Public-Private Partnerships for Critical Infrastructure Protection

							Public-Private Partnerships for
Critical Infrastructure Protection

        2009 GlobalOptions
         Executive Forum

             February 26, 2009

         Sara Alexander, Deputy Director
                 ChicagoFIRST
A Three-tiered Approach:
   National Level
   Regional (Grassroots) Level
   Coordinating Partnerships

                                  2
            Tier I:
The National Level Partnership



                             3
Financial Sector Partnership

Financial and Banking Information
  Infrastructure Committee (FBIIC)
        (public sector; formed January 2002)

Financial Services Sector Coordinating
  Council (FSSCC)
        (private sector; formed June 2002)

                                               4
 Needs/Mission

 Single points of contact
 Avoid regulation (“do it ourselves or
  have it done to us”)
 Take ownership of the solution
  • Recognize the Business Case
                                      5
 Funding/Staffing

 FSSCC has been funded and staffed by
  the firms that have chaired it:
  • Bank of America
  • Depository Trust Corporation
  • Options Clearing Corporation

 State Street Bank now chairs and staffs,
  and has introduced a dues structure
                                        6
                  FBIIC                                       FSSCC
              PUBLIC SECTOR                                PRIVATE SECTOR

        President’s Working Group                       Treasury - Lead Agency
           on Financial Markets                                (PDD 63)



                US Treasury                                Assistant Secretary for
           Assistant Secretary for                          Financial Institutions
            Financial Institutions                           SECTOR LIAISON
                FBIIC CHAIR
                                                       Shawn Johnson, Current Chair
                                                        SECTOR COORDINATOR

    Financial and Banking Information
        Infrastructure Committee
                  (FBIIC)

            US Treasury Department               Financial Services Sector Coordinating
   Commodity Futures Trading Commission                     Council for CIP/HLS
     Conference of State Bank Supervisors          Financial Services Trade Associations
    Federal Deposit Insurance Corporation                        & Institutes
        Federal Housing Finance Board                     New York Stock Exchange
     Federal Reserve Board of Governors                       The Clearinghouse
           Homeland Security Council                               FS/ISAC
       National Association of Insurance         Securities Industry Automation Corporation
                 Commissioners                       The Options Clearing Corporation
      National Credit Union Administration                     ChicagoFIRST
       New York Federal Reserve Bank                              NASDAQ
   Office of the Comptroller of the Currency                        AMEX
Office of Federal Housing Enterprise Oversight                       ASIS
           Office of Thrift Supervision                          CME Group
     Securities and Exchange Commission
DHS National Public/Private
Partnership
Homeland Security Presidential Directive 7
    (December 2003)
 Adopted the financial sector partnership
  structure for all critical sectors
    Established Government Coordinating Councils
        – Public sector membership
        – Similar to FBIIC
    Established Sector Coordinating Councils
        – Private sector membership
        – Similar to FSSCC
                                                8
  Critical Infrastructure Sectors
             Government Services
                                                          Energy
    Transportation

                                                          Public
Water                            CRITICAL                 Health
                             INFRASTRUCTURES
Defense
Industrial                                          Emergency
Base                                                 Services

   Chemical
   Industry                   Telecommunications
                                                    Agriculture


        Financial
        Services                                   Food            9
                               Postal & Shipping
         Tier II:
The Regional (Grassroots)
    Level Partnership


                            10
 Need/Mission: Filling a Gap
Local/Regional         Protecting the financial services sector requires collaboration at all
                       levels of business and government.
Partnerships to                                                          Industry
increase the              Company                                            Increase awareness amongst
                                                                              participants
resilience of the        
                         
                               Protect intellectual capital
                               Provide contingency workspace
                                                                             Coordinate periodic test of back-up
                                                                              networks and facilities
private sector in        
                         
                               Protect executive leadership
                               Perform threat and vulnerability
                                                                             Coordinate emergency contact
                                                                              information
the event of a           
                               assessments
                               Prioritize recovery of all business
                                                                             Share best practices amongst
                                                                              members
regional homeland        
                               functions
                               Test business continuity response
                                                                             Provide regulatory and legislative
                                                                              support for industry issues

security incident or           and recover plans  Business Continuity Planning
                              Consider alternate sites for
                               operations                                National
disaster in              
                         
                               Harden physical security
                               Consider sharing recovery solutions
                                                                             Re-organize security of nation under the
                                                                              Department of Homeland Security
collaboration with             with trusted partners                         Allocate resources to protect national
                                                                              infrastructure
the city, state, and     Local/Regional
                                                                             Provide intelligence to private industry
                                                                              through ISACs
federal agencies.              Coordination with city and state authorities
                               Region specific table-top/simulation exercises for threat assessment
                               Telecom traffic assessment
                        //06
                       572 0                                                                                              2


                                                                                                                         11
 Role of Regional Level Partnerships

Homeland security and disasters raise local issues:
Do private sector firms know…
 How their local jurisdiction prevents, prepares for, responds
  to, and recovers from incidents?
 How their local jurisdiction coordinates with the state and
  federal public safety agencies?
 What their limitations may be?

