Terrorism: Reducing Vulnerabilities and Improving Responses: U.S.-Russian Workshop Proceedings (2004)

Robert Prieto*

Parsons Brinckerhoff Inc.

A year and a half has passed since the terrorist attack on New York City. Thousands died that day, and the lives of millions of others were directly affected.

We cannot bring those who died that day back to life. Nor can we stop all deliberate acts of destruction targeted to our cities and their infrastructure. But we can improve the ability of our built environment to resist, respond, and recover from uncontrollable forces of nature and man. If this paper helps ensure that neither the events of September 11, 2001, nor the lessons we should draw from it are forgotten, then it will be judged worthwhile. If not, history will write a different epitaph.

I am a New Yorker, one who grew up and worked in the city throughout my entire career, as chairman of Parsons Brinckerhoff, New York’s oldest engineering firm whose roots, reaching back to 1885, predate our work on New York City’s first subway; as cochair of the Infrastructure Task Force established by the New York City Partnership in the aftermath of the attacks; and increasingly as a student of the history of great engineering “system” failures.

In essence, history has handed our profession an unusual challenge and an unmatched opportunity. How we respond will say much about the future of the heavily engineered environment we call our cities as well as much about our own profession.

To fully appreciate the events that day, we must understand their rapidity and scale. Table 1 provides a chronology. Within 18 minutes, planes struck each of the two World Trade Center towers in New York. Eighteen minutes after United Airlines flight 175 struck the south tower, all bridges and tunnels into the New York City area were closed. Sixty-two minutes after the south tower was struck, it collapsed, killing those still trapped inside as well as first responders who arrived to deal with the impact of American Airlines flight 11 into the north tower. The Port Authority Trans Hudson (PATH) line station was partially crushed by the collapse of the south tower. Twenty-three minutes later, the north tower collapsed.

The collapse of the twin towers caused collateral damage of varying degrees to 29 million sq ft of office space in lower Manhattan; started fires in nearby structures; and caused major portions of the transportation, power, telecommuni-

cations, and other infrastructure to be stressed to failure simultaneously. Many of the lessons learned came from observing the relative response of these systems to the same originating event and failure environment.

A little more than two hours after the first plane struck, an evacuation of southern Manhattan was ordered. During the next several weeks, rescue efforts continued and critical infrastructure systems were restored pending permanent solutions.

The impacts were overwhelming:

• 2,801 people killed in New York

• 29 million sq ft damaged or destroyed

• New York City Emergency Operations Center destroyed

• 125,000 workers displaced

• section of New York City subway destroyed by beams from the World Trade Center

• PATH World Trade Center station partially collapsed, rendering one of three Hudson River crossings out of service

• 350,000 passengers initially displaced

• $1.9 billion in telecommunications infrastructure destroyed

• cell traffic to 10 cell sites interrupted

• two substations and local distribution system of power grid badly damaged

• local power grid badly damaged

• service disrupted for 12,000 electric customers, 270 steam customers, 1,400 gas customers

What are we to learn as engineers from the attacks of September 11, 2001, and beyond? What are we to teach to those who follow in our footsteps? How are we to define critical infrastructure in the future? These are but a few of the questions we must answer if we are to meet history’s challenge.

This need to learn—and to teach—has caused me to return to the age-old fundamentals of education, namely the Three R’s. However, in the twenty-first century’s highly engineered environment and with our increased recognition of the threats this environment faces, the traditional Three R’s of reading, ‘riting, and ‘rithmatic have been replaced by resist, respond, and recover, at least as they relate to critical infrastructure.

The National Strategy for the Physical Protection of Critical Infrastructure and Key Assets, released by the White House in February 2003, provides a national perspective on the lessons to be learned, while a more scientific perspective is provided by the National Research Council report entitled Making the Nation Safer: The Role of Science and Technology in Countering Terrorism, published in August 2002. This paper offers a slightly different perspective—one founded on our city’s infrastructure systems.

In Box 1, a definition of critical infrastructure builds upon and helps shape these Three R’s. This definition sharpens the focus of the definition contained in H.R. 3162, the USA Patriot Act, wherein critical infrastructure is defined as “systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.”

An important point is that each element of infrastructure is not of the same critical importance. We must focus our efforts to ensure that limited resources are most appropriately applied. Let us now look at each of the Three R’s in turn.

