1200 words and three scholarly references

https___dftj9wb4gc6c5.cloudfront.net_Bethel_Courses_ESM_3200_Unit_2_read.pdf

Home >Law homework help >Criminal homework help >1200 words and three scholarly references

Critical Infrastructure Protection, Emergency Response, and Management Dr. John B. Noftsinger, Jr. Kenneth F. Newbold, Jr. Benjamin T. Delp

• Define the term critical infrastructure.

• List and describe the critical infrastructure sectors.

• Describe the current national policy that addresses critical infrastructure.

• List the hazards and threats in the physical and cyber components in America’s infrastructure.

• List and describe the seven cardinal rules of risk communication.

• Describe the roles of the Department of Homeland Security (DHS) in critical infrastructure protection.

• Discuss the roles of the Homeland Security Operations Center (HSOC).

Objectives

57854_CH04_final.indd 4757854_CH04_final.indd 47 1/20/10 10:23:00 AM1/20/10 10:23:00 AM

F O S T E R , C E D R I C 1 6 9 2 T S

48 Homeland Security: Principles and Practice of Terrorism Response

Introduction

Critical infrastructure protection is a vital component to ensuring effective and efficient emergency manage- ment practice. This chapter will explore infrastructure systems, how they are interconnected, and how these systems relate to emergency management. It is necessary to assess and identify civilian infrastructures that support communication, health, transportation, and other vital operations, which are susceptible to natural disasters, human error, and the direct target of malicious activi- ties including terrorism and sabotage. Included in this discussion will be an examination of the cyber, physical, and human aspects of critical infrastructure systems with a specific focus on emergency management practices. Critical infrastructure systems include not just hardware and software, but the people and institutions responsible for their existence, operation, and safety.

Defining Critical Infrastructure Protection

Critical infrastructure systems have become increasingly complex and reliant on computer-based automated sys- tems to provide the continuous operation of our critical systems. In this chapter, we will address technological and emergency management issues that affect cyber, physical, and human infrastructures.

As defined in the USA PATRIOT Act and the National Infrastructure Protection Plan (NIPP), critical

infrastructures are “systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic secu- rity, national public health or safety, or any combination of those matters.”

The NIPP goes on to define key resources and key assets. Critical infrastructure is “systems and assets, whether physical or virtual, so vital that the incapacity or destruction of such may have a debilitating impact on the security, economy, public health or safety, envi- ronment, or any combination of these matters, across any Federal, State, regional, territorial, or local jurisdic- tion” (Department of Homeland Security, 2009). Key resources are “publically or privately controlled re- sources essential to minimal operations of the economy and government”(Department of Homeland Security, 2009). Key assets are a “person, structure, facility, infor- mation, material, or process that has value” (Department of Homeland Security, 2009).

These broadly defined infrastructure sectors all have one characteristic in common—they rely on people and technology to support and protect the systems that provide the goods and services necessary to survive as individuals and as a society. As the foundation for the function of the United States, these infrastructure sectors require atten- tion from the policy community to ensure their continuity of operation. All levels of government have developed emergency response plans to address potential failures in critical infrastructure systems and outline best practices to ensure the safety of individuals in a disaster.

One area not specifically addressed in the list of critical infrastructure sectors is the concept of humans as a critical infrastructure. In studying the linkage be- tween emergency management and critical infrastructure protection, it is of upmost importance that one recog- nizes the human element of critical systems. Without the human component, the physical systems comprising critical infrastructure will not function. Thus infrastruc- ture assurance must include protection of the people necessary for construction, management, operation, and maintenance of critical systems.

The criticality of the human infrastructure com- ponent was dramatically illustrated by recent natural

Infrastructure sectors all rely on people and technology to support and protect the systems that provide the goods and services necessary to survive as individuals and as a society.

Critical Infrastructure Sectors as Identified in the NIPPId tifi d i th NIPP

• Banking and finance

• Chemical

• Commercial facilities communications

• Dams

• Defense industrial base

• Emergency services

• Energy

• Government facilities

• Health care and public health

• Information technology

• Manufacturing

• National monuments and icons

• Nuclear reactors, materials, and waste

• Postal and shipping

• Transportation systems

• Water

57854_CH04_final.indd 4857854_CH04_final.indd 48 1/20/10 10:23:03 AM1/20/10 10:23:03 AM

F O S T E R , C E D R I C 1 6 9 2 T S

CHAPTER 4: Critical Infrastructure Protection, Emergency Response, and Management 49

disasters such as Hurricane Katrina in 2005 (FIGURE 4-1). Evacuation planning and response hinged on the effec- tive management of the population, including commu- nication and leadership. Lack of planning, uncertainty of responsibilities, and poor management/coordination of the human response at all levels of government nega- tively affected the disaster’s consequences. A complete approach to infrastructure assurance must include the human factor.

Science and technology have long been key compo- nents to defending the nation and its citizens from its enemies and in increasing the resilience of infrastructure systems from natural disasters. In the post-September 11, 2001, environment, threats to the homeland increas- ingly include nonmilitary, transnational organizations. Along with sound public policy and law, technological innovations will factor heavily into solutions created for the DHS. Emergency response personnel are identified as the first line of defense and response to disasters (FIGURE 4-2). The human element of critical infrastructure protec- tion is best highlighted by the practices of the emergency response community.

History of Critical Infrastructure Protection Policy in the United States Historically, the United States has been shielded geo- graphically from physical threats to the nation’s infra- structures. With friendly neighbors to the north and south and vast oceans to the east and west, the United States was somewhat isolated from attacks by external enemies. In the early 1950s, technological developments in the nuclear field allowed for the creation of improved weapons, including intercontinental ballistic missiles (ICBMs) (White House, 1997, p. 7). Both military instal-

lations and civilian infrastructures were at risk of attack from these long-range weapons. The threat posed by the former Soviet Union and its nuclear ICBM capabilities was unique in U.S. history. An enemy had never before threatened the United States from such a great distance. Technological advances in physical destruction capabili- ties put U.S. soil in danger of attack.

Prior to the late 1990s, federal policy address- ing infrastructure protection was scarce. Not until the President’s Commission on Critical Infrastructure Protection published its final report, Critical Foundations: Protecting America’s Infrastructures, in 1997, did a na- tional level policy initiative exist. This report was the guiding force in establishing future efforts with critical infrastructure protection.

Critical Foundations emphasized the emerging and expanding threats to infrastructure systems from cyber attacks, and increased attention was given by this report to the reliance of physical systems on cyber networks. Through the report, the president’s commission called for increased sharing of information between govern- ment and industry as a means of improving the over- all resiliency of critical systems. The recommendations made by this presidential commission helped to shape the future path of infrastructure protection, as many of the concepts introduced in Critical Foundations continue to be advocated in current policies and initiatives.

In response to the President’s Commission on Critical Infrastructure Protection report, President Bill Clinton released Presidential Decision Directive 63 in 1998, which became the seminal document guiding U.S. policy in the arena of critical infrastructure protection. In Presidential Decision Directive 63, the Clinton ad- ministration stated that the “United States will take all necessary measures to swiftly eliminate any significant

FIGURE 4-1 New Orleans, La.—August 31, 2005. Ambulances stand at the ready to transport evacuees in need of additional medical attention to outlying towns and cities with hospitals. Many victims were treated for injuries resulting from Hurricane Katrina on August 29. New Orleans was evacuated as a result of floods and damage caused by Hurricane Katrina.

FIGURE 4-2 Emergency responders are often the first line of defense when critical infrastructure systems are threatened by natural disasters and terrorist attacks.

57854_CH04_final.indd 4957854_CH04_final.indd 49 1/20/10 10:23:05 AM1/20/10 10:23:05 AM

F O S T E R , C E D R I C 1 6 9 2 T S

50 Homeland Security: Principles and Practice of Terrorism Response

vulnerability to both physical and cyber attacks on our critical infrastructures, including especially our cyber systems” (White House, 1998).

Since September 11, 2001, the federal government has released four national strategy documents that outline the federal government’s agenda for infrastructure assur- ance. These publications address homeland security, both physical and cyber security, and explicitly mention the role that the science and technology and public policy communities can play in finding solutions to combat threats to infrastructure systems. Recommended national strategy technology focus areas included the following:

• Homeland Security (Office of Homeland Security, 2002, pp. 68–69): Develop chemical, biological, radiological, and nuclear counter- measures; develop systems for detecting hostile intent; apply biometric technology to identifi- cation devices; improve technical capabilities of first responders; coordinate research and development of the homeland security appa- ratus; establish a national laboratory of home- land security; solicit independent and private analysis for science and technology research; establish a mechanism for rapidly producing prototypes; conduct demonstrations and pilot deployments; set standards for homeland secu- rity technology; and establish a system for high risk, high payoff homeland security research.

• Securing Cyberspace (White House, 2003b, pp. 53–60): Review and exercise information tech- nology (IT) continuity plans; Department of Homeland Security will lead in the development and will conduct a national threat assessment, including red teaming, blue teaming, and other methods to identify the impact of possible at- tacks; adopt improved security protocols; de- velopment of more secure router technology; adoption of a code of good conduct; develop best practices and new technology to increase security of supervisory control and data acquisition that will determine the most critical supervisory con- trol and data acquisition-related sites; encourage the software industry to consider more secure out-of-the-box installation and implementation of their products; research and development in areas of intrusion detection, Internet infrastruc- ture security, application security, denial of ser- vice, communications security, high assurance systems, and secure system composition.

• Physical Protection (White House, 2003a): Advance modeling, simulation, and analysis capabilities including an effort to enhance data

collection and standardization; enhance detec- tion and testing capabilities with agriculture and food networks; assess transportation and security risks; improve monitoring of the water sector; enhance surveillance and communica- tions capabilities; develop redundant com- munications systems for emergency response agencies; expand infrastructure diverse routing capability in the telecommunications sector; develop a national system for measures to re- constitute capabilities of individual facilities and systems within the energy sector; increase cargo screening capabilities for the transporta- tion sector; enhance exchange of security re- lated information in the finance sector.

• National Infrastructure Protection Plan (Department of Homeland Security, 2009, pp. 13–15): Protect critical infrastructure and key resources against plausible and specific threats; long-term reduction of critical infra- structure and key resources vulnerabilities in a comprehensive and integrated manner; maxi- mize efficient use of resources for infrastructure protection; build partnerships among federal, state, local, tribal, international, and private sector stakeholders to implement critical infra- structure protection programs; continuously track and improve national protection.

Interdependencies among Critical Infrastructure Systems Critical infrastructure systems are heavily reliant on one another to operate at maximum efficiency. The interde- pendent nature of these systems makes them susceptible to cascading failures and adds a level of complexity to protecting the nation’s key assets. The most commonly used and farthest-reaching technology is the information technology (IT) infrastructure. Without computers and networks, our economic and infrastructure systems would not function in the manner to which we have become accustomed. Emergency managers rely on interoperable communication devices to respond to various accidents and disasters. Without a robust and resilient IT infrastruc- ture, these communication tools would not be useful and would hinder effective response activities.

A network of networks now directly supports op- erations within all of the following sectors of the nation’s economy: energy (electricity, oil, gas), transportation (rail, air), finance and banking, telecommunications, public health, emergency services, water, chemical, defense, food, agriculture, and postal (White House, 2003b, p. 6). Physical infrastructures such as electrical

57854_CH04_final.indd 5057854_CH04_final.indd 50 1/20/10 10:23:05 AM1/20/10 10:23:05 AM

F O S T E R , C E D R I C 1 6 9 2 T S

CHAPTER 4: Critical Infrastructure Protection, Emergency Response, and Management 51

transformers, trains, pipeline pumps, chemical vats, and radars are also dependent on computer networks (White House, 2003b, p. 6).

These networks (FIGURE 4-3) are vulnerable to many types of cyber threats (including terrorist attacks, eco- nomic espionage, and random failures) and present new challenges to owners and operators of the nation’s in- frastructures. The high degree of automation and inter- connectivity of computer networks, however, subjects them to potentially crippling and catastrophic attacks or failures.

Hazards and Threats to Critical Infrastructure Systems The list of hazards and threats that exist to both physical and cyber components of our infrastructure is quite long. Major hazard categories include natural disasters, terror- ist activities, human error, weapons of mass destruction, and mechanical failure. Solutions that combine technol- ogy with multidisciplinary research provide the most complete answers to infrastructure assurance problems. This litany of potential hazards makes it potentially chal- lenging to those engaged in emergency response because

they must be prepared to address a variety of situations, which may be caused by numerous sources. There is no single approach to addressing infrastructure protection, and emergency managers who understand the intercon- nected nature of critical systems and approach response from an all-hazards standpoint will be best prepared to address emergency situations and ensure the safety of individual citizens.

In the past decade, attacks against physical infrastruc- tures have been executed successfully by exploiting tech- nology. Emergency response personnel played key roles in mitigating further damage in each of these examples. In the 1993 attack at the World Trade Center, a truck bomb was used. In 1995, a disgruntled citizen using simple technologies and common products detonated a truck bomb at the Alfred Murrah Federal Building in Oklahoma City (FIGURE 4-4). Moreover, the tragic events of September 11, 2001, opened a new mode of threats to the nation’s infrastructure—the use of civilian transportation systems as weapons. Based on these precedents, communities need to be on guard to anticipate and prevent terrorist use of common commercial systems and technology that are readily available within our borders.

A. Agriculture needs oil and electricity to operate machinery as well as water to sustain growth. Crops, like corn, can also be used as alternative fuels.

B. Electricity supplies energy and uses oil to operate and water for cooling purposes.

C. Oil becomes fuel for the other branches and uses water for cooling and electricity for operat- ing machinery.

D. Water industries use power from electricity and oil, as well as for control and movement. Water is mainly used by the other branches for cooling properties as well as for power. Water is also es- sential for sustaining human health and life.

E. Humans, as the central cog of critical infra- structure, operate and manage each of the other branches as well as benefit from their use and products.

FIGURE 4-3 The interdependency of critical infrastructure.

57854_CH04_final.indd 5157854_CH04_final.indd 51 1/20/10 10:23:06 AM1/20/10 10:23:06 AM

F O S T E R , C E D R I C 1 6 9 2 T S

52 Homeland Security: Principles and Practice of Terrorism Response

A primary concern is the threat of organized cyber at- tacks that are capable of debilitating our nation’s critical infrastructures, economy, and national security (White House, 2003b). Computer networks can be attacked with little or no warning and cascade rapidly such that victims may not have time to respond. Even with warn- ings, victims may not have access to the proper tools and technologies to defend themselves. Efforts are under way worldwide to create models to simulate and visualize infrastructure networks.

Emergency responders must consider the intercon- nected nature of physical systems and cyber systems. In emergency planning, a balance must exist between physi- cal and cyber vulnerabilities. Although attacks to physi- cal structures often produce high numbers of victims, failures within cyber systems also create victims requiring awareness and response. Emergency response planning must now include multiple levels of consideration to how physical and cyber systems work to support each other.

While strong information security policy is of ut- most importance, physical security and building design are also critical. The location of computers and servers must be well planned to prevent damage from hazards such as flooding, fire, explosion, and intrusion. Fiber- optic cable must be protected as well to prevent ac- cidental damage from digging and malicious cutting of wires. Colocation of wires and cables introduces com- mon, serious, single-point failure vulnerabilities to be avoided in protection design. Consequences of cable colocation were evidenced by the Baltimore train tun- nel fire of 2001. This accident occurred in a tunnel with colocated fiber-optic cables whose failure interrupted telecommunications and Internet connectivity along the Washington–New York corridor.

