DRAFT MEMORANDUM To: From: Subject: XXXXXXXXXXXXXXXXXXXXXXX Andrew Magliochetti DHS Risk Assessment Methodology

Date: 10.28.2011 __________________________________________________________________________ Purpose This memorandum will summarize the past, current and potential future Department of Homeland Security (DHS) Risk Assessment Methodology (RAM) and its use in prioritizing funding allocations. DHS allocates assets under the Homeland Security Grant Program (HSGP) 40% according to legislative minimums and 60% according to risk calculation. This document will address the (60%) risk-determined component and propose a fourth-generation algorithmic approach to the same. Background The current iteration of the DHS RAM is the third since 2001, and has evolved to take into consideration several important variables. The current RAM is outlined in more detailed herein, and a brief summary of the prior two iterations will help the reader understand this evolution. Initially, risk (R) was equated as having a direct relationship to population (P), or: R=P The obvious flaw with this calculation is that is only considers one variable population - in determining risk, and the risk is not such a simple concept. The next generation of DHS RAM took into threat (T), consideration critical infrastructure (CI) and population density (PD), as follows: R= T + CI + PD While this formula was certainly an improvement over the first RAM, it was still problematic in a number of ways, but most significantly in that it was additive. That is, no particular weight, probabilities or consequence values were applied. Current Methodology The current, third version of DHS RAM calculates risk using a formula comprised of three variables: Threat (T) to a target/area, based on intelligence community and law enforcement input; Vulnerability (V) of the target/area; and, Consequence (C) of an attack on the target/area. The simple expression of the formula is a product of these three variables: R= T * (V&C) However, different weight is given to each variable - 20% to Threat (T) and 80% to Vulnerability and Consequence (V & C) - and Vulnerability and Consequence (V&C) is the sum of several different inputs. These inputs and their respective overall weights are: the Population Index (P), 40%; the National Infrastructure Index (I), 15%;

the National Security Index (N), 5%; and, the Economic Index (E), 20%.

Thus, the longer format formula is: R = T * (P + I + N + E) When compared to the two prior iterations of DHS RAM - and especially the first - the current formula is much more comprehensive and reflects the fact that homeland security methodologies improve and evolve as experience accrues and deliberation occurs. Mathematical Expression and Variable Definitions The following mathematical expression of the DHS RAM that more adequately allows the reader to examine the computation and the components to the formula, as well as the relative weight of each component.

APopulation BGMP

Density limited to 50% impact on Population Index. used for Urban Areas Security Initiative allocations; GSP as percentage of GDP for State allocations.

Author-Proposed Fourth Generation Algorithmic RAM The current, third version of DHS RAM calculates risk using a formula comprised of three variables: Threat (T) to a target/area, based on intelligence community and law enforcement input; Vulnerability (V) of the target/area; and, Consequence (C) of an attack on the target/area. The simple expression of the formula is a product of these three variables: HS RAM calculates risk using a formula comprised of three variables: Threat (T) to a target/area, based on intelligence community and law enforcement input; Vulnerability (V) of the target/area; and, Consequence (C) of an attack on the target/area. The simple expression of the formula is a product of these three variables: HS RAM calculates risk using a formula comprised of three variables: Threat (T) to a target/area, based on intelligence community and law enforcement input; Vulnerability (V) of the target/area; and, Consequence (C) of an attack on the target/area. The simple expression of the formula is a product of these three variables: HS RAM calculates risk using a formula comprised of three variables: Threat

(T) to a target/area, based on intelligence community and law enforcement input; Vulnerability (V) of the target/area; and, Consequence (C) of an attack on the target/area. The simp (T) to a target/area, based on intelligence community and law enforcement input; Vulnerability (V) of the target/area; and, Consequence (C) of an attack on the target/area. The simple expression of the formulaproduct of these three variables: HS RAM calculates risk using a formula comprised of three variables: Threat (T) to a target/area, based on intelligence community and law enforcement input; Vulnerability (V) of the target/area; and, Consequence (C) of an attack on the target/area. The simple expression of the formula is a product of these three variables: HS RAM calculates risk using a formula comprised of three variables: Threat (T) to a target/area, based on intelligence community and law enforcement input; Vulnerability (V) of the target/area; and, Consequence (C) of an attack on the target/area. The simple expression of the formula is a product of these three variables: HS RAM calculates risk using a formula comprised of three variables: Threat (T) to a target/area, based on intelligence community and law enforcement input; Vulnerability (V) of the target/area; and, Consequence (C) of an attack on the target/area. The simp

(T) to a target/area, based on intelligence community and law enforcement input; Vulnerability (V) of the target/area; and, Consequence (C) of an attack on the target/area. The simple expression of the formula is a produc of these three variables: HS RAM calculates risk using a formula comprised of three variables: Threat (T) to a target/area, based on intelligence community and law enforcement input; Vulnerability (V) of the area; and, Consequence (C) of an attack on the target/area. The simple expression of the formula is a product of these three variables: HS RAM calculates risk using a formula comprised of three variables: Threat (T) to a target/area, based on intelligence community and law enforcement input; Vulnerability (V) of the target/area; and, Consequence (C) of an attack on the target/area. The simple expression of the formula is a product of these three variables: HS RAM calculates risk using a formula comprised of three variables: Threat (T) to a target/area, based on intelligence community and law enforcement input; Vulnerability (V) of the target/area; and, Consequence (C) of an attack on the target/area. The simp

DHS Risk Assessment Methodology (RAM)

Vulnerability & Consequence
(80 % Total Weight)

Population Index
40% Overall Weight

National Infrastructure Index

15% Overall Weight
3 X Tier I Assets + Tier II Assets

Threat Index
20% Overall Weight

Total Population + Population Density (Lim. 50%)

RISK =

Input from:

Intelligence Community Law Enforcement Other Credible Sources

National Security Index

5% Overall Weight
Military Bases + Defense Industrial Base Sites + Intl Border Crossings

Economic Index
20 % Overall Weight
Gross Metropolitan Product OR Gross State Product as % of GDP