This is the accessible text file for GAO report number GAO-08-852 
entitled 'Homeland Security: DHS Risk-Based Grant Methodology Is 
Reasonable, But Current Version's Measure of Vulnerability is Limited' 
which was released on June 27, 2008.

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

United States Government Accountability Office: 
GAO: 

Report to Congressional Committees: 

June 2008: 

Homeland Security: 

DHS Risk-Based Grant Methodology Is Reasonable, But Current Version's 
Measure of Vulnerability is Limited: 

GAO-08-852: 

GAO Highlights: 

Highlights of GAO-08-852, a report to congressional committees. 

Why GAO Did This Study: 

Since 2002, the Department of Homeland Security (DHS) has distributed 
almost $20 billion in funding to enhance the nation’s capabilities to 
respond to acts of terrorism or other catastrophic events. In fiscal 
year 2007, DHS provided approximately $1.7 billion to states and urban 
areas through its Homeland Security Grant Program (HSGP) to prevent, 
protect against, respond to, and recover from acts of terrorism or 
other catastrophic events. As part of the Omnibus Appropriations Act of 
2007, GAO was mandated to review the methodology used by DHS to 
allocate HSGP grants. This report addresses (1) the changes DHS has 
made to its risk-based methodology used to allocate grant funding from 
fiscal year 2007 to fiscal year 2008 and (2) whether the fiscal year 
2008 methodology is reasonable. To answer these questions, GAO analyzed 
DHS documents related to its methodology and grant guidance, 
interviewed DHS officials about the grant process used in fiscal year 
2007 and changes made to the process for fiscal year 2008, and used 
GAO’s risk management framework based on best practices. 

What GAO Found: 

For fiscal year 2008 HSGP grants, DHS is primarily following the same 
methodology it used in fiscal year 2007, but incorporated metropolitan 
statistical areas (MSAs) within the model used to calculate risk. The 
methodology consists of a three-step process—a risk analysis of urban 
areas and states based on measures of threat, vulnerability and 
consequences, an effectiveness assessment of applicants’ investment 
justifications, and a final allocation decision. The principal change 
in the risk analysis model for 2008 is in the definition of the 
geographic boundaries of eligible urban areas. In 2007, the footprint 
was defined using several criteria, which included a 10-mile buffer 
zone around the center city. Reflecting the requirements of the 
Implementing Recommendations of the 9/11 Commission Act of 2007, DHS 
assessed risk for the Census Bureau's 100 largest MSAs by population in 
determining its 2008 Urban Areas Security Initiative (UASI) grant 
allocations. This change altered the geographic footprint of the urban 
areas assessed, aligning them more closely with the boundaries used by 
government agencies to collect some of the economic and population data 
used in the model. This may have resulted in DHS using data in its 
model that more accurately estimated the population and economy of 
those areas. The change to the use of MSA data in fiscal year 2008 also 
resulted in changes in the relative risk rankings of some urban areas. 
As a result, DHS officials expanded the eligible urban areas in fiscal 
year 2008 to a total of 60 UASI grantees, in part, to address the 
effects of this change to MSA data, as well as to ensure that all urban 
areas receiving fiscal year 2007 funding continued to receive funding 
in fiscal year 2008, according to DHS officials. 

Generally, DHS has constructed a reasonable methodology to assess risk 
and allocate funds within a given fiscal year. The risk analysis model 
DHS uses as part of its methodology includes empirical risk analysis 
and policy judgments to select the urban areas eligible for grants (all 
states are guaranteed a specified minimum percentage of grant funds 
available) and to allocate State Homeland Security Program (SHSP) and 
UASI funds. However, our review found that the vulnerability element of 
the risk analysis model has limitations that reduce its value. 
Measuring vulnerability is considered a generally-accepted practice in 
assessing risk; however, DHS’s current risk analysis model does not 
measure vulnerability for each state and urban area. Rather, DHS 
considered all states and urban areas equally vulnerable to a 
successful attack and assigned every state and urban area a 
vulnerability score of 1.0 in the risk analysis model, which does not 
take into account any geographic differences. Thus, as a practical 
matter, the final risk scores are determined by the threat and 
consequences scores. 

What GAO Recommends: 

GAO recommends that DHS formulate a methodology to measure variations 
in vulnerability across states and urban areas. In comments to our 
draft report, DHS components concurred with our recommendation. 

To view the full product, including the scope and methodology, click on 
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-852]. For more 
information, contact William O. Jenkins, Jr., (202) 512-8777, 
jenkinswo@gao.gov. 

[End of section] 

Contents: 

Letter: 

Results In Brief: 

Background: 

Shifting to Urban Area Boundaries Defined by MSA was the Primary Change 
to DHS's Risk-Based Methodology in 2008: 

DHS's Risk-based Methodology is Generally Reasonable, But the 
Vulnerability Element of the Risk Analysis Model Has Limitations that 
Reduce Its Value: 

Conclusions: 

Recommendations: 

Agency Comments: 

Appendix I: Briefing for Congressional Committees, February 11-25, 
2008: 

Appendix II: Identifying Eligible Urban Areas: 

Appendix III: DHS's Model is Robust for Tier 1 UASI Areas: 

Appendix IV: Contacts and Staff Acknowledgments: 

Table: 

Table 1: Urban Areas Eligible for UASI Grants: Fiscal Year 2006 
Footprint vs. 2008 by Metropolitan Statistical Areas (New UASI grantees 
are in italics): 

Figures: 

Figure 1: Risk Management Framework: 

Figure 2: Evolution of DHS's Risk-based formula: 

Figure 3: Overview of the Grant Allocation Methodology for UASI and 
SHSP: 

Figure 4: DHS's Risk Analysis Model Used in Determining Relative Risk 
Scores: 

Figure 5: Chicago, IL Urban Area Footprint: Center City + 10 mile 
radius vs. MSA. 

[End of section] 

United States Government Accountability Office: 

Washington, DC 20548: 

June 27, 2008: 

The Honorable Robert C. Byrd: 
Chairman: 
The Honorable Thad Cochran: 
Ranking Minority Member: 
Subcommittee on Homeland Security: Committee on Appropriations: 
United States Senate: 

The Honorable David E. Price: 
Chairman: 
The Honorable Harold Rodgers: 
Ranking Minority Member: 
Subcommittee on Homeland Security: Committee on Appropriations: 
House of Representatives: 

Since 2002, the Department of Homeland Security (DHS) has distributed 
almost $20 billion in federal funding through various DHS grant 
programs that provide funding to public jurisdictions and private 
owners/operators for planning, equipment, and training to enhance the 
nation's capabilities to respond to terrorist attacks and, to a lesser 
extent, natural and accidental disasters. In fiscal year 2007, DHS 
provided approximately $1.7 billion to states and urban areas through 
its Homeland Security Grant Program (HSGP) to prevent, protect against, 
respond to, and recover from acts of terrorism or other catastrophic 
events and plans to distribute approximately $1.6 billion under this 
program in fiscal year 2008. 

The majority of funding from the Homeland Security Grant Program is 
provided through two of its five component programs: the State Homeland 
Security Program (SHSP) and the Urban Areas Security Initiative (UASI). 
SHSP supports building and sustaining capabilities at the state and 
local levels through planning, equipment, training, and exercise 
activities and helps states to implement the strategic goals and 
objectives included in state homeland security strategies. SHSP 
provides funding to all 56 states and territories based on a 
combination of assessing relative risk, and determining the 
effectiveness of states' proposed investments. UASI addresses the 
unique multi-disciplinary planning, operations, equipment, training, 
and exercise needs of high-threat, high-density urban areas. The 
program provides funding to high-risk urban areas based on 
determinations of risk and assessments of the effectiveness of the 
plans for using the funds. DHS used this same risk-based methodology to 
allocate $852 million in fiscal year 2008 under the Infrastructure 
Protection Program, according to DHS.: 

The distribution of HSGP funds, including UASI funding, has raised 
congressional interest about DHS's methods in making such 
determinations. For the third consecutive year, GAO has been mandated 
as part of DHS's annual appropriation to review and assess the HSGP's 
risk analysis model and risk-based allocation methodology for 
determining risk and distributing funds. We responded to the mandate in 
February 2008 by briefing the staffs of congressional committees on the 
results of this review (see Appendix I). This report and the 
accompanying appendices supplements and transmits the information 
provided during those briefings. 

In response to a mandate in the Consolidated Appropriations Act, 2008, 
GAO reviewed the methodology used by DHS to allocate HSGP grants. This 
report addresses the following questions: 

1. How has the risk-based methodology DHS uses to allocate grant 
funding changed from fiscal year 2007 to fiscal year 2008? 

2. How reasonable is the fiscal year 2008 methodology? 

To answer these questions, we analyzed DHS documents, including the 
risk analysis models for fiscal years 2007 and 2008, grant guidance, 
and presentations. To provide a basis for examining efforts at carrying 
out risk management, we applied a framework for risk management that 
GAO developed based on best practices and other criteria. We used our 
risk management framework to examine DHS's risk-based methodology-- 
which includes its risk analysis model. Our analysis includes the 
extent to which: 

* Information used in DHS's methodology--such as specific measures and 
weights--was sufficient and reliable; 

* Attributes of DHS's methodology that potentially include both 
government and non-government items were identified by a reasoned 
process; 

* DHS could justify the aggregation or calculations of these 
attributes; 

* DHS documented its processes and applied written criteria when using 
methods to obtain scores or weights (i.e. peer review), or when ranges 
or categories (i.e. tiers) are used; 

* Relative risk rankings are sensitive to incremental changes in 
assumptions or alternative perceptions related to grantee eligibility 
or funding levels; and: 

* DHS has procedures in place to update their methodology if new 
information becomes available. 

Finally, we interviewed DHS officials about the HSGP grant 
determination process used in fiscal year 2007 and about changes made 
to the process for fiscal year 2008. We performed this performance 
audit from September 2007 through April 2008, in accordance with 
generally accepted government auditing standards. Those standards 
require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions 
based on our audit objectives. 

Results In Brief: 

For fiscal year 2008 HSGP grants, DHS is primarily following the same 
methodology it used in fiscal year 2007, but incorporated metropolitan 
statistical areas (MSAs) within the risk analysis model used to 
calculate risk. The methodology consists of a three-step process--risk 
analysis, effectiveness assessment, and final allocation decisions. The 
principal change in the model for 2008 is in the definition of the 
geographic boundaries, or footprint, of the UASI areas. In 2007, the 
footprint was defined using several criteria, which included a 10-mile 
buffer zone around the center city. Reflecting the requirements of the 
Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 
Act), DHS assessed risk for the Census Bureau's 100 largest MSAs by 
population in determining its 2008 UASI grant allocations. This change 
altered the geographic footprint of the urban areas assessed, aligning 
them more closely with the boundaries used by government agencies to 
collect some of the economic and population data used in the model, 
which may have resulted in DHS using data in its model that more 
accurately estimated the population and economy of those areas. As a 
result, DHS officials expanded the eligible urban areas in fiscal year 
2008 to a total of 60 UASI grantees, in part, to address the effects of 
this change to MSA data, as well as to ensure that all urban areas 
receiving funding in fiscal year 2007 received funding in fiscal year 
2008, according to DHS officials. 

Generally, DHS has constructed a reasonable methodology to assess risk 
and allocate funds within a given fiscal year. The risk analysis model 
DHS uses as part of its methodology includes empirical risk analysis 
and policy judgments to select the urban areas eligible for grants (all 
states are guaranteed a specified minimum percentage of the grant funds 
available) and to allocate SHSP and UASI funds. However, our review 
found that the vulnerability element of the risk analysis model has 
limitations that reduce its value. Measuring vulnerability is 
considered a generally-accepted practice in assessing risk; however, 
DHS did not measure vulnerability for each state and urban area. 
Rather, DHS considered all states and urban areas equally vulnerable to 
a successful attack and assigned every state and urban area a 
vulnerability score of 1.0 in the risk model. Thus, as a practical 
matter, the final risk scores are determined by the threat and 
consequences scores. By not measuring variations in vulnerability, DHS 
ignores differences across states and urban areas. 

To strengthen DHS's methodology for determining risk, we are 
recommending that the Secretary of DHS formulate a method to measure 
variations in vulnerability across states and urban areas, and apply 
this measure in future iterations of the risk analysis model. In email 
comments on the draft report, FEMA and I&A concurred with our 
recommendation that they formulate a method to measure vulnerability in 
a way that captures variations across states and urban areas and apply 
this vulnerability measure in future iterations of the risk-based grant 
allocation model. FEMA, NPPD and I&A also provided technical comments, 
which we incorporated as appropriate. 

Background: 

Risk management has been endorsed by Congress, the President, and the 
Secretary of DHS as a way to direct finite resources to those areas 
that are most at risk of terrorist attack under conditions of 
uncertainty. The purpose of risk management is not to eliminate all 
risks, as that is an impossible task. Rather, given limited resources, 
risk management is a structured means of making informed trade-offs and 
choices about how to use available resources effectively and monitoring 
the effect of those choices. Thus, risk management is a continuous 
process that includes the assessment of threats, vulnerabilities, and 
consequences to determine what actions should be taken to reduce or 
eliminate one or more of these elements of risk. 

To provide a basis for examining efforts at carrying out risk 
management, GAO developed a framework for risk management based on best 
practices and other criteria. The framework is divided into five 
phases: (1) setting strategic goals and objectives, and determining 
constraints; (2) assessing the risks; (3) evaluating alternatives for 
addressing these risks; (4) selecting the appropriate alternatives; and 
(5) implementing the alternatives and monitoring the progress made and 
the results achieved (see Fig.1). 

Figure 1: Risk Management Framework: 

[See PDF for image] 

This figure is an illustration of the Risk Management Framework, 
depicting the following information: 

* Strategic Goals, Objectives, and Constraints; 
* Risk Assessment; 
* Alternatives Evaluation; 
* Management Selection; 
* Implementation and Monitoring. 

Source: GAO. 

[End of figure] 

Because we have imperfect information for assessing risks, there is a 
degree of uncertainty in the information used for risk assessments 
(e.g., what the threats are and how likely they are to be realized). As 
a result, it is inevitable that assumptions and policy judgments must 
be used in risk analysis and management. It is important that key 
decision-makers understand the basis for those assumptions and policy 
judgments and their effect on the results of the risk analysis and the 
resource decisions based on that analysis. 