In an increasingly complex and interconnected global community, the reliance on computers to store,

transmit, and process data has grown exponentially. Wireless technology applications continue to increase society’s dependence on the computer infrastructure for communication and business processes. Private- sector businesses, governments, and individuals have all become more reliant on IT to perform routine tasks. Therefore, emergency response personnel must be acutely aware of interconnected infrastructure systems and the role in which humans interact with these im- portant elements of a modern society. Social networks are prime examples (such as Twitter and Facebook) where disaster information—some accurate and some inaccurate—can be quickly spread through an affected community.

Risk Communication Paradigms An integral component of emergency management and critical infrastructure protection is the field of risk com- munication. Risk communication focuses on communi- cating disaster preparedness information and mitigation strategies to the public in order to minimize the potential effects of an event before said event occurs. One of the first major publications produced in the risk communi- cation field was the 1988 guide, the Seven Cardinal Rules of Risk Communication, published by the Environmental Protection Agency based on the work of Vincent T. Covello and Frederick H. Allen. The guide lists seven basic rules on how to engage with the public, concerns of honesty and truthfulness, coordination efforts, dealing with the media, planning, and evaluating.

While the Seven Cardinal Rules of Risk Communication is still quite relevant and utilized at the local, state, and national level on a daily basis, the importance of properly communicating prior to an incident involving a critical infrastructure sector cannot be overstated.

Disastrous events involving critical infrastructure require an in-depth risk communication strategy that should be constantly evolving as technology advances and information knowledge management increases. This is due in part to the length of time a major event af- fecting critical infrastructure stays in the public’s mind. While risk communication is a discipline with numer- ous concepts, strategies, and techniques, one particular aspect identified by risk communication expert Dr. Peter Sandman in his article, Obvious or Suspected, Here or Elsewhere, Now or Then: Paradigms of Emergency Events, focuses on three variables relevant to critical infrastruc- ture protection. The three variables are as follows:

1. Obvious or suspected 2. Here or elsewhere 3. Now, future, or past (Sandman, 2002).

FIGURE 4-4 A scene of devastation at the Murrah Federal Building follow- ing the Oklahoma City bombing on April 26, 1995.

57854_CH04_final.indd 5257854_CH04_final.indd 52 1/20/10 10:23:06 AM1/20/10 10:23:06 AM

F O S T E R , C E D R I C 1 6 9 2 T S

CHAPTER 4: Critical Infrastructure Protection, Emergency Response, and Management 53

For example, when preparedness officials commu- nicated with the citizens of New York City; Washington, DC; and other localities in the weeks after the events of September 11, 2001, the communication fell in the obvious/here/past paradigm. The attacks were obvious because they could be seen/heard/felt; they occurred where New Yorkers and Washingtonians resided and worked, not in a foreign city 3,000 miles away; and the attacks had already taken place. However, a California mayor’s communication about those attacks would have been identified as the obvious/elsewhere/past paradigm because the incidents happened on the opposite coast from California. This distinction takes into account the physical attack on the U.S. defense industrial base (Pentagon) (FIGURE 4-5) and an institution of the bank- ing and finance sector (World Trade Center). The para- digm of obvious/here/now could describe the framework for communication to the entire United States during the economic collapse following September 11, 2001, because Americans were impacted by the targeting of the banking and finance sector.

The H1N1 virus (swine flu) public health emer- gency highlights the distinction between obvious and suspected—the most difficult concept of the three variables as here or elsewhere and now or then are relatively easy to identify. A small number of more

FIGURE 4-5 A 200-foot gash exposes interior sections of the Pentagon following the terrorist crash of a commercial airliner into the southwest corner of the building on September 11, 2001.

Seven Cardinal Rules of Risk Communication

(Covello and Sandman, 2004) Rule 1: Accept and involve the public as a legitimate partner. Disaster managers must realize in advance

that the public is going to want to be involved and will find a way to be involved. It only makes sense to openly include them early on.

Rule 2: Listen to the audience. An effective dialogue will occur only after the communicators find out what is important to the public. In some cases it may be trust, caring, and courtesy, while other communities will value quantitative statistics or a combination.

Rule 3: Be honest, frank, and open. The two greatest attributes in a risk communicator’s arsenal are trust and credibility. These are judgments made early on and are highly resistant to change. If answers are unknown, one should say, “We do not have the answer at this time, but are working on it.” Lies and mislead- ing will destroy any trust already gained.

Rule 4: Coordinate and collaborate with other credible sources. One of the best ways to ensure inter- organizational and intraorganizational lines of communication is to set up specific tasks early on. Agencies should know whom to contact outside of their team for information and have lines of communication already established. Once communication to the public takes place, it will look much more credible coming from many highly trained sources.

Rule 5: Meet the needs of the media. Know what the media is interested in. “The media are generally more interested in politics than in risk; more interested in simplicity than in complexity; and more interested in wrongdoing, blame and danger than in safety” (Covello & Sandman, 2004, p. 13). The overall goal with the media should be the same with the public—establish long-term relationships of trust.

Rule 6: Speak clearly and with compassion. Overly technical speech damages risk communication more than it helps. Describe technical aspects only when necessary. The public is more concerned with empathy and caring over numbers.

Rule 7: Plan carefully and evaluate performance. This essentially reiterates what risk communication is—planning. Start early on with clear objectives. Properly train staff to deal with stakeholders, the public, and other technical workers.

57854_CH04_final.indd 5357854_CH04_final.indd 53 1/20/10 10:23:07 AM1/20/10 10:23:07 AM

F O S T E R , C E D R I C 1 6 9 2 T S

54 Homeland Security: Principles and Practice of Terrorism Response

virulent cases of the flu would require the suspected distinction, without taking into account where the flu cases were occurring and the life cycle of the sus- pected illness. Once the H1N1 virus was identified and the number of confirmed cases reached well into the hundreds, the more virulent cases of the flu are now the swine flu pandemic, an obvious and no lon- ger suspected event. The following list highlights six paradigms, as described by Dr. Sandman using real and hypothetical situations:

1. Obvious/Here/Future. Bioterrorists may someday poison the water supply. Planning now what to say if it happens is planning for an obvious/here/ now emergency … but what do we say now about this future possibility?

2. Obvious/Here/Past. Emergencies end. When they end, the communication about them doesn’t end, but it does change. What should the postemer- gency public dialogue look like, and how can you get ready to conduct it?

3. Obvious/Elsewhere/Now. September 11, 2001, and the 2002 anthrax attacks soon afterwards were obvious/here/now for a few emergency managers in a few cities. Everywhere else they were obvi- ous/elsewhere/now—and they required a lot of communication.

4. Suspected/Here/Now. Someone shows up at the airport with a severe fever. The nearest doctor thinks it might be Ebola. Various health-protec- tive steps are initiated and need to be communi- cated pending a more definitive diagnosis.

5. Suspected/Here/Future. If someone thinks he may someday face the fourth paradigm, then he faces this one now. People are likelier to cope well with the cliffhanging tension of a suspected/here/now emergency if they were aware in advance that such a dilemma might well be on its way.

6. Suspected/Here/Past. Some people thought there were a lot of foreign nationals taking flying les- sons, but they weren’t sure this was a problem and they decided not to take action. Now they have to explain why they underreacted. Others thought a weird case of chickenpox might be smallpox and did take action, and it was just a weird case of chickenpox. Now they have to ex- plain why they overreacted (Sandman, 2002).

Understanding these characteristics of an event or future event with the potential to impact critical infrastructure will create risk communication specifi- cally tailored to the audience; when and where the event occurred; and situations where an event has not completely unfolded. The more specific the communi-

cation is, the better chance preparedness officials will gain the trust and confidence of the public after an event occurs. While faulty communication will leave the public fearful and skeptical of the messenger (al- most always government when critical infrastructure is involved), utilizing the paradigms will improve risk communication understanding, skills, and techniques, ensuring a more robust overall emergency management strategy.

The Role of the Department of Homeland Security

Critical infrastructure protection, cyber security, and emergency response initiatives are major components of the efforts of government agencies at the federal, state, and local levels. Emergency response planning varies from state to state and locality to locality, but the federal gov- ernment has designated the DHS as the lead agency for policy development for critical infrastructure protection and emergency response. Within the DHS, an Assistant Secretary for Cyber Security and Telecommunications is responsible for identifying and assessing the vulnerability of critical telecommunications infrastructure and assets; providing timely, actionable, and valuable threat informa- tion; and leading the national response to cyber attacks and telecommunications attacks. The Assistant Secretary for Infrastructure Protection is charged with cataloging the nation’s critical infrastructures and key resources and coordinating risk-based strategies and protective measures to secure them from terrorist attack.

As the cognizant agency for coordinating federal activities within the area of infrastructure protection and information assurance, the DHS has established pro- grams that address policy and action necessary for the continued operation of the nation’s critical systems. It’s through these programs that preparedness and response activities are developed and implemented.

Critical Infrastructure Protection and Response One major DHS initiative is the Protected Critical Infrastructure Information Program, which is designed to encourage private industry and others with knowl- edge about our critical infrastructure to share sensitive and proprietary business information with the govern- ment. This program is used in pursuit of a more secure homeland, focusing primarily on analyzing and securing critical infrastructure and protected systems and devel- oping risk and vulnerability assessments assisting with recovery (DHS, 2009).

57854_CH04_final.indd 5457854_CH04_final.indd 54 1/20/10 10:23:07 AM1/20/10 10:23:07 AM

F O S T E R , C E D R I C 1 6 9 2 T S

CHAPTER 4: Critical Infrastructure Protection, Emergency Response, and Management 55

Homeland Security Operations Center Emergency response personnel are actively engaged in protecting the nation’s infrastructure through the Department of Homeland Security’s Homeland Security Operations Center (HSOC), which serves as the nation’s center for information sharing and domes- tic incident management. One of the goals of this effort is to dramatically increase the coordination between federal, state, territorial, tribal, local, and private-sector partners, which provide constant watch for the safety of our nation. The center includes partners from over thirty-five agencies and receives hundreds of calls in its effort to collect and fuse information from a variety of sources on a daily basis to help deter, detect, and prevent terrorist acts and address approximately twenty incidents/cases per day. The HSOC is in constant com- munication with the White House, serving as a conduit of information for the White House situation room by providing the intelligence needed to make decisions and define courses of action. The information gath- ered and analyzed by the HSOC provides real-time situational awareness in monitoring the homeland. This program also coordinates incident and response activities and issues advisories and bulletins concern- ing threats, as well as coordinating specific protective measures. Information on domestic incident manage- ment is shared with emergency operations centers at all levels through the Homeland Security information network.

Information is shared and fused on a daily basis by the two halves of the HSOC that are referred to as the “intelligence side” and the “law enforcement side.” Each half of the HSOC functions in conjunction with the other but requires a different level of clearance to access infor- mation. The intelligence side focuses on pieces of highly classified information and how specific details contribute to the current threat for any given area. The law enforce- ment side is dedicated to tracking the different enforce- ment activities across the country that may have a link to terrorism. These efforts highlight the relationships and coordination among all levels of government. Without the cooperation among law enforcement agencies at all levels, the HSOC would not be effective in its efforts to thwart terrorist activities.

The HSOC communicates in real time to its part- ners through the Homeland Security information net- work’s Internet-based counterterrorism communications tool. This tool supplies information to all fifty states, Washington, DC, and more than fifty major urban ar- eas. Threat information is exchanged with state and local partners to assist in planning and response activi- ties. Participants in the Homeland Security information

network include governors, mayors, state Homeland Security advisors, state National Guard offices, emer- gency operations centers, first responders and public safety departments, and other key homeland security partners (DHS, 2009).

The HSOC regularly disseminates domestic terror- ism-related information generated by the Information Analysis and Infrastructure Protection Directorate. Information released by the HSOC comes in one of the following two forms:

1. Homeland Security threat advisories, which are the result of information analysis and con- tain actionable information about an incident involving or a threat targeting critical national networks, infrastructures, or key assets. They often relay newly developed procedures that, when implemented, significantly improve secu- rity and protection. Advisories also often suggest a change in readiness posture, protective actions, or response.

2. Homeland Security information bulletins are protection products that communicate infor- mation of interest to the nation’s critical in- frastructures that do not meet the timeliness, specificity, or significance thresholds of warn- ing messages. Such information may include statistical reports, periodic summaries, incident response or reporting guidelines, common vulnerabilities and patches, and configuration standards or tools.

In March of 2002, President George W. Bush un- veiled the Homeland Security Advisory System as a tool to improve coordination and communication among all levels of government, the private sector, and the American public. The advisory system not only iden- tifies the threat condition, but it also outlines protective measures that can be taken by partner agencies. The federal government, states, and the private sector each have a set of plans and protective measures that are implemented as the threat condition is raised or low- ered, thus flexibly mitigating vulnerability to attack. The HSOC is the distributor of the recommended security measures to state and local partners when the threat level is raised or lowered.

The HSOC monitors vulnerabilities and compares them to threats and pertinent intelligence, providing a centralized, real-time flow of information between homeland security partners. These data collected from across the country are then compiled into a master tem- plate that allows the HSOC to provide a visual picture of the nation’s current threat status. The HSOC has the capability to do each of the following:

57854_CH04_final.indd 5557854_CH04_final.indd 55 1/20/10 10:23:07 AM1/20/10 10:23:07 AM

F O S T E R , C E D R I C 1 6 9 2 T S

56 Homeland Security: Principles and Practice of Terrorism Response

• Perform an initial assessment of the informa- tion to gauge the terrorist nexus.

• Track operational actions taking place across the country in response to the intelligence in- formation.

• Disseminate notifications and alerts about the information and any decisions made.

As information is shared across agencies, HSOC staff can utilize visualization tools by cross-referencing hu- man intelligence against geospatial data that can isolate an area of interest on the earth’s surface. Satellite tech- nology is then able to transmit pictures of the site in question directly into the HSOC. This type of geographic data can be stored to create a library of images that can be mapped against future threats and shared with our state and local partners.

The Interagency Incident Management Group (IIMG) is based in Washington, DC, and is comprised of senior representatives from DHS, other federal depart- ments and agencies, and nongovernment organizations. The IIMG provides strategic situational awareness, syn- thesizes key intelligence and operational information, frames courses of action and policy recommendations, anticipates evolving requirements, and provides decision support to the Secretary of Homeland Security and other national authorities during periods of elevated alert and national domestic incidents.

During incidents such as Hurricanes Isabel (2003), Katrina (2005), Rita (2005), and Wilma (2005); the December 2003 orange alert; and the Northeast black- out, the IIMG was activated in less than 90 minutes and hosted assistant secretary-level members of fed- eral agencies to provide strategic leadership (DHS, 2009).

Along with the critical infrastructure initiatives al- ready discussed, the DHS is also focused on improving cyber security efforts. As discussed earlier in this chapter, the consequences of an attack on our cyber infrastructure can cascade across many sectors, causing widespread dis- ruption of essential services, damaging our economy, and imperiling public safety.

The speed and maliciousness of cyber attacks have increased dramatically in recent years. Accordingly, the preparedness directorate places an especially high pri- ority on protecting our cyber infrastructure from terror- ist attack by unifying and focusing key cyber security activities. The directorate augments the capabilities of the federal government with the response functions of the National Cyber Security Division of the United States Computer Emergency Response Team. Due to the interconnected nature of information and telecom-

munications sectors, DHS will also assume the func- tions and assets of the national communications system within the Department of Defense, which coordinates emergency preparedness for the telecommunications sector.

Providing indications and warning advisories is a major function of the DHS’s efforts within cyber secu- rity. In advance of real-time crisis or attack, prepared- ness will provide the following:

• Threat warnings and advisories against the homeland including physical and cyber events.