Critical infrastructure must be designed to resist attack and catastrophic failure. Immediately following the attacks and the subsequent collapse of the World Trade Center towers, there were those who called for high-profile buildings and other critical infrastructure to be designed to stop airplanes. This, simply put, is utter nonsense. Unless we are prepared to live in a heavily engineered environment more closely resembling the complex of caves in Afghanistan, we will not design buildings to stop planes. The challenge is to keep airplanes away from buildings and to root out those who challenge our way of life at the source.

Does that mean our profession is to do nothing? Far from it. Each engineering disaster, whether natural or manmade, has taught us lessons. Over time, these lessons are disseminated within a subset of our profession or within an industry segment. Some lessons are only understood with the fullness of time and often offer a deeper understanding of the real challenges we as engineers face. Short-term code modifications often satisfy the tendency to overreact in the short term but, as understanding develops, may fail to sufficiently react in the long term.

Our profession’s tendency to specialize often constrains our ability to translate lessons learned across a broad range of disciplines and industry segments. Here, perhaps, lies a role for the National Academies—to know all that is being done, to learn from an incident, to consolidate this invaluable source of knowledge, and to ensure its timely distribution across the industries. Perhaps the return of the Renaissance ideals embodied in the master builders are once again in order.

In New York City on September 11, 2001, we saw the best of engineering, not the failure of it. We saw two proud structures swallow two maliciously guided planes that were fully loaded with fuel, and endure not only an impact beyond their design basis but also an ensuing fire. In the face of these attacks, these buildings did not simply allow themselves to be overwhelmed as the attackers most likely envisioned. Rather, they were the first of the many heroes to die that day, but only after they had bought the time for up to 25,000 people to leave and live. This is the true testament to the designers of the structures, and our recognition of their successful resistance to an overwhelming attack in no way diminishes the human tragedy associated with those who did not safely escape that day.

Our challenge as we move forward is to learn what we can from this tragedy and, as we have in the past, intelligently incorporate these lessons into our endeavors of the future. We must be comprehensive in our understanding, thorough in our consolidation of lessons learned, and broader in our distribution, especially for the lessons that transcend specialties and industries.

Not all damage on September 11 was to high-profile buildings in New York. In dollars, the damage to surrounding infrastructure—transportation, electricity, and telephone—exceeds that of the buildings. The very open role of infrastructure to tie developments together in some ways limits its ability to resist deliberate attack. Infrastructure’s limited ability to resist provides a sufficient segue to the second of the Three R’s of critical infrastructure.

The attacks of September 11, 2001, destroyed the operability of large portions of the transportation, electricity, and telephone networks servicing lower Manhattan and impacted, more broadly, entire system operation. In the immediate aftermath of the attacks, transit system operators modified system operation to stop passenger flow into the affected area and to remove trains already in the area. That immediate action prevented any loss of life to transit passengers or workers despite the subsequent destruction of portions of the transit system from falling debris. On the heels of that immediate response came an even more daunting challenge: to reconfigure the original transportation system to meet the needs of the 850 businesses and 125,000 workers physically displaced when 29 million sq ft of office space was damaged or destroyed and provide for a reason-

able restoration of service to the more than 350,000 passengers to lower Manhattan who had their commuting patterns disrupted. Many valuable lessons for the highly engineered environment that cities represent can be learned, including the following:

• The link between infrastructure and development is crucial.

• “Core capacity” of infrastructure systems is essential.

• Deferred maintenance represents a real cost and a real risk.

• Operational and emergency response training is an integral element of critical infrastructure response.

• Today’s highly engineered environment requires a first responder team that goes beyond the traditional triad of fire, police, and emergency services.

Let us consider each lesson in turn:

Infrastructure and development (in other words, the built environment) are intricately linked, often in ways we fail to fully appreciate. Each is the sine qua non of the other. However, as is often the case with all that we engineer, we can best appreciate the strengths, weaknesses, and functionality only in their failure or application in response to some new paradigm.

September 11 highlighted the interrelationships of infrastructure and development. In the localized failure of the built environment, or development (the collapse of the World Trade Center towers), we witnessed a localized destruction of the attendant infrastructure (subway lines 1 and 9, the local power grid, PATH station, and so forth). In the reconfiguration of regional development (an estimated 29,000 employees working outside New York City as a result of September 11 and another 29,000 temporarily backfilled in other existing metropolitan-area space), we modified our regional transportation network (mandatory high-occupancy vehicle [HOV], increased ferry service, increased transit ridership at other river crossings, and so on). Similar analogs exist for utility and telecommunications networks affected on September 11. However, this ability to reconfigure the infrastructure systems in response to a new development paradigm draws heavily from what we find in Lesson 2.

