ONE OF PRESIDENT Bush's first tasks in his second term ought to be a thorough overhaul of homeland security spending. A new report by the American Enterprise Institute demonstrates that critics of the administration's homeland security policy have been right to feel suspicious of the invariably optimistic progress reports of the Department of Homeland Security (DHS). Despite the department's upbeat rhetoric, the report shows that neither Congress nor the Bush administration ever conducted any real risk assessment or applied any real oversight to the enormous amount of new funding.

The report -- "What Does Homeland Security Spending Buy?" -- not only documents waste and duplication but pins some of the problem on a rigid set of formulas that Congress used to distribute some $10 billion in federal grant money to fire, police and other emergency first responders. The formulas required a minimum amount of money to be spent in each state, regardless of risk. As a result, the state with the highest per capita homeland security spending in 2003 was Wyoming. The states with the lowest per capita spending were California, Texas and New York. To worsen the problem, many states then passed the money on to localities through similarly rigid formulas. California, for example, simply gave $5,000 to each county, an amount too small to make a difference.

Once money was allocated, the absence of federal terrorism preparedness standards or goals meant that at least in the initial tranches, money was wasted. Rural Colchester, Vt., spent $58,000 buying equipment used for boring through the concrete in collapsed skyscrapers. Grand Forks, N.D., spent $1.5 million on decontamination equipment and more biochemical suits than it has police officers. The Steamship Authority, which runs ferries to Martha's Vineyard, Mass., received $900,000 to upgrade its facilities. On top of this kind of waste, the 2004 homeland security bill was stuffed with more ordinary, unrelated pork, including $2.9 billion for disaster aid to farm states.

In an attempt to streamline the process in 2003, Congress designated a list of seven cities that would be considered "high threats": New York, Washington, Los Angeles, Seattle, Chicago, San Francisco and Houston. But -- under pressure from city officials and members of Congress -- DHS soon began expanding the list, first to 30, then to 50. Each of these "high risk" cities -- among them Columbus, Ohio; Fresno, Calif.; and Louisville -- was due to receive, in 2004, up to $10 million in extra grants on top of the minimum payments.

Finally, the report's author, Veronique de Rugy, suggests that one of DHS's most frequently trumpeted achievements, the new Transportation Security Administration, may not have produced results worthy of its costs. The agency's funding rose from $1.35 billion in fiscal 2002 to $5.3 billion requested for fiscal 2005 and now exceeds that of the FBI. Yet the agency causes huge disruption and still covers only a part of airline security; baggage must be secured by the airlines. But the creation of the agency follows a typical pattern for DHS spending: React to the news of the day, don't think in advance about costs and don't weigh the risks. Changing that culture will be one of the most important jobs of the Bush administration's second term.