• Processes to develop and issue national and sector-specific threat advisories through the Homeland Security advisory system.

• Terrorist threat information for release to the public, private industry, or state and local gov- ernment.

Chapter Summary

Given the distributed nature of the nation’s infrastruc- ture systems, the sharing of information between the public and private sectors and across the critical infra- structure sectors is imperative. As discussed previously, the DHS places a priority on initiatives that emphasize and facilitate the flow of information, which is crucial to preventing and responding to a disaster. While DHS has focused on the area of information sharing, greater efforts need to be taken to engage the appropriate par- ticipants. Without coordinated activities at the federal level, policy makers may be missing crucial informa- tion in a time of crisis. Data gathered by DHS must be verified and trustworthy before details are released to localities, and the communication of threats needs to be articulated clearly and early in order for appropri- ate measures to be taken. It is key to remember that coordination of efforts in the areas of infrastructure protection and information assurance relies on accurate and well-communicated details.

Prior to the creation of the DHS, the responsibility for the nation’s efforts to secure cyber space and protect critical infrastructures was distributed within a number of federal agencies. Today, DHS is the primary organiza- tion for all cyber security and physical security initia- tives. The programs highlighted in this chapter address the key areas of focus for DHS as the organization ad- dresses an ever-evolving and growing number of threats. While all levels of government are important stakehold- ers in securing critical assets, only with cooperation from the private sector and individual citizens will the efforts of DHS be effective.

57854_CH04_final.indd 5657854_CH04_final.indd 56 1/20/10 10:23:08 AM1/20/10 10:23:08 AM

F O S T E R , C E D R I C 1 6 9 2 T S

Wrap Up Chapter Questions

1. Define critical infrastructure. 2. Describe the current national policy that ad-

dresses critical infrastructure protection. 3. List and define at least four threats in the physical

and cyber components of the U.S. infrastructure. 4. List and define the seven cardinal rules of risk

communication. 5. What are the roles of the HSOC? 6. Discuss the roles of the IIMG.

Chapter Project

List the critical infrastructure networks in your commu- nity, identify the key threats to each network, and define appropriate local protection and response efforts.

Vital Vocabulary

Critical infrastructure Systems and assets, whether physical or virtual, so vital that the incapacity or de- struction of such may have a debilitating impact on the security, economy, public health or safety, environment, or any combination of these matters, across any federal, state, regional, territorial, or local jurisdiction.

Homeland Security Advisory System A tool to im- prove coordination and communication among all levels of government, the private sector, and the American public that identifies the threat condition and protective measures that can be taken by partner agencies.

Homeland Security information bulletins Protection products that communicate information of interest to the nation’s critical infrastructures that do not meet

the timeliness, specificity, or significance thresholds of warning messages.

Homeland Security Operations Center (HSOC) Homeland Security center that serves as the nation’s center for information sharing and domestic incident management by enhancing coordination between fed- eral, state, territorial, tribal, local, and private-sector partners.

Homeland Security threat advisories Information analysis and actionable information about an incident involving or a threat targeting critical national networks, infrastructures, or key assets.

Interagency Incident Management Group (IIMG) Senior representatives from DHS, other federal depart- ments and agencies, and nongovernment organizations to provide strategic situational awareness, synthesize key intelligence and operational information, frame courses of action and policy recommendations, anticipate evolv- ing requirements, and provide decision support to the secretary of Homeland Security.

Key asset Person, structure, facility, information, mate- rial, or process that has value.

Key resources Publicly or privately controlled re- sources essential to minimal operations of the economy and government.

Network of networks A system that directly supports the following operations within all sectors of the nation’s economy: energy (electricity, oil, gas), transportation (rail, air), finance and banking, telecommunications, public health, emergency services, water, chemical, de- fense, food, agriculture, and postal.

Risk communication Communicating disaster pre- paredness information and mitigation strategies to the public in order to minimize the potential effects of an event before said event occurs.

57854_CH04_final.indd 5757854_CH04_final.indd 57 1/20/10 10:23:08 AM1/20/10 10:23:08 AM

F O S T E R , C E D R I C 1 6 9 2 T S

57854_CH04_final.indd 5857854_CH04_final.indd 58 1/20/10 10:23:08 AM1/20/10 10:23:08 AM

F O S T E R , C E D R I C 1 6 9 2 T S

Planning for Terrorism Hank T. Christen Paul M. Maniscalco

• Describe planning as a front-end concept.

• Recognize the importance of incorporating terrorism in an emergency operations plan (EOP).

• Outline the key National Incident Management System (NIMS) and National Response Framework (NRF) elements in an EOP.

• Distinguish between an EOP and a real-time incident action plan (IAP).

• Outline the logistics/resource management elements in an EOP.

• Describe the liaison process with support agencies in emergency planning.

Objectives

57854_CH05_final.indd 5957854_CH05_final.indd 59 1/20/10 10:24:37 AM1/20/10 10:24:37 AM

F O S T E R , C E D R I C 1 6 9 2 T S

60 Homeland Security: Principles and Practice of Terrorism Response

Introduction

Effective response to a terrorism event is often per- ceived as action oriented. We picture quick and ag- gressive operations and tactics. This idea is hopefully accurate in a well-organized response. However, effec- tive tactical and strategic actions cannot occur without planning.

Advanced planning is a front-end concept. This means that for positive outcomes at the back end, we must heavily load the front end. It is simply impossible to dynamically deploy in a terrorism incident and be successful without planning.

A front-end plan is different than a reference guide. Many disaster plans are kept in a 2-inch thick binder that includes radio frequencies, names and addresses, lists of vehicles, units, and descriptions of resources. These guides are important for reference information, but they are not documents that yield tactical guidelines in the heat of battle. There is nothing wrong with refer- ence information—it is important, but it’s not a plan that guides you through the critical steps of a disaster or terrorism incident.

An effective plan is an easy-to-read template and framework that benchmarks the critical factors of a dy- namic event; the plan identifies operations and support functions that complement operations. In other words, the plan is a NIMS guide. It is important to remember that all plans suffer from a common deficiency. Namely, plans do not incorporate unexpected events. Plans ad- dress only expected or anticipated events. Unexpected events require a high-reliability organizing hallmark called resilience. Resilience is the ability to bounce back or recover from unexpected events. For example, the U.S. Postal Service had no plan for responding to mailed anthrax attacks. They were resilient and rewrote plans in a dynamic and unexpected environment. In summary, effective plans are a necessity but not the holy grail; expect plans to fail sometimes.

The NIMS and the NRF—Templates for Planning

Effective plans guide you through the NIMS functions and the NRF structure. The NIMS (Chapter 2) and the NRF (Chapter 3) are templates for response planning. This means all emergency response activities are man- aged by a command/unified staff and involve operations, logistics, planning, and administration/finance. It makes sense to use the NIMS and NRF models when developing effective operational plans.

An emergency operations plan (EOP) for terrorism incidents should identify key elements such as:

• Command or unified command staff • Operations • Logistics and multiagency coordination

systems (MACS) • Planning • Administration/finance • Liaison with state, federal, nongovernment,

and private-sector agencies • Information management • Public information • Safety

Who Is in Charge?

Command turf wars have no place in terrorism incidents. Emergency response agencies and policy officials have to formally determine who will manage what type of event. This may be a difficult process. Federal and state agencies have elaborate plans and statutes that identify who manages the incident, but their response may take hours or days. Local responders are always the first to arrive and the last to leave a terrorism incident.

If an event meets the federal definition of terror- ism, federal agencies will have jurisdiction. In accor- dance with the NRF, the Department of Justice is the lead agency. The Department of Homeland Security (DHS) coordinates response activities. Coordinate is the key word because DHS is not a first-responder entity. This means local communities must establish scene man- agement immediately and maintain command with a common operational picture throughout the incident. A critical step is determining who is in charge. In most local governments, the responsibility of scene manage- ment in terrorism incidents rests with the ranking law enforcement official. However, terrorism incidents are complex and require a number of agencies. This means the incident will likely involve a large EMS and fire/ rescue response—possibly public health and public works—with the appropriate command responsibili- ties and challenges.

One solution is a single-agency incident commander, such as a sheriff or police chief, with EMS and fire/rescue operating at branch levels. The second solution is unified

One must plan on the front end to ensure success on the back end.

57854_CH05_final.indd 6057854_CH05_final.indd 60 1/20/10 10:24:40 AM1/20/10 10:24:40 AM

F O S T E R , C E D R I C 1 6 9 2 T S

CHAPTER 5: Planning for Terrorism 61

command. A unified command team is utilized when multiple agencies and/or disciplines have jurisdiction in a complex incident. Consider a bombing with a building collapse and mass casualties—clearly there are major EMS, fire/rescue, and law-enforcement operations that must effectively coordinate. In this case, a command post with a unified EMS/fire/law enforcement management team is the solution (FIGURE 5-1).

Unified command requires that all managers be lo- cated in the same area (a command post, vehicle, or an emergency operations center) to share information and maintain a common operational picture. The planning section guides this process with effective status displays, resource tracking, and comprehensive interagency ac- tion plans. Separate command posts for each major agency are not a workable solution because separated agencies and jurisdictions tend to freelance with poor interagency coordination. Unified command does not begin in the heat of battle—it starts with effective plan- ning well before a terrorism incident. The responsibility of each agency must be specifically defined and written. Emergency management facilitates the formal develop- ment of unified command through the local compre- hensive EOP.

In many ways, the informal development of unified command is more significant than the formal process. Managers must get to know each other. The corporate world uses the term networking. It means that various agency managers initiate mutual support by breaking bread and sharing coffee—this informal process is the first

step in building trust (FIGURE 5-2). A community disaster committee is an excellent vehicle to schedule quarterly meetings where mutual incident command issues are discussed and agency heads develop mutual trust. Joint training exercises also facilitate interagency networking. Managers cannot meet each other for the first time in a major incident and expect to coordinate effectively.

Operations

The EOP must identify operations agencies in the local/ regional area that are trained and equipped to handle specific operational problems. Obviously, EMS, fire, public health, and law enforcement have clearly defined and visible tasks. However, terrorism incidents present unique resource management and operational problems. Many of these issues require special teams that may not be available within the immediate area. Special terrorism operational requirements include the following:

1. Heavily armed tactical teams to combat terrorists with automatic weapons.

2. Hazardous materials teams equipped to detect, penetrate, and decontaminate radiological inci- dents.

3. EMS teams with protective equipment that triage, treat, and transport large numbers of victims.

4. A decontamination unit that decontaminates hun- dreds of victims in a chemical attack.

5. A public health unit that detects and tracks mass disease victims (medical surveillance/epidemiol- ogy) in a biological attack.

6. Search and rescue teams for structural collapse incidents.

7. Cyber forensics teams.FIGURE 5-1 A command post should be coordinated by a unified EMS/fire/ law enforcement management team.

FIGURE 5-2 The informal process of building trust with colleagues or networking.

An essential step in consequence management plan- ning is to determine who will be in charge.

57854_CH05_final.indd 6157854_CH05_final.indd 61 1/20/10 10:24:42 AM1/20/10 10:24:42 AM

F O S T E R , C E D R I C 1 6 9 2 T S

62 Homeland Security: Principles and Practice of Terrorism Response

These scenarios are not common incidents. At the time of this writing, few cities in the United States have the capability of managing all of these events. If special teams are not locally available, the plan must identify other sources. These resources include federal response teams, military units, state and regional agencies, and private-sector resources.

In reality, no single local government can afford all the anticipated resources. However, an effective threat assessment and planning process reveals areas of vulner- ability and identifies possible operational units capable of threat response.

Resource Management

Terrorism incidents are often destructive because resources—personnel, equipment, and supplies— are consumed faster than they are replaced. A small bombing with few casualties is manageable, but a major terrorism or disaster incident rapidly depletes responders, vehicles, supplies, medications, and hos- pital beds. Examples of critical needs in terrorism in- cidents are:

• Emergency responders • Weapons/crime scene supplies • EMS units • Personal protective equipment (ensembles and

breathing equipment) • Medical supplies and equipment • Emergency Department/surgical facilities • Detection and decontamination equipment • Vehicles/aircraft • Medical laboratories • Medications/antidotes (pharmaceutical cache) • Communications In long-duration incidents, there is an added de-

mand for crew rehabilitation, food/water, sleeping facilities, and sanitation measures. An effective plan ad- dresses these resource and logistics management issues. The plan is based on the correct assumption that first response resources are immediately depleted. Resources that support the previous problem areas are outlined in the plan. There are several solutions for critical logistics needs such as:

1. Logistics caches for regional support, such as a decontamination cache of washing supplies, pro- tective equipment, and 100 ensembles.

2. Mutual aid agreements with local, state, and fed- eral agencies or jurisdictions.

3. A MACS to complement incident logistics activi- ties.

4. Military support including a memorandum of un- derstanding with local military installations and state National Guard units for critical personnel or equipment.

5. Private contracting, such as an agreement with a chemical spill response company to provide chemical spill control or radiation equipment.

6. State/federal support, such as procedures for re- questing state and federal logistical support; and a nationwide pharmaceutical cache system.

Logistics caches must be packaged and stored for rapid deployment. A logistics trailer or truck is recom- mended. In rural systems, supplies can be stored in plas- tic containers for immediate loading on vehicles. Caches should not be stored in closets or back rooms where they gather dust. Supplies should be accessible, packaged, and maintained in good condition for utilization in high- impact, low-frequency incidents (FIGURE 5-3).

Cost and quantities are challenging issues—how much should be bought and what is affordable? The history of the local area and the political climate greatly influence the financial commitment. A selling point is that equipment caches are resources for all hazards—not just terrorism. The question of quantities is complex— there is no formula based on population or threat as- sessment to determine how much protective equipment or how many body bags or atropine injections a com- munity needs. It seems obvious that high-threat urban areas need the largest caches, but what about a small college town that has a football stadium with 50,000 fans on Saturdays in autumn? Again, there is no defini- tive answer. In some areas of the country, communi- ties have developed a spoke and hub system to move resources and medication as dictated by incidents and events. Routine movement of these resources is a good dress rehearsal for resource deployment in large or high-impact incidents.

FIGURE 5-3 The Centers for Disease Control and Prevention Strategic National Stockpile can deliver one of many push packs to any location in the country within 12 hours of an emergency.

57854_CH05_final.indd 6257854_CH05_final.indd 62 1/20/10 10:24:44 AM1/20/10 10:24:44 AM

F O S T E R , C E D R I C 1 6 9 2 T S

CHAPTER 5: Planning for Terrorism 63

At a minimum, there should be enough medica- tions and protective equipment for first responders and mutual aid personnel. This sounds self-serving, but the logic is irrefutable. Responders must protect themselves to ensure survivability. Key resource management points are as follows:

1. Resource management takes planning. 2. Equipment and supplies must be transferred

quickly to a scene. 3. Logistics caches must be accessible and main-

tained. 4. Budgets and political realities will always be re-

source management issues. 5. Estimates of resource quantities are at best a

semieducated guess. 6. Responders need certified protective equipment.

Administration

Administrative functions are omitted from most emer- gency plans. In normal operations, individual agen- cies take care of the usual administrative duties such as finance/purchasing, workman’s compensation, and payroll records. During major disasters, administrative requirements escalate—normal administration is no longer suitable. For example, purchasing and contract- ing in the middle of the night or tracking personnel from state and national agencies are functions that local agency administrative personnel have not experienced. Many responders do not consider fiscal accountability until issues arise for expenditures that may exceed $1 million per day. To summarize, consider and plan for the administration and financial challenges of a major terrorism incident.

