National Resilience Priorities for UK Government - Sir David Omand

Sir David Omand
Security & Intelligence Co-ordinator, Cabinet Office

Introduction
Thank you for inviting me to give the keynote speech at your emergency planning, security and business continuity conference as part of the RUSI Homeland Security and Resilience department. These are subjects at the heart of my responsibilities in the Cabinet Office, and I welcome the continued interest being shown by the Royal United Services Institute in promoting wider expert debate on these issues.

I want to take this opportunity during this address to describe some of the very significant steps that have been taken over the last year to improve our national resilience, in other words our ability to detect, prevent and if necessary to handle disruptive challenges. The depth and breadth of our resilience governs our ability as a nation to face shocks and disruption and to be able to maintain or to restore normal life as quickly as possible. We are better prepared in that respect than we have ever been in relation to the challenges we face. It is however not sensible to encourage detailed debate about vulnerabilities and counter-measures, even in a forum such as this, without inadvertently risking the disclosure of information, or allowing inferences to be drawn, that would be of great value to a terrorist. But there are important issues that do merit exploring in a forum such as this, both to help create an informed public understanding and to advance our grasp of the issues themselves.

I am also conscious that the efforts of myself and my colleagues are focused on delivering urgent programmes of improvement, setting challenging targets and milestones and ensuring they are met. There is only limited time for developing the underlying thinking. Occasions such as this conference should, however, be the opportunity to step back and consider the more fundamental questions for the longer term and for us to connect to the expert communities outside government.

Some of the problems that face us are genuinely hard. Some require technical analysis; others have at their heart political choices. Some will excite controversy and debate, and we must recognise there will be very different points of view to be reconciled. Let me touch briefly on some of these issues, on which I expect you will hear more in the sessions to follow over the next two days.

I group my inter-related issues under the following six headings:

1. Threat and hazard analysis

1. Constructing a national counter-terrorist strategy

1. The concept of the Critical National Infrastructure

1. Methodologies for risk reduction: having a resilience capability framework

1. Adapting national and international structures

1. Operational doctrine for dealing with disaster

What I have always believed in is the power of posing the right problems at the right time. It is in that spirit that I offer you the following observations on the subjects you have chosen for the RUSI programme.

1. Threat and hazard analysis
The first cluster of issues starts with two questions. What future major threats or hazards to our security, tranquility and economic well-being justify significant action and protective investment now? And how can we best assess those threats and hazards and bring to bear all possible sources of knowledge and expertise on reducing the risks they pose for us?

Implicit in these questions is the distinction between a predicted future threat or hazard and a materialised risk now. Preventive and protective security measures can take years to implement and to be effective. Funds for hiring and training people as well as investment in infrastructure are limited and need to be subject to balance of investment planning. So the time for action should be when the possible danger is clear but well in advance of it becoming present. This distinction has important implications for public debate: we need to explain why we are investing in sensible risk reduction against future as well as current threats but at the same time avoid alarmist reporting about environmental catastrophe or enemies already at the gates. And of course in some cases at least, investment now may reduce the risk of the threat ever materialising in a form that need greatly concern the public.

Let me start by briefly mentioning our work on hazards, by which I mean non-malicious accidental or environmental dangers, such as industrial accidents or flooding. We have built a horizon scanning system in government to look at non-security related hazards that arise in the 'civil' world, paralleling that we have had for many years for defence and security threats.

We have a team in the Civil Contingencies Secretariat in the Cabinet Office that is well plugged in to a very wide set of sources of national and international information about future risks, and which is able through SAPER - the scientific advisory panels under the Government's Chief Scientific Adviser - to tap into the science base and expertise which is such a huge national asset for the UK. I do not say that we will not ever be caught by surprise, but the chances of that have been much reduced. This early warning system gives us the opportunity to activate our civil contingency planning and take preparatory action when necessary. This analysis of hazards also feeds in to our overall resilience capability framework to help guide the setting of targets for improvement.

Our analysis so far shows that much of what we need to do to enhance our resilience capabilities, for example in decontamination or handling large scale casualties, is also needed to deal with the potential threats from international terrorism, and that it is the latter that drives most of the programmes of improvement we need now. That is hardly surprising given the known interest international terrorist groups have shown in chemical, biological and radiological weapons and in causing mass casualties by attacking soft targets.