DHS has used an evolving risk-based methodology to identify the urban 
areas eligible for HSGP grants and the amount of funds states and urban 
areas receive (see Fig 2). For example, the risk analysis model used 
from fiscal year 2001 through 2003 largely relied on measures of 
population to determine the relative risk of potential grant 
recipients, and evolved to measuring risk as the sum of threat, 
critical infrastructure and population density calculations in fiscal 
years 2004 and 2005. 

Figure 2: Evolution of DHS's Risk-based formula: 

[See PDF for image] 

This figure is a timeline showing the evolution of DHS's risk-based 
formula, as follows: 

2001: Department of Justice-run grant program. 

9/11/01 occurs. 

FY 2001-2003: 
Stage I: R = P; 
10/26/01: USA Patriot Act; 
11/25/02: Homeland Security Act. 

FY 2004-2005: 
Stage II: R = T+Cl+PD. 

FY 2006: 
Stage III: R = T*V*C. 

FY 2007-2008: 
Stage IV: R = T*"(V&C)".
08/03/07: 9/11 Act. 

Source: GAO analysis based on Congressional Research Service. 

Notes: 

Definitions for the formulas above: 

* R = P represents Risk = Population; 

* R = T+CI+PD represents Risk = Threat plus Critical Infrastructure 
plus Population Density; 

* R = T*V*C represents Risk = Threat times Vulnerability times 
Consequences; and: 

* R = T* "(V&C)" represents DHS's presentation of the risk calculation 
formula used in their risk analysis model for 2007 and 2008: Risk = 
Threat times the combination of Vulnerability and Consequences. 
However, in the 2007 and 2008 risk analysis models, the combination of 
vulnerability and consequence is still calculated as the product of V 
times C, or R = T*V*C. 

Federal legislation affecting DHS's risk-based methodology: 

* United and Strengthening America by Providing Appropriate Tools 
Required to Intercept and Obstruct Terrorism Act (USA PATRIOT Act) of 
2001: Legislated statutory minimum funding levels for states and 
territories to receive under SHSP (0.75 percent of SHSP appropriations 
for states, the District of Columbia and Puerto Rico; 0.25 percent for 
territories). 

* Homeland Security Act of 2002: Moved the Department of Justice's 
Office for Domestic Preparedness grant programs into DHS. 

* 9/11 Act: Legislated (a) minimum funding levels for state and 
territories to receive under SHSP (0.375 percent of all funds 
appropriated for SHSP and UASI for states, the District of Columbia and 
Puerto Rico (0.008 percent for territories) for FY 2008 with the state 
percentage decreasing each fiscal year down to 0.35 percent by FY2012, 
(b) that DHS is to assess the risk for 100 most populous Metropolitan 
Statistical Areas (MSAs), and (c) based on that assessment, designate 
high-risk urban areas that may apply for UASI grants. 

[End of figure] 

The fiscal year 2006 process introduced assessments of threat, 
vulnerability and consequences of a terrorist attack in assessing risk. 
In addition to modifications to its risk analysis model, DHS adopted an 
effectiveness assessment for fiscal year 2006 to determine the 
anticipated effectiveness of the various risk mitigation investments 
proposed by urban areas, which affected the final amount of funds 
awarded to eligible areas. For the fiscal year 2007 allocation process, 
DHS defined Risk as the product of Threat times Vulnerability and 
Consequences, or "R= T* (V & C)" and applied a three-step risk-based 
allocation methodology which incorporates analyses of risk and 
effectiveness to select eligible urban areas and allocate UASI and SHSP 
funds (see Fig. 3). The three steps include: 

1. Implementation of a Risk Analysis model to calculate scores for 
states and urban areas, defining relative Risk as the product of 
Threat, Vulnerability and Consequences; 

2. Implementation of an Effectiveness Assessment, including a process 
where state and urban area representatives acting as peer reviewers 
assess and score the effectiveness of the proposed investments 
submitted by the eligible applicants. This process is also known as 
peer review. 

3. Calculation of a Final Allocation of funds based on states' and 
urban areas' risk scores as adjusted by their effectiveness scores. 

The Post-Katrina Emergency Management Reform Act places responsibility 
for allocating and managing DHS grants with the Federal Emergency 
Management Agency (FEMA) [Footnote 12]. While FEMA is responsible for 
implementing the above 3-step process, FEMA relies on other DHS 
components such as the National Protection and Programs Directorate 
(NPPD) and the Office of Intelligence and Analysis (I&A) in the 
development of the risk analysis model, which we will discuss in 
greater detail below. 

Figure 3: Overview of the Grant Allocation Methodology for UASI and 
SHSP: 

This figure is an illustration of the Grant Allocation Methodology for 
UASI and SHSP, as follows: 

UASI: 

Funding allocation: 
Tier 1: 55%; 
Tier 2: 45%. 

Relative risk: Number of urban areas. 

Risk estimator: R = T x "(V & C)"; 
Yields relative risk estimate. 

Phase I: Risk analysis: produces Risk score; 
Phase II: Effectiveness assessment: 
Peer review of Investment Justifications; 
Yields effectiveness score. 

Phase 3: Final allocation: 
Utilizes Effectiveness/risk matrix. 

SHSP: 

Risk estimator: R = T x "(V & C)"; 
Yields relative risk estimate. 

Relative risk: Number of states and territories. 

Phase I: Risk analysis: produces Risk score; 
Phase II: Effectiveness assessment: 
Peer review of Investment Justifications; 
Yields effectiveness score. 

Phase 3: Final allocation: 
Utilizes Effectiveness/risk matrix. 
Statutory minimum = .375%[A] 

Source: GAO analysis of DHS documents and information provided in 
interviews. 

[A] The statutory minimum of 0.375 percent of the total funds 
appropriated for SHSP and UASI for fiscal year 2008. In fiscal years 
2006 and 2007, the statutory per state minimum equaled 0.75 percent 
of funds appropriated for SHSP. 


[End of figure] 

Risk Analysis Model: 

DHS employs a risk analysis model to assign relative risk scores to all 
states and urban areas under the SHSP and UASI grant programs. These 
relative risk scores are also used to differentiate which urban areas 
are eligible for UASI funding. These eligible areas are divided into 
two tiers: Tier 1 UASI grantees and those eligible for Tier 2. 
[Footnote 13] In fiscal year 2007, 45 candidates were eligible to apply 
for funding under the UASI program, and eligible candidates were 
grouped into two tiers according to relative risk. Tier 1 included the 
six highest risk areas; Tier 2 included the other 39 candidate areas. 
Figure 4 provides an overview of the factors that are included in the 
risk analysis model for fiscal year 2007 and their relative weights. 
The maximum relative risk score possible for a given area was 100. The 
Threat Index accounted for 20 percent of the total risk score; the 
Vulnerability and Consequences Index accounted for 80 percent. 

Figure 4: DHS’s Risk Analysis Model Used in Determining Relative Risk 
Scores: 

[See PDF for image] 

This figure is an illustration of DHS’s Risk Analysis Model Used in 
Determining Relative Risk Scores, as follows: 

Risk = Threat Index: 
* Data: Credible plots, planning and threats from international 
terrorist networks, their affiliates and those inspired by them.
* Source: Intelligence Community reporting. 

Times: 

Vulnerability and Consequence Index; V&C = (P+E+I+N); 

Population Index: 
* Data: Total population (nighttime, commuter, visitor, military 
dependent) and population density (constrained to 50 percent impact); 
* Source: Census, LandScan, Smith Travel, and DOD. 

Economic Index: 
* Data: Gross Metropolitan Product (UASI)/percent GDP (state analysis); 
* Source: Global Insight/Department of Commerce, Bureau of Economic 
Statistics. 

National Infrastructure Index: 
* Data: # Tier I Assets (x3) +# Tier II Assets; 
* Source: DHS/OIP, SSAs, states and territories. 

National Security Index: 
* Data: Presence of Military Bases (yes/no) + # DIB + # international 
border crossings; 
* Source: DOD, DHS/CBP. 

Source: DHS. 

Note: “DHS/OIP” stands for DHS’s Office of Infrastructure Protection. 
“SSAs” stands for Sector-Specific Agencies, which are Federal 
departments and agencies identified in the National Infrastructure 
Protection Plan as responsible for critical infrastructure protection 
activities. “DHS/CBP” stands for the DHS’s Customs and Border 
Protection. “DIB” stands for “defense industrial base,” which includes 
a count of Department of Defense, government, and private sector 
industrial complex with capabilities to perform research and 
development, design, produce, and maintain military weapon systems, 
subsystems, components and parts to meet military requirements. “GDP” 
stands for Gross Domestic Product. 

[End of figure] 

The Threat Index accounted for 20 percent of the total risk score, 
which was calculated by assessing threat information for multiple years 
(generally, from September 11, 2001 forward) for all candidate urban 
areas and categorizing urban areas into different threat tiers. 
According to DHS officials, the agency’s Office of Intelligence and 
Analysis (I&A) calculated the Threat Index by (1) collecting 
qualitative threat information with a nexus to international terrorism, 
[Footnote 14] (2) analyzing the threat information to create threat 
assessments for states and urban areas, (3) empaneling intelligence 
experts to review the threat assessments and reach consensus as to the 
number of threat tiers, and (4) assigning threat scores. This process, 
according to DHS officials, relied upon analytical judgment and 
interaction with the Intelligence Community, as opposed to the use of 
total counts of threats and suspicious incidents to calculate the 
Threat Index for the 2006 grant cycle. The final threat assessments are 
approved by the Intelligence Community—the Federal Bureau of 
Investigation, Central Intelligence Agency, National Counterterrorism 
Center, and the Defense Intelligence Agency—along with the DHS Under 
Secretary for Intelligence and Analysis and the Secretary of DHS, 
according to DHS officials. 

The Vulnerability and Consequences index accounts for 80 percent of the 
total risk score. Because DHS considered most areas of the country 
equally vulnerable to a terrorist attack given freedom of movement 
within the nation, DHS assigns vulnerability a constant value of 1.0 in 
the formula across all states and urban areas. Therefore, DHS’s 
measurement of vulnerability and consequences is mainly a function of 
the seriousness of the consequences of a successful terrorist attack, 
represented by four indices: a Population Index, an Economic Index, a 
National Infrastructure Index, and a National Security Index. 

Population Index (40 percent). This index included nighttime population 
and military dependent populations for states and urban areas, based 
upon U.S. Census Bureau and Department of Defense data. For urban 
areas, factors such as population density, estimated number of daily 
commuters, and estimated annual visitors were also included in this 
variable using data from private entities. DHS calculated the 
Population Index for urban areas by identifying areas with a population 
greater than 100,000 persons and cities that reported threat data 
during the past year, then combined cities or adjacent urban counties 
with shared boundaries to form single jurisdictions, and drew a 10-mile 
buffer zone around identified areas. 

Economic Index (20 percent). This index is comprised of the economic 
value of the goods and services produced in either a state or an urban 
area. For states, this index was calculated using U.S. Department of 
Commerce data on their percentage contribution to Gross Domestic 
Product. For UASI urban areas, a parallel calculation of Gross 
Metropolitan Product was incorporated. [Footnote 15] 

National Infrastructure Index (15 percent). This index focused on over 
2,000 critical infrastructure/key resource (CIKR) assets that were 
identified by DHS’s Office of Infrastructure Protection. These 
particular critical infrastructure assets are divided into two rankings 
that, if destroyed or disrupted, could cause significant casualties, 
major economic losses, or widespread/long term disruptions to national 
well-being and governance capacity. The Tier 2 CIKR assets include the 
nationally-significant and high-consequence assets and systems across 
17 sectors. [Footnote 16] Tier 1 assets are a small subset of the Tier 
2 list that include assets and systems certain to produce at least two 
of four possible consequences if disrupted or destroyed: (1) prompt 
fatalities greater that 5,000; (2) first-year economic impact of at 
least $75 billion; (3) mass evacuations with prolonged (6 months or 
more) absence; and (4) loss of governance or mission execution 
disrupting multiple regions or critical infrastructure sectors for more 
than a week, resulting in a loss of necessary services to the public. 
Tier 1 assets were weighted using an average value three times as great 
as Tier 2 assets. 

The National Security Index (5 percent). This index considered three 
key national security factors: whether military bases are present in 
the state or urban area; how many critical defense industrial base 
facilities are located in the state or urban area; and the total number 
of people traversing international borders. Information on these inputs 
comes from the Department of Defense and DHS. 

Effectiveness Assessment: 

In addition to determining relative risk using the risk analysis model, 
DHS added an effectiveness assessment process in fiscal year 2006 to 
assess and score the effectiveness of the proposed investments 
submitted by grant applicants. To assess the anticipated effectiveness 
of the various risk mitigation investments that states and urban areas 
proposed, DHS required states and urban areas to submit investment 
justifications as part of their grant applications. The investment 
justifications included up to 15 “investments” or proposed solutions to 
address homeland security needs, which were identified by the states 
and urban areas through their strategic planning process. DHS used 
state and urban area representatives as peer reviewers to assess these 
investment justifications. The criteria reviewers used to score the 
investment justifications included the following categories: relevance 
to national, state and local plans and policies such as the National 
Preparedness Guidance states’ and urban areas’ homeland security plans, 
anticipated impact, sustainability, regionalism, and the applicants’ 
planned implementation of each proposed investment. Reviewers on each 
panel assigned scores for these investment justifications, which, 
according to DHS officials, were averaged to determine a final 
effectiveness score for each state and urban area applicant. 

In fiscal year 2007, DHS provided states and urban areas the 
opportunity to propose investment justifications that included regional 
collaboration to support the achievement of outcomes that could not be 
accomplished if a state or urban area tried to address them 
independently. States and urban areas could choose to submit multi-
state or multi-urban area investment justifications which outlined 
shared investments between two or more states or between two or more 
urban areas. Such investments were eligible for up to 5 additional 
points on their final effectiveness score, or up to 8 more 
effectiveness points for additional proposed investments, although 
these additional points would not enable a state’s or urban area’s 
total effectiveness score to exceed 100 points. These proposed 
investments were reviewed by one of two panels established specifically 
to consider multi-applicant proposals. Points were awarded based on the 
degree to which multi-applicant investments showed collaboration with 
partners and demonstrated value or outcomes from the joint proposal 
that could not be realized by a single state or urban area. 