Comprehensive Planning

The EOP is usually developed and maintained by the local emergency management agency, an interagency disaster committee, or both. An effective emergency manager plays a coordinating role in bringing competing agencies together and implementing the EOP. Response and support agency managers should participate in the EOP development. The document should be formal and

approved as indicated by appropriate signatures. When conflicts arise, the EOP serves as a template to remind participants of their responsibilities.

The EOP should establish the position of planning section chief for disasters and terrorism incidents. The planning section chief is responsible for developing the IAP, conducting planning briefings, and supervising the resource, situation, documentation, and demobilization units along with technical advisors (refer to Chapter 2).

EOP Summary

The EOP is a comprehensive plan (sometimes called a comprehensive emergency management plan) that uses the NIMS and the NRF as templates to establish an in- teragency plan for terrorism incidents. The key steps in the implementation phase of an EOP are:

1. Coordinate with local/regional response agencies. 2. Assign EOP responsibility to emergency manage-

ment or a disaster committee. 3. Conduct a community terrorism threat assess-

ment. 4. Identify operational and resource needs based on

the threat assessment. 5. Produce a formal document signed by cooperat-

ing agency managers. 6. Perceive the EOP as an evolving document that

is always a work in progress. 7. Test the EOP in exercises and revise the plan

based on lessons learned. The EOP key elements:

1. Specify who is in charge. 2. Make provisions for unified command in complex

incidents. 3. Establish a command staff for public information,

safety, and liaison. 4. Establish an operations section and identify op-

erations agencies. 5. Establish a logistics section for resource manage-

ment and logistics requirements. 6. Establish a planning section. 7. Establish an administration/finance section. 8. Conduct comprehensive NIMS training for all

levels in the incident command system (ICS). 9. Conduct tabletop and operational exercises to

test your plan. Smaller communities are overwhelmed with the per-

sonnel demands of a full-scale EOP implementation. Remember that in any disaster, ICS positions are filled only as needed. The critical concept is that any function not assigned by the incident commander is his or her

An operations/logistics mindset must not interfere with the administrative needs of a major terrorism incident.

57854_CH05_final.indd 6357854_CH05_final.indd 63 1/20/10 10:24:45 AM1/20/10 10:24:45 AM

F O S T E R , C E D R I C 1 6 9 2 T S

64 Homeland Security: Principles and Practice of Terrorism Response

responsibility. It is important to identify critical person- nel from other support agencies or mutual aid agencies and train them on their operational responsibilities per the NIMS. This is especially significant in locales that have inadequate staffing.

The Incident Action Plan

An incident action plan (IAP) is a plan of objectives for implementing an overall incident strategy. The IAP is a tactical plan for an operational period. Unlike the EOP, the IAP is related to a specific incident and a set of dynamic circumstances. The EOP is reference oriented, whereas the IAP is action oriented.

On routine incidents or small mass casualty events, the incident commander follows a protocol without a written plan. Planning is on the fly with the aid of a quick checklist. Major incidents need a formal IAP because esca- lating and dynamic variables require increased resources over an extended time period. Major incidents may geo- graphically expand, requiring several divisions. Incidents of this nature present major planning problems, including the fact that incident or unified commanders cannot keep all of the strategies in their heads. No single individual can plan all the strategies without consultation and help. Written documents are needed to clarify and convey the strategies, objectives, and assignments to others.

The solution is a formalized IAP. When do you go formal? is a valid question. In short-duration incidents usually lasting less than one operational period, a verbal and informal plan suffices. When an incident progresses beyond an 8-hour operational period, a written plan is prepared, briefed, and distributed to operational shifts. This is especially important if 24-hour operations are continued. If night operations are scaled down, a daily briefing is adequate.

The development of an 8-hour or daily IAP is de- manding for the planning section chief. Fortunately, there is a nationally accepted format developed by the National Wildfire Coordinating Group. This format has been adopted by NIMS for all-hazard incidents, including terrorism events. There are several forms associated with the IAP that serve as checklists, com- pleted by the appropriate supervisor, and this greatly eases the IAP process. ICS forms are available via the Federal Emergency Management Agency (FEMA) ICS resource center, http://training.fema.gov/EM/Web/IS/ ICSResource/ICSResCntr_Forms.htm. The forms, listed next, address critical planning areas.

1. ICS 202, Incident Objectives—includes basic strategy/objectives for the overall incident and

includes critical areas such as safety concerns and forecasted weather.

2. ICS 203, Organizational Assignment List— includes operations sections with all branch di- rectors and division/group supervisors; includes logistics section, planning section, and finance (administration) section with the respective units for each section.

3. ICS 204, Division Assignment List—a list for each branch (operations), divisions assigned to each branch, division managers, and units assigned to each division.

4. ICS 205, Incident Radio Communications Plan— lists administrative frequencies, operations fre- quencies, and tactical channels; lists telephone numbers for managers and key agencies; and specifies an overall communications plan, in- cluding secondary and tertiary communications networks.

5. ICS 206, Medical Plan—formalizes medical sup- port for overhead team and on-scene responders; includes nearest hospitals, medical frequencies, and a roster of EMS units. Note: In mass casualty incidents, medical operations are delineated in ICS 204 relating to organizational assignments and division assignments.

6. ICS 220, Air Operations Summary Worksheet— lists all air units, air objectives, frequencies, and assignments.

7. Incident Map—a map, computer graphic, or aerial photo depicting the incident area.

8. Safety Plan—safety objectives and hazard warn- ings (prepared by the safety officer).

The formal IAP is not as overwhelming as it may appear. First, the forms serve as a checklist using fill-in- the-blank or electronic forms. Second, the IAP is a joint effort—the incident commander, operations, planning and logistics section chiefs, and specialized units such as medical, safety, weather, and communications con- tribute to the effort.

The IAP forms serve as an effective planning checklist. ICS forms facilitate the incident command process be- cause the forms assist in maintaining span of control with checks and balances for achieving functional ob- jectives. ICS forms are not intended to be used as check- lists. However, the forms are an effective reminder of key ICS actions.

57854_CH05_final.indd 6457854_CH05_final.indd 64 1/20/10 10:24:46 AM1/20/10 10:24:46 AM

F O S T E R , C E D R I C 1 6 9 2 T S

CHAPTER 5: Planning for Terrorism 65

The IAP Briefing Cycle

In long-duration incidents, the IAP is presented during a formal briefing every 8, 12, or 24 hours. This is called a planning briefing cycle. The nature of the incident dictates the length of a shift, which is typically 12 hours in length. Some morning events use an 8-hour briefing cycle (at shift changes) or a 24-hour briefing cycle when there are diminished night operations. Effective plan- ning section chiefs (like effective logistics section chiefs) complement and support the actions and decisions of incident commanders.

The briefing is a very important formal process. The briefing must be concise and short in duration—an average briefing of 30 minutes or less is desirable. All section-level and division-level managers, along with appropriate unit leaders, should attend the briefing—a 50-person audience or more is not unusual in a com- plex event. The IAP is presented by the planning section chief and includes briefings by other specialists such as weather, safety, and technical experts. The technical experts specialize in the medical, radiological, and bio- weapons fields, etc.

Copies of the IAP are distributed to each attendee. An IAP may be ten pages in length in a major disaster or terrorism incident. The IAP copies are a reference for all managers, especially the sections on communications frequencies, unit assignments, and safety procedures.

The National Wildfire Coordinating Group publishes the formal planning guidelines in the Fireline Handbook. The California FIRESCOPE Field Operations Guide con- tains similar material. These documents are specific to wildland firefighting, but the guidelines are adaptable to nonfire disciplines. In a 12-hour briefing cycle, IAP preparation progresses as follows:

1. Shift change—receive field observations; 1 hour. 2. Prepare for planning meeting; 1 hour. 3. Planning meeting with management staff, section

chiefs, agency representatives; 1 hour. 4. Prepare IAP; 4 hours. 5. Finalize IAP; 2 hours. 6. Prepare for operations briefing; 1 hour. 7. Briefing of management staff, section chiefs,

branch/division/unit supervisors; 1 hour. 8. Finalize reports; 1 hour.

The briefing cycle is a flexible guide that can be shortened or lengthened as appropriate.

To demonstrate the use of an EOP and informal and formal IAPs, consider the scenario in the accompanying case study.

CASE STUDY

It is 09:30 hours in Denney City, California. There is an explosion originating from a parked van on Center Street. One person is killed, 14 people are injured, and windows are shattered throughout the block.

A law enforcement unit arrives at 09:32; fire/rescue and EMS units arrive at 09:35. At 09:41, there is a massive explosion in a complex of government buildings immediately adjacent to the van explosion site. Many of the first responders are injured. A five-story building collapses (estimated occupancy of 500 people). The major trauma center next to the building is heavily damaged; there are multiple injuries in the hospital from flying glass. The EOP The Denney City EOP has several sections directly related to an explosives attack on building complexes based on the history of the Oklahoma City and World Trade Center bombings and a local emergency management threat assessment. Key response agencies immediately consult checklists based on elements of the EOP. Critical agency managers, as well as the state operations center, are immediately notified. The EOP is based on the NIMS and the NRF and identifies several critical areas, including the following:

• Command—A unified command team is specified, with unified command among law enforcement, EMS, and fire/rescue.

• Operations—The three critical operations branches are law enforcement, fire/rescue, and EMS. The EOP lists state/federal law enforcement mutual aid assets, procedures for fire mutual aid, urban search and rescue teams, regional medical response, and the activation of a disaster medical assistance team.

• Logistics—The resource management plan establishes a MACS at the EOC and lists resources for scene control, vehicles, lighting, generators, back-up communications, fuel, emergency food, construction equipment, and lumber for shoring.

The IAP must be developed with a briefing cycle ap- propriate for the incident.

57854_CH05_final.indd 6557854_CH05_final.indd 65 1/20/10 10:24:48 AM1/20/10 10:24:48 AM

F O S T E R , C E D R I C 1 6 9 2 T S

66 Homeland Security: Principles and Practice of Terrorism Response

Chapter Summary

Planning for terrorism is a front-end concept. For a successful tactical outcome on the back end, effective planning must occur at the front end. The model of an effective EOP is the NIMS and the NRF. The EOP addresses the key NIMS functions of command staff, operations, logistics, planning, and administration/ finance. The command component identifies who is

in charge and recognizes the concept of unified man- agement. The operations section identifies operations agencies/teams based on an emergency management threat assessment.

Terrorism incidents and disasters consume resources rapidly. The logistics section of an EOP must identify lo- gistics needs and agencies or organizations that provide the appropriate people, supplies, and equipment. In a major event, logistical support may be regional, state,

CASE STUDY (Continued)

• Administration/finance—Specifies that expenditures, claims, and worker’s compensation issues be tracked and establishes the city purchasing director as the supervisor of expenditures.

• Planning—Establishes the activation of the EOC by emergency management and the establishment of a fully staffed planning section if the incident becomes protracted, including a resource unit and a situation unit.

The Informal IAP Managers begin arriving and command is formally transferred from the first arriving engine company of- ficer to a fire battalion chief. It is apparent that a major incident is in progress. A police captain and the battalion chief establish a command post four blocks from the incident. An informal IAP is developed in minutes by identifying critical factors. This plan is communicated verbally and by radio to response man- agers and units. The key elements are:

1. All units search their operational and staging areas for possible secondary devices.

2. The following three divisions are established: collapse division, Center Street division (including the van explosion), and trauma center division (the EOP never addressed the loss of the trauma center).

3. A reconnaissance group is established to assess damage on all sides of the original explosion.

4. Immediate control of the scene perimeter is established by law enforcement.

5. Appropriate EMS, law enforcement, and fire units are assigned to groups/divisions.

6. Triage, treatment, and transport of mass casualty incident victims throughout the incident area are addressed. New problems include an area power failure and the loss of the downtown communications repeater. There

is also disturbing information that many victims appear to have chemical injuries—a combination explosive/ chemical attack is suspected. As these problems evolve, the IAP is revised accordingly.

The unified command team becomes aware in the first hour that this is a complex, long-duration incident. As a result, they request a preestablished management team for full staffing of NIMS/ICS positions. This management team is comprised of NIMS-certified personnel from a multitude of local and state response agencies. Day Two—The Formal IAP The planning section, in coordination with the unified command team and the logistics and operations section chiefs, develops the IAP. Emergency management maintains a MAC. The formal action plan is developed us- ing a laptop computer and ICS forms 202–206. Copies are made for each member of the management team and all branch directors and division/group supervisors.

The second day also dawns with the arrival of federal assistance. The Federal Bureau of Investigation has a full response team assigned to law enforcement operations. A National Guard team is assigned to the hazardous materials branch for detection and decontamination. Last, state police units are assigned to law enforcement operations for perimeter security.

FIGURE 5-4 demonstrates an overview of the IAP for an incident of this level. These pages include incident objectives and safety (ICS 202) and an incident medical plan (ICS 206).

57854_CH05_final.indd 6657854_CH05_final.indd 66 1/20/10 10:24:50 AM1/20/10 10:24:50 AM

F O S T E R , C E D R I C 1 6 9 2 T S

CHAPTER 5: Planning for Terrorism 67

FIGURE 5-4 Incident action plan overview example. INCIDENT OBJECTIVES 1. INCIDENT NAME

Denney City explosion

2. DATE PREPARED 3/1/2010

3. TIME PREPARED 05:37

4. OPERATIONAL PERIOD (DATE/TIME) 08:00 to 20:00

5. GENERAL CONTROL OBJECTIVES FOR THE INCIDENT (INCLUDE ALTERNATIVES) Scene control entry/exit Detailed secondary search Evidence recovery and preservation Chemical detection and decontamination Heavy rescue Equip and reopen trauma center

6. WEATHER FORECAST FOR OPERATIONAL PERIOD Heavy fog restricting visibility to 10:30 Wind light from 270 deg. 50% chance rain from 17:00 to 19:00

7. GENERAL/SAFETY MESSAGE Type of chemical(s) not confirmed in collapse area; treat entire area as hot zone. Full PPE required in hot zones Bio precautions for all divisions Possible nondetonated explosives; possible secondary devices Lightning in afternoon thunderstorms

8. ATTACHMENTS (X IF ATTACHED) • ORGANIZATION LIST (ICS 203) XXX INCIDENT MAPS (2) Safety Message XXX

• DIVISION ASSIGNMENT LIST (ICS 204) XXX TRAFFIC PLAN Homestead Map

• COMMUNICATIONS PLAN (ICS 205) XXX Air Operations Structural Fire Plan • Summary (ICS 220) XXX • MEDICAL PLAN (ICS 206) XXX

202 ICS 9. PREPARED BY (PLANNING SECTION CHIEF) James

10. APPROVED BY (INCIDENT COMMANDER) Colby

MEDICAL PLAN 1. INCIDENT NAME Denney City explosion

2. DATE PREPARED 3/1/2010

3. TIME PREPARED 06:30

4. OPERATIONAL PERIOD 08:00 to 20:00

5. INCIDENT MEDICAL AID STATIONS

MEDICAL AID STATIONS LOCATION

CONTACT THROUGH DISPATCH

PARAMEDICS

YES NO

Pratt treatment group 123 Pratt St. XXX

Center St. treatment group 704 Center St. XXX

(continues)

57854_CH05_final.indd 6757854_CH05_final.indd 67 1/20/10 10:24:50 AM1/20/10 10:24:50 AM

F O S T E R , C E D R I C 1 6 9 2 T S

68 Homeland Security: Principles and Practice of Terrorism Response

or federal and coordinated by a MACS. Critical logistics requires logistics caches (push logistics) that are quickly deployed to a scene.