It is of course sensible to keep questioning whether we are right to build our resilience programmes largely around international terrorism as the major current threat axis. We must of course be alert and be ready to adjust our targets as new hazards are evaluated. And at the local level, it is certainly the case that the overwhelming likelihood is that the challenges that local responders will be called upon to face are the everyday hazards of modern life, not terrorism.

But when we look ahead at potential impact, it is terrorism that poses the major - although clearly not the only - risk to the security of the UK, and to UK interests overseas now, as well as posing a direct threat to the United States and across Europe and to Western interests round the world.

In examining the implications of this proposition we should recognise that the current international terrorist threat is different in important respects from that posed by previous terrorist movements. Structures, processes, coordination mechanisms that may have worked for nations in the past have to be rethought against the new threat and how it might develop. That is what the UK has had to do. It can involve changes that break with traditions. It is certainly costing more money. Some key factors are:

1. Scale. AQ associated terrorist groups are now present in many parts of the world. Such terrorist groups have links across Europe. We have seen cases of the extreme radicalisation of some young Muslims in several EU countries including the UK. It was the potential scale of the threat from international terrorism that led the Government last year to decide to increase significantly the size of the Security Service, together with supporting increases in Special Branch and in the other intelligence agencies.

1. Psychology of terror. The threat from suicide bombings poses new problems for law enforcement, and for protective security as tragically we have seen in the attack that killed our Consul-General in Istanbul. We have seen in attacks around the world that small means on the part of the determined terrorist can have a disproportionate (or asymmetrical) impact.

1. Mass casualties. The deliberate and callous wish to kill and injure large numbers of civilians, regardless of faith or nationality, precisely for the shock effect is a disturbing feature of the present wave of terrorism as we saw tragically in Madrid.

1. Targeting of the vulnerable. Associated with the wish to cause large casualties is the choice of so-called soft targets, such as young people in clubs as we saw in Bali. Again, this feature poses great problems in managing protective security consistent with encouraging ordinary life to go on, as it must if the terrorist is not to win by intimidating us.

1. Global connections. The networks are not confined to national territories. Not is the threat 'external' to Europe. Terrorist inspiration and knowledge of methods easily crosses frontiers.

1. Identities. More than in the past, terrorists and facilitators are operating under multiple identities that are hard to validate - thus weakening one of the traditional security tools, the 'dossier' or filing system.

1. Terrorist desire for CBR capability. The desire of AQ leaders to acquire such capability has been evident for some time, and there is plenty of evidence of this from the camps that were found in Afghanistan. Knowledge of these materials is available to terrorists and is increasingly to be found on sites on the internet. We can expect to have to devote increasing effort over next few years to the search for pre-emptive intelligence to prevent terrorists acquiring effective CBR capability. Looking ahead, and without necessarily predicting the worst case, we can be confident that the public reaction will be unforgiving of any Government that did not take all reasonable steps when they could.

2. Constructing a national counter-terrorist strategy
My second set of issues follows directly from the first. What strategic aim should we and our international partners set for the next few years? What would be a stretching yet realisable aim in relation to the defeat of international terrorism? How far is it realistic to plan to reduce the risks to the public from international terrorism, both here and in respect of UK interests overseas? How far ahead is it realistic to build our plans?

The British Government has set itself a challenging programme of counter-terrorist action, with a strategic aim for the next five years. The strategic aim is to reduce the risk from international terrorism over the next few years, so that our people can go about their business freely and with confidence. 'Freely' means not taking measures that will seriously impede everyday life, travel, trade or travel or undermine individual rights; 'with confidence' means being sufficiently tough that the public will trust that their government is doing what it reasonably can to reduce the risks to them and that we all have the confidence to go about our normal business without fear. We have also a wider longer-term goal of removing terrorism as a force in international affairs. But that is realistically not going to be achieved in the next five years, although we should be resolute about the direction of travel. There is no acceptable level of terrorism nor should we accept excuses that international terrorism is in any way a legitimate form of protest.

Our strategic aim for the next five years as I have expressed it is one that can be achieved and one that will deny the terrorist that which they are most seeking in terms of the disruption of our way of life, our prosperity and our confidence in our own societies and culture. That is the thinking behind our choice of aim.

