown Tokyo at this facility.
Each functional service—fire, transport, telecommunications, police, medical services, and so forth—has its own operations center, with the staff dressed in uniforms of immediately identifiable colors.
Status information is fed up from hundreds of local community officials to a central planning room. A much larger command center, on the scale of a manned space launch control room, brings the mayor, his top advisors, and heads of all the functional services together for strategic decisions. On a full-time basis the mayor is represented by retired Lt. General Toshiyuki Shitaka, who brings a high level of discipline to the complex operations of the center.
Central control, as evidenced in Tokyo, has great effectiveness advantages. Through subordinates the mayor of Tokyo has line authority over the component resources, and he can ensure a general budget for the EOC and its staff. The center is equipped with very modern and capable information technology (IT) equipment. For natural and technogenic disasters, the Tokyo center is adequately protected. However, it is not invulnerable, and for certain classes of terrorism attacks with weapons of mass destruction, it might not be adequately protected.
The DCEMA, on the other hand, has very limited authority and limited resources. It is also evidently vulnerable to any attack that would break the glass covering one side of the control room. If, however, the DCEMA were to be
made ineffective, there are multiple layers of services, including federal military and D.C., Virginia, and Maryland National Guard forces, that could provide some infrastructure to knit together all the separate first responder services in the 18 political jurisdictions that comprise the Washington metropolitan area.
The primary conclusion from this comparison of centralized and decentralized organizations is that the differences may be large when faced with a deliberate attack from terrorists, but the centralized and decentralized facilities are perhaps comparable in capability when responding to natural and technogenic disasters. One of the major advantages of a well-structured, centrally commanded emergency operations authority is the potential to provide uniform, credible information to the public. This would in theory be provided by the DCEMA, but in a major terrorist disaster, political officials such as the president, two governors, and secretaries (ministers) in charge of military and homeland security resources would very likely provide mixed messages.
THREE AREAS FOR POSSIBLE COOPERATION BETWEEN THE U.S. AND RUSSIAN ACADEMIES
Modeling Cities and Their Infrastructure
Unless infrastructure services most critical in a disaster can be modeled and simulated it will be very difficult to assess a city’s vulnerability under various disaster scenarios. These models would have to include modeling relationships between government and private institutions, and across interdependent infrastructures and independent government authorities. In addition there is a need to model management of disasters, and especially terror attacks, under both centralized and decentralized command structures. High levels of professional skill at complex systems modeling are required; a sharing of ideas about methods and data could be helpful in both countries.
Need for a Sustainable Strategy
As the frequency of disasters of ever greater consequence declines, the public’s attention wanes, as does its tolerance for the costs and inconvenience of measures to reduce vulnerability to improbable but high-consequence events. On the other hand, natural disasters and threats of terrorism will always exist, and a sustainable strategy is necessary.12
The goal of disaster avoidance and mitigation should be safety and security, with the understanding that security must include the threat of terrorism. The
12 |
Branscomb, L. M. 2004. Protecting civil society from terrorism: the search for a sustainable strategy. Technology in Society 26(2-3):271–285. http://authors.elsevier.com/sd/article/S0160791X04000053. |
public needs to understand that the resources to deal with the most likely disasters pay for most of the risks the city faces. Terrorism is an added cost because it introduces different threat patterns.
The technical strategy must attempt to maximize dual benefits to economy and security through the development of appropriate technologies and procedures. To the extent that costs of vulnerability reduction can be reduced or offset by improved quality of infrastructure services, the public will be more willing to support investments to mitigate very unlikely but high-consequence events.
Collaborative Learning Between Megacities
As cities work to become both safer and more secure, there are opportunities for international collaborative learning between megacities. Because the analytical work is so complex, a pair of major cities such as Moscow and Los Angeles might find that engaging the two academies of sciences as partners in such collaboration to be mutually beneficial.