An EOP also identifies an administration section and a planning section. The administration section includes a time unit, a procurement unit, and a compensation unit. The planning section consists of a resource unit, situa- tion unit, and mobilization/demobilization unit. An EOP is a reference tool, and not a tactical guide. Terrorism incidents are extremely dynamic where critical events change in seconds or minutes. In the fog of “combat,” the

incident commander develops an informal and verbal IAP. The informal plan should be followed by a formal IAP if the incident is significant and/or longer in duration than a quick-response incident.

A long-duration incident (longer than a day) requires a written IAP developed by the planning section chief in coordination with the incident commander and other sec- tion chiefs. The National Wildfire Coordinating Group has developed forms for the IAP. The forms serve as a checklist for organizing the event. All section groups and divisions are given a daily briefing along with copies of the IAP.

FIGURE 5-4 (Continued) 6. TRANSPORTATION

A. AMBULANCE SERVICES

NAME ADDRESS PHONE PARAMEDICS

YES NO

Denney City EMS/ mutual aid

Citywide 754 Main Ave. 555-2376 XXX

Johnson Co. EMS County-wide 117 Wilson St. 555-2311 XXX

B. INCIDENT AMBULANCES

NAME LOCATION PARAMEDICS

YES NO

Orange Co. 62, 64, 17, 28 Trauma center XXX

Denney City EMS 2, 4, 6, 9

Center St. XXX

Johnson Co. medic 4, 5, 8, 12

Hazardous materials operations—Center St. XXX

7. HOSPITAL NAME ADDRESS TRAVEL TIME (Hr)

PHONE HELIPAD BURN CENTER

AIR GRD YES NO YES NO

Sim City Trauma Center 123 Pratt St. N/A 1 555-2624 XXX

Baptist Hospital 2766 Mullen Dr. 10 30 555-4555 XXX

Mount Sinai 1749 125th Ave. 5 15 555-4002 XXX X

8. MEDICAL EMERGENCY PROCEDURES

All pediatric victims to Baptist; burn victims to Mount Sinai

All divisions have EMS coverage—requests for additional EMS medical branch directors

206 ICS 8/78

9. PREPARED BY (MEDICAL UNIT LEADER) Christen

10. REVIEWED BY (SAFETY OFFICER) Maniscalco

6. TRANSPORTATION

57854_CH05_final.indd 6857854_CH05_final.indd 68 1/20/10 10:24:50 AM1/20/10 10:24:50 AM

F O S T E R , C E D R I C 1 6 9 2 T S

Wrap Up Chapter Questions

1. Define the front-end concept of planning. 2. What are the key elements in the NIMS, and how

do they relate to planning? 3. What are the key elements in the NRF, and how

do they relate to planning? 4. Why is administration important in a long-dura-

tion terrorism incident? 5. What are the key steps in the implementation of

an EOP? 6. What are the key elements in an EOP? 7. What factors determine if an IAP is formal or in-

formal? 8. Define an IAP briefing cycle. What are the related

steps in the cycle?

Chapter Project I

Obtain an after-action report of a major incident in your community or state. Based on the incident report, de- velop an IAP for the incident by using ICS forms 202 and 206 (pages 8–10). Establish NIMS sections and use the branch/division concept.

Chapter Project II

You have been appointed as the emergency manager in your community. Your elation is short lived when you find out your first assignment is to develop an EOP. Develop a community EOP by observing the following principles:

• Obtain a realistic threat assessment or design a hypothetical threat assessment.

• Identify key operations agencies. • Determine who will be the incident manager in

various types of incidents.

• Identify resource entities at a local and regional level.

• Identify sources of support personnel and sup- port agencies.

Vital Vocabulary

Emergency operations plan (EOP) A comprehensive interagency and interdisciplinary plan identifying the key elements of the terrorism response continuum using the NIMS and NRF as templates.

Front-end plan Planning for anticipated incidents rather than waiting for an incident to occur before de- veloping a plan.

Incident action plan (IAP) A plan that contains objec- tives that reflect the incident strategy and specific control actions for the current or next operational period. An IAP is verbal in the early stages of an incident.

Multiagency coordination system (MACS) A sys- tem of coordinated entities and off-scene resource processes organized as a full-scale logistics system to support the resource requirements of single or mul- tiple incidents in a local area or region. Entities in the MACS include government agencies, nongovernment agencies, volunteer organizations, and private-sector resources.

Networking A process (formal and informal) of col- laboration and relationship building leading to trust and mutual support between individuals, agencies, and organizations.

Planning briefing cycle An 8-, 12-, or 24-hour cycle encompassing the development of the IAP and the con- duct of an IAP briefing by the planning section chief in collaboration with the incident commander.

Resilience The organizational elasticity to bounce back or recover from unexpected events.

57854_CH05_final.indd 6957854_CH05_final.indd 69 1/20/10 10:24:51 AM1/20/10 10:24:51 AM

F O S T E R , C E D R I C 1 6 9 2 T S

57854_CH05_final.indd 7057854_CH05_final.indd 70 1/20/10 10:24:52 AM1/20/10 10:24:52 AM

F O S T E R , C E D R I C 1 6 9 2 T S

Terrorism Response Procedures Hank T. Christen Paul M. Maniscalco

• Define convergent responders and discuss how convergent responder agencies relate to first responders.

• Discuss the critical importance of scene awareness in a dynamic terrorism incident.

• List and describe the on-scene complications present in a terrorism incident.

• List the responsibilities of the first arriving unit in a terrorism incident.

• Define the principles of 2 in 2 out and lookout, awareness, communications, escape, and safety.

• Outline the key elements in a terrorism response protocol.

• Outline critical hospital response issues.

Objectives

57854_CH06_final.indd 7157854_CH06_final.indd 71 1/20/10 10:25:37 AM1/20/10 10:25:37 AM

F O S T E R , C E D R I C 1 6 9 2 T S

72 Homeland Security: Principles and Practice of Terrorism Response

Introduction

Response to an emergency is a routine function of public safety agencies. Thousands of times each day around the world, EMS, fire, rescue, and law enforcement agencies respond and effectively handle a myriad of incidents. However, no terrorism incident is an average or ordinary incident. Initial responders are confronted with unfa- miliar, unpredictable, and unsafe scenes. There is often a combined mass casualty incident, rescue, hazardous materials incident, and crime scene scenario. No matter how global an incident becomes, it starts with conver- gent responders trying to assist (more on this in later paragraphs) and first responders being overwhelmed upon arrival at the scene.

While many emergency scenarios share some similar characteristics and response demands, none are routine, and all pose complex and confusing environments for the arriving emergency responders. Consider the follow- ing cases of terrorism incidents:

• Virginia Tech University (2007)—A single student shot and killed 31 students and teach- ers and wounded 17 others at multiple loca- tions on the Virginia Tech campus.

• Mumbai, India (2008)—A planned and coor- dinated attack by at least nine Islamic extrem- ist gunmen killed a total of 164 people and injured 308 people. The attack took place in at least ten locations and involved a combina- tion of automatic weapons, hand grenades, and bombs. A major fire was set at the Taj Mahal hotel during the attack. The terrorists were eventually killed by Indian security forces. Similar attacks on Pakistani police stations oc- curred in 2009.

• Geneva, Alabama (2009)—A lone, heavily armed gunman attacked his family and co- workers in four separate locations in southeast- ern Alabama before killing himself. He began by killing his mother and setting her house on fire. There was a total of 11 dead, including a small child.

• Oakland, California and Pittsburgh, Pennsylvania (2009)—Within a 10-day period, four police officers were killed in Oakland and three police officers were killed in Pittsburgh. Both cases involved a single gunman.

• Binghamton, New York (2009)—A heavily armed gunman entered the American Civic Association where foreign immigrants were taking were taking a test for U.S. citizenship.

He killed 13 people before turning a gun on himself. Four people were wounded. No emer- gency responders were injured.

• Fort Hood, Texas (2009)—A single gunman with an automatic handgun opened fire on U.S. Army soldiers and civilians at a process- ing facility for personnel deploying to Iraq. Thirteen people were killed and 29 people were wounded. The alleged perpetrator, an army psychiatrist, was engaged by police officers and seriously wounded.

ABC News reported that there have been 50 mass shootings in the United States in a time period from the Virginia Tech incident to the mass killings in Binghamton. Collectively, these incidents share certain common de- nominators. Entire communities were terrorized. In each incident, local emergency response resources were se- verely stressed and initially overwhelmed. Law enforce- ment officers were killed or wounded in several cases. The initial response was quickly followed by intense na- tional media exposure. The Mumbai incident was terror- ism related because of the political nature of the attacks. In the other cases, individuals had differing motives, but used extreme violence to accomplish their goals. Ultimately, in each case, fire, emergency medical, and law enforcement agencies needed a robust emergency response plan and effective incident command system (ICS) to manage the incidents successfully.

First responders manage an incident for hours or possibly a day before state and federal resources arrive to support the local effort. Reliance upon state or federal assets as initial responders is unwise because regional, state, and federal resources often have extended response times. The time it takes for these resources to arrive at most emergencies creates a vast disadvantage that may result in great detriment to the responders, victims, and the community. Clearly, it is in the best interests of policy officials and emergency planners to ensure that local personnel and jurisdictions are capable of mount- ing an effective and sustainable response to high-impact/ high-yield incidents.

Convergent Responders

Convergent responders are citizens or workers from nonemergency agencies who witness a terrorism incident and converge on the scene. In most incidents, convergent responders arrive first because attacks usually occur in a public setting where private citizens witness the incident, call 911, and take some form of action. In the cases previ- ously discussed, convergent responders played a role in

57854_CH06_final.indd 7257854_CH06_final.indd 72 1/20/10 10:25:41 AM1/20/10 10:25:41 AM

F O S T E R , C E D R I C 1 6 9 2 T S

CHAPTER 6: Terrorism Response Procedures 73

the outcomes. Fire, EMS, and law enforcement officers are known as first responders, but they almost never ar- rive first; convergent responders usually arrive first, and first responders usually arrive second.

Many response professionals perceive convergent responders in a negative light. Convergent responders are viewed as undisciplined and in the way. This percep- tion is often inaccurate. In many disaster and terrorism incidents, video footage shows convergent responders digging victims out of rubble, manning hose lines, or rendering first aid to victims (FIGURE 6-1). Convergent responders are the people who call 911 to report a ter- rorism incident and provide vital incident information to the 911 operator or dispatcher. This information is often conflicting and sometimes hysterical, but multiple calls paint an initial picture that is important for determining the nature of an incident and the level of response.

Realistically, convergent responders can become victims and create a crowd, and they may hinder initial response efforts. On the surface, it appears that the good and the bad aspects of convergent responders are beyond control. This is not the case. First responder agencies are often unaware that many convergent responders are from organized and disciplined entities. At any moment, a local street may have potential convergent agencies, companies, or individuals performing work assignments. These organizations include:

1. Utility crews such as power, gas, telephone, and cable crews

2. Postal workers and express delivery services (like FedEx or UPS) workers

3. Meter readers and inspectors

4. Transit authority, school bus and taxi drivers 5. Public works crews 6. Social workers or probation officers 7. Private security agents 8. Real estate agents 9. Crime watch and neighborhood watch volunteers

Many of these people are in radio-equipped vehi- cles or have cellular telephones and provide early and accurate reports of a suspicious scene or a terrorism incident in progress. Festivals, events, and public as- sembly buildings have security guards, ushers, ticket takers, and concession workers who are employees of formal organizations.

With training, convergent agencies are a positive ini- tial response component. The level of training is similar to the hazardous materials awareness model. Members of convergent agencies are exposed to basic awareness material in the following subject areas:

• A brief overview of terrorism history and local threats

• Recognition of potential threats such as suspi- cious people, weapons, or devices

• Procedures for reporting an incident and the critical information needed by 911 communi- cations

• Safe scene control and personal safety • Basic first aid techniques While it may not be practical to conduct awareness

training for most of the public, adoption of the com- munity emergency response team (CERT) initiative and online NIMS training is a mechanism to acquaint members of the community with an awareness of emer- gency actions and their roles at an incident.

It is feasible to identify agencies that are possible convergent responders, solicit their participation, and assist them with basic awareness training. This con- cept is similar to CERT programs or law enforcement agency training programs for developing volunteer crime/neighborhood watch organizations. Convergent responders are a viable force that the emergency ser- vice community needs to collaborate with because convergent responders usually arrive at an emergency incident first.

Scene Awareness

A terrorism incident is a dynamic and unstable scene. The area is a hot zone that may include chemical/bio- logical/radiological hazards, individuals firing weapons (on both sides), explosive devices, secondary devices or booby traps, fires, collapsed structures, and multiple

FIGURE 6-1 Arlington, Va. (September 11, 2001): Medical personnel and convergent responders work the first medical triage area set up outside the Pentagon after a hijacked commercial airliner crashed into the south- west corner of the building.

57854_CH06_final.indd 7357854_CH06_final.indd 73 1/20/10 10:25:42 AM1/20/10 10:25:42 AM

F O S T E R , C E D R I C 1 6 9 2 T S

74 Homeland Security: Principles and Practice of Terrorism Response

injured victims screaming for assistance. Timewise, first responders arrive when the incident is starting (stum- bling into a minefield), when it is already over (some- times responders are lucky), or somewhere in between (usually the case).

Scene awareness principles begin before the re- sponse to any incident (routine or terrorism). Familiarity with the neighborhood, the surroundings, and the vio- lence history of the area is important. Does the area have a gang history? Are special events being held? Is the stadium full or empty? Is there recent unrest such as political protests or union/labor issues? Are special religious ceremonies being held? These questions only scratch the surface of information that response agencies must consider before the 911 call. In fact, this type of information (intelligence) should be obtained pre-event if possible and incorporated into an organization’s intel- ligence fusion and preincident response plans.

During an emergency response, scene awareness is critical because terrorism 911 calls seldom provide ac- curate descriptions of incidents. An incident dispatched as a single shooting might evolve into a mass shooting with automatic weapons. A suspicious package report can become a pipe bomb explosion, and a report of respiratory distress at a stadium evolves into a chemical release with contamination and mass casualties.

While en route, responders should consider the possibility that the scene is far worse than the initial information. Key preresponse knowledge must be mentally replayed. For example, when responding to a high-profile facility for an unknown medical situ- ation, responders should expect more than a simple medical patient. Radio traffic must be closely monitored because responders cannot afford to miss additional information about scene conditions. Local protocol must emphasize that new information be immediately forwarded to all responding units. Radio traffic from convergent responder agencies and other emergency response agencies is critical. Weather information, es- pecially speed and direction, is also important.

When responders get close enough for the scene to appear in the distance, they need to carefully scan the landscape, especially the entire scene periphery (this is limited at night or in bad weather). This process is called a windshield survey. Likewise, on arrival, respond- ers have a tendency to get tunnel vision. Tunnel vision means that responders have a tendency to concentrate on their area of responsibility. For example, EMS focuses on victims, firefighters focus on fires, and law enforcement officers focus on a crime scene. These are habits based on years of practice that are detrimental in a complex

terrorism incident. Responders need to force them- selves to look around the incident. If threats are seen or suspected, responders should stop or possibly retreat. Experience and intuition should always be trusted.

Staging is another important protection posture for high-hazard incident scenes. Staging means that nones- sential and support units stand by in a nearby safe zone awaiting further orders or assignments. In the ICS, the staging area is managed by a staging officer who tracks staged resources and coordinates unit assignments with the incident commander. The staging concept enhances scene safety because staging ensures minimal exposure to units that are not operating in the high-hazard zone.