Final Allocation Process: 

DHS allocated funds based on the risk scores of states and urban areas, 
as adjusted by their effectiveness scores. DHS officials explained that 
while allocations are based first upon area risk scores, the 
effectiveness scores are then used to determine adjustments to states 
and urban areas allocations based on an “effectiveness multiplier.” 
States and urban areas with high effectiveness scores received an 
additional percentage of their risk-based allocations, while states and 
urban areas with low effectiveness scores had their risk-based 
allocations lowered by a percentage. [Footnote 17] 

In addition to determining funding by risk score as adjusted by an 
effectiveness multiplier, urban areas that received funds through the 
UASI grant program were subject to an additional tiering process that 
affected funding allocation. For example, in fiscal year 2007, the 45 
eligible urban area candidates were grouped into two tiers according to 
relative risk. The Tier 2 UASI grantees included the 6 highest-risk 
areas; Tier 2 UASI grantees included another 39 candidate areas ranked 
by risk. The 6 Tier 1 UASI grantees were allocated fifty-five percent 
of the available funds, or approximately $410.8 million, while the 39 
Tier 2 UASI grantees received the remaining forty-five percent of 
available funds, or approximately $336.1 million. 

Shifting to Urban Area Boundaries Defined by MSA was the Primary Change 
to DHS’s Risk-Based Methodology in 2008: 

DHS’s risk-based methodology had few changes from fiscal year 2007 to 
2008. DHS changed the definition it used to identify the UASI areas 
included in the risk analysis model in 2008 from an urban area’s center 
city plus a ten-mile radius to metropolitan statistical areas (MSAs) as 
defined by the Census Bureau. [Footnote 18] DHS made this change in 
response to the 9/11Act requirement to perform a risk assessment for 
the 100 largest MSAs by population. [Footnote 19] Because the change in 
definition generally expanded the geographic area of each potential 
UASI grant recipient, the change had an effect on the data used to 
assess threat and consequences, and it may also have resulted in the 
use of more accurate data in the risk analysis model. The change to the 
use of MSA data in fiscal year 2008 also resulted in changes in the 
relative risk rankings of some urban areas. As a result, DHS officials 
expanded the eligible urban areas in fiscal year 2008 to a total of 60 
UASI grantees, in part, to address the effects of this change to MSA 
data, as well as to ensure that all urban areas that received fiscal 
year 2007 funding also received funding for fiscal year 2008, according 
to DHS officials. 

Changing the boundaries had an effect on the data by which risk is 
calculated because the change in boundaries resulted in changes in the 
population and critical assets within the new boundaries. Figure 3 
below uses the Chicago, IL urban area to illustrate this change. One 
benefit of the change to MSAs was that the UASI boundaries align more 
closely with the boundaries used to collect some of the economic and 
population data used in the model. Consequently, the fiscal year 2008 
model may have resulted in more accurate data. Because the 2007 
boundaries were based on distance, areas inside the boundaries may have 
included partial census tracts or partial counties, each of which would 
have required DHS to develop rules as to how to handle the partial 
areas. By contrast, the MSAs are based on counties and allow DHS to use 
standard census data instead of developing an estimated population 
within the defined boundaries. Additional information describing the 
boundaries of UASI urban areas for fiscal year 2007 versus fiscal year 
2008 is presented in Appendix II. 

Figure 5: Chicago, IL Urban Area Footprint: Center City + 10 mile 
radius vs. MSA: 

[See PDF for image] 

This figure is a map of the Chicago, IL Urban Area Footprint, with the 
following areas highlighted: 
* City of Chicago; 
* Chicago-Naperville-Joliet, IN-IN-WI Metropolitan statistical area; 
* 10-mile radius. 

Source: GAO analysis. 

[End of figure] 

DHS calculated the Population Index of MSAs by: (1) using census data 
to determine the population and population density of each census 
tract; (2) calculating a Population Index for each individual census 
tract by multiplying the census tract’s population and population 
density figures; and (3) adding together the population indices of all 
of the census tracts making up the MSA. DHS did not use average 
population density because using an average resulted in losing 
information about how the population is actually distributed among the 
tracts. Using averages for population density over census tracts with 
dissimilar densities could have yielded very misleading results, 
according to DHS officials. 

The change to MSAs for fiscal year 2008 resulted in an increase of 
almost 162,000 square miles across the total area of urban area 
footprints. While 3 urban areas actually lost square mileage because of 
the change, the other areas all increased their square mileage 
footprint by almost 2,700 square miles on average. The increased size 
of urban areas’ footprints increased the number of critical 
infrastructure assets that were counted within them. We analyzed the 
number of Tier 1 and Tier 2 critical infrastructure assets associated 
with UASI areas between fiscal year 2007 and 2008, and found a higher 
number of total Tier 1 and Tier 2 critical infrastructure assets 
assigned to urban areas in 2008, and–individually—almost all urban 
areas increased the number of assets assigned to them. 

This change to the use of MSAs also resulted in changes in urban areas 
rankings, including the increase of the relative risk scores for such 
urban areas as Albany, Syracuse and Rochester, NY, and Bridgeport, CT. 
As a result, DHS officials expanded the eligible urban areas in fiscal 
year 2008 to a total of 60 with the top seven highest risk areas 
comprising UASI Tier 1 grantees, and the 53 other risk-ranked UASI Tier 
2 grantees. As in fiscal year 2007, the top seven UASI Tier 1 grantee 
areas will receive fifty-five percent of the available funds, or 
approximately $429.9 million, and the remaining 53 UASI Tier 2 grantees 
will receive forty-five percent of the available funds, or 
approximately $351.7 million. According to DHS officials, the decision 
to expand the eligible urban areas to a total of sixty was a policy 
decision largely driven by two factors: the 9/11 Act requirement that 
FEMA use MSAs; and the desire to continue to fund urban areas already 
receiving funding. 

DHS’s Risk-based Methodology is Generally Reasonable, But the 
Vulnerability Element of the Risk Analysis Model Has Limitations that 
Reduce Its Value: 

The risk-based methodology DHS uses to allocate HSGP grant dollars is 
generally reasonable. It includes and considers the elements of risk 
assessment—Threat, Vulnerability, and Consequences—and, as DHS’s risk-
based methodology has evolved, its results have become less sensitive 
to changes in the key assumptions and weights used in the risk analysis 
model. [Footnote 20] Furthermore, the indices that DHS uses to 
calculate the variable constituting the greatest portion of the risk 
analysis model—Consequences—are reasonable. However, limitations such 
as the absence of a method for measuring variations in vulnerability 
reduce the vulnerability element’s value. Although DHS recognized and 
described the significance of Vulnerability in its FY 2006 model, the 
model DHS used for fiscal years 2007 and 2008 used a constant value of 
1.0 in its formula, rather than measuring variations in vulnerability 
across states and urban areas. 

DHS’s Risk Analysis Model is Reasonable Because it Contains the Key 
Elements of Risk Assessment, Relies on Reasonable Indices to Measure 
Consequences, and is Less Sensitive to Changes in Variables: 

One measure of the reasonability of DHS’s risk-based methodology is the 
extent to which DHS’s risk analysis model provides a consistent method 
to assess risk. Risk assessment helps decision makers identify and 
evaluate potential risks facing key assets or missions so that 
countermeasures can be designed and implemented to prevent or mitigate 
the effects of the risks. [Footnote 21] In a risk management framework, 
risk assessment is a function of Threat, Vulnerability, and 
Consequences, and the product of these elements is used to develop 
scenarios and help inform actions that are best suited to prevent an 
attack or mitigate vulnerabilities to a terrorist attack. Threat is the 
probability that a specific type of attack will be initiated against a 
particular target/class of targets, and analysis of threat-related data 
is a critical part of risk assessment. The Vulnerability of an asset is 
the probability that a particular attempted attack will succeed against 
a particular target or class of targets. It is usually measured against 
some set of standards, such as availability/predictability, 
accessibility, countermeasures in place, and target hardness (the 
material construction characteristics of the asset). The Consequences 
of a terrorist attack measures the adverse effects of a successful 
attack and may include many forms, such as the loss of human lives, 
economic costs, and adverse impact on national security. The risk 
analysis model used by DHS is reasonable because it attempts to capture 
data on threats, vulnerabilities, and consequences—the three types of 
information used in evaluating risk. 

Because DHS considered most areas of the country equally vulnerable to 
a terrorist attack given freedom of movement within the nation, DHS 
assigns vulnerability a constant value of 1.0 in the formula across all 
states and urban areas. Therefore, DHS’s measurement of vulnerability 
and consequences is mainly a function of the seriousness of the 
consequences of a successful terrorist attack. Because the risk 
analysis model is consequences-driven, another measure of the model’s 
overall reasonableness is the extent to which the indices used to 
calculate the consequences component of the model are reasonable. As 
previously described, the consequences component of the model is 
comprised of four indices – a Population Index, an Economic Index, a 
National Infrastructure Index, and a National Security Index – each 
assigned a different weight. These indices are generally reasonable. 

Both the population and economic indices are calculated from data 
derived from reliable sources that are also publicly available, 
providing additional transparency for the model. For example, according 
to DHS officials, the fiscal year 2008 analysis used Gross Metropolitan 
Product (GMP) estimates prepared by the consulting firm Global Insight 
for the United States Conference of Mayors and the Council for the New 
American City that were published in January 2007, and reported on the 
GMP for 2005. In addition, the National Infrastructure Index focused on 
over 2,000 Tier 1and Tier 2 critical infrastructure/key resource assets 
identified by DHS’s Office of Infrastructure Protection (IP). For both 
fiscal years 2007 and 2008, DHS used a collaborative, multi-step 
process to create the Tier 2 CIKR list. First, IP works with sector-
specific agencies to develop criteria used to determine which assets 
should be included in the asset lists. Second, these criteria are 
vetted with the private-sector through sector-specific councils, who 
review the criteria and provide feedback to IP. Third, IP finalizes the 
criteria and provides it to the sector-specific agencies and State and 
Territorial Homeland Security Advisors (HSAs). Fourth, IP asks states 
to nominate assets within their jurisdiction that match the criteria. 
Fifth, assets nominated by states are reviewed by both the sector-
specific agencies and IP to decide which assets should comprise the 
final Tier 2 list. For example, to identify the nation’s critical 
energy assets, IP will work with the Department of Energy to determine 
which assets and systems in the energy sector would generate the most 
serious economic consequences to the Nation should they be destroyed or
disrupted. Further, in the fiscal year 2008 process, IP added a new, 
additional step to allow for the resubmission of assets for 
reconsideration if they are not initially selected for the Tier 2 list. 
In addition, the National Security Index comprises only a small 
fraction of the model – 5 percent – and has also evolved to include 
more precision, such as counting the number of military personnel 
instead of simply the presence or absence of military bases. To 
identify the nation’s critical defense industrial bases, the Department 
of Defense analyzes the impact on current warfighting capabilities, 
recovery and reconstitution, threat, vulnerability, and consequences of 
possible facility disruption and destruction, and other aspects. 

DHS’s approach to calculating threat, which accounts for the remaining 
20 percent of the model, also represents a measure of the model’s 
overall reasonableness. DHS uses analytical judgments to categorize 
urban areas’ threat, which ultimately determines the relative threat 
for each state and urban area. DHS has used written criteria to guide 
these judgments, and DHS provided us with the criteria used in both of 
these years for our review. The criteria are focused on threats from 
international terrorism derived from data on credible plots, planning, 
and threats from international terrorist networks, their affiliates, 
and those inspired by such networks. The criteria provided guidance for 
categorizing areas based on varying levels of both the credibility and 
the volume of threat reporting, as well as the potential targets of 
threats. Results of this process are shared with the DHS Undersecretary 
for Intelligence and Analysis, the FBI, and the National 
Counterterrorism Center, all of whom are afforded the opportunity to 
provide feedback on the placements. Additionally, DHS develops written 
threat assessments that indicate whether states are “high,” “medium,” 
or “low” threat states. States can provide threat information that they 
have collected to DHS, but in order for that information to affect a 
state’s tier placement and threat level, the information must be 
relevant to international terrorism, according to DHS officials. We 
reviewed several examples of these assessments from 2007, which 
included key findings describing both identified and potential threats 
to the state. The classified assessments addressed potential terrorist 
threats to critical infrastructure in each of the 56 states and 
territories. However, DHS shared assessments only with state officials 
who had appropriate security clearances. According to DHS officials, 
states without officials with sufficient clearances will receive an 
unclassified version of their state’s assessment for the fiscal year 
2009 grant process. DHS is also developing a process by which they can 
share the threat assessments with UASI areas, including those UASI 
areas whose boundaries cross state lines; however, currently the 
assessments are transmitted only to the DHS state representatives and 
state officials, and the states and representatives are responsible for 
sharing the information with the UASI areas, according to DHS 
officials. 

Another measure of the overall reasonableness of DHS’s risk analysis 
model is the extent to which the model’s results change when the 
assumptions and values built into the model, such as weights of 
variables, change. A model is sensitive when a model produces 
materially different results in response to small changes in its 
assumptions. Ideally, a model that accurately and comprehensively 
assesses risk would not be sensitive, and such a model exhibiting 
little sensitivity could be said to be more robust than a model with 
more sensitivity to changes in assumptions underlying the model. A 
robust calculation or estimation model provides its users greater 
confidence in the reliability of its results. For both fiscal years 
2007 and 2008, substantial changes had to be made to the weights of any 
of the indices used in the risk model to calculate state and urban area 
risk scores before there was any movement in or out of the top 7 (or 
Tier 1) ranked UASI areas. In other words, the model provides DHS with 
a level of assurance that the highest at-risk areas have been 
appropriately identified. While Tier 1 UASI areas were similarly robust 
in both FY 2007 and FY 2008, the sensitivity of Tier 2 UASI areas to 
changes in the weights of indices used to calculate risk scores was 
significant in FY 2007, but improved in FY 2008. In FY 2007, very small 
changes in the weights for the indices used to quantify risk (for Tier 
2 UASI areas at the eligibility cut point) resulted in changes in 
eligibility; however, FY 2008 results are more robust, as eligibility 
of urban areas is much less sensitive to changes in the index weights 
in the FY2008 model than it was in the FY2007 model. Appendix III 
provides an in-depth description of the sensitivity of the model to 
specific changes in the relative weights of each index for Tier 1 and 
Tier 2 UASI areas. 

