Every official in America is watching the government's response to the oil leak catastrophe. Even those state and local officials not directly involved can pick up some key lessons from the gusher in the gulf about how government anticipates and responds to disaster.

Regulation Neither Eliminates Risk Nor Takes the Place of Disaster Planning

Offshore drilling is highly regulated. According to the American Petroleum Institute, "offshore operators are required to operate under 17 major permits and follow 90 sets of federal regulations, as well as meet state requirements." This regulatory oversight didn't prevent the Deepwater Horizon rig from blowing up and creating a mammoth environmental catastrophe.

Historically, the record of offshore drilling has been reasonably good. The current disaster has likely discharged more oil into the gulf than the previous 30 years of offshore drilling. No regulation can eliminate all the risk from inherently risky activities.

Lesson: Because regulation doesn't eliminate risk, officials and their private partners must adequately plan for the unexpected.

Rare Events Aren't Routine

Government does a good job of regulating obvious, recurring risks -- rodents in restaurant kitchens, lead paint in old buildings or bad brakes on unsafe taxis.

Applying attention to remote risk, or even recognizing it, is more difficult. Regulators failed to see the housing bubble coming, encouraging lending well into 2008. If the chances of a very bad result are highly unlikely as a statistical matter, an agency might ignore such risk as an intentional allocation of resources. But if the consequences of such an unlikely event are dire enough, government should try to be prepared.

Lesson: Anticipating the unanticipated requires a structured effort. Regulators and industry officials should more frequently involve experts in sessions that imagine the less likely and how to prevent it. These sessions should be supported by the federal government and national associations, as the costs of developing answers can more easily be addressed nationally.

Expert Asymmetries Exist

BP and other oil firms have more institutional expertise than the government when it comes to undersea drilling. That is to be expected, but it makes regulatory oversight difficult. BP assured the government that it had a plan to handle oil leaks of this magnitude, but it turns out they did not.

Government officials could have asked more questions about the rigor behind that assurance. While government simply cannot possess superior expertise in every field it regulates, it is reasonable for the public to demand its government secure whatever expertise is necessary, particularly when the cost of failure is high, even if the risk is low.

When a regulated entity suggests a complex technological innovation, public officials are in a very difficult circumstance. Say no, and slow down progress, or say yes and risk catastrophe. This challenge has been an ongoing tension, for example, in the area of mine safety. One approach has been to impose contractual or regulatory consequences for failure, to make the financial penalties for risky behavior ever more severe. Yet this approach assumes that the private company would tolerate a calamitous event but for the addition of the government penalty. It is hard to imagine even the most callous corporate CEO engaging in that calculus.

Another approach involves the regulator or contractor as initiating an interactive and constructive regulatory process that identifies areas that need improvement. In its role as regulator, government is neither a partner nor an adversary of business. Structuring the right "trust but verify" approach is critical.

Lesson: Even experienced professional regulators must utilize outside processes -- third party experts and third party organized "war games" to expose both additional risks and the inadequacy of responses. And, while government regulators and the companies they oversee shouldn't have too cozy a relationship, an adversarial relationship is counterproductive as well. New York City Mayor Michael Bloomberg recently raised questions about the timing of the government's announcing investigations in to criminal misconduct against BP and its leadership. The point raised by the mayor did not relate to how diligently the government should hold the company responsible but rather a more practical timing issue. In some circumstances, whether resolving a crisis of huge proportions or winding down an important outsourced contract that went awry -- the parties often need to work cooperatively. In such situations, does launching a criminal and personal campaign against the regulated party's leadership detract from the urgent issue of solving the immediate crisis? (Full disclosure: I recently accepted a position as deputy mayor for operations in Mayor Bloomberg's cabinet.)

Levels of Risk Must Be Underwritten at Different Levels of Government

How much money should Indianapolis, or Wichita, Kan., or even Chicago invest in homeland security? A suitcase bomb, biological attack or other terrorist event could have enormous consequence -- but in any given city the likelihood is very low. This tends to lead to an under-appreciation of risk. (In contrast, the New York City police are particularly good at prevention because they know the risk is real.) Moreover, such events may occur regardless of how much government spends trying to prevent them. A city must decide if investing in prevention and response preparation is worth shifting resources from other critical efforts, such as combating day-to-day street crime.

For any given city, this calculation is difficult. Yet it is clear that there is a much, much higher likelihood -- some say certainty -- that such acts will be attempted somewhere. Thus national and state leaders have a responsibility to identify those places where the incentives for the right level of planning and prevention are not in place and to provide the necessary safety net.

Lesson: Government at all levels should consider these risks and then determine over what scale the cost should be spread. In most situations the federal government needs to organize the technical skills and extraordinary resources, but should defer to local government in terms of first responder responsibilities.

The BP disaster erodes our confidence in technological solutions to overcome natural events. It raises fundamental questions concerning how government can and should deal with risks created in regulated areas. How government discharges its duty to protect the public in these highly complex areas is a question worthy of widespread consideration.