  Where possible, business continuity plans should
      incorporate government response plans.
                                                             12
Role of Regional Level Partnerships

Why can’t government take care of it?
 They don’t own and operate most critical infrastructure
 Many don’t understand how emergencies and threats
  affect critical infrastructure

Private Sector Has a Role & a Responsibility:
 Large corporations or institutions have the necessary
  political capital and credibility
 Organizations with resources have a responsibility to
  prepare
 Sectors have the necessary expertise and experience
                                                            13
The ChicagoFIRST Approach
        Fostering Industry Resilience and
          Security through Teamwork




A crisis is no time to exchange business cards
                                                 14
 Formation & Operations
 Formed in 2003, with fourteen founding members
 Members from the private sector
 Members PARTNER with government, associations, and
  other sectors
 Funded entirely through member dues
 Two employees
 Participants tend to be executives from business continuity,
  disaster recovery, physical security, information security,
  and risk management
 Government does not participate in governance or funding
                                                            15
    Current Membership
   Allstate Insurance Company          Harris Bank
   Aon                                 JP Morgan Chase
   Bank of America (LaSalle Bank)      Mesirow Financial
   Chicago Board Options Exchange      MB Financial Bank
   Chicago Federal Home Loan Bank      MF Global
   Chicago Stock Exchange              Mizuho Securities USA
   Chicago Trading Company             Northern Trust
   Citadel Group                       Nuveen Investments
   CME Group                           NYSE Euronext
   CNA Financial                       The Options Clearing Corporation
   Cole Taylor Bank                    The PrivateBank
   Global Electronic Trading Co.       UBS
   Goldman Sachs                       William Blair & Company    16
    Strategic Partners
 American Red Cross of Greater Chicago
 City of Chicago
         Chicago Fire Department
         Chicago Office of Emergency Management and Communications
         Chicago Police Department
         Chicago Department of Public Health
   Commodity Futures Trading Commission
   FBI / InfraGard
   Federal Deposit Insurance Corporation
   Federal Emergency Management Agency
   Federal Reserve Bank of Chicago
   FBIIC
   Financial Services Information Sharing and Analysis Center
   Financial Services Roundtable / BITS                              17
   FSSCC
    Strategic Partners
   Futures Industry Association
   National Futures Association
   Office of the Comptroller of the Currency
   Securities and Exchange Commission
   Securities Industry Association
   State of Illinois
          Illinois Department of Financial and Professional Regulation
          Illinois Emergency Management Agency
          Illinois Department of Public Health
          Illinois State Police
          Illinois Terrorism Task Force
   United States Attorney’s Office for the IL Northern District
   United States Department of Homeland Security
   United States Department of the Treasury
                                                                          18
   United States Secret Service
 Primary Objectives
 Information Sharing: Obtain a seat at Chicago's
  Joint Operations Center in the event of a crisis that
  affects Chicago's financial community
 Credentialing: Create permits/passes for essential
  personnel to safely access business facilities in the
  event of a general evacuation
 Evacuation Procedures: Develop and communicate
  standard evacuation procedures for industry
  personnel
 Interdependencies: Work with other critical sectors
                                                   19
  to educate about or address interdependencies
 ChicagoFIRST Activities:
Achieving Our Initial Goals


                              20
 Formal EOC Seat
 Obtained seat at Chicago Office of Emergency
  Management in fall 2003
   • Primarily for government agencies
   • May use seat when Center is activated

 Enhancements to seat at emergency operations center
   • Trained individuals to staff the seat
   • Developed protocols manual
   • Private component of web site created and configured to
     provide a message board for posting and recording critical
     information
   • Information about the membership, including critical
     locations and essential employees, at the seat
                                                                  21
Informal Information Sharing
 Seat is used rarely, but the resulting
  relationships with the city and state are
  invaluable
  • Day-to-day information sharing about local and
    national events
  • Spring 2004 information about leaning
    transmission tower
  • August 1, 2004 threats against financial
    institutions
  • LaSalle Bank fire, December 2004
                                                     22
Credentialing and Evacuations