Vulnerability Element of the Risk Analysis Model Has Limitations that 
Reduce Its Value: 

Although the methodology DHS uses is reasonable, the vulnerability 
element of the risk analysis model—as currently calculated by DHS—has 
limitations that reduce its value for providing an accurate assessment 
of risk. DHS considered most areas of the country equally vulnerable to 
a terrorist attack in the risk analysis model used for fiscal years 
2007 and 2008 and assigned a constant value to vulnerability, which 
ignores geographic differences in the social, built, and natural 
environments across states and urban areas. Although DHS recognized and 
described the significance of vulnerability in its FY 2006 model, the 
model used for fiscal years 2007 and 2008 did not attempt to measure 
vulnerability. Instead, DHS considered most areas of the country 
equally vulnerable to a terrorist attack due to the freedom of 
individuals to move within the nation. As a result, DHS did not measure 
vulnerability, but assigned it a constant value of 1.0 across all 
states and urban areas. 

Last year we reported that DHS measured the vulnerability of an asset 
type as part of its FY2006 risk analysis. [Footnote 22] DHS used 
internal subject matter experts who analyzed the general attributes of 
an asset type against various terrorist attack scenarios by conducting 
site vulnerability analyses on a sample of sites from the asset type in 
order to catalog attributes for the generic asset. These experts 
evaluated vulnerability by attack scenario and asset type pairs and 
assigned an ordinal value to the pair based on 10 major criteria. In 
describing its FY 2006 methodology, DHS acknowledged that because all 
attack types are not necessarily applicable to all infrastructures, the 
values for threat must be mapped against vulnerability to represent the 
greatest likelihood of a successful attack. DHS also acknowledged that 
vulnerability of an infrastructure asset was also a function of many 
variables and recognized that it did not have sufficient data on all 
infrastructures to know what specific vulnerabilities existed for every 
infrastructure, what countermeasures had been deployed, and what impact 
on other infrastructures each asset had. At that time, DHS noted it 
would require substantial time and resource investment to fully develop 
the capability to consistently assess and compare vulnerabilities 
across all types of infrastructure. 

Vulnerability is a crucial component of risk assessment. An asset may 
be highly vulnerable to one mode of attack but have a low level of 
vulnerability to another, depending on a variety of factors, such as 
countermeasures already in place. According to our risk management 
framework, the vulnerability of an asset is the probability that a 
particular attempted attack will succeed against a particular target or 
class of targets. It is usually measured against some set of standards, 
such as availability/predictability, accessibility, countermeasures in 
place, and target hardness (the material construction characteristics 
of the asset). Each of these four elements can be evaluated based on a 
numerical assignment corresponding to the conditional probability of a 
successful attack. Additionally, other research has developed methods 
to measure vulnerability across urban areas. For example, one study 
described a quantitative methodology to characterize the vulnerability 
of U.S. urban centers to terrorist attack for the potential allocation 
of national and regional funding to support homeland security 
preparedness and response in U.S. cities. [Footnote 23] This study 
found that vulnerability varied across the country, especially in urban 
areas. The study noted that “place matters,” and a one-size-fits all 
strategy ignores geographic differences in the social, built, and 
natural environments. Furthermore, in February of 2008 the Secretary of 
DHS said that “as we reduce our vulnerabilities, the vulnerabilities 
change as well.” However, while earlier iterations of the risk analysis 
model attempted to measure vulnerability, DHS’s risk analysis model now 
considers the states and urban areas of the country equally vulnerable 
to a terrorist attack and assigns a constant value to vulnerability, 
which ignores geographic differences. 

Conclusions: 

In fiscal year 2008, DHS will distribute approximately $1.6 billion to 
states and urban areas through its Homeland Security Grant Program – a 
program that has already distributed approximately $20 billion over the 
past six years – to prevent, protect against, respond to, and recover 
from acts of terrorism or other catastrophic events. Given that risk 
management has been endorsed by the federal government as a way to 
direct finite resources to those areas that are most at risk of 
terrorist attack under conditions of uncertainty, it is important that 
DHS use a reasonable risk-based allocation methodology and risk 
analysis model as it allocates those limited resources. Conclusions 
DHS’s risk-based allocation methodology and risk analysis model are 
generally reasonable tools for measuring relative risk within a given 
fiscal year, considering its use of a generally-accepted risk 
calculation formula; key model results’ decreased sensitivity to 
incremental changes in the assumptions related to Tier 1 UASI grantees 
or the eligibility for Tier 2 UASI funding, the reliability of the 
consequence variable component indices, and its adoption of MSAs to 
calculate urban area footprints. However, the element of vulnerability 
in the risk analysis model could be improved to more accurately reflect 
risk. Vulnerability is a crucial component of risk assessment, and our 
work shows that DHS needs to measure vulnerability as part of its risk 
analysis model to capture variations in vulnerability across states and 
urban areas. 

Recommendations: 

To strengthen DHS’s methodology for determining risk, we are 
recommending that the Secretary of DHS take the following action: 

* Instruct FEMA, I&A, and NPPD - DHS components each responsible for 
aspects of the risk-based methodology used to allocate funds under the 
Homeland Security Grant Program - to formulate a method to measure 
vulnerability in a way that captures variations across states and urban 
areas, and apply this vulnerability measure in future iterations of 
this risk-based grant allocation model. 

Agency Comments: 

We requested comments on a draft of this report from the Secretary of 
Homeland Security, FEMA, I&A, and NPPD, or their designees. In email 
comments on the draft report, FEMA and I&A concurred with our 
recommendation that they formulate a method to measure vulnerability in 
a way that captures variations across states and urban areas and apply 
this vulnerability measure in future iterations of the risk-based grant 
allocation model. FEMA, I&A, and NPPD also provided technical comments, 
which we incorporated as appropriate. 

We are sending copies of this correspondence to the appropriate 
congressional committees, and the Secretary of Homeland Security. 

Contact points for our Offices of Congressional Relations and Public 
Affairs may be found on the last page of this report. For further 
information about this report, please contact William Jenkins, Jr., 
Director, GAO Homeland Security and Justice Issues Team, at (202)-512-
8777 or at jenkinswo@gao.gov. GAO staff members who were major 
contributors to this report are listed in appendix IV. 

Signed by: 

William Jenkins, Jr., Director: 
Homeland Security and Justice Issues Team: 

[End of section] 

Appendix I: Briefing for Congressional Committees, February 11-25, 
2008: 

For the third consecutive year, GAO has been mandated as part of DHS’s 
annual appropriation to review and assess the HSGP’s risk analysis 
model and risk-based allocation methodology for determining risk and 
distributing funds. We responded to the mandate in February 2008 by 
briefing the staffs of congressional committees on the results of this 
review. During the course of our engagement, we had ongoing dialog with 
DHS officials regarding the extent to which written criteria were used 
in the development of the Threat Index. At that time, officials from 
DHS’s Office of Intelligence and Analysis stated that the criteria were 
not documented. As a result, we noted in the accompanying presentation 
slides that DHS’s approach to measuring threat did not include 
specific, written criteria to use when determining the threat tiers 
into which states and urban areas are placed. 

As part of GAO’s agency protocols, we convened an exit conference with 
DHS officials which occurred on April 14, 2008. We provided them with a 
statement of facts to reflect the information gathered during our 
engagement. At this exit conference an official from the Office of 
Intelligence and Analysis said DHS had used criteria in 2007 and 2008 
for categorizing cities and states based on threat, and in further 
discussions with DHS we were able to independently review these 
documents and confirm that such criteria were used in the development 
of the Threat Index, which is reflected in the letter above. However, 
we did not modify the accompanying presentation contained in this 
appendix. 

Homeland Security Grant Program (HSGP) Risk-Based Distribution Methods: 

Briefing for Congressional Committees: 

February 25, 2008: 

Introduction: 

According to the Department of Homeland Security (DHS), in fiscal year 
2007: 

* DHS provided approximately $1.7 billion to states and urban areas 
through its Homeland Security Grant Program (HSGP) to prevent, protect 
against, respond to, and recover from acts of terrorism or other 
catastrophic events. DHS plans to distribute about $1.6 billion for 
these grants in fiscal year 2008. 

* The HSGP risk-based allocation process is used for the State Homeland 
Security Program (SHSP) and Urban Area Security Initiative (UASI). 

* In addition, DHS used this same approach to allocate $655 million in 
fiscal year 2007 under the Infrastructure Protection Program. 

Objectives: 

In response to a legislative mandate and discussions with relevant 
congressional staff, we addressed the following questions: 

1. What methodology did DHS use to allocate HSGP funds for fiscal years 
2007 and 2008, including any changes DHS made to the eligibility and 
allocation processes for fiscal year 2008 and the placement of states 
and urban areas within threat tiers, and why? 

2. How reasonable is DHS’s methodology? 

Scope and Methodology: 

We analyzed DHS documents including the FY2007 and FY2008 risk analysis 
models, grant guidance, presentations, and interviewed DHS officials 
about: 

* The HSGP grant determination process in FY07—and any changes to the 
FY08 process—including: 
- The process by which DHS’s risk analysis model is used to estimate 
relative risk: Risk = Threat*(Vulnerability & Consequences); 
- How the effectiveness assessment process is conducted; 
- How final allocation decisions are made. 

* DHS’s methodology for ranking grantees by tiered groups and the 
impact of this ranking on funding allocations. 

We did our work from September 2007 and February 2008, in accordance 
with generally accepted government accounting standards (GAGAS). 

Background: 

We’ve reviewed this program for the last 3 years. In previous reviews 
we reported: 

* DHS has adopted a process of “continuous improvement” to its methods 
for estimating risk and measuring applicants’ effectiveness. 

* Inherent uncertainty is associated with estimating risk of terrorist 
attack, requiring the application of policy and analytic judgments. The 
use of sensitivity analysis can help to gauge what effects key sources 
of uncertainty have on outcomes. 

Results in Brief: 

This year, in our review of DHS’s allocation methodology, we found: 

* For FY 2008, DHS is using the same 3-step process –Risk Analysis, 
Effectiveness Assessment, and Final Allocation decisions –that includes 
empirical analytical methods and policy judgments, to select eligible 
urban areas and allocate SHSP and UASI funds. 

* Generally, DHS has constructed a reasonable methodology to assess 
risk and effectiveness and allocate funds within that given year. 
However, DHS could take an additional step to evaluate the reliability 
and validity of the peer review process. 

Overview of the Grant Determination Process for UASI and SHSP for FY 
2007 and FY 2008: 

In both years, DHS applied a 3-step process–using empirical analytical 
methods and policy judgments–to select eligible urban areas and 
allocate SHSP and UASI funds: 

1. Use of a Risk Analysis formula –R = T*(V&C) –with the same indices 
and weights--except for the Population Index used. 

2. Implementation of an Effectiveness Assessment, including a peer 
review process, to assess and score the effectiveness of the proposed 
investments submitted by the eligible applicants. 

3. Calculation of a Final Allocation of funds based on states and urban 
areas’ risk scores as adjusted by their effectiveness scores. 

Overview of the Grant Allocation Methodology for UASI and SHSG: 

This figure is an illustration of the Grant Allocation Methodology for 
UASI and SHSP, as follows: 

UASI: 

Funding allocation: 
Tier 1: 55%; 
Tier 2: 45%. 

Relative risk: Number of urban areas. 

Risk estimator: R = T x "(V & C)"; 
Yields relative risk estimate. 

Phase I: Risk analysis: produces Risk score; 
Phase II: Effectiveness assessment: 
Peer review of Investment Justifications; 
Yields effectiveness score. 

Phase 3: Final allocation: 
Utilizes Effectiveness/risk matrix. 

SHSP: 

Risk estimator: R = T x "(V & C)"; 
Yields relative risk estimate. 

Relative risk: Number of states and territories. 

Phase I: Risk analysis: produces Risk score; 
Phase II: Effectiveness assessment: 
Peer review of Investment Justifications; 
Yields effectiveness score. 

Phase 3: Final allocation: 
Utilizes Effectiveness/risk matrix. 
Statutory minimum = .375%[A] 

[End of figure] 

Risk Analysis: DHS’s Model Used in Determining Relative Risk Scores: 

This figure is an illustration of DHS’s Risk Analysis Model Used in 
Determining Relative Risk Scores, as follows: 

Risk = Threat Index: 
* Data: Credible plots, planning and threats from international 
terrorist networks, their affiliates and those inspired by them.
* Source: Intelligence Community reporting. 

Times: 

Vulnerability and Consequence Index; V&C = (P+E+I+N); 

Population Index: 
* Data: Total population (nighttime, commuter, visitor, military 
dependent) and population density (constrained to 50 percent impact); 
* Source: Census, LandScan, Smith Travel, and DOD. 

Economic Index: 
* Data: Gross Metropolitan Product (UASI)/percent GDP (state analysis); 
* Source: Global Insight/Department of Commerce, Bureau of Economic 
Statistics. 

National Infrastructure Index: 
* Data: # Tier I Assets (x3) +# Tier II Assets; 
* Source: DHS/OIP, SSAs, states and territories. 

National Security Index: 
* Data: Presence of Military Bases (yes/no) + # DIB + # international 
border crossings; 
* Source: DOD, DHS/CBP. 

Source: DHS. 

[End of figure] 

Risk Analysis Model: Calculating Threat: 

Threat Index: Reflects the Intelligence Community’s best assessment of 
areas of the country and potential targets most likely to be attacked. 