Responders are especially vulnerable when exiting vehicles. For example, Fire Fighter Ryan Hummert of the Maplewood Fire Department (St. Louis County, Missouri) was shot and killed in 2008 when exiting his apparatus for a vehicle fire. A sniper also wounded two police officers before taking his own life. Step one for responders is to look for indications of an unsafe scene. This initial scene survey includes looking up, down, and around the periphery of the scene. Responders should look for any indication of people with weapons, explo- sive devices, or evidence of a chemical agent. Bodies or unconscious victims may unfortunately indicate a hot zone where entry requires appropriate personal protec- tive equipment.

The Occupational Safety and Health Administration (OSHA) has established guidelines for the structural fire service that are referred to as 2 in 2 out. These guidelines specify that two members should enter a fire hot zone, remain in personal contact, and exit together. Two oth- ers remain outside for backup purposes. This principle is similar to the buddy principle that children are taught in swimming lessons. The 2 in 2 out principle is a rule that applies to all first responders (EMS, fire, and law enforcement) in a terrorism incident when the scene is unstable. Responders must work in teams.

Another effective scene principle is one adopted from the wildland fire community and suggested for terrorism by retired Assistant Chief Phil Chovan of the Marietta, Georgia, fire and rescue department. The principle is called lookout, awareness, communica- tions, escape, and safety (LACES) (FIGURE 6-2). These

Responders should not become blinded by tunnel vi- sion. They should survey the entire scene, including the area above them, for threats to their safety.

57854_CH06_final.indd 7457854_CH06_final.indd 74 1/20/10 10:25:42 AM1/20/10 10:25:42 AM

F O S T E R , C E D R I C 1 6 9 2 T S

CHAPTER 6: Terrorism Response Procedures 75

principles were developed from hard-learned lessons when wildland fires made sudden and unexpected changes in direction and/or intensity and trapped fire suppression crews. The same scene dynamics occur in a terrorism hot zone; especially when there is a chemical agent or automatic weapons fire.

L—Lookout: Someone is responsible for watch- ing the overall scene from a safe distance and warning crews of danger.

A—Awareness: All members on the scene have situational awareness and are ready for dynamic changes and unpleasant surprises.

C—Communications: Exposed crews must have effective communications including direct voice or hand signals as well as portable radios.

E—Escape: Those on any unstable scene should plan an escape route and an alternate route.

S—Safety zones: Crews should escape to a safe area that provides distance, shielding, and/or up- wind protection.

Consider a mass-shooting example where a 911 caller describes shots fired with one possible victim in a warehouse. A first EMS unit finds a single victim by the doorway. A law enforcement unit declares the scene secured. A second EMS unit and engine company arrives and enters a large open floor space and finds six victims. The scene is quiet but does not look or feel right. Fire

fighters begin searching in pairs using the 2 in 2 out principle. An EMS commander arrives and places him- self as a lookout watching the street and the crime scene. Crews in the area look around the periphery and above (awareness). The lookout suddenly spots three men with weapons moving on the far side of the building. He broadcasts an evacuation message (communications) to the fire and medical crews who run along an escape route and retreat behind an industrial trash container (escape and safety). Heavy gunfire breaks out, but responders are safe because they used the LACES principle.

Active Shooter Response

On April 20, 1999, at Columbine High School near Littleton, Colorado, fourteen students were killed and twenty-one injured over a period of 22 minutes by two disturbed active shooters. It was a massacre that on- scene officers will never forget. It was also a wake-up call.

Before the Columbine shootings, law enforce- ment tactics dictated that responding officers protect the perimeter and wait for special weapons and tactics (SWAT) units instead of tactically engaging a shooter. This was sound wisdom in the pre-Columbine era because shooters almost always barricaded themselves with (or without) hostages and sometimes committed suicide. It made sense to wait for a SWAT unit and a negotiator to respond because they had the weapons, training, and protective equipment to ensure a suc- cessful outcome.

The Columbine situation was different. The shoot- ers intended to die, not negotiate. They moved from one area to another, randomly shooting victims of op- portunity. This pattern was repeated in other workplace shootings, a shopping center in Salt Lake City, Utah, and in university shootings including Virginia Tech and Northern Illinois University.

There were common threads in each of these cases. First, the incidents were well planned. The shooters were familiar with the layout of their crime scene. Second, they were well armed with handguns, assault rifles, shotguns, and in some cases explosives or incendiary devices. They carried extra ammunition and frequently reloaded. Last, they were shot by officers or committed suicide. Negotiations were not part of their plan. Today’s active shooter response procedures are based on quick action by whatever group of law enforcement officers ini- tially arrives. An effective active shooter policy requires a minimum of four officers to aggressively enter a building or structure with the intent of engaging an active shooter or shooters. In some agencies, a team of two or three

FIGURE 6-2 The LACES principle—Exposed crews must have effective communications, including direct hand signals such as holding hands in the air to signal that the responder is okay.

57854_CH06_final.indd 7557854_CH06_final.indd 75 1/20/10 10:25:44 AM1/20/10 10:25:44 AM

F O S T E R , C E D R I C 1 6 9 2 T S

76 Homeland Security: Principles and Practice of Terrorism Response

officers can choose to engage a shooter. The primary ob- jective is to save lives by neutralizing the shooter.

An active shooter response team uses a diamond- type formation consisting of a point officer, two utility officers, and a rear guard officer. Each officer has a des- ignated function. The point officer is responsible for the front of the team. Utility officers offer side protection as unsecured areas are approached, and the rear officer protects the team from a rear attack.

An active shooter response team does not con- duct a thorough search. The objective is to accomplish a primary sweep to locate victims and the shooter. In long-duration incidents, a coordinated search is necessary, but this is not an objective in the early re- sponse stage.

An equally significant objective is clearing the im- mediate area for rescue and medical treatment by fire/ rescue and EMS units. Rescue and medical personnel do not have the training, weapons, or protective equipment to function in an uncleared area. It is essential that areas are cleared quickly to save lives.

The foundation of the active shooter response phi- losophy is quick and coordinated engagement instead of waiting for SWAT units. A rapidly assembled strike team must engage active shooters to save lives. Because active shooter incidents result in mass casualties, it is impor- tant to coordinate response actions with fire/rescue and EMS agencies.

The law enforcement incident command system (LEICS) provides a framework for managing and sup- porting active shooter incidents. Essential LEICS func- tions are organized using the ICS template and include command, a law enforcement operations section, a safety officer, and fire/EMS branches. Planning and logistics functions are established and expanded based on the needs and requirements of the incident. Further discus- sion of LEICS is beyond the scope of this text.

New Scenes—New Surprises

Twenty-first-century terrorism scenes offer new prob- lems previously unseen by civilian responders. It is important to understand that first responders are not heroes to everyone. In fact, the purpose of an incident or attack may be to harm the emergency response troops.

Remember that any terrorism incident is a high- impact incident, which means there is a detrimental effect on a community’s ability to deliver other 911 services. If possible, public safety managers should uti- lize the military principle of uncommitted reserves for

911 services and/or other terrorism incidents. In small communities, this principle requires early initiation of mutual aid resources and support. In summary, these managers must be prepared for diversions; there’s no rule against having two simultaneous terrorism inci- dents occur on a very bad day.

Another trend is tactical ultraviolence. Terrorists, criminals, political militias, and street gangs carry the latest automatic weapons and wear body armor. Often law enforcement officers are outgunned. Responders are threatened by projectiles and fragmentation from con- crete, glass, wood, and metals. There is also a danger of fire and EMS teams being caught in a crossfire between law enforcement officers and perpetrators.

The best defense is to avoid entering a ballistic hot zone by observing the scene awareness principles. The only protections for exposure to shooting are distance, concealment, and shielding. Concealment is the act of hiding to prevent detection. Shielding is the use of solid objects that cannot be penetrated by projectiles or explo- sive fragments. In most cases, vehicles are not effective for shielding. Although law enforcement officers might require body armor for shielding, fire and EMS respond- ers who are in an area requiring body armor are in the wrong place.

Along with bombings and shootings, consider the brutal reality of a chemical/biological/radiological (CBR) hot zone. Biological mass casualties on a single scene are unlikely because biological effects take days or weeks to manifest themselves. Victims with bio- logical ailments will be dispersed throughout a region, state, or the nation. Chemical attacks and radiological weapons are another story. First, the dispatch infor- mation is unlikely to paint a clear picture. The inci- dent may begin with a report of a single victim having respiratory distress in a mass crowd venue such as a stadium, auditorium, or airport. Second, the usual indicators of a hazardous materials incident may not be present. The location might be benign of hazardous materials storage or transportation facilities and not have identifiable containers, placards, material safety data sheets, or shipping papers. First responders may not immediately recognize a chemical incident, and it could take hours before chemical agents are positively identified.

First responders must look for indicators and re- member several important points, including:

1. Suspect a chemical agent in cases with several nontrauma victims with similar symptoms.

2. Check for multiple victims scattered throughout a crowd or facility.

57854_CH06_final.indd 7657854_CH06_final.indd 76 1/20/10 10:25:45 AM1/20/10 10:25:45 AM

F O S T E R , C E D R I C 1 6 9 2 T S

CHAPTER 6: Terrorism Response Procedures 77

3. Look for convergent responders who are symp- tomatic; beware of direct exposure or transfer of mechanism of injury from victims to responders.

4. If odors are noticed, responders must don breath- ing equipment and protective ensembles imme- diately.

5. In extreme cases, bodies may indicate a hot zone.

6. Radio traffic from other units is a key information source.

7. Establish a hot zone fast; remove walking victims. 8. Call for special teams quickly; control hot zone

entry. 9. Set up a decontamination area for mass casualty

victims. Scene awareness in a chemical attack saves the lives

of responders and victims. First responders must survey the scene, establish a hot zone, and observe safe hot zone entry principles. In all terrorism incidents, prepared- ness begins before arrival. Responders must use their senses and suspect anything that does not sound, look, or feel right. Use the safety principles of 2 in 2 out and LACES. Lastly, remember that the purpose of the inci- dent may be to kill or injure first responders.

The First Arriving Unit

The first arriving unit has a drastic effect (positive or negative) on the progress of the incident because scene management and incident command builds from the bottom up. This means the first arriving unit is the in- cident commander and is responsible for operations, logistics, and planning. Obviously, this is an impossible task without prioritization.

Getting help is the first priority. This process be- gins by making a quick scene survey and giving a radio report. The initial report involves taking command and describing the incident such as mass shooting victims or multiple nontrauma victims. A call for a number of people having food poisoning at the local food court could be a chemical incident. The first arriving unit must ensure that an initial report is acknowledged by dispatchers before taking further action.

Initial units should try to determine the scope of the hot zone, an approximate number of victims, and a mechanism of injury by questioning convergent re- sponders or victims. It is critically important to transmit scene threats over the dispatch radio system and ensure that dispatchers relay this information to other units and agencies. Critical threat information includes:

1. Shooters on the scene or perpetrators with weapons

2. Suspicious device(s) 3. A possible CBR hot zone

As help arrives, the first arriving unit assigns operations actions. Command is relinquished by the first arriving unit when a senior officer, supervisor, or manager arrives. This process is done on a face- to-face basis and announced over the dispatch radio channel.

The following example demonstrates the responsi- bilities of the first arriving unit:

CASE STUDY 1

A call is dispatched for respiratory difficulty at a religious institution during worship services. Rescue 7 ar- rives at the front entrance. The first thing they see before even entering the building is that there are two victims on the building steps; they are experiencing respiratory difficulty with no apparent trauma. Several convergent responders are removing other victims from the building and everyone is coughing.

The unit transmits the following report: “Rescue 7 has 58th Street command; we have multiple respiratory victims; send two additional rescues and a chief officer; command post is in front of 5530 58th Street.”

The Rescue 7 paramedic sends her EMT partner into the building to begin triage and obtain a victim count. The EMT stops at the doorway after discovering at least ten victims inside gasping for breath. The building interior is too hot to enter.

The paramedic orders the EMT out of the area and transmits the following report: “58th Street Command, emergency traffic; we have at least ten respiratory victims in the building. Declaring a hot zone in the interior and front entrance for unknown chemical agent; request a full first-alarm fire response and the hazardous materials team; request law enforcement for scene control; notify emergency management.”

Proper actions by the first responding units are critical for an effective outcome.

57854_CH06_final.indd 7757854_CH06_final.indd 77 1/20/10 10:25:45 AM1/20/10 10:25:45 AM

F O S T E R , C E D R I C 1 6 9 2 T S

78 Homeland Security: Principles and Practice of Terrorism Response

Scene Control

In any emergency incident, scene control is a difficult issue. Terrorism incidents present new and challeng- ing scene control problems. The objective of scene control is to establish a secure perimeter around the scene/hot zone for the purpose of controlling entry and exit from the incident area (FIGURE 6-3). Entry control prevents civilians or media from converging on the area. Effective scene control also establishes entry/exit points where personnel and units are logged in/out for accountability purposes. Unfortunately, terrorism hot zones are very dynamic (the scene can grow in many directions). Shooters on the move or rooftop snipers expand an incident by several blocks. The discovery of an unexploded device or a secondary device requires an evacuation area of 1,000 feet or more in every direction including up and maybe down.

Preventing victims from leaving the hot zone is a new scene control issue unfamiliar to most respond- ers. In a CBR incident, it is important to keep victims in an evacuation area to prevent contaminated vic- tims from spreading the mechanism of injury. When victims leave in many different directions, they con- taminate vehicles, people, and buildings (FIGURE 6-4). In urban areas, commuters board trains or return home in their cars, only to later present at suburban emer- gency rooms.

The solution to this problem is difficult. First, there is no corporate memory of a large civilian CBR incident. However, if large-scale industrial accidents are indicators, there will be great difficulty in control-

ling victim exits. Many victims will leave before first responders arrive, especially if untrained convergent responders are eager to transport them. Other victims will heed warnings to stay in place, but later grow impatient while waiting for decontamination. Lastly, some victims will resist the indignity of stripping down to their underwear to have themselves and their loved ones scrubbed by men or women in hazardous ma- terials suits.

Responders should realize that many victims will initially leave the scene. This is why it is crucial for medical facilities to have an aggressive decontamination plan. Secondary victims have to be decontaminated as dictated by practicality. In most cases (not all), basic steps of clothing removal and washdown, done quickly, will suffice. Responders who lose control should at least settle for the clothing removal. Some alarmists raise the issue of using force to contain grossly contaminated victims to prevent further injury to rescuers or civil- ians. In reality, such force is not acceptable because the officers exerting the force must be fully suited for protection from the victims (this is an opinion based on educated guesses and a few case histories). The Tokyo sarin gas attack was an incident in which victims were not effectively confined. The victims scattered from the hot zone, unknowingly transmitted the mechanism to emergency responders, and in some cases contami- nated medical facilities.

The following example demonstrates some practical scene control issues:

FIGURE 6-3 Isolating the hot zone is a vital step in gaining control of an incident.

FIGURE 6-4 Victims leave incidents in many different directions and en- danger effective scene control.

57854_CH06_final.indd 7857854_CH06_final.indd 78 1/20/10 10:25:47 AM1/20/10 10:25:47 AM

F O S T E R , C E D R I C 1 6 9 2 T S

CHAPTER 6: Terrorism Response Procedures 79

CASE STUDY 2

A crime syndicate plans a multimillion-dollar armored car robbery. To create a diversion, a street gang is subcontracted to explode a chlorine tank car on a downtown railroad siding. At 12:07 p.m. on a blustery November Tuesday, the tank car has a violent pressure rupture caused by 2 pounds of strategically placed plastic explosives.

Ten people are killed almost immediately. Within minutes, 160 people are injured from acute chlorine exposure. Thirty convergent responders and three police officers approach the scene and are immediately overcome by chlorine gas.