How do we best go about constructing practical plans to achieve that aim? We can see that to reduce the risk can involve both reducing the likelihood of the threat manifesting itself, and reducing our vulnerability to threats when they do arise.

Our counter-terrorist strategy is therefore divided into mission areas to reduce the threat, and missions to reduce our vulnerability, all underpinned by two vital capabilities, good assessed intelligence and effective public communications. The first mission area is based around 'prevention', in particular preventing the next generation of terrorists from emerging. That involves work both domestically tackling the dangers of radicalisation and its roots as well as working together overseas helping create conditions of stability, resolve conflicts, to support moderate Islam and reform and diminish support for terrorism and help states build up their own counter-terrorist capabilities.

The second mission area is the vigorous pursuit of the present generation of terrorists and those that support and finance them to disrupt their operations and networks and where we can to bring them to justice. 'Prevention' is a long term business and the strategy recognises that there is no alternative in the meantime to developing further our ability to 'pursue' the terrorists and their networks, improving the domestic legal framework as well as building up our intelligence and law enforcement capabilities, and in parallel deploying forces with our allies overseas.

The third mission area is the 'protection' of the public and of our critical national infrastructure from terrorist attack to make the UK a harder target.

We build here on the sound foundations of over 30 years experience in this field, but extending our protective security work in the light of the new characteristics of international terrorism that I laid out for you. This effort has a major international dimension: a good example is the leadership the UK has shown in improving international standards in aviation security.

The fourth mission area is concerned with our 'preparation' against the consequences of attacks and disruption, at three levels. First, ensuring an effective immediate response with well equipped and trained first responders backed up by effective arrangements at regional and national level. I shall say more about those plans in a moment. Second, ensuring that in the face of a disruptive challenge essential services can be maintained. And third, delivering specific improvements in national capabilities to deal with disaster, particularly associated with chemical, biological or radiological attack such as initial detection and identification, dealing with infectious disease, mass casualties and mass fatalities, clearance of rubble and other necessary capabilities. Taken together the plans in this mission area will improve our national resilience and ability to bounce back as quickly as possible after disruption.

From my description you will see that the strategy and our four missions - 'prevent', 'pursue', 'protect' and 'prepare' - involve all parts of Government in reducing the risk from terrorism. It is a genuinely national effort that we are generating. It is an effort that involves intensive work with all stakeholders inside and outside Government. And it involves consultation with the public at large, with Government explaining the dilemmas it faces in protecting the public given the level of threat we face and the need to keep in balance considerations of individual liberty and of protective security. I draw attention here to the substantial discussion paper on counter-terrorism powers, Reconciling Security and Liberty in an Open Society, (Cm 6147) published by the Home Secretary in February of this year.

3. The concept of the critical national infrastructure
My third cluster of issues takes us down a level of detail, to ask the question, how will the increasingly information-based and global economy develop in future? What are the key interdependencies between the sectors of the economy that could introduce vulnerabilities? What are the characteristics of networked societies? Are they more, or are they if properly planned in important respects less vulnerable to disruption? What is the future role in relation to CNI protection of the Regulators of some of these key sectors?

How will the answers to those questions affect our plans for protection of the critical national infrastructure and for the preparations we should make to minimise disruption to the CNI following an attack?

There are certainly obvious characteristics that we need to take into account in our planning. The speed and penetration of global communications. The tightly coupled markets that can transmit shocks instantly around the globe. The known vulnerabilities of complex information infrastructure, for example controlling logistic systems or power grids. More fundamentally the commercial competitive pressures on the Boardrooms that now control most of our national critical infrastructure that in years gone by would have been in public sector control or at the least subject to influence in the public interest. Just in time value chains, leanness and speed to market all can introduce greater fragility in the face of unexpected disruption.

Our knowledge of these inter-relationships is far from complete. I know of no full mapping of an advanced economy anywhere in the world, or even of a manageable methodology for obtaining one. But we have been able to reassess our arrangements in the UK for identifying those parts of national infrastructure that are essential to the maintenance of normal life. This CNI is now broken down into ten sectors (telecommunications, energy, finance, health, water and sewerage, food, transport, emergency services, government services and hazards and public safety). Within each of these sectors a dialogue is now under way with the industry or sector bodies, companies or trade associations to discuss vulnerabilities, resilience, and protective security issues. And security in this context means physical, personnel and information security. This major effort is now being coordinated through the National Security Advice Centre very recently set up by the Security Service in conjunction with the police and with lead Government departments to strengthen the longstanding arrangements.