According to DHS officials, for FY2007 and FY2008, the DHS calculated 
the threat index by: 

1. Collecting qualitative threat information having a nexus with 
international terrorism or its affiliates (and not, for 
example,domestic terrorists or separatist groups); 

2. Analyzing the threat information to create threat assessments for 
states and urban areas; 

3. Empaneling intelligence experts to review the threat assessments and 
reach consensus as to the number of threat tiers and the placement of 
urban areas within threat tiers; and; 

4. Assigning threat scores to states and each urban area based on their 
threat tier placement. 

DHS /HITRAC officials characterized the general approach to measuring 
threat as empaneling senior intelligence experts who: 

* Consider threat information in four categories –detainee reporting, 
ongoing plot lines, credible reporting, and relevant investigations; 
and; 

* Use analytical judgment and discussion to reach consensus as to the 
number of threat tiers and the placement of urban areas within threat 
tiers. 

According to DHS officials, final threat assessments are approved by 
the Intelligence Community - FBI, CIA, NCTC, DIA, the DHS 
Undersecretary of I&A and the Secretary of DHS. 

This general approach has no written criteria, and DHS program 
officials expressed concerns about their confidence in the existing 
threat information. 

The threat tiering system is a method for organizing the threat 
information for the grant risk calculation model. The application of 
threat data to the risk determination methodology is process of 
assigning numbers to qualitative data according to DHS officials. 

Given their concerns about the available threat data, DHS officials 
expressed limited confidence in the formula’s ability to adequately 
represent threat (T). 

Consequently, threat has a weight of only 20% in the model used to 
determine relative risk. 

Risk Analysis Model: Calculating Vulnerability & Consequence (V&C): 

* Population Index: this variable included nighttime population and 
military dependent populations for states and urban areas, based upon 
U.S. Census Bureau and Department of Defense inputs. In addition, for 
urban areas, population density, commuters, and visitors were also 
factored into this variable, using data from private entities. 

* National Infrastructure Index: this variable focused on approximately 
2,100 Tier I and Tier II critical infrastructure/key resource (CI/KR) 
assets that were identified by the DHS Office of Infrastructure 
Protection. Tier I assets or systems are those that if attacked could 
trigger major national or regional impacts similar to those experienced 
during Hurricane Katrina or 9/11. Tier II assets are other highly-
consequential assets with potential national or regional impacts if 
attacked. 

* Economic Index: this variable considered the economic value of the 
goods and services produced in either a state or an urban area. For 
states, this index was calculated using U.S. Department of Commerce 
data on their percentage contribution to Gross Domestic Product. For 
UASI urban areas, a parallel calculation of Gross Metropolitan Product 
was incorporated based on data from Global Insight. 

* National Security Index: this variable considered the presence of 
three key national security factors: whether military bases are present 
in the state or urban area; how many critical defense industrial base 
facilities are located in the state or urban area; and the total number 
of people traversing international borders. Information on these inputs 
comes from the Department of Defense and DHS. 

Population Index: 

* For FY 2007, Urban Areas were defined as: Center city boundary +10-
mile radius. 

* For FY 2008, DHS used Metropolitan Statistical Areas (MSAs) from the 
Census Bureau, as provided under the Implementing Recommendations of 
the 9/11 Commission Act of 2007.[A] 

* Consequently, there were a number of changes in the rankings that 
were driven by the required change in FY2008 to use the MSAs, according 
to DHS officials. 

[A] 6 U.S.C. § 601(5). 

National Infrastructure Index: 

* Critical infrastructure assets are divided into 2 tiers that, if 
destroyed or disrupted, could cause significant casualties, major 
economic losses, or widespread/long-term disruptions to national well-
being and governance capacity. 

* Tier 2 includes the nation’s highest consequence critical 
infrastructure and key resources across 17 sectors. 

* Tier 1 is a small subset of Tier 2 and includes the most nationally 
significant assets/systems certain to produce at least two of four 
consequences: 
1. Prompt fatalities greater than 5,000; 
2. First-year economic impact of at least $75 billion; 
3. Mass evacuations with prolonged (6 months or more) absence; 
4. Loss of governance or mission execution disrupting multiple regions 
or critical infrastructure sectors for more than a week, resulting in a 
loss of necessary services to the public. 

National Infrastructure Index: Asset Identification Process: 

According to DHS, it used a collaborative, multi-step process to create 
the Tier 2 asset list: 

* Step 1: DHS’s Infrastructure Protection office (IP) works with sector-
specific agencies (SSAs) to develop criteria used to determine which 
assets should be placed in a threat tier; 

* Step 2: The criteria is vetted with private-sector companies through 
sector-specific councils who review the criteria and provide feedback 
to IP; 

* Step 3: IP finalizes the criteria list and provides the list to the 
sector-specific agencies; 

* Step 4: IP asks states to nominate assets within their jurisdiction 
that match the criteria; 

* Step 5: Nominated assets are reviewed by IP and the SSAs to decide 
which assets comprise the final Tier 2 list. 

IP has recently added a new process so SSAs can resubmit for 
reconsideration assets that are not initially selected for the list. 

Sensitivity of the risk analysis: 

In FY 2007, DHS had developed a greater understanding of the 
sensitivity of the risk model as a result of its changes to the model. 

GAO’s analysis of the FY 2007 model: 

* It takes sizable changes to the weights of these indices used to 
quantify risk to change the areas that compose the Tier 1 list. 

* For those urban areas ranked near the bottom of Tier 2 list, very 
small changes in the weights for the indices used to quantify risk can 
result in changes in eligibility. 

According to DHS officials, there were a number of changes in the 
rankings, and these changes were driven by the required change in 
FY2008 to use MSAs. 

Effectiveness Assessment: 

For fiscal year 2007 DHS assessed the applications submitted by states 
and eligible urban areas. 

DHS used a peer-review process to assess and score the effectiveness of 
proposed investments by: 

* Engaging the states in identifying and selecting peer reviewers; 

* Having peer reviewers individually score investments, and; 

* Assigning peer reviewers to panels to make final effectiveness score 
determinations. 

FY 2007 Effectiveness Assessment: 

[See PDF for image] 

This figure is an illustration of the FY 2007 Effectiveness Assessment, 
as follows: 

Effectiveness score (100 points); 
* Portfolio score (20 points); 
* Multi-applicant bonus, where applicable (up to 8 points); 
* Average of investment scores, 1 up to 15 (80 points); 
Investment scores: 
* Comprehensive Investment score (80 points) plus:
* Investment categories score (80 points): 
- Strategy (15%); 
- Milestones (10%); 
- Investment challenges (5%); 
- Impact (10%); 
- Program management (25%); 
- Impact (35%); 
[Published in fiscal year 2007 HSGP grant guidance]. 

Source: DHS. 

[End of figure] 

Effectiveness Assessment: Peer Review Process Quality Assurance and 
Inter-rater Reliability: 

As a quality control step, DHS analyzed the results of the peer review 
process to assess whether the process was affected by human bias. 

* DHS analyzed all FY 2007 panels’ scores and found no panel’s average 
was more than 2 standard deviations from the mean. 

* DHS concluded, from this finding, that their peer review process 
adequately mitigated human bias. 

However, based on GAO’s review of DHS documentation, the analysis DHS 
used did not apply a generally-accepted method to ensure inter-rater 
reliability. 

* One way to effectively assess the potential for human bias is to have 
a sample of the same applications independently rated by multiple 
panels to provide a measure of inter-rater reliability. 

Final Allocation Process: FY 2007 Grants Based on Both Risk and 
Effectiveness Scores: 

DHS allocated funds based on the risk scores of states and urban areas, 
as adjusted by their effectiveness scores. 

SHSP provided a minimum allocation, ensuring no state or territory’s 
allocation falls below the minimum levels established by the USA 
PATRIOT Act.[A] 

For UASI, DHS established maximum and minimum allocation to minimize 
variations in some urban areas’ final allocations between years. 

[A] For FY2007 this minimum was 0.75 percent of funds appropriated for 
SHSP for states and 0.25 percent for territories. FY 2008 statutory 
minimum = 0.375% of all funds appropriated for SHSP and UASI. 

Final Allocation Process: Ranking UASI Grantees by Tiered groups: 

Fiscal year 2007, 45 eligible candidates were grouped into two tiers 
according to relative risk. 

Tiering was established from a policy judgment by DHS leadership, 
according to DHS grant officials. 

Tier I included the 6 highest risk areas; Tier II included the other 39 
candidate areas ranked by risk. 

* FY 2007 Tier I Urban Areas = 6 Urban Areas, $410,795,000 allocated 
(55 percent of available funds). 

* FY 2007 Tier II Urban Areas = 39 Urban Areas, $336,105,000 allocated 
(45 percent of available funds). 

Final Allocation Process: Risk Estimates Used to Inform Eligibility 
Decisions for the UASI Grant Program—Fiscal Year 2008: 

60 eligible UASI areas in FY 2008: 

* Tier I = 7 highest risk areas and eligible for 55 percent of 
available funds --$429,896,500. 

* Tier II = 53 areas (14 more than FY 2007) and eligible for 45 percent 
of available funds --$351,733,500. 

According to DHS officials, the expansion to 60 eligible UASI areas for 
FY2008 is a policy decision largely driven by two factors: 

1. The new requirement that FEMA use MSAs; 

2. The desire to remain consistent with the funding. 

Observations on the Reasonableness of the HSGP Grant Distribution 
Methodology: 

As inherent uncertainty is always associated with estimating risk of 
terrorist attack, policy and analytic judgments are required. 

DHS has adopted an overall risk assessment approach that consists of 
risk factors, and in implementing this approach has made judgments in 
an attempt to address inherent uncertainties. 

Generally, DHS has constructed a reasonable methodology to assess risk 
and effectiveness and allocate funds within that given year. 

DHS could take an additional step to evaluate the reliability and 
validity of the peer review process. 

* One way to effectively assess the potential for human bias is to have 
a sample of the same applications independently rated by multiple 
panels to provide a measure of inter-rater reliability. 

* DHS identified resource constraints as a reason for not measuring 
inter-rater reliability. 

[End of section] 

Appendix II: Identifying Eligible Urban Areas: 

As we reported in 2007, DHS first had to determine the geographic 
boundaries or footprint of candidate urban areas within which data were 
collected to estimate risk in order to determine the urban areas that 
were eligible to receive UASI grants. In fiscal year 2005, the 
footprint was limited to city boundaries (and did not include the 10-
mile buffer zone). DHS chose to further redefine the footprint for 
fiscal year 2006, on the basis of comments from state and local 
governments. DHS took several steps to identify this footprint; these 
included: 

* Identifying areas with population greater than 100,000 persons and 
areas (cities) that had any reported threat data during that past year. 
For fiscal year 2006, DHS started with a total of 266 cities. 

* Combining cities or adjacent urban counties with shared boundaries to 
form single jurisdictions. For fiscal year 2006, this resulted in 172 
urban areas. 

Drawing a buffer zone around identified areas. A 10-mile buffer was 
then drawn from the border of that city/combined entity to establish 
candidate urban areas.[Footnote 24] This area was used to determine 
what information was used in the risk analysis, and represents the 
minimum area that had to be part of the state/urban areas defined grant 
application areas. 

According to DHS, for fiscal year 2006, it considered other 
alternatives such as a radius from a city center, although such a 
solution created apparent inequities among urban areas. DHS 
incorporated buffer zones at the suggestion of stakeholders, although 
this action resulted in making the analysis more difficult, according 
to a DHS official. In addition, DHS officials told us the steps taken 
to determine the footprint were based on the “best fit,” as compared 
with other alternatives. DHS did not provide details on what criteria 
this comparison was based on. 

A principal change between fiscal year 2007 and 2008 was the method 
used to identify the footprint, or boundaries, of UASI areas for the 
purposes of calculating relative risk. In fiscal year 2008, DHS used 
Metropolitan Statistical Areas (MSAs) from the Census Bureau, as 
required under the Implementing Recommendations of the 9/11 Commission 
Act of 2007. [Footnote 25] 

Table 1 below provide additional information listing the urban areas by 
its prior geographic area captures, and the areas captured by MSAs. 

Table 1: Urban Areas Eligible for UASI Grants: Fiscal Year 2006 
Footprint vs. 2008 by Metropolitan Statistical Areas (New UASI grantees 
are in italics): 

State: Arizona; 
Eligible urban area/Geographic area captured in the data count: Phoenix 
Area: Chandler, Gilbert, Glendale, Mesa, Peoria, Phoenix, Scottsdale, 
Tempe, and a 10-mile buffer extending from the border of the combined 
area. 
Metropolitan Statistical Areas used in FY2008[A]: Phoenix-Mesa-
Scottsdale, AZ Metropolitan Statistical Area; Principal Cities: 
Phoenix, Mesa, Scottsdale, Tempe; Maricopa County, Pinal County. 

State: Arizona; 
Eligible urban area/Geographic area captured in the data count: [Empty] 
Metropolitan Statistical Areas used in FY2008[A]: Tucson, AZ 
Metropolitan Statistical Area; Principal City: Tucson; Pima County. 

State: California; 
Eligible urban area/Geographic area captured in the data count: Anaheim 
/Santa Ana Area: Anaheim, Costa Mesa, Garden Grove, Fullerton, 
Huntington Beach, Irvine, Orange, Santa Ana, and a 10-mile buffer 
extending from the border of the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: Santa Ana-Anaheim-
Irvine, CA Metropolitan Division Orange County. 

State: California; 
Eligible urban area/Geographic area captured in the data count: Los 
Angeles/Long Beach Area: Burbank, Glendale, Inglewood, Long Beach, Los 
Angeles, Pasadena, Santa Monica, Santa Clarita, Torrance, Simi Valley, 
Thousand Oaks, and a 10-mile buffer extending from the border of the 
combined area. 
Metropolitan Statistical Areas used in FY2008[A]: Los Angeles-Long 
Beach-Santa Ana, CA Metropolitan Statistical Area; Principal Cities: 
Los Angeles, Long Beach, Glendale, Irvine, Pomona, Pasadena, Torrance, 
Orange, Fullerton, Costa Mesa, Burbank, Compton, Carson, Santa Monica, 
Newport Beach, Tustin, Montebello, Monterey Park, Gardena, Paramount, 
Fountain Valley, Arcadia, Cerritos Los Angeles-Long Beach-Glendale, CA 
Metropolitan Division Los Angeles County. 