The incident generates an immediate second-alarm fire response and the arrival of two EMS units. Units approaching from the north see a large green fog accumulating in the low-lying area around ground zero. A chlorine cloud is seen drifting south. Units approaching from the south begin driving into the chlorine cloud and have to divert their response.

Mass casualties are reported including bodies. Many victims are staggering in all directions from the scene. Some victims are leaving in taxis and private vehicles. Victims receiving minimal exposure are moving farther away or going back to their offices. Scene Control Procedures

• There is a dynamic hot zone at ground zero that is moving south.

• Victims are diverted to three staging areas (west, north, east) for decontamination and medical treatment.

• An evacuation is conducted south of the incident. Scene Control Issues

• Many victims exit before scene control is established. Within 10 minutes, the two nearest hospitals are inundated with contaminated victims arriving in private vehicles.

• In spite of a heavy chlorine odor, media, bystanders, and friends or relatives of the victims begin trying to enter the victim treatment areas.

• Because of a slow decontamination process, many walking wounded victims are becoming adamant about leaving to go home or get personal medical care from their private physicians.

• Within 1 hour, multiple 911 calls are being received for victims in offices, transit stations, and residences.

• For the next 48 hours, reports are continually received about patients presenting at suburban emer- gency rooms as far as 50 miles from the incident.

• The scene requires entry by hundreds of EMS, fire, and law enforcement responders.

• CNN breaks the story, opening the floodgates for every conceivable type of media response. Media pressure to get closer and closer to ground zero escalates.

Scene Control Solutions

• Hospitals throughout the region are alerted. The importance of decontamination before admission is stressed.

• On-site monitoring is used to determine the extent of the hot zone. The perimeter is reduced accordingly.

• A law enforcement perimeter is established in the crime area. All evidence is properly preserved, photographed, cataloged, and removed.

• Scene entry points are established for public safety personnel to control warm zone and hot zone access. A local personnel accountability system is effectively utilized.

• All receiving hospitals initiate entry control procedures. Contaminated vehicles are diverted to a remote and secured parking lot (not the emergency room [ER] driveway). Arriving victims are diverted to a de- contamination area outside the building for clothing removal and initial wash-down. No victim is permit- ted entry into any hospital area without being decontaminated.

• Calls to 911 from outside the incident area are handled by a beefed-up response force of mutual aid units and recall personnel. Records from all chlorine exposure victims are separately maintained for inclusion into a final after-action report. All cases are also reported to law enforcement for future investigation.

• The media is instructed to establish a media pool. The media pool is given a closely supervised, escorted tour of areas cleared by the safety officer and law enforcement.

57854_CH06_final.indd 7957854_CH06_final.indd 79 1/20/10 10:25:47 AM1/20/10 10:25:47 AM

F O S T E R , C E D R I C 1 6 9 2 T S

80 Homeland Security: Principles and Practice of Terrorism Response

Effective control of an incident perimeter places a high drain on law enforcement resources. Consider con- trolling a chemical hot zone encompassing a four-square- block area. This hypothetical area requires an officer at every intersection, which is a minimum of eight units for control. To place a unit halfway down each block on the perimeter requires sixteen law enforcement units. This is a commitment of resources that severely taxes even the largest urban police or sheriff’s department.

Another issue is maintaining law enforcement re- sponse times for 911 services unrelated to the major incident. A third consideration is that many units are engaged within the perimeter in a mass shooting or bombing scenario.

Major terrorism incidents requiring perimeter security are high-impact law enforcement incidents. Effective sealing of a large urban area is very difficult and resource intensive under the best of circumstances. If possible, the scene area should be reduced as soon as practical. In the previous example, if the four-square- block area was reduced to two square blocks, the num- ber of perimeter control units are reduced from eight to six units.

Wind change is an uncontrollable factor in a chem- ical incident. A 90-degree wind change or a change in wind speed that optimizes a chemical plume footprint greatly changes the size and/or location of the hot zone. Sudden changes make effective perimeter control im- possible in the short term because of a shifting and dynamic perimeter. Such changes require altering the evacuation zone—a step that cannot be done well on the run.

The last significant factor is public reaction—the CNN factor. A media evacuation announcement often draws people to an area. These people are not the help- ful convergent responders discussed earlier. Civilians attempting to enter an evacuated area include bystand- ers, photographers, residents, and parents entering an area to retrieve their children. This situation is universal; onlookers and parents will always present scene control problems.

Response Training

The emergency responder survival skills required for living through a terrorism incident require develop- ment and training. The most important component is the implementation and daily use of NIMS. The ICS component within NIMS must be the gold standard for the activities of response and support agencies (see Chapter 2).

All agency members, including nonresponders, must be trained in basic NIMS as a starter. The NIMS must pervade all areas of agency operations, not just emergen- cies. Daily business should be conducted using NIMS forms and jargon. These actions result in NIMS and ICS becoming an organizational way of life. For example, agencies can use the ICS boilerplate for meeting agendas. Agenda items are listed under four columns entitled op- erations, logistics, planning, and administration. Weekly or biweekly plans are distributed using the official ICS incident action plan form. It is important to use ICS every day in all facets of an agency to ensure that when emergencies, disasters, or terrorism incidents unfold, responders will know how to effectively operate.

Convergent responder awareness is another impor- tant training objective. Trained convergent responders provide valuable crisis management information (intel- ligence) and early assistance in the response effort. The first step in convergent responder training is identifica- tion of relevant government agencies and utilities, with private businesses identified on a separate list. The next step is to provide training for employees of government agencies and solicit cooperation from utilities and private businesses.

Using a traditional brick and mortar classroom to train a myriad of agencies in a convergent responder program is time consuming and expensive for all par- ties. Virtual training is one solution. Using the Internet, e-mail, online social networks, and teleconference call- ing, information and basic awareness programs can be disseminated to any organization. Virtual technology is also useful to monitor certification and new employee orientation. By effectively using educational technol- ogy, response agencies become a training source with minimal expenditure of personnel. Private businesses can determine when to utilize the material and sched- ule employee awareness sessions. At the least, response agencies should provide a convergent responder training video supplemented by handouts or virtual files.

For major high-threat events, specialized conver- gent responder awareness training should be conducted for security guards, staffers, ushers, maintenance per- sonnel, concession workers, tour guides, and others. This includes events such as major religious activities, political conventions, presidential visits, political issue rallies (pro-life, pro-choice, animal rights, etc.), and major sporting events. Before the 1996 Olympics, thou- sands of Atlanta workers received terrorism awareness training. Such a program is time consuming and ex- pensive, but a single truck driver reporting a suspicious incident can prevent an attack plan from becoming a tragic incident.

57854_CH06_final.indd 8057854_CH06_final.indd 80 1/20/10 10:25:48 AM1/20/10 10:25:48 AM

F O S T E R , C E D R I C 1 6 9 2 T S

CHAPTER 6: Terrorism Response Procedures 81

Special response teams have national standards and training certification levels that must be maintained. This sounds like a given, but in some locales, special team activity is infrequent and the specialists lose their edge. These teams, including SWAT units, SWAT medics, search and rescue teams, and hazardous materials teams, also need terrorism awareness programs.

All emergency responders must be trained in scene awareness. The principles of 2 in 2 out and LACES should be in a written protocol and part of a scene awareness program. All terrorism incidents, especially the small ones, should be reviewed for scene awareness issues. An effective postincident analysis is also a good training aid.

Medical Facility Response

A terrorism incident requires medical facilities to alter their general mode of operation and support the medi- cal demands of the incident. Granted, hospitals do not respond by driving to a scene, but they do respond by preparing for unusual patients in mass numbers.

The initial element in hospital preparation that drives the rest of the hospital response system is com- munications. Medical receiving facilities must be alerted early in the incident chain via the same process used in standard mass casualty procedures. Early warning gives facilities time to prepare for a patient onslaught. Information about the type of incident and numbers of victims is critical. For example, ten mass shooting vic- tims, thirteen bombing victims, or twenty chemical at- tack victims all trigger different preparedness actions.

Communications are assured (or have a high poten- tial for success) through the use of correct protocol and technology. Local protocol must specify that terrorism incidents initiate immediate notification of appropriate receiving facilities. Medical facilities must be in the re- ceiving loop when EMS crews transmit scene informa- tion (FIGURE 6-5).

A protocol for hospital communications must re- quire feedback from critical medical facilities. In many systems, EMS and/or fire communications are moni- tored in the ER. There are many reasons why initial information about a terrorism incident may not be heard on a busy night. One-way monitoring is not reliable. Protocols should require that medical receiv- ing facilities acknowledge receiving notification of an unusual incident.

Medical facilities should have several layers of tech- nology to ensure receipt of communications. There must be auxiliary power and backup systems to compensate

for the failure of private systems and electrical power. At the least, a secondary system must back up the tele- phone system.

Hospital security is a key nonmedical element in hospital response procedures. Workplace violence and gang-related mass shootings sometimes migrate from the scene to the ER. The number one cause of work- place death for physicians and nurses is gun violence. Assailants in several case histories have gone to the ER attempting to finish off their victims.

Hospital security should be immediately alerted when mass shooting victims are being transported to the facility. Armed officers should secure entry to the ER and related treatment areas.

Contaminated victims en route to an ER require a different type of security plan. Security officers should initiate a complete medical facility lockdown. Every effort must be made to protect the facility from con- taminated victims bypassing decontamination pro- cedures. Erik Auf der Heide, in his book, Disaster Response, noted that in mass casualty incidents, over 50 percent of the victims arrived at the hospital in private vehicles or by other means. Hospital personnel cannot expect all chemically exposed victims to arrive via EMS in a clean condition.

If the decontamination area is separate from the ER entrance, security officers must direct arriving vehicles (EMS and private cars) to the decontamination cor- ridor. In any terrorism incident, the CNN factor goes into hyperdrive. Victims’ friends and relatives follow the

FIGURE 6-5 First responders should provide hospital facilities with initial information about a terrorism incident.

Victims may also present at physician offices or emer- gency care centers hours or days later.

57854_CH06_final.indd 8157854_CH06_final.indd 81 1/20/10 10:25:48 AM1/20/10 10:25:48 AM

F O S T E R , C E D R I C 1 6 9 2 T S

82 Homeland Security: Principles and Practice of Terrorism Response

media swarm. Both situations require security control. All private vehicles are assumed to be contaminated and must be diverted from driveways to a vehicle stag- ing area. The vehicles are decontaminated later after victim removal.

Unfortunately, some hospitals use contract security officers who are not permanently assigned to the facil- ity. An officer assigned to a hospital one day may have been at a park on the previous day. This is especially true on weekends. For this reason, security checklists and protocols for officers should be written in a pocket guide format and issued to each security officer, espe- cially officers on rotation. The pocket guide procedures should be brief and consist of critical factors only—the usual 2-inch-thick notebook is too much. Remember that if a facility has contracted security that frequently rotates, traditional methods of orientation and training will not suffice.

Reliance upon local emergency response agencies to augment hospital capacity to manage victim load or decontamination is unwise. This dependency is discour- aged because most, if not all, emergency assets will be either committed to incident operations (on the scene) or responding to 911 calls unrelated to the terrorism incident.

Chapter Summary

Local agencies are the cornerstone of an effective terror- ism response. Managers at these agencies should plan to be self-sustaining for 12 to 72 hours before federal

help arrives. As convergent responders arrive before first responders, it is important to identify convergent responder agencies and develop an awareness training program for them.

A terrorism scene is a hostile workplace environ- ment, and focusing on victims instead of overall scene awareness is an unsafe practice. Responders must use their senses and look around before charging in. First responders must be aware of chemical threats, shooters in the area, and primary or secondary explosive devices. Responders must use the buddy system when entering an unsecured scene by applying the 2 in 2 out principle and the wildland firefighting principle of LACES. Likewise, the trend of mass shootings and tactical ultraviolence means more exposure to ballistic hot zones. Responders must survey the peripheral areas of a scene, including roofs or other high places, and use the principles of distance and cover for self-protection.

The NIMS and ICS are the boilerplate for manage- ment of terrorism incidents. Response agencies must learn, implement, train, exercise, and operate using NIMS. Scene control is a critical factor in a terrorism event and has high impact on law enforcement. Victims, witnesses, and possible assailants must be kept on the scene. Other groups, such as media, onlookers, and friends and families of the victims, will attempt to enter the scene.

Essentially, all emergency responders must be spe- cially trained for terrorism incidents. This training in- cludes NIMS proficiency, scene awareness, and special team training. Medical facilities must initiate response protocols for processing and treating mass casualty ter- rorism victims. Facility response begins with effective communications to provide early scene information, and hospital security is a critical factor in medical fa- cility preparedness. In a mass shooting, the ER must be physically protected from possible perpetrators. In a chemical attack, contaminated victims must be diverted to the decontamination area and the facility should be locked down.

Hospital/medical facilities must adopt terrorism inci- dent protocols within their disaster plans and have the equipment to support actions related to these types of incidents.

57854_CH06_final.indd 8257854_CH06_final.indd 82 1/20/10 10:25:50 AM1/20/10 10:25:50 AM

F O S T E R , C E D R I C 1 6 9 2 T S

Wrap Up Chapter Questions

1. What are convergent responders? What are their strengths and weaknesses?

2. List the public and private convergent responder agencies in your community.

3. What are the unsafe conditions that may be pres- ent at a terrorism incident?

4. What is the 2 in 2 out principle? Discuss the LACES principle.

5. What is the importance of NIMS in terrorism in- cidents?

6. List and discuss the major scene control issues in a terrorism incident.

7. What procedures should be initiated by a medi- cal facility when contaminated victims are en route?

Chapter Project

Research the response procedures of your local fire, EMS, and law enforcement agencies. Determine how effectively these procedures address tactical violence scenes. Develop a comprehensive terrorism operational procedure based on the concepts and key issues dis- cussed in this chapter.

Vital Vocabulary

2 in 2 out A firefighting safety principle dictating that when two members enter a structure or high-hazard area, two additional members are standing by outside

the hazard area for the purpose of immediate rescue and/or support.

Active shooter response The quick action by what- ever group of law enforcement officers initially arrive on scene by aggressively entering a building or structure with the intent of engaging an active shooter or shooters. The primary objective is to save lives by neutralizing the shooter.

Chemical/biological/radiological (CBR) An incident or threat involving chemical, biological, or radiological devices or weapons.

Community emergency response team (CERT) An organized team of community citizens trained to respond to local disasters and perform actions that mitigate death, injury, property loss, and quality of life.

Convergent responders Citizens or workers who wit- ness a terrorism incident and converge on the scene, call 911, and take action before first responders arrive.

Law enforcement incident command system (LEICS) Law enforcement incident management functions orga- nized by the ICS template.

Lookout, awareness, communications, escape, and safety (LACES) Scene safety procedures based on hav- ing a lookout, situational awareness, functioning com- munications among units, and an escape route leading to a safe zone.

Staging A safe area near the incident scene where non- essential and support units, managed by a staging officer, stand by awaiting further orders or assignments.

Windshield survey Careful scan of the incident scene from a vehicle, especially the entire scene periphery, to determine hazards or threats.

