What do the global financial crisis, Hurricane Katrina and the 9/11 terrorist attacks have in common? All are examples of how not to manage risk, according to America’s top risk-management official, Homeland security secretary Michael Chertoff.

Risk management “lies at the core” of his department’s mission, Chertoff said at a recent Wharton Leadership Lecture in which he addressed areas where regulation — in moderation — can reduce risk in the marketplace. Managing risk was the first objective he saw before him when he was sworn in almost four years ago, Chertoff said, and it remains “maybe the fundamental social problem that we face in the 21st century.”

“Our mission is very broad — it covers everything from preventing and reducing our vulnerability to terrorist attacks; to protecting and reducing the vulnerabilities of our infrastructure, including our cyber-infrastructure, and then mitigating the consequences of disasters by strengthening our preparedness and response.”

Looking back at the 9/11 attacks and various natural disasters during his soon-to-conclude tenure, “or even the current financial crisis, it becomes very clear that we have not always handled risk properly,” Chertoff acknowledged.

The 9/11 attacks were not, he said, “a total surprise.” U.S. law enforcement and intelligence agencies had known for years about Osama bin Laden’s intentions because he had been linked to the 1993 World Trade Center bombing and the suicide attack on the USS Cole. “We had report after report that talked about the need to strengthen our homeland security. And with all of that, we did not devote even a fraction of the investment we currently put into homeland security … before September 11,” Chertoff said. “So, you’d have to say we misjudged the risk.”

Similarly, U.S. officials have long known that storms the magnitude of Hurricane Katrina could seriously harm a city, especially a large city below sea level. “It’s clear that government at all levels simply failed to invest in maintaining critical infrastructure such as the levies,” he said, “wreaking untold havoc” upon New Orleans.

The same can be said of the global credit seizure, he argued. The nation now faces financial woes that were to some degree or another “predicted over a period of years, going back into the 1990s…. We have not managed to address the risk in a way that prevented what was … a [financial] disaster of the magnitude of a natural disaster and a terrorism disaster.”

The official response to each of those was after-the-fact, he noted, and was costlier than would have been necessary had prevention or mitigation efforts been underway beforehand. “Managing risk is not about looking backward at something that’s already happened, although that can be useful in terms of what we do going forward,” he explained. “Managing risk is fundamentally looking ahead” to possible disasters and making cost-benefit analyses designed to prevent or reduce our vulnerability to them.

“That’s not a particularly startling definition of risk management. And yet if you look at all of the events I’ve described … you will see that our society has simply failed on a looking-forward basis to manage risk properly.” Worse yet, he said, is that institutions of all kinds fail to learn from such mistakes. “We begin to decide that we are spending too much money trying to avert the risk, and we begin to degrade our preparation once again.”

That pattern applies even to the U.S. reaction to the 9/11 attacks and Hurricane Katrina, he suggested. Because there have been no terror attacks on U.S. soil since 9/11, many officials at various levels of government say the need to be prepared for attacks, or to spend so much money to prevent them, has diminished. So, he urged a “disciplined, risk-managed approach” to learning the lessons of the last three major American catastrophes.

Chertoff was sworn in as the second Homeland Security secretary in February 2005, less than seven months before Katrina swept over the Gulf Coast. After that disaster, Chertoff acknowledged that he was slow to focus on the storm as it developed. Congressional investigations into the federal response to the deadly storm faulted Chertoff specifically for delays in activating the federal emergency plan that could have rushed aid more quickly. Previously, he was a partner in the law firm of Latham & Watkins, and he served as Special Counsel for the U.S. Senate Whitewater Committee from 1994 to 1996. He was also a federal prosecutor for more than 10 years, including service as U.S. Attorney for the District of New Jersey.

When to Regulate

Because of the current financial mess and the federal response to it, “people are beginning to wonder if changes [are needed in] the … role of government in dealing with risk in the financial sector and perhaps across the board,” Chertoff said. “Although it’s getting less publicity, these very same questions are being asked with respect to natural disasters. For instance, what is the role of government in letting people rebuild” in places like Galveston and East Texas, flooded by the most recent hurricanes?