State: California; 
Eligible urban area/Geographic area captured in the data count: 
Sacramento Area: Elk Grove, Sacramento, and a 10-mile buffer extending 
from the border of the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: Sacramento—Arden-
Arcade—Roseville, CA Metropolitan Statistical Area; Principal Cities: 
Sacramento, Arden-Arcade, Roseville, Folsom, Rancho Cordova, Woodland; 
El Dorado County, Placer County, Sacramento County, Yolo County. 

State: California; 
Eligible urban area/Geographic area captured in the data count: San 
Diego Area: Chula Vista, Escondido, and San Diego, and a 10-mile buffer 
extending from the border of the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: San Diego-Carlsbad-
San Marcos, CA Metropolitan Statistical Area; Principal Cities: San 
Diego, Carlsbad, San Marcos, National City; San Diego County. 

State: California; 
Eligible urban area/Geographic area captured in the data count: Bay 
Area: Berkeley, Daly City, Fremont, Hayward, Oakland, Palo Alto, 
Richmond, San Francisco, San Jose, Santa Clara, Sunnyvale, Vallejo, and 
a 10-mile buffer extending from the border of the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: San Francisco-San 
Jose-Bay Area: San Francisco-Oakland-Fremont, CA Metropolitan 
Statistical Area Principal Cities: San Francisco, Oakland, Fremont, 
Hayward, Berkeley, San Mateo, San Leandro, Redwood City, Pleasanton, 
Walnut Creek, South San Francisco, San Rafael; Oakland-Fremont-Hayward, 
CA Metropolitan Division Alameda County, Contra Costa County; San 
Francisco-San Mateo-Redwood City, CA Metropolitan Division; Marin 
County, San Francisco County, San Mateo County; San Jose-Sunnyvale-
Santa Clara, CA Metropolitan Statistical Area ; Principal Cities: San 
Jose, Sunnyvale, Santa Clara, Mountain View, Milpitas, Palo Alto, 
Cupertino San Benito County, Santa Clara County. 

State: California; 
Eligible urban area/Geographic area captured in the data count: [Empty] 
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area – 
Riverside -San Bernardino-Ontario, CA Metropolitan Statistical Area 
Principal Cities: Riverside, San Bernardino, Ontario, Victorville, 
Temecula, Chino, Redlands, Hemet, Colton; Riverside County, San 
Bernardino County. 

State: Colorado; 
Eligible urban area/Geographic area captured in the data count: Denver 
Area: Arvada, Aurora, Denver, Lakewood, Westminster, Thornton, and a 10-
mile buffer extending from the border of the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: Denver-Aurora, CO 
Metropolitan Statistical Area Principal Cities: Denver, Aurora; Adams 
County, Arapahoe County, Broomfield County, Clear Creek County, Denver 
County, Douglas County, Elbert County, Gilpin County, Jefferson County, 
Park County. 

State: Connecticut; 
Eligible urban area/Geographic area captured in the data count: [Empty] 
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area – 
Hartford -West Hartford-East Hartford, CT Metropolitan Statistical Area 
Principal Cities: Hartford, West Hartford, East Hartford, Middletown; 
Hartford County, Middlesex County, Tolland County. 

State: Connecticut; 
Eligible urban area/Geographic area captured in the data count: [Empty] 
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area — 
Bridgeport-Stamford-Norwalk, CT Metropolitan Statistical Area Principal 
Cities: Bridgeport, Stamford, Norwalk, Danbury, Stratford; Fairfield 
County. 

State: District of Columbia; 
Eligible urban area/Geographic area captured in the data count: 
National Capital Region: National Capital Region and a 10-mile buffer 
extending from the border of the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: Washington-Arlington-
Alexandria, DC-VA-MD-WV Metropolitan Statistical Area; Principal 
Cities: Washington, DC; Arlington, VA; Alexandria, VA; Reston, VA; 
Bethesda, MD; Gaithersburg, MD; Frederick, MD; Rockville, MD Bethesda-
Gaithersburg-Frederick, MD Metropolitan Division Frederick County, 
Montgomery County; Washington-Arlington-Alexandria, DC-VA-MD-WV 
Metropolitan Division District of Columbia, DC; Calvert County, MD; 
Charles County, MD; Prince George’s County, MD; Arlington County, VA; 
Clarke County, VA; Fairfax County, VA; Fauquier County, VA; Loudoun 
County, VA; Prince William County, VA; Spotsylvania County, VA; 
Stafford County, VA; Warren County, VA; Alexandria city, VA; Fairfax 
city, VA; Falls Church city, VA; Fredericksburg city, VA; Manassas 
city, VA; Manassas Park city, VA; Jefferson County, WV. 

State: Florida; 
Eligible urban area/Geographic area captured in the data count: Fort 
Lauderdale Area: Fort Lauderdale, Hollywood, Miami Gardens, Miramar, 
Pembroke Pines, and a 10-mile buffer extending from the border of the 
combined area. 
Metropolitan Statistical Areas used in FY2008[A]: Fort Lauderdale-
Pompano Beach, FL Metropolitan Statistical Area; Principal Cities: Fort 
Lauderdale, West Palm Beach, Pompano Beach, Boca Raton, Deerfield 
Beach, Boynton Beach, Delray Beach; Broward County, Palm Beach, County. 

State: Florida; 
Eligible urban area/Geographic area captured in the data count: 
Jacksonville Area: Jacksonville and a 10-mile buffer extending from the 
city border. 
Metropolitan Statistical Areas used in FY2008[A]: Jacksonville, FL 
Metropolitan Statistical Area; Principal City: Jacksonville; Baker 
County, Clay County, Duval County, Nassau County, St. Johns County. 

State: Florida; 
Eligible urban area/Geographic area captured in the data count: Miami 
Area: Hialeah, Miami, and a 10-mile buffer extending from the border of 
the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: Miami, FL 
Metropolitan Statistical Area; Principal Cities: Miami, Miami Beach, 
Kendall; Monroe County, Miami-Dade.County. 

State: Florida; 
Eligible urban area/Geographic area captured in the data count: Orlando 
Area: Orlando and a 10-mile buffer extending from the city border. 
Metropolitan Statistical Areas used in FY2008[A]: Orlando-Kissimmee, FL 
Metropolitan Statistical Area; Principal Cities: Orlando, Kissimmee; 
Lake County, Orange County, Osceola County, Seminole County. 

State: Florida; 
Eligible urban area/Geographic area captured in the data count: Tampa 
Area: Clearwater, St. Petersburg, Tampa, and a 10-mile buffer extending 
from the border of the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: Tampa-St. Petersburg-
Clearwater, FL Metropolitan Statistical Area; Principal Cities: Tampa, 
St. Petersburg, Clearwater, Largo; Hernando County, Hillsborough 
County, Pasco County, Pinellas County. 

State: Georgia; 
Eligible urban area/Geographic area captured in the data count: Atlanta 
Area: Atlanta and a 10-mile buffer extending from the city border. 
Metropolitan Statistical Areas used in FY2008[A]: Atlanta-Sandy Springs-
Marietta, GA Metropolitan Statistical Area; Principal Cities: Atlanta, 
Sandy Springs, Marietta; Barrow County, Bartow County, Butts County, 
Carroll County, Cherokee County, Clayton County, Cobb County, Coweta 
County, Dawson County, DeKalb County, Douglas County, Fayette County, 
Forsyth County, Fulton County, Gwinnett County, Haralson County, Heard 
County, Henry County, Jasper County, Lamar County, Meriwether County, 
Newton County, Paulding County, Pickens County, Pike County, Rockdale 
County, Spalding County, Walton County. 

State: Hawaii; 
Eligible urban area/Geographic area captured in the data count: 
Honolulu Area: Honolulu and a 10-mile buffer extending from the city 
border. 
Metropolitan Statistical Areas used in FY2008[A]: Honolulu, HI 
Metropolitan Statistical Area; Principal City: Honolulu, Honolulu 
County. 

State: Illinois; 
Eligible urban area/Geographic area captured in the data count: Chicago 
Area: Chicago and a 10-mile buffer extending from the city border. 
Metropolitan Statistical Areas used in FY2008[A]: Chicago-Naperville-
Joliet, IL-IN-WI Metropolitan Statistical Area; Principal Cities: 
Chicago, IL; Naperville, IL; Joliet, IL; Gary, IN; Elgin, IL; Arlington 
Heights, IL; Evanston, IL; Schaumburg, IL; Skokie, IL; Des Plaines, IL; 
Hoffman Estates, IL ; Chicago-Naperville-Joliet, IL Metropolitan 
Division; Cook County, DeKalb County, DuPage County, Grundy County, 
Kane County, Kendall County, McHenry County, Will County ,Gary, IN 
Metropolitan Division Jasper County, Lake County, Newton County, Porter 
County Lake County-Kenosha County, IL-WI Metropolitan Division Lake 
County, IL; Kenosha County, WI. 

State: Indiana; 
Eligible urban area/Geographic area captured in the data count: 
Indianapolis Area: Indianapolis and a 10-mile buffer extending from the 
city border. 
Metropolitan Statistical Areas used in FY2008[A]: Indianapolis-Carmel, 
IN Metropolitan Statistical Area; Principal City: Indianapolis city 
(balance),[Footnote 26] Carmel; Boone County, Brown County, Hamilton 
County, Hancock County, Hendricks County, Johnson County, Marion 
County, Morgan County, Putnam County, Shelby County. 

State: Kentucky; 
Eligible urban area/Geographic area captured in the data count: 
Louisville Area: Louisville and a 10-mile buffer extending from the 
city border. 
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area — 
Louisville/Jefferson County, KY-IN Metropolitan Statistical Area; 
Principal City: Louisville/Jefferson County (balance), KY, [Footnote 
27] Clark County, IN; Floyd County, IN; Harrison County, IN; Washington 
County, IN; Bullitt County, KY; Henry County, KY; Jefferson County, KY; 
Meade County, KY; Nelson County, KY; Oldham County, KY; Shelby County, 
KY; Spencer County, KY; Trimble County, KY. 

State: Louisiana; 
Eligible urban area/Geographic area captured in the data count: Baton 
Rouge Area: Baton Rouge and a 10-mile buffer extending from the city 
border. 
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area — 
Baton Rouge, LA; Metropolitan Statistical Area; Principal City: Baton 
Rouge; Ascension Parish, East Baton Rouge Parish, East Feliciana 
Parish, Iberville Parish, Livingston Parish, Pointe Coupee Parish, St. 
Helena Parish, West Baton Rouge Parish, West Feliciana Parish. 

State: Louisiana; 
Eligible urban area/Geographic area captured in the data count: New 
Orleans Area: New Orleans and a 10-mile buffer extending from the city 
border. 
Metropolitan Statistical Areas used in FY2008[A]: New Orleans-Metairie-
Kenner, LA; Metropolitan Statistical Area: Principal Cities: New 
Orleans, Metairie, Kenner; Jefferson Parish, Orleans Parish, 
Plaquemines Parish, St. Bernard Parish, St. Charles Parish, St. John 
the Baptist Parish, St. Tammany Parish. 

State: 
Eligible urban area/Geographic area captured in the data count: 
Metropolitan Statistical Areas used in FY2008[A]: 

State: Massachusetts; 
Eligible urban area/Geographic area captured in the data count: Boston 
Area: Boston, Cambridge, and a 10-mile buffer extending from the border 
of the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: Boston-Cambridge-
Quincy, MA-NH Metropolitan Statistical Area; Principal Cities: Boston, 
MA; Cambridge, MA; Quincy, MA; Newton, MA; Framingham, MA; Waltham, MA; 
Peabody, MA Boston-Quincy, MA Metropolitan Division; Norfolk County, 
Plymouth County, Suffolk County Cambridge-Newton-Framingham, MA 
Metropolitan Division Middlesex County, Peabody, MA Metropolitan 
Division Essex County Rockingham County-Strafford County, NH 
Metropolitan Division Rockingham County, Strafford County. 

State: Maryland; 
Eligible urban area/Geographic area captured in the data count: 
Baltimore Area: Baltimore and a 10-mile buffer extending from the city 
border. 
Metropolitan Statistical Areas used in FY2008[A]: Baltimore-Towson, MD 
Metropolitan Statistical Area; Principal Cities: Baltimore, Towson; 
Anne Arundel County, Baltimore County, Carroll County, Harford County, 
Howard County, Queen Anne’s County, Baltimore city. 

State: Michigan; 
Eligible urban area/Geographic area captured in the data count: Detroit 
Area: Detroit, Sterling Heights, Warren, and a 10-mile buffer extending 
from the border of the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: Detroit-Warren-
Livonia, MI Metropolitan Statistical Area; Principal Cities: Detroit, 
Warren, Livonia, Dearborn, Troy, Farmington Hills, Southfield, Pontiac, 
Taylor, Novi Detroit-Livonia-Dearborn, MI Metropolitan Division; Wayne 
County, Warren-Troy-Farmington Hills, MI Metropolitan Division Lapeer 
County, Livingston County, Macomb County, Oakland County, St. Clair 
County. 

State: Minnesota; 
Eligible urban area/Geographic area captured in the data count: Twin 
Cities Area: Minneapolis, St. Paul, and a 10-mile buffer extending from 
the border of the combined entity. 
Metropolitan Statistical Areas used in FY2008[A]: Minneapolis-St. Paul-
Bloomington, MN-WI Metropolitan Statistical Area; Principal Cities: 
Minneapolis, MN; St. Paul, MN; Bloomington, MN; Plymouth, MN; Eagan, 
MN; Eden Prairie, MN; Minnetonka, MN; Anoka County, MN; Carver County, 
MN; Chisago County, MN; Dakota County, MN; Hennepin County, MN; Isanti 
County, MN; Ramsey County, MN; Scott County, MN; Sherburne County, MN; 
Washington County, MN; Wright County, MN; Pierce County, WI; St. Croix 
County, WI. 

State: Missouri; 
Eligible urban area/Geographic area captured in the data count: Kansas 
City Area: Independence, Kansas City (MO), Kansas City (KS), Olathe, 
Overland Park, and a 10-mile buffer extending from the border of the 
combined area. 
Metropolitan Statistical Areas used in FY2008[A]: Kansas City, MO-KS 
Metropolitan Statistical Area [Footnote 28]; Principal Cities: Kansas 
City, MO, Overland Park, KS, Kansas City, KS Franklin County, KS; 
Johnson County, KS; Leavenworth County, KS; Linn County, KS; Miami 
County, KS; Wyandotte County, KS; Bates County, MO; Caldwell County, 
MO; Cass County, MO; Clay County, MO; Clinton County, MO; Jackson 
County, MO; Lafayette County, MO; Platte County, MO; Ray County, MO. 