 Credentialing
    City adopted credentialing pilot in which
     ChicagoFIRST participates

    State of Illinois and City of Chicago are working
     together on an interoperable system
 Evacuations
    Worked with State Department of Transportation
     tabletops

    Sought and helped implement downtown evacuation
     drill in September 2006
                                                         23
Interdependencies

 Addressed through several forums,
  workshops, and tabletop exercises
  • Pandemic Exercises – focusing on
    telecommunications & internet
  • Regional Interdependencies Forum – power &
    telecommunications panels (federal and local)
  • Cyber Forum – panel and exercise scenarios
    regarding cyber attacks and vulnerabilities
  • BC Exercise – scenarios focused on
    earthquakes and regional water systems      24
Additional Activities
    & Projects


                        25
Working Groups
 Security Working Group
  • Focuses on physical and information security
  • Coordinating training needs and opportunities
  • Coordinating security guard needs and options
  • Piloted event tracking and emergency alert systems
 Business Continuity Working Group
  • Sharing best practices & lessons learned
  • Implementing mutual aid
 Pandemic Planning Working Group
  • Free exchange of HR, legal, and BCP information, without NDAs
  • Coordinating with state and local health departments
  • Coordinating with sector-wide efforts, tabletops                26
 Accomplishments
 First of its kind for the financial sector and includes
  banks, exchanges, securities and futures firms,
  brokerages, and insurance companies throughout the
  region

 Identified as a national model – by local and federal
  officials - for regional, public-private partnerships
       9/11 Commission legislation
       GAO Report on Financial Market Preparedness
       US Treasury Department handbook for Regional Coalitions

 Selected to partner with DHS and Chair the Regional
  Consortium Coordinating Council
                                                                  27
 Accomplishments
 Collaborates regularly with the City of Chicago, the
  State of Illinois, the U.S. Treasury Department, the U.S.
  Department of Homeland Security, and other agencies
  on disaster preparedness and business continuity
  issues

 Provided Testimony before House Financial Services
  Committee
 Design and Facilitate Annual Member-wide, Multi-
  sector Tabletop Exercises

 DHS-sponsored Interdependencies Initiative
                                                        28
  Regional Partnerships
within the Financial Sector



                              29
 Regional Partnerships Nationwide

 FBIIC & FSSCC held regional outreach
  meetings to encourage the formation of
  coalitions (2003-2007)

 Held in dozens of cities, beginning with
  Chicago

 No public funding; building the private sector
  business case
                                               30
 Regional Partnerships:
 Formed
 FloridaFIRST                  NCRfirst (National Capital
   • Miami                       Region)
   • Tampa
                                HawaiiFIRST
 San Francisco
 Los Angeles                   WashingtonFIRST
 Minneapolis                    (Washington State)
 Alaska                        ShowMeFIRST (southeast
 Great ValleyFIRST              Missouri)
  (Philadelphia)
                                Financial Recovery Coalition
 dfwFIRST (Dallas/Fort
  Worth)                         for North Carolina
 Alabama Recovery Coalition    ChicagoFIRST
  for the Financial Sector
                                                          31
Regional Partnerships:
Forming
 • Colorado
 • Memphis
 • Arizona
 • Georgia
 • Louisiana
 • South Carolina
 • Houston



                         32
         Tier III:
Coordinating Partnerships



                            33
  RPCfirst:
  Regional Partnership Council
 ChicagoFIRST formed RPCfirst in 2005
   • Assist with development of partnerships
   • Share best practices
 Quarterly calls & annual meetings
 Plug the partnerships into the national structure
       Treasury DAS
       DHS AS
       FSSCC
       Telecommunications & Power Industries
 Educate partnerships about the federal structure – public
  & private
                                                        34
    Regional Consortium
    Coordinating Council
   ChicagoFIRST has been selected to chair the
    RCCC
   Formed by DHS as the final arm of the national
    level partnership structure
      1.   GCCs
      2.   SCCs
      3.   SLTTGCC – state, local, territorial, tribal governments
      4.   RCCC
   Designed to provide a national level forum
    through which effective regional coalitions can
    work together and can address critical
    infrastructure protection and resilience                         35
Contact Information
Sara Alexander
Deputy Director
ChicagoFIRST

312-595-6048
sara.alexander@chicagofirst.org


                 www.chicagofirst.org



                                        36