“I still believe, with all that we’ve experienced, that in a free society like our own, the default position, the starting point for risk management, is with the individual and with the private sector,” he stated. “People routinely balance risk and reward. It is the essence of what freedom is…. The private economy is … the fundamental engine of risk management, and by and large it works very well. We have a system that has figured out the right level of risk.” But he added that “there really is no such thing as a truly free market. The market is always bounded by rules and regulations that are put in place by government. Even the most ardent capitalist, the most ardent free marketer, accepts as a fundamental premise that government does have a role to play in laying down certain rules of the road that make it possible for a free market to function.”

He recommended that lawmakers, when considering the regulatory response to the financial crisis, should ask themselves what “the government could do and should do to allow risk management, at a social level and an individual level, to proceed in a much more informed, balanced and sensible way.” He suggested that any regulations should address three factors: short-tem thinking, self-centered assessments of the value of risk, and conditions under which the value of risk is obscured.

“The free market and people who operate in it tend to favor and focus on [the] short-term,” Chertoff said. They prefer benefits that are “immediately realized and immediately capitalized, at the expense of potentially higher long-term costs, especially when those long-term costs are uncertain.” For example, he noted, when federal officials make flood maps to help hurricane-prone coastal regions try to direct development efforts to higher ground, “we start to see community pushback” from property owners who do not want to spend tens of thousands of dollars to elevate structures in threatened areas.

He said that if those property owners had to eventually pay the price for ignoring the maps — instead of being bailed out with federal aid programs that are routinely provided to cover such losses — they’d be less likely to ignore the flood maps’ warnings. Because they encourage risky behavior, such aid programs establish a “moral hazard,” a term that Chertoff noted has come up a lot in the debates over whether the U.S. government should invest in or provide loans to financial firms whose devaluation of risk helped create today’s credit crisis. The post-hurricane federal aid provides “a clear message to people that they can continue to ignore the warning because even if they don’t get the insurance — for which they have now been disqualified because they didn’t elevate the house — they’re going to get rescued anyway.” This is an area where government action before the event can help reduce everyone’s costs, he said, by making sure people have properly internalized their own risk management.

Another problem that can be addressed by the government “occurs when we may properly internalize our own costs, but we simply don’t internalize the costs that we’re putting on others.” This is an old economic problem, classically illustrated by the upstream landowner who fouls the water used by downstream neighbors. “Increasingly, the failure of a business to internalize its own costs has collateral and cascading consequences for people in unrelated businesses.” In the immediate aftermath of hurricanes, it’s a “critical cornerstone of recovery [that] you’ve got to get the power up and running.” Government must step in, he asserted, because the people who run the power plant can’t get there because filling stations lack electricity to pump gasoline. Chertoff said he is working with federal energy authorities to devise a federal rule similar to one in Florida requiring gas stations to have emergency generators.

Chertoff also offered an example from the shipping industry. He said shippers do not want to incur the expense of gathering and providing to federal inspectors point-of-departure information about shipping containers. Such data, he asserted, speeds the inspection process, reducing the shippers’ and the nation’s exposure to the risk of a catastrophic terrorist attack. “Again and again we come up against this short-sighted mentality that does not look beyond people’s own costs and balance sheets.”

The third area for regulation, he argued, “is what I call ‘validation.'” It eliminates “the … costs that are imposed by risk when we don’t really have confidence in what we are dealing with, or what we are seeing.” The government, he suggests, can require producers to clearly state the risks associated with their product or service so that customers can know “what we are dealing with, and who.” Toxic ingredients — within toys from China or intricately constructed investment vehicles — harm everyone and [undercut] the entirety of the food chain,” he argued. “All of these systems of the marketplace depend on this trust,” Chertoff said. “When this trust fails, we see very serious consequences.”

Even where regulation is required, he said, moderation is important. “The case in these instances is for intelligent, strong and not overly coercive regulation. We don’t want to go to the extreme of smothering initiative, but we also want to make sure that initiative is rewarded” when properly used to allocate and manage risk, Chertoff said. “Over-regulation … is just as big a problem as under-regulation.”