State: Missouri; 
Eligible urban area/Geographic area captured in the data count: St. 
Louis Area: St. Louis and a 10-mile buffer extending from the city 
border. 
Metropolitan Statistical Areas used in FY2008[A]: St. Louis, MO-IL 
Metropolitan Statistical Area [Footnote 29]; Principal Cities: St. 
Louis, MO; St. Charles, MO; Bond County, IL; Calhoun County, IL; 
Clinton County, IL; Jersey County, IL; Macoupin County, IL; Madison 
County, IL; Monroe County, IL; St. Clair County, IL; Crawford County, 
MO (part—Sullivan city);[Footnote 30] Franklin County, MO; Jefferson 
County, MO; Lincoln County, MO; St. Charles County, MO; St. Louis 
County, MO; Warren County, MO; Washington County, MO; St. Louis city, 
MO. 

State: North Carolina; 
Eligible urban area/Geographic area captured in the data count: 
Charlotte Area: Charlotte and a 10-mile buffer extending from the city 
border. 
Metropolitan Statistical Areas used in FY2008[A]: Charlotte-Gastonia-
Concord, NC-SC Metropolitan Statistical Area; Principal Cities: 
Charlotte, NC; Gastonia, NC; Concord, NC, Rock Hill, SC; Anson County, 
NC; Cabarrus County, NC; Gaston County, NC; Mecklenburg County, NC; 
Union County, NC; York County, SC. 

State: New Jersey; 
Eligible urban area/Geographic area captured in the data count: Jersey 
City/Newark Area: Elizabeth, Jersey City, Newark, and a 10-mile buffer 
extending from the border of the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: Newark Metropolitan 
Statistical Area; Principal Cities: Newark, Edison, Union, Wayne; 
Bergen County, Essex County, Hudson County, Hunterdon County, Middlesex 
County, Monmouth County, Morris County, Ocean County, Passaic County, 
Somerset County, Sussex County , Union County , Pike County (PA). 
[Footnote 31] 

State: Nevada; 
Eligible urban area/Geographic area captured in the data count: Las 
Vegas Area: Las Vegas, North Las Vegas, and a 10-mile buffer extending 
from the border of the combined entity. 
Metropolitan Statistical Areas used in FY2008[A]: Las Vegas-Paradise, 
NV Metropolitan Statistical Area; Principal Cities: Las Vegas, 
Paradise; Clark County. 

State: New York; 
Eligible urban area/Geographic area captured in the data count: [Empty] 
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area — 
Albany-Schenectady-Troy, NY Metropolitan Statistical Area; Principal 
Cities: Albany, Schenectady, Troy; Albany County, Rensselaer County, 
Saratoga County, Schenectady County, Schoharie County. 

State: New York; 
Eligible urban area/Geographic area captured in the data count: Buffalo 
Area: Buffalo and a 10-mile buffer extending from the city border. 
Metropolitan Statistical Areas used in FY2008[A]: Buffalo-Niagara 
Falls, NY Metropolitan Statistical Area; Principal Cities: Buffalo, 
Cheektowaga, Tonawanda, Niagara Falls; Erie County, Niagara County. 

State: New York; 
Eligible urban area/Geographic area captured in the data count: New 
York City Area: New York City, Yonkers, and a 10-mile buffer extending 
from the border of the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: New York-Long Island, 
NY — Metropolitan Statistical Area; Principal Cities: New York, White 
Plains; Bronx County, Kings County, Nassau County, New York County, 
Putnam County, Queens County, Richmond County, Rockland County, Suffolk 
County, Westchester County. 

State: New York; 
Eligible urban area/Geographic area captured in the data count: [Empty] 
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area — 
Rochester, NY Metropolitan Statistical Area; Principal City: Rochester; 
Livingston County, Monroe County, Ontario County, Orleans County, Wayne 
County. 

State: New York; 
Eligible urban area/Geographic area captured in the data count: [Empty] 
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area — 
Syracuse, NY Metropolitan Statistical Area; Principal City: Syracuse; 
Madison County, Onondaga County, Oswego County. 

State: Ohio; 
Eligible urban area/Geographic area captured in the data count: 
Cincinnati Area: Cincinnati and a 10-mile buffer extending from the 
city border. 
Metropolitan Statistical Areas used in FY2008[A]: Cincinnati-
Middletown, OH-KY-IN Metropolitan Statistical Area; Principal Cities: 
Cincinnati, OH; Middletown, OH; Dearborn County, IN; Franklin County, 
IN; Ohio County, IN; Boone County, KY; Bracken County, KY; Campbell 
County, KY; Gallatin County, KY; Grant County, KY; Kenton County, KY; 
Pendleton County, KY; Brown County, OH; Butler County, OH; Clermont 
County, OH; Hamilton County, OH; Warren County, OH. 

State: Ohio; 
Eligible urban area/Geographic area captured in the data count: 
Cleveland Area: Cleveland and a 10-mile buffer extending from the city 
border. 
Metropolitan Statistical Areas used in FY2008[A]: Cleveland-Elyria-
Mentor, OH Metropolitan Statistical Area; Principal Cities: Cleveland, 
Elyria, Mentor; Cuyahoga County, Geauga County, Lake County, Lorain 
County, Medina County. 

State: Ohio; 
Eligible urban area/Geographic area captured in the data count: 
Columbus Area: Columbus and a 10-mile buffer extending from the city 
border. 
Metropolitan Statistical Areas used in FY2008[A]: Columbus, OH 
Metropolitan Statistical Area; Principal City: Columbus; Delaware 
County, Fairfield County, Franklin County, Licking County, Madison 
County, Morrow County, Pickaway County, Union County. 

State: Ohio; 
Eligible urban area/Geographic area captured in the data count: Toledo 
Area: Oregon, Toledo, and a 10-mile buffer extending from the border of 
the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area — 
Toledo, OH Metropolitan Statistical Area; Principal City: Toledo; 
Fulton County, Lucas County, Ottawa County, Wood County. 

State: Oklahoma; 
Eligible urban area/Geographic area captured in the data count: 
Oklahoma City Area: Norman, Oklahoma City, and a 10-mile buffer 
extending from the border of the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: Oklahoma City, OK 
Metropolitan Statistical Area; Principal City: Oklahoma City; Canadian 
County, Cleveland County, Grady County, Lincoln County, Logan County, 
McClain County, Oklahoma County. 

State: Oregon; 
Eligible urban area/Geographic area captured in the data count: 
Portland Area: Portland, Vancouver, and a 10-mile buffer extending from 
the border of the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: Portland-Vancouver-
Beaverton, OR-WA Metropolitan Statistical Area; Principal Cities: 
Portland, OR; Vancouver, WA; Beaverton, OR; Hillsboro, OR; Clackamas 
County, OR; Columbia County, OR; Multnomah County, OR; Washington 
County, OR; Yamhill County, OR; Clark County, WA; Skamania County, WA. 

State: Pennsylvania; 
Eligible urban area/Geographic area captured in the data count: 
Philadelphia Area: Philadelphia and a 10-mile buffer extending from the 
city border. 
Metropolitan Statistical Areas used in FY2008[A]: Philadelphia-Camden-
Wilmington, PA-NJ-DE-MD Metropolitan Statistical Area; Principal 
Cities: Philadelphia, PA; Camden, NJ; Wilmington, DE Camden, NJ 
Metropolitan Division; Burlington County, Camden County, Gloucester 
County 37964 Philadelphia, PA Metropolitan Division Bucks County, 
Chester County, Delaware County, Montgomery County, Philadelphia County 
Wilmington, DE-MD-NJ Metropolitan Division New Castle County, DE; Cecil 
County, MD; Salem County, NJ. 

State: Pennsylvania; 
Eligible urban area/Geographic area captured in the data count: 
Pittsburgh Area: Pittsburgh and a 10-mile buffer extending from the 
city border. 
Metropolitan Statistical Areas used in FY2008[A]: Pittsburgh, PA 
Metropolitan Statistical Area; Principal City: Pittsburgh; Allegheny 
County, Armstrong County, Beaver County, Butler County, Fayette County, 
Washington County, Westmoreland County. 

State: Puerto Rico; 
Eligible urban area/Geographic area captured in the data count: [Empty] 
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area — 
San Juan-Caguas-Guaynabo, PR Metropolitan Statistical Area; Principal 
Cities: San Juan, Caguas, Guaynabo Aguas Buenas Municipio, Aibonito 
Municipio, Arecibo Municipio, Barceloneta Municipio, Barranquitas 
Municipio, Bayamón Municipio, Caguas Municipio, Camuy Municipio, 
Canóvanas Municipio, Carolina Municipio, Cataño Municipio, Cayey 
Municipio, Ciales Municipio, Cidra Municipio, Comerío Municipio, 
Corozal Municipio, Dorado Municipio, Florida Municipio, Guaynabo 
Municipio, Gurabo Municipio, Hatillo Municipio, Humacao Municipio, 
Juncos Municipio, Las Piedras Municipio, Loíza Municipio, Manatí 
Municipio, Maunabo Municipio, Morovis Municipio, Naguabo Municipio, 
Naranjito Municipio, Orocovis Municipio, Quebradillas Municipio, Río 
Grande Municipio, San Juan Municipio, San Lorenzo Municipio, Toa Alta 
Municipio, Toa Baja Municipio, Trujillo Alto Municipio, Vega Alta 
Municipio, Vega Baja Municipio, Yabucoa Municipio. 

State: Rhode Island; 
Eligible urban area/Geographic area captured in the data count: [Empty] 
Metropolitan Statistical Areas used in FY2008[A]: Providence-New 
Bedford-Fall River, RI-MA Metropolitan Statistical Area; Principal 
Cities: Providence, RI; New Bedford, MA; Fall River, MA; Warwick, RI; 
Cranston, RI; Bristol County, MA; Bristol County, RI; Kent County, RI; 
Newport County, RI; Providence County, RI; Washington County, RI. 

State: Tennessee; 
Eligible urban area/Geographic area captured in the data count: Memphis 
Area: Memphis and a 10-mile buffer extending from the city border. 
Metropolitan Statistical Areas used in FY2008[A]: Memphis, TN-MS-AR 
Metropolitan Statistical Area; Principal City: Memphis, TN; Crittenden 
County, AR; DeSoto County, MS; Marshall County, MS; Tate County, MS; 
Tunica County, MS; Fayette County, TN; Shelby County, TN; Tipton 
County, TN. 

State: Tennessee; 
Eligible urban area/Geographic area captured in the data count: [Empty] 
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area – 
Nashville –Davidson, Murfreesboro, Franklin, TN Metropolitan 
Statistical Area Principal Cities: Nashville-Davidson (balance), 
[Footnote 32] Murfreesboro, Franklin; Cannon County, Cheatham County, 
Davidson County, Dickson County, Hickman County, Macon County, 
Robertson County, Rutherford County, Smith County, Sumner County, 
Trousdale County, Williamson County, Wilson County. 

State: Texas; 
Eligible urban area/Geographic area captured in the data count: [Empty] 
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area — 
Austin-Round Rock, TX Metropolitan Statistical Area; Principal Cities: 
Austin, Round Rock; Bastrop County, Caldwell County, Hays County, 
Travis County, Williamson County. 

State: Texas; 
Eligible urban area/Geographic area captured in the data count: 
Dallas/Fort Worth/Arlington Area: Arlington, Carrollton, Dallas, Fort 
Worth, Garland, Grand Prairie, Irving, Mesquite, Plano, and a 10-mile 
buffer extending from the border of the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: Dallas-Fort Worth-
Arlington, TX Metropolitan Statistical Area; Principal Cities: Dallas, 
Fort Worth, Arlington, Plano, Irving, Carrollton, Denton, Richardson, 
McKinney Dallas-Plano-Irving, TX Metropolitan Division; Collin County, 
Dallas County, Delta County, Denton County, Ellis County, Hunt County, 
Kaufman County, Rockwall County Fort Worth-Arlington, TX Metropolitan 
Division Johnson County, Parker County, Tarrant County, Wise County. 

State: Texas; 
Eligible urban area/Geographic area captured in the data count: [Empty] 
Metropolitan Statistical Areas used in FY2008[A]: El Paso, TX 
Metropolitan Statistical Area; Principal City: El Paso; El Paso County. 

State: Texas; 
Eligible urban area/Geographic area captured in the data count: Houston 
Area: Houston, Pasadena, and a 10-mile buffer extending from the border 
of the combined entity. 
Metropolitan Statistical Areas used in FY2008[A]: Houston-Sugar Land-
Baytown, TX Metropolitan Statistical Area; Principal Cities: Houston, 
Sugar Land, Baytown, Galveston; Austin County, Brazoria County, 
Chambers County, Fort Bend County, Galveston County, Harris County, 
Liberty County, Montgomery County, San Jacinto County, Waller County. 

State: Texas; 
Eligible urban area/Geographic area captured in the data count: San 
Antonio Area: San Antonio and a 10-mile buffer extending from the city 
border. 
Metropolitan Statistical Areas used in FY2008[A]: San Antonio, TX 
Metropolitan Statistical Area; Principal City: San Antonio; Atascosa 
County, Bandera County, Bexar County, Comal County, Guadalupe County, 
Kendall County, Medina County, Wilson County. 

State: Utah; 
Eligible urban area/Geographic area captured in the data count: [Empty] 
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area — 
Salt Lake City, UT Metropolitan Statistical Area; Principal City: Salt 
Lake City; Salt Lake County, Summit County, Tooele County. 

State: Virginia; 
Eligible urban area/Geographic area captured in the data count: [Empty] 
Metropolitan Statistical Areas used in FY2008[A]: FY 2008 UASI area — 
Richmond, VA Metropolitan Statistical Area; Principal City: Richmond; 
Amelia County, Caroline County, Charles City County, Chesterfield 
County, Cumberland County, Dinwiddie County, Goochland County, Hanover 
County, Henrico County, King and Queen County, King William County, 
Louisa County, New Kent County, Powhatan County, Prince George County, 
Sussex County, Colonial Heights city, Hopewell city, Petersburg city, 
Richmond city. 

