Vulnerability and Consequences accounted for 80 percent of the total risk score and were represented by the following four indices: (1) Population Index (40 percent): This variable included nighttime population and military dependant populations for states and urban areas, based upon U.S. Census Bureau and Department of Defense inputs. In addition, for urban areas, population density, commuters, and visitors were also factored into this variable, using data from private entities. (2) Economic Index (20 percent): This variable considered the economic value of the goods and services produced in either a state or an urban area. For states, this index was calculated using U.S. Department of Commerce data on their percentage contribution to Gross Domestic Product. For UASI urban areas, a parallel calculation of Gross Metropolitan Product was incorporated. (3) National Infrastructure Index (15 percent): This variable focused on over 2,000 Tier I and Tier II critical infrastructure/key resource assets that were identified by DHS's Office of Infrastructure Protection. Tier I assets or systems are those that if attacked could trigger major national or regional impacts similar to those experienced during Hurricane Katrina or 9/11. Tier II assets are other highly consequential assets with potential national or regional impacts if attacked. (4) National Security Index (5 percent): This variable considered the presence of three key national security factors: whether military bases are present in the state or urban area; how many critical defense industrial base facilities are located in the state or urban area; and the total number of people traversing international borders. Information on these inputs comes from the Department of Defense and DHS. (GAO, Homeland Security: DHS Improved its Risk-Based Grant Programs Allocation and Management Methods, But Measuring Programs Impact on National Capabilities Remains a Challenge, 11 March 2008, p. 10)