In early 2001, I had the opportunity to attempt to explain the importance of some planned New York City transportation improvements to members of the political arena. These improvements were about enhancing the core capacity of a well-developed transportation network in order to improve overall system reliability, availability, and performance. Core capacity is the degree of intercon-

nectivity of the various elements of the system as well as the number of alternative paths available—its flexibility and redundancy.

These additions to core capacity strengthened the overall system, going well beyond the benefits associated with new system connections from some new point A to new point B. My case for strengthening a complex system, inherently tying together the most complex and engineered urban environment in the world, was nearly lost. Traditional project evaluation models focused on new riders from new connections between points A and B. But, in complex systems, the dislocations that can be caused by even a partial loss of overall system capacity and capability can be much more profound. Similarly, the improved reliability, availability, and performance created by adding core capacity to a complex system can pay dividends not often easily seen.

Such was the case for the regional transit system in the aftermath of September 11, 2001. The core capacity of these systems provided the flexibility to deal with commuting patterns literally modified overnight with lines and stations outside the immediately affected area, seeing changed passenger volumes exceeding those often associated with new point A-to-B connections. It was gratifying to receive the call from the political arena several days later stating that they now understood core capacity.

Each of the infrastructure systems impacted by September 11 responded more or less quickly depending on the core capacity inherently incorporated in the system as well as the concentration of critical infrastructure in the damaged area. Older systems tended to be more “built out,” while many newer systems were still heavily focused on building new A-to-B connections and as such had not yet achieved the level of core capacity of some of the more mature systems. This suggests that core capacity needs to be a criterion as we plan and implement the new infrastructure the twenty-first century will undoubtedly require.

Complex systems need a new model. We must recognize that dislocations can be profound. We must also recognize that improved reliability, availability, and performance pay hidden dividends. Core capacity is not just about the extent of the system or the number of alternate system paths. It is also about the intrinsic quality of the system at the point in time when it is stressed. This brings us to the third lesson learned.

The history of engineering is marked by exciting breakthroughs, great works of master builders, and outstanding service to our nation’s and the world’s population. Regretfully, it is also marked by systemic degradation of some of our greatest achievements. As a society, and perhaps even in some parts of our profession, we do not see sustained maintenance as important as the creation of the next new grand work. Whatever the reason—its routine nature, the ability to hopefully do it tomorrow, the lack of technical complexity, or just plain lack of

“sex appeal”—we are collectively guilty of allowing some of our most complex systems to fall into disrepair and to have their level of reliability, availability, and operational and safety performance degraded. We have seen this most notably in failing rail systems in England and the United States, but the impacts of deferred maintenance affect every element of infrastructure.

To a large measure, the ability of New York City’s transit system to respond and to take full advantage of the core capacity inherent in its system has its roots at the time of the system’s nadir. Out of crisis emerged a commitment to fund, reorganize, rebuild, improve, and maintain to a well-defined standard. This, too, stands as one of the lessons to recognize as we engineer and operate our increasingly complex infrastructure systems. The strength of a well-maintained system is clearly seen in the aftermath. Other elements of infrastructure with higher backlogs of deferred maintenance are struggling to keep up, and for many the challenges are in the years immediately ahead.

The condition of the system—how well it is maintained—is critical to sustain its ability to respond. The backlog of deferred maintenance should be viewed as an element of systems risk. On September 11, 2001, and in its aftermath, systems in a state of good repair fared better in both the response and recovery phases. This ability to respond often to other than design-basis events is key to the integrity of new security and safety systems.

In the same way we factor constructability reviews into our design process and maintainability considerations into our construction details, so must we address operational training as an element of our engineering of critical infrastructure. The events of September 11, 2001, show many areas of exceptional performance, but this serves to only underscore the importance of operational training. The operational training for the events of the twenty-first century changed after September 11. New scenarios need to be considered. New threats in the form of weapons of mass destruction, higher risk of collateral physical and economic damage, and more extended response time frames need to be addressed. First responder training (actions, interactions, communications, decision making) needs to be integrated with infrastructure system operational training.

Simple items such as establishing evacuation routes and off-property staging areas must be clearly provided by the infrastructure of our built environment, but also must be clearly integrated in first responder protocols.

Scenario training must be evolutionary as new threats emerge. Emerging response plans must be reviewed regularly and revamped as needed. Unusual incident reporting must be similarly kept up to date and relevant. Training to handle a growing range of threat scenarios must be kept current.