We know where we want to arrive - having redefined the CNI, having understood the inter-relationships, identified vulnerabilities and having discussed and agreed programmes of improvement with the owners and operators of the CNI.

4. Methodologies for risk reduction
My fourth suggestion for a cluster of issues to examine is around the question, how much is enough? What can be regarded as reasonable public expectations of Government, central and local, of business and of the voluntary sector in terms of providing future security and peace of mind? How far is it reasonable to expect that Government action in particular can help reduce or even eliminate classes of risk to society from the threats we identify?

In part I have given an answer already, by giving you a UK 5-year strategic aim for counter-terrorism. No Government can or should promise to eliminate in the next year or so the risks from international terrorism: but networks and plots can be uncovered, finance and communications intercepted or disrupted, the value of scarce funds for protective investment and preparations maximised etc. Overall, better intelligence can enable the threat to be managed down. Protective security measures, based both on intelligence assessment and on understanding of vulnerabilities in critical national infrastructure, can reduce the risk. And well equipped and trained emergency services together with carefully targeted improvements in our capacity to recover from disaster, can shorten the period of disruption after an attack and narrow its impact on the nation. We cannot provide complete protection but that is not a reason for fatalism and acceptance of unnecessary risk.

Once we get into individual areas of planning against each of the major categories of threat, however, we have to start putting numbers, costs and timescales against the plans, and to examine the cost-effectiveness of the options that are open. What is the most effective methodology for systematic and cost-effective risk reduction, both in terms of reducing the likelihood of trouble and of reducing our vulnerability should it arise? How do we answer the question, how much is enough? How far do we invest in ensuring against the very specific low probability but high impact threats, minimising the maximum loss. How far on the other hand do we invest against more likely and more conventional threats, maximising the minimum reasonable level of general security? What is the mix of minimax or maximin risk mitigation strategies? There are no right answers: in the end it comes down to judgements based on deep experience, guided by knowledge of our vulnerabilities and illuminated by an understanding of the threat.

5. Adapting national and international structures
From the assessment I gave at the outset, one evident conclusion is that we need to harness a genuine national effort across all our mission areas. I said at the outset that all our work needed to be based on carefully assessed intelligence on all aspects of the threat. We, along with our allies and partners abroad, need structures and processes that will enable those assessments to be applied quickly and surely to inform policy decisions and enforcement action alike. Nations that want to be successful in reducing the risk from international terrorism must recognise that intelligence, law enforcement, administrative and policy processes and structures ought to be re-examined to see if they are still fit for purpose. How are we doing this in the UK?

Let me start with how we are handling intelligence.

At the strategic level, we have had for many years a system based on the JIC admired around the world for bringing together intelligence and policy analysts to provide all source strategic assessment and judgements on defence and overseas security risks to illuminate policy decisions. We now also have a well developed domestic Strategy Unit at the centre of government capable of in-depth strategic examination of major policy issues, for example energy, environmental or demographic challenges over a 10-year timeframe or beyond. We are constantly looking for ways of strengthening our strategic capabilities, for example ensuring scientific and technical expertise is fully engaged through Scientific Advisory Panels under the Government's Chief Scientific Adviser, and allowing space for 'what if' exploration of alternative futures.

Looking ahead specifically at the prospects over the next 5 years in relation to terrorism there are many questions we might put to our strategic analysts: for example what will be the future development of AQ as it experiences the continuing pressure and attrition from security forces around the world, to what extent will radicalised extremism develop here in the UK, what are the prospects for terrorists in Europe acquiring chemical, biological or radiological means of attack, how long before there will be serious terrorist capability for cyber-attacks? There are many more such questions of great strategic import than there are sure answers, but I am confident that we have a world class system to derive for all available sources of information as firm a set of key judgements as are possible.

At the operational level, our main need is for detailed and timely threat assessments on which Ministers, Departments and military commanders can base sound operational decisions. That means detailed threat analysis (on a 24/7 basis) making sense of all available information and intelligence to judge whether action is needed or not. One example is to set the level of alert posture for protective security measures or alert states for parts of the CNI, and on which operational decisions can be taken. Is it safe to allow tomorrow's transatlantic flight to Washington to take off in the light of threat intelligence received? Should additional airport security measures be taken? What is the threat to the visiting VIP, Summit or sporting event? What extra action should the police take? What advice should the Foreign Office give to the travelling public about the danger of terrorism in country X? Should the Embassy in country Y be closed following a warning telephone call?

