GlobeSt.com: To play devil's advocate, at the end of the day, if someone wants to take down a building, that building is coming down, and the only ones you will stop are those who are playing by the rules anyway. How do you respond?

Weisel: That's probably true. But that doesn't mean that property owners should do nothing. The goal should be to reduce vulnerability and make the property a less attractive target.

GlobeSt.com: Give me an example of a building that does that well and yet has been successful as a business center and tourist destination and traffic hub.

Weisel: I'm not sure I can point to specific buildings. There are many in New York that do a pretty good job of screening people and vehicles. If you look at government buildings, such as the White House and the Capitol, they've provided effective security, but they've become unapproachable. Obviously that isn't practical for the private sector. But how do you balance greater security with access? That's one of the hard questions we're still grappling with, and the industry has yet to find a good answer.

GlobeSt.com: But who should be providing that answer? ISAC? The feds? The industry itself?

Weisel: Not ISAC; their goal is to facilitate the dialogue, to serve as an intermediary, funneling information between the private real estate sector and the Department of Homeland Security. The government has made it clear that it's looking to the private sector. For all the buildings that aren't considered part of the critical infrastructure, the private sector is on its own.

GlobeSt.com: Are the associations doing enough?

Weisel: All the associations are grappling with these questions. Some are doing more than others; BOMA has been doing a good job of providing some type of standards and guidelines and working with the federal government, and the Real Estate Roundtable for sure. I don't think any of the organizations have gotten to the point of trying to tell members what the best practices would be. But I hesitate to point any fingers because to some extent this uncertainty stems from the government's response. The industry needs to get better guidance from the government and from Homeland Security on the nature of the risks. And the government itself has been reluctant to define the risks and apply some type of sophisticated probability analysis.

GlobeSt.com: Did the 9/11 Commission have any impact at all?

Weisel: The commission concluded that the private sector is still largely unprepared for a terrorist attack and it promoted two approaches. At a minimum, emergency preparedness should include an evacuation plan, adequate communication capabilities and a strategy for continuity of operations. The commission also recommended the more comprehensive NFPA 1600, which is a standard developed by the National Fire Protection Association prior to Sept. 11 and updated after.

GlobeSt.com: All recommendations have to be tailored to individual buildings. But is there more the industry as a whole can do to foster general guidelines?

Weisel: That really needs to be taken up by the industry organizations. Because of cost considerations and disclosure issues that individual companies face, they're not likely to take the lead on this. There are some private companies—I won't give names—that are proactive in this area and have developed guidelines they've enacted for their own buildings. But there are many more owners who are either unsure of what to do and so do very little or are reluctant to do anything because if they do more they fear more liability. In some cases they're concerned about costs, because if you take NFPA 1600 literally, it's a very costly program to implement.

GlobeSt.com: Any program is going to cost something.

Weisel: But if you do everything the costs can be prohibitive. One of the elements lacking in all of the recommendations made by the government is some sort of cost/benefit analysis. It's not clear how to apply that to risks that haven't been quantified.

GlobeSt.com: It's those unquantified risks I always see as the problem. The World Trade Center responded to the 1993 bombing—in large part--by upgrades in truck screening. It seemed to be enough.

Weisel: The conundrum is partly identifying how the attack will take place. But once it does, the risk will take the form of biological agents or fire or some type of bomb, and it's possible to take measures. In the WTC litigation, the Court held that there was a duty of care to protect against the terrorist attacks. It was foreseeable that there could be fires and the need for evacuation.

GlobeSt.com: It was eight years between the '93 bombing and Sept. 11. We're now four years after Sept. 11. Isn't it late in the game to not have those answers?

Weisel: I would agree with that.