On September 11 we saw the impact of having the Emergency Operation Center (EOC) in proximity to a high-profile target. We also saw the importance of having safe, redundant capability and comprehensive integration with other relevant EOCs. Quick response is essential, and the importance of interoperability of first responders has not received as much attention in the past as might be warranted now. But we must not stop there. We must also understand how the first responder team has evolved in light of our increasingly engineered environment.

In early 2001, at the World Economic Forum (WEF) in Davos, Switzerland, one of the WEF governors was attempting to mobilize construction equipment to assist in rescue and recovery for victims of an earthquake in India. Engineers and constructors were not viewed as traditional members of the emergency response team and the barriers to “doing the right thing” were immense. Out of that frustration grew the WEF Disaster Response Network.

On September 11, 2001, we witnessed the engineering and construction industry voluntarily reach out and provide the technical and construction expertise for one of the greatest disasters in a highly engineered environment. All necessary protocols were not firmly in place and response training had never fully factored this dimension in. Yet, this “fourth responder” will be even more critical as the twenty-first century unfolds.

Response protocols in our engineered urban environment will increasingly need to proactively incorporate this fourth responder. New, dedicated first responder training facilities reflecting the unique nature of highly engineered environments and their infrastructure need to be deployed, and legislation needs to be provided to remove the onerous risks that accrue to engineer volunteers, who are often not covered by Good Samaritan statutes.

If we learn—and remember—each of these five lessons well, we will greatly enhance our ability to respond. But our ability to resist and respond in our critical infrastructure must also be matched by the third R, our ability to recover.

We design to resist, to avoid catastrophic failure in our critical infrastructure, to delay the failure as long as possible if it is not preventable, and to minimize loss of life, collateral damage, and degraded system performance. Having built in as much resistance as makes sense from a risk-weighted and operational and economic perspective, we enhance our ability to respond. We provide

core capacity; we focus on reliability, availability, and performance. We reconfigure inherently resilient systems for both the short and the long term.

But, for our critical infrastructure, that is not enough. We must recover the capacity and service that were destroyed. We must restore the engineered fabric, making it better than it was, if possible. We must engineer for recovery. From an engineering standpoint, this can mean many things:

• providing for accessibility to the sites of critical infrastructure

• ensuring availability of specialized construction equipment, contracts, and materials

• developing a well-documented system with clear interface points

• preplanning and rehearsing response and recovery scenarios for high-probability events (earthquake, hurricane, flood in areas so prone)

However, to truly respond in a highly engineered environment, even more is required. A vision must exist. Whether that involves the notional concept of the master builder of the past or the well-developed consensus builder recent history has required is irrelevant. Each aspect of our engineered environment must be understood not only in terms of its past and present but perhaps more importantly in terms of its future. How it will evolve. How resistance, response, and recovery will be built in as the system expands. How it fits in that vision of the future. What role it provides as part of a larger engineered environment. It is only with this vision in hand that a clear, unambiguous, and deliberate recovery effort can begin.

The challenge ahead for our cities and their critical infrastructure is best viewed from the perspective of the Three R’s—resist, respond, recover. To successfully meet this challenge we must

• understand the uniqueness of cities

• develop a systems perspective

• recognize the open nature of infrastructure

• engage the full range of talent available worldwide in the government, academic, and private sectors

Gilbert, P. H., J. Isenberg, G. B. Baecher, L. T. Papay, L. G. Spielvogel, J. B. Woodard, E. V. Badolato. 2003. International issues for cities—countering terrorist threat. Journal of Infrastructure Systems (March).

National Research Council. 2002. Making the nation safer: The role of science and technology in countering terrorism. Washington, D.C.: The National Academies Press. (http://www.nap.edu/books/0309084814/html/)

Prieto, R. 2002. A 911 call to the engineering profession. The Bridge 32(Spring). Washington, D.C.: National Academy of Engineering. (http://www.nae.edu/nae/naehome.nsf/weblinks/CGOZ-58NLJM?OpenDocument)

Prieto, R. 2002. The Three R’s: lessons learned from September 11th, presented at the Royal Academy of Engineering, London, October 28, 2002.

The White House. 2003. National strategy for the physical protection of critical infrastructure and key assets. February. Washington, D.C.: U.S. Government Printing Office. (http://www.whitehouse.gov/pcipb/physical_strategy.pdf)