The latest development in our own national capability at this level has been the setting up last year of the national Joint Terrorism Threat Analysis Centre, staffed by analysts and experts from across the whole British intelligence community, including civilian and uniformed personnel from the Ministry of Defence, and by police officers, and also with the participation of representatives from Departments such as the Foreign Office, the Home Office, Dept. of Transport and other Agencies that have to act on the assessments of the Centre. This is a model of inter-agency and intelligence/law enforcement cooperation that is attracting great interest around the world as an excellent example of how you adapt structures to take account of the characteristics of the threat.

At the tactical level, our experience over the last 30 years with managing the risks from terrorism has equipped the UK with the ability to harness all sources of information (for example from national intelligence agencies, law enforcement, Government departments, financial institutions, and open sources) to support effective counter-terrorist operations on the ground. Uncovering the networks, identifying the key individuals, financing routes, disrupting or mounting prosecutions etc. No one agency can be expected to generate all the information it needs for an effective investigation or disruption operation against international terrorist networks. The vital missing piece of the jigsaw may be unknowingly held by any of the agencies/services. But much of the information is exceptionally source-sensitive. Lives of agents, or of hard won intelligence breakthroughs, are at risk. Contacts at this tactical level are best left to the professionals who have built up relations of trust, both at the national level and with partner services and agencies overseas.

I have mentioned the importance of JTAC as an example of effective inter-Agency working which notably is inspiring similar developments in other countries abroad. There is of course no single model of intelligence, police and governmental organisation that will fit the history and traditions of different nations. We have much to learn too from the experience of other nations. But although there is no single template (and the UK is certainly not trying to promote one) there are perhaps conditions for success in organising against the developing international terrorist threat that we might all agree on. Let me give a few examples:

• Any traditional barriers between agencies/services working in the domestic space and those working abroad must be addressed. We face an enemy that does not respect international borders. But that gives us advantages to link traditional overseas intelligence activity with domestic security and law enforcement and vice-versa.

• Any traditional barriers preventing exchanges between law enforcers (those with the power of arrest) and intelligence collectors and analysts must also be addressed. Collecting 'intelligence' in the domestic space is a legitimate activity (in the UK case under the strict conditions laid down by Parliament) in the interests of defeating terrorism. Information gathered in the course of criminal investigation must be available to those analysing terrorist threats and running CT intelligence operations. The excellent cooperation in the UK between intelligence and law enforcement communities over security issues is a key enabler in the pursuit of the terrorist.

• Any obstacles to the use by investigators and analysts of the capabilities that modern information and communications technology provide should be identified and where necessary enabling legislation sought as it has been in the UK. This is an issue that the UK has already promoted at the European level.

• At this point, I might add the need to keep counter-terrorist and immigration legislation up to date and in proportion to the threat. An example is the swift action by Parliament after 9/11 in passing the ATCS Act 2001, which has proved of great value in helping to provide protection for the public.

• I could go on to produce a very long list, but let me add one important general condition for success namely the ability when there are potential or actual terrorist attacks to direct a Government-wide response. That response must be capable of providing clear strategic direction looking beyond the immediate emergency response, harness all the support at local, regional or state, and national levels as the case might be, provide effective international linkage and most important provide effective public information and advice on the situation and on the response to it.

The international reach of terrorist groups such as Al Qaida - their cross-border ability to carry out attacks, to manage networks and to recruit - means that governments must work together to combat the threat. The United Nations Counter-Terrorism Committee was established in the wake of the 11 September attacks to keep up the pressure on all States to raise their counter-terrorism standards. Working both bilaterally and in various multilateral groups, we are reinforcing this pressure for improvement, and sharing our expertise with those countries struggling to improve.

G8 work on counter-terrorism has been particularly productive. Over the last three years it has launched initiatives on preventing terrorist access to weapons of mass destruction, raising transport security standards and co-ordinating counter-terrorism assistance to other countries. In the EU, we are engaged in discussions about the most effective combination of national actions and international co-operation to reduce the risk. Most gaps in capabilities will be for nations to fill, but there are important international contributions - for example, the European common arrest warrant, and EU legislation to allow the retention of communications data. We welcome the appointment of the new EU Counter-Terrorism Co-ordinator, Mr de Vries, to help the European Council ensure its decisions in these areas are effectively implemented. We will use our G8 and EU presidencies in 2005 to drive this agenda forward.

The EU has also committed itself to ensuring effective and practical cooperation with third countries in combating terrorism, in particular through the development of technical assistance strategies, to help vulnerable countries in enhancing their CT capabilities. The priority list of countries is being compiled now according to vulnerability, current needs, and capacity requirements.

I should also mention in relation to the 'prepare' mission that NATO has had a role for many years in civil emergency planning and preparations for mutual aid in case of disaster.

6. Operational doctrine for dealing with disaster
Finally, let me mention briefly a sixth cluster of issues that are worth discussion in fora such as this. In the light of all of the above, and taking account of our constitutional and legal framework and our historical experience, what concept of operations and set of operational doctrines will best enable challenges in the UK to be managed when they arise with the minimum dislocation to normal life?

Our approach is based on being clear about the mandates of those who will be called on to exercise authority in an emergency, at the strategic level, at the operational level and at the tactical level. We have reviewed and revised our concept of operations in the light of the international terrorist threat, and we have exercised it against demanding scenarios. We have introduced a regional level for emergency planning based on the Government Offices for the Regions and are working closely with emergency planners in the devolved administrations.

We have introduced new plans for ensuring the continuity of government including ensuring central strategic direction in a crisis as well as alternate locations from which Departments can ensure the continuity of key services to the public. We continue to learn from exercising these plans and to refine our training and preparations accordingly.

The major Civil Contingencies Bill is being taken through Parliament now. This Bill provides us with a complete modern legislative framework for dealing with civil contingencies replacing the present inadequate patchwork of historic law.

Part 1 of the Bill provides the framework for civil protection, placing duties at a local level on two categories of responder. The core responders will have a general duty of civil protection covering risk management, emergency planning, business continuity and warning and informing the public. The co-operating responders will have supporting obligations in providing information and co-operation.

Part 2 of the Bill provides the essential ability for government to take appropriate and proportionate emergency powers immediately in a crisis, subject to important safeguards.

An important part of our doctrine must be effective public communication. We are still developing our approach in the light of developments in the threat covering informing, alerting and warning.

We are seeking to ensure an informed and supportive public opinion and you will be aware of the material that is now available on the web: www.ukresilience.info, www.homeoffice.gov.uk/terrorism, www.mi5.gov.uk, and on information assurance issues, www.niscc.gov.uk. These sites welcome feed-back.

We are seeking to develop our arrangements for alerting key sectors to relevant threat information, such as aviation, the CNI, in the City of London and other areas based on assessments of threat level from JTAC.

We are also ready, should it be necessary, to warn the public directly by the emergency services and by the media through the arrangements made by the joint Media Emergency Forum, when this is needed for their protection, together with advice on how the public can act to minimise the risk to themselves as well as reassurance to those who need to know that they are not potentially affected by the consequences of an event. The arrangements for advising British travellers overseas have also been reviewed and improved, again based where necessary on threat assessments from JTAC.

Our diplomatic posts' Emergency Response Plans have been refined, and are being tested in a rolling programme of exercises. The FCO has Rapid Deployment Teams which can be dispatched within hours to provide specialist support in the aftermath of major terrorist incidents affecting British nationals overseas.

We take public expectations very seriously.

In the end, the public will judge us by the competence of our immediate response in the event of trouble and our ability to deal with the consequences of an attack.

We will be judged by evidence that we are making a real effort to stop attacks here and overseas and that we are doing this in a determined, systematic, and innovative way.

We will be judged by how far the public feels that people can go about their normal business freely and with confidence - our strategic aim.

And we will be judged by the honesty and candour of our public statements.

Conclusion
In all these respects, I hope I have demonstrated to you that we are on the case and that there is a great deal of effective work going on in government on all these issues. I hope I have whetted your appetite for the sessions to come in identifying some of the important and interesting questions to be addressed. I hope I have shown that our counter-terrorism strategy rests on consistent and coherent responses to these issues. But we do not pretend to have complete answers, and in that spirit we enter your debates.