57854_CH06_final.indd 8357854_CH06_final.indd 83 1/20/10 10:25:51 AM1/20/10 10:25:51 AM

F O S T E R , C E D R I C 1 6 9 2 T S

57854_CH06_final.indd 8457854_CH06_final.indd 84 1/20/10 10:25:52 AM1/20/10 10:25:52 AM

F O S T E R , C E D R I C 1 6 9 2 T S

Chapter 4
Chapter 5
Chapter 6

<< /ASCII85EncodePages false /AllowTransparency false /AutoPositionEPSFiles true /AutoRotatePages /None /Binding /Left /CalGrayProfile (Dot Gain 20%) /CalRGBProfile (sRGB IEC61966-2.1) /CalCMYKProfile (U.S. Web Coated \050SWOP\051 v2) /sRGBProfile (sRGB IEC61966-2.1) /CannotEmbedFontPolicy /Error /CompatibilityLevel 1.4 /CompressObjects /Off /CompressPages true /ConvertImagesToIndexed true /PassThroughJPEGImages false /CreateJDFFile false /CreateJobTicket false /DefaultRenderingIntent /Default /DetectBlends false /DetectCurves 0.1000 /ColorConversionStrategy /LeaveColorUnchanged /DoThumbnails false /EmbedAllFonts true /EmbedOpenType false /ParseICCProfilesInComments true /EmbedJobOptions true /DSCReportingLevel 0 /EmitDSCWarnings false /EndPage -1 /ImageMemory 1048576 /LockDistillerParams false /MaxSubsetPct 100 /Optimize false /OPM 1 /ParseDSCComments true /ParseDSCCommentsForDocInfo true /PreserveCopyPage true /PreserveDICMYKValues true /PreserveEPSInfo true /PreserveFlatness true /PreserveHalftoneInfo true /PreserveOPIComments true /PreserveOverprintSettings true /StartPage 1 /SubsetFonts true /TransferFunctionInfo /Preserve /UCRandBGInfo /Preserve /UsePrologue false /ColorSettingsFile (None) /AlwaysEmbed [ true ] /NeverEmbed [ true ] /AntiAliasColorImages false /CropColorImages true /ColorImageMinResolution 300 /ColorImageMinResolutionPolicy /Warning /DownsampleColorImages false /ColorImageDownsampleType /Average /ColorImageResolution 300 /ColorImageDepth -1 /ColorImageMinDownsampleDepth 1 /ColorImageDownsampleThreshold 1.50000 /EncodeColorImages false /ColorImageFilter /None /AutoFilterColorImages false /ColorImageAutoFilterStrategy /JPEG /ColorACSImageDict << /QFactor 0.15 /HSamples [1 1 1 1] /VSamples [1 1 1 1] >> /ColorImageDict << /QFactor 0.15 /HSamples [1 1 1 1] /VSamples [1 1 1 1] >> /JPEG2000ColorACSImageDict << /TileWidth 256 /TileHeight 256 /Quality 30 >> /JPEG2000ColorImageDict << /TileWidth 256 /TileHeight 256 /Quality 30 >> /AntiAliasGrayImages false /CropGrayImages true /GrayImageMinResolution 300 /GrayImageMinResolutionPolicy /Warning /DownsampleGrayImages false /GrayImageDownsampleType /Average /GrayImageResolution 300 /GrayImageDepth -1 /GrayImageMinDownsampleDepth 2 /GrayImageDownsampleThreshold 1.50000 /EncodeGrayImages false /GrayImageFilter /None /AutoFilterGrayImages true /GrayImageAutoFilterStrategy /JPEG /GrayACSImageDict << /QFactor 0.15 /HSamples [1 1 1 1] /VSamples [1 1 1 1] >> /GrayImageDict << /QFactor 0.15 /HSamples [1 1 1 1] /VSamples [1 1 1 1] >> /JPEG2000GrayACSImageDict << /TileWidth 256 /TileHeight 256 /Quality 30 >> /JPEG2000GrayImageDict << /TileWidth 256 /TileHeight 256 /Quality 30 >> /AntiAliasMonoImages false /CropMonoImages true /MonoImageMinResolution 1200 /MonoImageMinResolutionPolicy /Warning /DownsampleMonoImages false /MonoImageDownsampleType /Average /MonoImageResolution 1200 /MonoImageDepth -1 /MonoImageDownsampleThreshold 1.50000 /EncodeMonoImages false /MonoImageFilter /None /MonoImageDict << /K -1 >> /AllowPSXObjects false /CheckCompliance [ /None ] /PDFX1aCheck false /PDFX3Check false /PDFXCompliantPDFOnly false /PDFXNoTrimBoxError true /PDFXTrimBoxToMediaBoxOffset [ 0.00000 0.00000 0.00000 0.00000 ] /PDFXSetBleedBoxToMediaBox true /PDFXBleedBoxToTrimBoxOffset [ 0.00000 0.00000 0.00000 0.00000 ] /PDFXOutputIntentProfile (None) /PDFXOutputConditionIdentifier () /PDFXOutputCondition () /PDFXRegistryName () /PDFXTrapped /False /Description << /CHS <FEFF4f7f75288fd94e9b8bbe5b9a521b5efa7684002000410064006f006200650020005000440046002065876863900275284e8e9ad88d2891cf76845370524d53705237300260a853ef4ee54f7f75280020004100630072006f0062006100740020548c002000410064006f00620065002000520065006100640065007200200035002e003000204ee553ca66f49ad87248672c676562535f00521b5efa768400200050004400460020658768633002> /CHT <FEFF4f7f752890194e9b8a2d7f6e5efa7acb7684002000410064006f006200650020005000440046002065874ef69069752865bc9ad854c18cea76845370524d5370523786557406300260a853ef4ee54f7f75280020004100630072006f0062006100740020548c002000410064006f00620065002000520065006100640065007200200035002e003000204ee553ca66f49ad87248672c4f86958b555f5df25efa7acb76840020005000440046002065874ef63002> /DAN <FEFF004200720075006700200069006e0064007300740069006c006c0069006e006700650072006e0065002000740069006c0020006100740020006f007000720065007400740065002000410064006f006200650020005000440046002d0064006f006b0075006d0065006e007400650072002c0020006400650072002000620065006400730074002000650067006e006500720020007300690067002000740069006c002000700072006500700072006500730073002d007500640073006b007200690076006e0069006e00670020006100660020006800f8006a0020006b00760061006c0069007400650074002e0020004400650020006f007000720065007400740065006400650020005000440046002d0064006f006b0075006d0065006e0074006500720020006b0061006e002000e50062006e00650073002000690020004100630072006f00620061007400200065006c006c006500720020004100630072006f006200610074002000520065006100640065007200200035002e00300020006f00670020006e0079006500720065002e> /DEU <FEFF00560065007200770065006e00640065006e0020005300690065002000640069006500730065002000450069006e007300740065006c006c0075006e00670065006e0020007a0075006d002000450072007300740065006c006c0065006e00200076006f006e002000410064006f006200650020005000440046002d0044006f006b0075006d0065006e00740065006e002c00200076006f006e002000640065006e0065006e002000530069006500200068006f006300680077006500720074006900670065002000500072006500700072006500730073002d0044007200750063006b0065002000650072007a0065007500670065006e0020006d00f60063006800740065006e002e002000450072007300740065006c006c007400650020005000440046002d0044006f006b0075006d0065006e007400650020006b00f6006e006e0065006e0020006d006900740020004100630072006f00620061007400200075006e0064002000410064006f00620065002000520065006100640065007200200035002e00300020006f0064006500720020006800f600680065007200200067006500f600660066006e00650074002000770065007200640065006e002e> /ESP <FEFF005500740069006c0069006300650020006500730074006100200063006f006e0066006900670075007200610063006900f3006e0020007000610072006100200063007200650061007200200064006f00630075006d0065006e0074006f00730020005000440046002000640065002000410064006f0062006500200061006400650063007500610064006f00730020007000610072006100200069006d0070007200650073006900f3006e0020007000720065002d0065006400690074006f007200690061006c00200064006500200061006c00740061002000630061006c0069006400610064002e002000530065002000700075006500640065006e00200061006200720069007200200064006f00630075006d0065006e0074006f00730020005000440046002000630072006500610064006f007300200063006f006e0020004100630072006f006200610074002c002000410064006f00620065002000520065006100640065007200200035002e003000200079002000760065007200730069006f006e0065007300200070006f00730074006500720069006f007200650073002e> /FRA <FEFF005500740069006c006900730065007a00200063006500730020006f007000740069006f006e00730020006100660069006e00200064006500200063007200e900650072002000640065007300200064006f00630075006d0065006e00740073002000410064006f00620065002000500044004600200070006f0075007200200075006e00650020007100750061006c0069007400e90020006400270069006d007000720065007300730069006f006e00200070007200e9007000720065007300730065002e0020004c0065007300200064006f00630075006d0065006e00740073002000500044004600200063007200e900e90073002000700065007500760065006e0074002000ea0074007200650020006f007500760065007200740073002000640061006e00730020004100630072006f006200610074002c002000610069006e00730069002000710075002700410064006f00620065002000520065006100640065007200200035002e0030002000650074002000760065007200730069006f006e007300200075006c007400e90072006900650075007200650073002e> /ITA <FEFF005500740069006c0069007a007a006100720065002000710075006500730074006500200069006d0070006f007300740061007a0069006f006e00690020007000650072002000630072006500610072006500200064006f00630075006d0065006e00740069002000410064006f00620065002000500044004600200070006900f900200061006400610074007400690020006100200075006e00610020007000720065007300740061006d0070006100200064006900200061006c007400610020007100750061006c0069007400e0002e0020004900200064006f00630075006d0065006e007400690020005000440046002000630072006500610074006900200070006f00730073006f006e006f0020006500730073006500720065002000610070006500720074006900200063006f006e0020004100630072006f00620061007400200065002000410064006f00620065002000520065006100640065007200200035002e003000200065002000760065007200730069006f006e006900200073007500630063006500730073006900760065002e> /JPN <FEFF9ad854c18cea306a30d730ea30d730ec30b951fa529b7528002000410064006f0062006500200050004400460020658766f8306e4f5c6210306b4f7f75283057307e305930023053306e8a2d5b9a30674f5c62103055308c305f0020005000440046002030d530a130a430eb306f3001004100630072006f0062006100740020304a30883073002000410064006f00620065002000520065006100640065007200200035002e003000204ee5964d3067958b304f30533068304c3067304d307e305930023053306e8a2d5b9a306b306f30d530a930f330c8306e57cb30818fbc307f304c5fc59808306730593002> /KOR <FEFFc7740020c124c815c7440020c0acc6a9d558c5ec0020ace0d488c9c80020c2dcd5d80020c778c1c4c5d00020ac00c7a50020c801d569d55c002000410064006f0062006500200050004400460020bb38c11cb97c0020c791c131d569b2c8b2e4002e0020c774b807ac8c0020c791c131b41c00200050004400460020bb38c11cb2940020004100630072006f0062006100740020bc0f002000410064006f00620065002000520065006100640065007200200035002e00300020c774c0c1c5d0c11c0020c5f40020c2180020c788c2b5b2c8b2e4002e> /NLD (Gebruik deze instellingen om Adobe PDF-documenten te maken die zijn geoptimaliseerd voor prepress-afdrukken van hoge kwaliteit. De gemaakte PDF-documenten kunnen worden geopend met Acrobat en Adobe Reader 5.0 en hoger.) /NOR <FEFF004200720075006b00200064006900730073006500200069006e006e007300740069006c006c0069006e00670065006e0065002000740069006c002000e50020006f0070007000720065007400740065002000410064006f006200650020005000440046002d0064006f006b0075006d0065006e00740065007200200073006f006d00200065007200200062006500730074002000650067006e0065007400200066006f00720020006600f80072007400720079006b006b0073007500740073006b00720069006600740020006100760020006800f800790020006b00760061006c0069007400650074002e0020005000440046002d0064006f006b0075006d0065006e00740065006e00650020006b0061006e002000e50070006e00650073002000690020004100630072006f00620061007400200065006c006c00650072002000410064006f00620065002000520065006100640065007200200035002e003000200065006c006c00650072002000730065006e006500720065002e> /PTB <FEFF005500740069006c0069007a006500200065007300730061007300200063006f006e00660069006700750072006100e700f50065007300200064006500200066006f0072006d00610020006100200063007200690061007200200064006f00630075006d0065006e0074006f0073002000410064006f0062006500200050004400460020006d00610069007300200061006400650071007500610064006f00730020007000610072006100200070007200e9002d0069006d0070007200650073007300f50065007300200064006500200061006c007400610020007100750061006c00690064006100640065002e0020004f007300200064006f00630075006d0065006e0074006f00730020005000440046002000630072006900610064006f007300200070006f00640065006d0020007300650072002000610062006500720074006f007300200063006f006d0020006f0020004100630072006f006200610074002000650020006f002000410064006f00620065002000520065006100640065007200200035002e0030002000650020007600650072007300f50065007300200070006f00730074006500720069006f007200650073002e> /SUO <FEFF004b00e40079007400e40020006e00e40069007400e4002000610073006500740075006b007300690061002c0020006b0075006e0020006c0075006f00740020006c00e400680069006e006e00e4002000760061006100740069007600610061006e0020007000610069006e006100740075006b00730065006e002000760061006c006d0069007300740065006c00750074007900f6006800f6006e00200073006f00700069007600690061002000410064006f0062006500200050004400460020002d0064006f006b0075006d0065006e007400740065006a0061002e0020004c0075006f0064007500740020005000440046002d0064006f006b0075006d0065006e00740069007400200076006f0069006400610061006e0020006100760061007400610020004100630072006f0062006100740069006c006c00610020006a0061002000410064006f00620065002000520065006100640065007200200035002e0030003a006c006c00610020006a006100200075007500640065006d006d0069006c006c0061002e> /SVE <FEFF0041006e007600e4006e00640020006400650020006800e4007200200069006e0073007400e4006c006c006e0069006e006700610072006e00610020006f006d002000640075002000760069006c006c00200073006b006100700061002000410064006f006200650020005000440046002d0064006f006b0075006d0065006e007400200073006f006d002000e400720020006c00e4006d0070006c0069006700610020006600f60072002000700072006500700072006500730073002d007500740073006b00720069006600740020006d006500640020006800f600670020006b00760061006c0069007400650074002e002000200053006b006100700061006400650020005000440046002d0064006f006b0075006d0065006e00740020006b0061006e002000f600700070006e00610073002000690020004100630072006f0062006100740020006f00630068002000410064006f00620065002000520065006100640065007200200035002e00300020006f00630068002000730065006e006100720065002e> /ENU (Use these settings to create Adobe PDF documents best suited for high-quality prepress printing. Created PDF documents can be opened with Acrobat and Adobe Reader 5.0 and later.) >> /Namespace [ (Adobe) (Common) (1.0) ] /OtherNamespaces [ << /AsReaderSpreads false /CropImagesToFrames true /ErrorControl /WarnAndContinue /FlattenerIgnoreSpreadOverrides false /IncludeGuidesGrids false /IncludeNonPrinting false /IncludeSlug false /Namespace [ (Adobe) (InDesign) (4.0) ] /OmitPlacedBitmaps false /OmitPlacedEPS false /OmitPlacedPDF false /SimulateOverprint /Legacy >> << /AddBleedMarks false /AddColorBars false /AddCropMarks false /AddPageInfo false /AddRegMarks false /ConvertColors /ConvertToCMYK /DestinationProfileName () /DestinationProfileSelector /DocumentCMYK /Downsample16BitImages true /FlattenerPreset << /PresetSelector /MediumResolution >> /FormElements false /GenerateStructure false /IncludeBookmarks false /IncludeHyperlinks false /IncludeInteractive false /IncludeLayers false /IncludeProfiles false /MultimediaHandling /UseObjectSettings /Namespace [ (Adobe) (CreativeSuite) (2.0) ] /PDFXOutputIntentProfileSelector /DocumentCMYK /PreserveEditing true /UntaggedCMYKHandling /LeaveUntagged /UntaggedRGBHandling /UseDocumentProfile /UseDocumentBleed false >> ] >> setdistillerparams << /HWResolution [2400 2400] /PageSize [684.000 855.000] >> setpagedevice