State: Virginia; 
Eligible urban area/Geographic area captured in the data count: [Empty] 
Metropolitan Statistical Areas used in FY2008[A]: Norfolk- Virginia 
Beach-Newport News, VA-NC Metropolitan Statistical Area; Principal 
Cities: Virginia Beach, VA; Norfolk, VA; Newport News, VA; Hampton, VA; 
Portsmouth, VA; Currituck County, NC; Gloucester County, VA; Isle of 
Wight County, VA; James City County, VA; Mathews County, VA; Surry 
County, VA; York County, VA; Chesapeake city, VA; Hampton city, VA; 
Newport News city, VA; Norfolk city, VA; Poquoson city, VA; Portsmouth 
city, VA; Suffolk city, VA; Virginia Beach city, VA; Williamsburg city, 
VA. 

State: Washington; 
Eligible urban area/Geographic area captured in the data count: Seattle 
Area: Seattle, Bellevue, and a 10-mile buffer extending from the border 
of the combined area. 
Metropolitan Statistical Areas used in FY2008[A]: Seattle-Tacoma-
Bellevue, WA Metropolitan Statistical Area; Principal Cities: Seattle, 
Tacoma, Bellevue, Everett, Kent, Renton Seattle-Bellevue-Everett, WA 
Metropolitan Division; King County, Snohomish County Tacoma, WA 
Metropolitan Division Pierce County. 

State: Wisconsin; 
Eligible urban area/Geographic area captured in the data count: 
Milwaukee Area: Milwaukee and a 10-mile buffer extending from the city 
border. 
Metropolitan Statistical Areas used in FY2008[A]: Milwaukee-Waukesha-
West Allis, WI Metropolitan Statistical Area; Principal Cities: 
Milwaukee, Waukesha, West Allis; Milwaukee County, Ozaukee County, 
Washington County, Waukesha County. 

Source: GAO analysis of DHS and OMB — a OMB Bulletin No. 07-01, 
announcing updates to metropolitan and micropolitan statistical areas 
as of December 2006, based on the Census Bureau’s July 1, 2004 and July 
1, 2005 population estimates. 

[End of table] 

[End of section] 

Appendix III: DHS’s Model is Robust for Tier 1 UASI Areas: 

Population Index: Neither maximizing nor minimizing the weight of the 
Population Index resulted in the movement of an area into or out of 
Tier 1 for either FY 2007 or FY 2008. 

Economic Index: In FY 2007, minimizing the weight of the Economic Index 
had no effect on Tier 1 placement, but increasing the weight of the 
Economic Index by 12.8% resulted in a new area moving into Tier 1, 
displacing an area that had previously been ranked in the top 7. In FY 
2008, lowering the weight of the Economic Index by 15.25% resulted in a 
new area moving into the top 7 ranked areas, displacing an area that 
had been previously ranked as Tier 1, but maximizing the weight of the 
Economic Index had no effect on Tier 1 placement. 

National Infrastructure Index: In FY 2007, maximizing the weights of 
the National Infrastructure Index did not result in any change in those 
areas designated Tier 1, but lowering the National Infrastructure Index 
by 5.53% resulted in a new area moving into the Tier 1 areas, 
displacing an area that had been previously ranked as Tier 1. In FY 
2008, increasing the weight of the National Infrastructure Index by 
4.68% resulted in a new area moving into the top 7 ranked areas, 
displacing an area that had been previously ranked as Tier 1. 
Similarly, lowering the National Infrastructure Index by 15% resulted 
in a new area moving into the Tier 1 areas. 

National Security Index: In FY 2007, minimizing the weight of the 
National Security Index also did not result in any change in those 
areas designated Tier 1, but increasing the National Security Index by 
7.5% resulted in a new area moving into Tier 1, displacing an area that 
had been previously ranked as Tier 1. In FY 2008, lowering the weight 
of the National Security Index by 3.73% resulted in a new area moving 
into the top 7 ranked areas, displacing an area that had been 
previously ranked as Tier 1. Increasing the National Security Index by 
10% resulted in a new area moving into Tier 1, also displacing an area 
that had been previously ranked as Tier 1. 

Urban Area Sensitivity to Changes in Consequence Index Weights is 
Reduced in FY 2008 for Funding Eligibility: 

While Tier 1 areas were similarly robust in both FY 2007 and FY 2008, 
the sensitivity of Tier 2 areas to changes in the weights of indices 
used to calculate risk scores was significant in FY 2007, but improved 
in FY 2008. In FY 2007, very small changes in the weights for the 
indices used to quantify risk for Tier 2 urban areas at the eligibility 
cut point resulted in changes in eligibility; however, FY 2008 results 
are more robust, as eligibility of urban areas is much less sensitive 
to changes in the index weights in the FY2008 model than it was in the 
FY2007 model. 

Population Index: In FY 2007, decreasing the weight of the Population 
Index by 0.4% or increasing the weight of the Population Index by 4% 
resulted in one area displacing another area with regard to 
eligibility. However, neither maximizing nor minimizing the Population 
Index resulted in one area displacing another area with regard to 
eligibility in FY 2008. 

Economic Index: In FY 2007, lowering the weight of the Economic Index 
by 0.24% or increasing the weight of the Economic Index by 2.4% 
resulted in one area displacing another area with regard to 
eligibility. By contrast, FY 2008 required an increase in the weight of 
the Economic Index by 12.33% or a decrease in the weight of the 
Economic Index by 10.48% resulted in one area displacing another area 
with regard to eligibility. 

National Infrastructure Index: In FY 2007, changing the weight for the 
National Infrastructure Index by 1.58% (either increase or decrease) 
resulted in one area displacing another area with regard to 
eligibility, while the FY 2008 National Infrastructure Index required 
an increase in the weight by 5.67% or a decrease the weight by 4.54% to 
result in one area displacing another area with regard to eligibility. 

National Security Index: In FY 2007, increasing the weight for the 
National Security Index by 0.08% resulted in one area displacing 
another area with regard to eligibility, but FY 2008 required an 
increase in the weight for the National Security Index by 2.34% or a 
decrease in the weight of the National Security Index by 1.37% to 
result in one area displacing another area with regard to eligibility. 

[End of section] 

Appendix IV: Contacts and Staff Acknowledgments: 

For further information about this statement, please contact William O. 
Jenkins Jr., Director, Homeland Security and Justice Issues, on (202) 
512-8777 or jenkinswo@gao.gov. 

In addition to the contact named above, the following individuals also 
made major contributors to this report: GAO Homeland Security and 
Justice Issues Team—Chris Keisling, Assistant Director; John Vocino, 
Analyst-in-Charge; Orlando Copeland and Michael Blinde, Analysts; Linda 
Miller and Adam Vogt, Communications Analysts. Other major contributors 
to this report include: GAO Applied Methodology and Research Team—Chuck 
Bausell, Jr., Economist, and Virginia Chanley; and GAO Office of 
General Counsel—Frances Cook. 

[End of section] 

Footnotes: 

[1] This figure includes such DHS grant programs as the Homeland 
Security Grant Program, Infrastructure Protection Programs, and the 
Emergency Management Performance Grants. 

[2] In addition, HSGP encompasses three smaller grant programs: the Law 
Enforcement Terrorism Prevention Activities, the Metropolitan Medical 
Response System, and the Citizen Corps Program, which do not use a risk-
based methodology to allocate funds to grantees. 

[3] Each state and territory receives a statutory minimum percentage of 
available funds. 

[4] The Infrastructure Protection Program supports specific activities 
to protect critical infrastructure, such as ports, mass transit, 
highways, rail and transportation. The grant programs included here are 
Transit Security Grant Program, Port Security Grant Program, Buffer 
Zone Protection Program, Trucking Security Program, and Intercity Bus 
Security Grants. 

[5] For example, GAO Homeland Security Grants: Observations on Process 
DHS Used to Allocate Funds to Selected Urban Areas, [hyperlink, 
http://www.gao.gov/cgi-bin/getrpt?GAO-07-381R] (Washington, D.C.: Feb 
7, 2007) 

[6] For the purposes of this report, we use “risk analysis model” to 
refer to DHS’s application of its risk calculation formula to score and 
rank states and urban areas. We use “risk-based allocation methodology” 
to refer to the three-step process it uses in determining and making 
grant fund allocations—risk analysis, effectiveness analysis, and final 
allocation decisions. 

[7] Pub. L. No. 110-161, 121 Stat. 1844, 2063 (2007). 

[8] GAO Risk Management: Further Refinements Needed to Assess Risks and 
Prioritize Protective Measures at Ports and Other Critical 
Infrastructure, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-
91] (Washington, D.C.: Dec 15, 2005). 

[9] 6 U.S.C. §§ 601(5), (8), 604(b). 

[10] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-91]. 

[11] While DHS documents express their risk analysis model as a 
function of Threat times the combination of Vulnerability and 
Consequences,; mathematically, the 2007 risk analysis model was still 
calculated as the product of T times V times C, or R = T*V*C. The risk 
model considers the potential risk of international terrorism to 
people, critical infrastructure, and the economy to estimate the 
relative risk of terrorism faced by a given area. Risk is the product 
of Threat, the likelihood of an attack occurring, and Vulnerability and 
Consequence, the relative exposure to and expected impact of an attack. 

[12] The Post-Katrina Emergency Management Reform Act of 2006 was 
enacted as Title VI of the Department of Homeland Security 
Appropriations Act, 2007, Pub. L. No. 109-295, 120 Stat. 1355, 1394 
(2006). 

[13] This tiering process was first used for the UASI grant program in 
fiscal year 2007. Its effect on funding allocation will be discussed in 
greater detail later in this report. 

[14] This threat information does not consider either domestic 
terrorism or natural hazards such as hurricanes or earthquakes, 
according to DHS’s Office of Intelligence and Analysis. 

[15] For the urban areas in Puerto Rico, DHS split the total GDP of 
Puerto Rico published in the CIA World Factbook into Puerto Rico’s 
constituent municipios according to the municipios’ percentage of total 
non-farm employees, a figure provided by the Bureau of Labor 
Statistics. 

[16] The 17 critical infrastructure sectors and key resources include 
agriculture and food, banking and finance, chemical, commercial 
facilities, dams, defense industrial base, emergency services, energy, 
government, information and telecommunications, national monuments and 
icons, postal and shipping, public health, transportation, and water 
sectors. 

[17] States are statutorily required to receive a minimum percentage of 
the total funds appropriated for SHSP and UASI, and adjustments based 
on their effectiveness cannot lower a state’s risk-based allocation 
below that threshold. UASI urban areas do not have a similar minimum. 

[18] Additionally, fiscal year 2008 is the first year that FEMA has had 
responsibility for the risk assessment and grant allocations for these 
grants. 

[19] In addition to the change to the definition DHS used to identify 
the UASI areas, DHS also incorporated population density for the SHSP 
risk analysis model and the presence of international waterways, based 
on the language of the Implementing Recommendations of the 9/11 
Commission Act of 2007. 

[20] A model is sensitive when a model produces materially different 
results in response to small changes in its assumptions. Ideally, a 
model that accurately and comprehensively assesses risk would not be 
sensitive, and such a model exhibiting little sensitivity could be said 
to be more robust than a model with more sensitivity to changes in 
assumptions underlying the model. 

[21] A countermeasure is any action taken or physical equipment used 
principally to reduce or eliminate one or more vulnerabilities. 

[22] [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-831R]. 

[23] See Society for Risk Analysis Benchmark Analysis for Quantifying 
Urban Vulnerability to Terrorist Incidents Piegorsch, Walter W., Susan 
L. Cutter and Frank Hardisty Risk Analysis Vol. 27, No. 6, 2007. 

[24] Buffer zone extensions were considered for chemical plants (25 
miles) and nuclear power plants (50 miles). According to DHS officials, 
these distances were selected based on plume effects influenced by 
research conducted by the Department of Energy. 

[25] 6 U.S.C. § 601(5). 

[26] Indianapolis (balance) refers to the portion of the consolidated 
government of Indianapolis city and Marion County minus the separately 
incorporated places of Clermont, Crows Nest, Cumberland, Homecroft, 
Meridian Hills, North Crows Nest, Rocky Ripple, Spring Hill, Warren 
Park, Williams Creek, and Wynnedale within the consolidated city. It 
excludes the cities of Beech Grove, Lawrence, Southport, and Speedway 
which are within Marion County, but are not part of the consolidated 
city. 

[27] Louisville/Jefferson County (balance) refers to the portion of the 
consolidated government of Louisville city and Jefferson County minus 
the separately incorporated places. For a complete listing of 
jurisdictions, see OMB Bulletin No. 07-01, page 39 (Washington, DC. 
Dec. 16, 2006). 

[28] The title is pursuant to P.L. 98-369, Section 611 (July 18, 1984); 
all counties specified in that legislation, plus five additional 
counties, qualify under the 2000 standards and are included in the 
definition of the Kansas City, MO-KS Metropolitan Statistical Area. 

[29] The title and definition reflect the provisions of P.L. 98-473, 
Section 119A (October 12, 1984), plus six additional counties that 
qualify under the 2000 standards. 

[30] Pursuant to P.L. 100-202, Section 530, the part of Sullivan city 
in Crawford County, MO was added to the St. Louis, MO-IL Metropolitan 
Statistical Area effective December 22, 1987. 

[31] According to FEMA, for the purposes of DHS’ risk analysis, a 
policy decision was made to utilize the metropolitan division lines to 
parse out the New Jersey metropolitan divisions from the NYC MSA. The 
NJ metropolitan divisions of the NYC MSA were attributed to the Newark 
MSA. 

[32] Nashville-Davidson (balance) refers to the portion of the 
consolidated government of Nashville city and Davidson County minus the 
separately incorporated places of Belle Meade, Berry Hill, Forest 
Hills, Goodlettesville, Lakewood, Oak Hill, and Ridgetop within the 
consolidated city. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office: 
441 G Street NW, Room LM: 
Washington, D.C. 20548: 

To order by Phone: 
Voice: (202) 512-6000: 
TDD: (202) 512-2537: 
Fax: (202) 512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: