Tag homeland security

Active Shooter Drills with Students – Good Idea or Bad?

Tim Riecker, The Contrarian Emergency Manager Leave a comment

While school shootings, unfortunately, are nothing new, we are seeing them occur with greater frequency.  Without getting into my thoughts on firearms, I will say that preparedness, prevention, and mitigation for mass shooting incidents in schools and other soft targets of opportunity, are multi-faceted.  Shooters are just as much of a persistent threat as hurricanes, tornadoes, or flooding; amplified by the will of the shooter(s) to do harm and their ability to reason through paths of deterrence.  While a number of measures can and should continue to be implemented to prevent and protect soft targets, just as we do with natural hazards, we must continue to prepare for an attack that slips past or through our preventative measures.

Readers will know that I’m a huge advocate of exercises in the emergency management/public safety/homeland security space.  While the primary purpose of exercises is to validate plans, policies, and procedures; we also use them to practice and reinforce activities.  Certainly every school, college, shopping mall, office building, and other mass gathering space should hold active shooter drills.  Many of these facilities already conduct regular fire evacuation drills, and shooter drills should also be added to the mix.

Where to start?  First of all, you need a plan.  ALL EXERCISES START WITH A PLAN.  The sheer number of exercises I’ve seen conducted with no plan or a knowingly poor plan in place is staggering.  If people don’t know what to do or how to do it, the value of the exercise is greatly diminished.  If you are a responsible party for any of these spaces, reach out to your local law enforcement and emergency management office for assistance in developing an active shooter protection plan.  If you are a regulated facility, such as a school or hospital, the state offices that provide your oversight are also a resource.  You can find some planning guidance here and here.   While your focus with this activity is an active shooter protection plan, recognize that you will also need to re-visit the public information component of your emergency operations plan (you have one, right?) and your business continuity plan, as I guarantee you will need to reference these in the event of a shooting incident.  A final note on planning… don’t do it in a vacuum!  It should be a collaborative effort with all relevant stakeholders.

As for exercises, consider what you want to accomplish and who needs to be involved.  In a mall, it’s not wise to include shoppers in exercises since they are a transient audience and forcing their involvement will very likely be some bad PR and impact stores financially.  That said, you need to anticipate that mall shoppers won’t know what to do or how to react to a shooter, therefore mall staff need to be very forceful and persistent in how they deal with patrons in such an incident.  Therefore, involving mall staff along with law enforcement and other stakeholders in an off-hours exercise is a great idea.

Schools, however, are a different situation, as their populations are static for an extended period of time.  While school faculty and staff should exercise with law enforcement, there are different thoughts on how and when to involve kids in these exercises.  There are some that advocate their involvement, while there are some who are adamantly opposed.  I reflect back on fire evacuation drills, which occur with regularity in schools. These drills reinforce procedure and behavior with students.  They know they need to line up and proceed calmly and well behaved along a designated path to exit the building, proceeding to a meeting spot where teachers maintain order and accountability.  These are behaviors that stick with many into adulthood if they find themselves in a fire evacuation (drill or otherwise) – so it’s also a learning experience.  The same holds for tornado and earthquake drills, which are held regularly in many areas around the country.  Fundamentally, for a shooter situation, we also need to reinforce procedure and behavior with students.  They need to know what to do in lockdown, lockout, and evacuation.

The prospect of a shooter is a horrible thing for anyone to deal with, much less a child.  I’ve spoken to parents who, themselves, are horrified about the prospect of speaking to their children about a shooter in their school.  In every occasion, I’ve said this: You damn well better talk to them about it.  This is a discussion with perhaps greater importance than talks about strangers, drugs, alcohol, or sex; and it needs to begin with children from kindergarten on up.  Schools need to teach students what to do when the alert occurs for an active shooter – typically this involves getting them safely out of view from someone who might be in the hallway while teachers lock or barricade the door and turn off lights.  Students need to understand the gravity of the situation and remain still and quiet.  Evacuation will generally only occur under someone’s direction.  There will be loud noises and it’s likely the police won’t speak kindly as they are clearing rooms, looking for a shooter and potential devices.  To be certain, it’s scary for adults and I wish our children didn’t have to endure such a thing, but practicing and reinforcing procedures and behavior will save lives.  I’ll offer this article, that discusses some of the potential psychological impacts of shooter drills on kids.  These impacts are a reality we also need to deal with, but I think the benefits of the drills far outweigh the costs.

Mass shootings, like most aspects of public safety, underscore the need for us to do better not only in public safety response, but also as a society.  The answers aren’t easy and there is no magic pill that will provide a solution to it all.  It requires a multifaceted approach on the part of multiple stakeholders, sadly even those as young as four years old, to prepare, prevent, and protect.

© 2018 – Timothy M. Riecker, CEDP

Emergency Preparedness Solutions, LLC

HSEEP Training – Is it Required

Tim Riecker, The Contrarian Emergency Manager Leave a comment

Continuing from my previous blog post, I’ll answer a search phrase used to bring someone to my blog.  Earlier this month, someone searched ‘Is HSEEP training mandatory?’.  We speak, of course, of the Homeland Security Exercise and Evaluation Program, which is the DHS-established standard in exercise program and project management.

The short answer to the question: Maybe.

Generally speaking, if your exercise activities are funded directly or indirectly by a federal preparedness grant, then grant language usually requires that all exercises are conducted in accordance with HSEEP.  While most federal grant guidance doesn’t explicitly state that exercise personnel must be formally trained in HSEEP, it’s kind of a no-brainer that the fundamental way to learn the standards of practice for HSEEP so you can apply them to meet the funding requirement is by taking an HSEEP course.  If you are a jurisdiction awarded a sub-grant of a federal preparedness grant or a firm awarded a contract, there may exist language in your agreement, placed there by the principal grantee, that specifically requires personnel to be trained in HSEEP.

Beyond grant requirements, who you work for, who are you, and what you do generally don’t dictate any requirement for HSEEP training.  Aside from the federal grant funding or contracts mentioned, there is no common external requirement for any organization to have their personnel trained in HSEEP.  If your organization does require it, this is likely through a management-level decision for the organization or a functional part of it.

So, while HSEEP is a standard of practice, training in HSEEP, in general terms, is not a universal requirement.  That said, I would certainly recommend it if you are at all involved in the management, design, conduct, or evaluation of exercises.  FEMA’s Emergency Management Institute (EMI) offers HSEEP courses in both a blended learning and classroom format.  The emergency management/homeland security offices of many states and some larger cities offer them as well.

© 2018 Timothy Riecker, CEDP

Emergency Preparedness Solutions, LLC SM

Learning From a 10-Year-Old Report

Tim Riecker, The Contrarian Emergency Manager Leave a comment

I’ll admit that I’m often dismissive of information, especially in the field of emergency management and homeland security, if it’s over 10 years old.  There is a lot that’s changed in the past 10 years, after all.  But, realistically, for as much as we’ve changed, things have stayed the same.  Arguably, the first decade of this millennium saw much more change in EM/HS than the second decade has, at least so far.  The first decade saw events like 9/11 and Hurricane Katrina.  Yes, there certainly have been major events in this second decade, but none, it seems, were as influential to our field of practice than those in the first decade.

It’s important to reflect upon lessons observed and to examine what lessons we’ve actually learned.  How far have we come in implementing improvements from the 9/11 Report?  What still needs to be accomplished to meet the intent of the Post-Katrina Emergency Management Reform Act (PKEMRA)?  Perhaps when I have some time to devote I’ll review those documents again and look on them reflectively and provide my thoughts here.

Yesterday I received the latest email from DomesticPreparedness.com.  I refer often to their work in my articles.  This weekly brief included an article from one of my favorite authors in this field, John Morton.  I’ve referenced his work in a few of my past articles.  This article, titled The What If Possibility: A Chilling Report, talks about planning for a rogue nuclear attack, the likely lead role the federal government would have to take in response to such an attack (versus a locally-led response), and what the situation would be the day after.  With the threat of North Korean nuclear weapons capability looming, this article was an interesting read and spot-on.  I noticed a problem, though… It referenced Ash Carter as an assistant secretary of defense in the Clinton administration.  While this was true, Carter’s highest office was SecDef under President Obama.  Surely John Morton, with his incredible attention to detail that I’ve come to recognize couldn’t have made this error.

Nope.  No error on his part.  I looked at the date of the article.  June 27, 2007 – over a decade old.  Incredibly, this article is still highly relevant today.  The article does reference the drafting of certain federal plans for nuclear attack.  Plans which I am not privy to, but that must assuredly exist today.  I’m curious as to the model these plans follow, what has been learned from exercising them, and how we might be able to apply elements of these plans to other catastrophic occurrences.

Despite change, so much seems to stay the same. Of course a decade isn’t that long.  Given that emergency management and homeland security are primarily government roles, we have to acknowledge that the (usually necessary) bureaucracy simply doesn’t move that quickly.  Unfortunately, there are things we are far too slow to adopt, not just from a government perspective, but socially.  As a lover of history and sociology, I see lessons observed from the 1900 Galveston hurricane as well as the eruption of Mt Vesuvius in 79 CE.  There is much that history can teach us, if we are willing to listen. Lessons observed, but not learned.

© 2017 – Timothy Riecker

Emergency Preparedness Solutions, LLC

Defining Terrorism

Tim Riecker, The Contrarian Emergency Manager Leave a comment

It seems odd that in 2017 we still need to be clear about what constitutes an act of terrorism.  For context, last night, the horrible shooting in Las Vegas occurred.  At the time of writing this, it’s already been the most fatal shooting in US history.  This is a horrible incident that, as usual, I’m not going to Monday morning quarter-back, as so much is still developing in the aftermath.

What I will comment on are statements by media outlets and ‘experts’, many of which proclaimed once it was released that the perpetrator of this crime was an older white guy local to the Las Vegas area, that this was not an act of terrorism.  So let’s clarify against stupidity, ignorance, and general bullshit.  While there are a variety of definitions of terrorism that can be found, no definition worth its salt includes any pre-determined profile based upon race, age, gender, religion, sexuality, nationality, or skin color.  Those factors alone have nothing to do with determining if an act was or was not terrorism.

The most common definition referenced in the US is what is known as the ‘FBI definition’.  This definition actually comes from a section of the US Code of Federal Regulations (28 CFR 0.85) which outlines the general functions of the Director of the Federal Bureau of Investigation.  In the Code, terrorism is defined as ‘the unlawful use of force and violence against persons or property to intimidate or coerce a government, the civilian population, or any segment thereof, in the furtherance of political or social objectives’.

It seems easy in these times to decry any act of violence as terrorism or, similarly, to dismiss certain acts because they are perpetrated by some old white guy with no known agenda.  Both of these actions would be wrong without further evidence.  The FBI definition focuses on motive and intent.  While the results of the incident may certainly be intimidating or coercive, the motivation may not have been to accomplish that – it may have been, not to understate any act of violence, simply to kill people.  It may not have necessarily been motivated by any specific social, political, or religious extremism.  At this moment, there has been no publicly-released information indicating that this person acted to ‘intimidate or coerce a government, civilian population, or segment thereof in furtherance of political or social objectives.’  But that could change at any moment.

In the hours and days ahead, more details will be uncovered on the perpetrator of this crime and their possible motives.  Some people simply want to call it terrorism so they have a label for it or because they think that the crime is somehow elevated by calling it terrorism.  Over 50 were killed and over 500 were injured.  Whatever label you apply doesn’t make the crime any better or worse.  It’s still horribly tragic.  Some people, particularly those with pre-conceived notions of what is or is not terrorism, will hold that this couldn’t possibly be terrorism because it was committed by an older, local, white guy; and not a radicalized individual from the middle east.  Assumptions either way are dangerous.

Regardless of how the investigation shakes out and what labels may be applied to this act, the loss of life and impact to families and loved ones is horrific.  Let us all take some time to consider that and what must be done to prepare for and prevent further mass shootings such as this.

No matter what the disaster is, be informed!

© 2017 – Timothy Riecker, CEDP

Emergency Preparedness Solutions, LLC

Thinking Smarter About Security

Tim Riecker, The Contrarian Emergency Manager 2 Comments

If you work in any facet of public safety and you aren’t thinking about how you secure public and event spaces, you haven’t been paying attention.  Our complacency is the greatest gift we can give to terrorists and criminals.  I certainly acknowledge that the most difficult aspect of dealing with criminal intent versus natural hazards is their determination to circumvent our own protective measures and systems, but we often make it easy for them because it’s too difficult for us to change. Is that really the excuse you want to give to the board, the media, or the families of those killed in a criminal act?

While I will never claim to be a security expert, I try to look at things with a critical eye and take the advice of those who are experts in the field.  Here are a few examples of things I’ve encountered.

Several years ago I was part of a team supporting preparedness at a major sporting venue.  The organization who had exclusive rights to the venue requested support in planning, training, and exercise activities.  I provided incident management training and was the lead on exercises.  As preparation for a tabletop exercise, I coordinated with the organization to observe security procedures during a major event.  The security screeners at the entrances to the venue did a reasonable job with most patrons, although consistently faulted with one type of patron – persons in wheelchairs.  Anyone who came to the door in a wheelchair was waved through ALL security screening without so much as a bag check.  This became the gap that I exploited for the exercise, much to the objection of their head of security who insisted that personnel were trained in how to screen patrons in wheelchairs.  While they may have been trained, it is something they consistently failed in doing and I never observed a supervisor correct the behavior.  Perhaps they weren’t trained at all, or the training wasn’t effective, or it was too uncomfortable or inconvenient for them to do.  Regardless, this is a significant gap that I’ve continued to see at other locations through the years.

Earlier this year I attended a large convention that drew tens of thousands of patrons in a large convention center over a long weekend.  I was an attendee and not working in any official capacity.  Security at the venue was laughable.  Security personnel had three main activities – bag checks, credential checks, and metal detector operation.  Metal detector operation was only performed the first day, utilizing walk through detectors as well as wands.  The personnel clearly had no idea how to operate either (I was among dozens if not hundreds of people who were directed to go through a walk through detector – which I noticed was unplugged).  On the occasion that a walk through alerted (one that was plugged in…), I observed security personnel waiving the wand around people too quickly and too far away from their bodies.  For bag checks, we were asked to open all bags for security inspection.  The ‘inspection’ I observed on each day usually consisted of someone saying thank you and waving you through as they looked around the room or chatted with a co-worker, certainly not actually looking into the bags.  As for checking credentials, every patron was provided with a lanyard and a pass to be attached to said lanyard.  Security personnel were supposed to be checking passes as people entered doors to the main exhibit hall and other areas.  I noted some security personnel did this better than others – some of which didn’t check at all.  I actually managed to keep my pass in my pocket through the entire event, only being challenged by security once.  I was so alarmed by some of the practices that on separate occasions I introduced myself to a county sheriff’s deputy and a fire marshal to point out some of the more egregious issues.

My work has brought me to a number of secure facilities owned by various levels of government and private entities.  One federal facility I’ve frequently visited through the years usually screens vehicles.  As expected, this includes the opening of doors and the trunk of the car.  Not once, in the many years and visits to this facility has anyone ever moved a seat or checked a bag or package.

My last anecdote comes from a few years ago spending some down time in a small park in an area of DC where there a number of embassies.  One embassy seemed to have regular traffic in and out for visitors as well as some light construction work being performed on their grounds.  As one guard would check identification and presumably verify the need of the visitor to be there, another guard would walk around the vehicle with an inspection mirror (the type at the end of a pole with which to inspect the underside of a vehicle).  It was evident that the guard was either not trained in its proper use or the importance of this protocol, as every time he walked around a vehicle holding the mirror, but never actually putting it in position to view under the vehicle, much less ever looking down at the mirror.  He simply took a casual stroll around the vehicle.

The things I’ve noted here are just a few that happened to come to mind as I crafted this article.  There are dozens more, and I’m sure each of you can come up with a list of poor practices as well.  Keep your eyes open when you go to a public space to see how security is handled.  Look at things through the lenses of potential adversaries.  How could someone gain entry?  Are there recognized security patterns they can circumvent?  What vulnerabilities exist?  If you are responsible for security for a facility, have a security audit performed.  While formal security audits are valuable, often the most meaningful ones are casual and unannounced, with someone the front-line security personnel don’t know trying to gain entrance to the facility.  Are they challenged appropriately? Are they screened effectively?

The mitigation, prevention, and protection against security threats is something that many take too lightly – clearly even those whose job it is to focus on those matters.  Highly effective training programs are available – but we need to ensure that people take these courses and implement what they’ve learned in accordance with documented organizational practices.  Supervisors must be present and constantly maintain quality control.  This is a good matter of practice, but even more important when most non-sworn security personnel have a high rate of turn over or may be part time or temporary employees, or even volunteers.  For large events, proper just-in-time training must be performed for supplemental security staff who are not certified or otherwise professionally qualified security personnel.

Security is a challenging environment to work in.  We must constantly be recognizing threats and trying to out-think potential adversaries.  We must strive to keep passive and active security practices up to par, meeting or exceeding standards without becoming predictable to an observer.  How do you assess security in your facility?  What best practices have you identified?

© 2017 – Timothy Riecker, CEDP

Emergency Preparedness Solutions, LLC

Exercises: Simple is Usually Better

Tim Riecker, The Contrarian Emergency Manager 2 Comments

I find often that people want to run exercises they aren’t quite ready for.  Sometimes those exercises are too complex, or they simply aren’t the appropriate type.  Most often, we run exercises to test plans, policy, and procedures; but sometimes those plans, policies, and procedures aren’t quite ready to be tested.  Last year I advised a client to run a workshop instead of a tabletop exercise.  The initial goal of the tabletop was to validate a new plan, but this plan wasn’t ready to be validated.  The problem was that many stakeholders hadn’t yet seen the plan, and the review of that plan by our team in preparedness for the exercise wasn’t favorable.  The plan had much of the needed content, but it was disjointed and didn’t have any logical flow.  By conducting a scenario-based workshop, we were able to identify not only the ideal flow of the plan by flagging benchmark activities, but we were also able to discuss expectations of and for each stakeholder agency in the plan.  The client was then able to apply the results of the workshop to restructure their plan and make some needed substantive changes.

Similarly, I’ve encouraged a current client to conduct a workshop instead of a tabletop.  The initial goal of this tabletop was to identify how a new group of stakeholders could integrate into an existing plan.  In this situation, the tabletop would have been less than effective as the new stakeholder group isn’t yet identified in the plan.  The outcome of the workshop will be to identify how this integration can occur.

I think that sometimes people gravitate to certain exercises simply because they are more popular in a certain application.  That preconceived notion might be too complex or simply a poor choice for what you really need to accomplish.  When it comes to discussion-based exercises, most people default to a tabletop.  With operations-based exercises, it can vary.  Drills are often used for tactical applications, but we don’t see them as much in EOCs.  Drills certainly have a place in an EOC if you are looking to test a very specific function or activity.  While full-scale exercises are fun and sexy, I’ve been to the site of plenty that are total chaos because the fundamental premise of certain plans hasn’t been worked out (or some stakeholders aren’t familiar with them), which perhaps should have been done through a discussion-based exercise or a drill or functional exercise first.  Running a drill to test and familiarize the process of setting up key equipment prior to doing it for the first time in a full scale will pay a lot of benefits, and certainly prevent dozens or hundreds of other people being held up in a full scale.

Another issue I often see with exercises is very long and complex Master Scenario Events Lists (MSELs).  The MSEL is essentially the timeline or script of the exercise.  Along with listing all injects, it also identifies all benchmarks in the management of the exercise, such as StartEx and EndEx, and the introduction of new elements or transition to a different segment.  While there is no particular rule of thumb for how many injects are needed for different exercise types, everything needs to associate back to the objectives of the exercise.  I hate injects that are crafted simply for ‘noise’ (unless it’s an intel exercise), or injects intended to just give someone something to do.  Arguably, if the participants take an exercise seriously, such as a functional exercise, and play out the situation as they would in real life, you can engage an entire EOC for a few hours with even ten well-crafted injects.  While some functions are very focused, consider that the vast majority of what we do in emergency management requires coordination among a variety of elements and functions.  Capitalize on that.  One inject may engage multiple agencies or functions because of the need to coordinate and problem solve.  It’s not enough to identify a solution to the problem, but work through where the resources will come from, how they will get to where they need to go, and what support is needed for them and how long.  That’s a lot of problems to solve and will often transcend every function within the incident command system.  Exercises don’t need to be complex to be effective.  Create a handful of objectives and make sure everything relates back to them.  Simplicity can work.

My last recommendation is to keep your exercise planning team a manageable size.  I’ve been the lead planner for some very large exercises.  These exercises, largely due to their sponsors, ended up involving massive exercise planning teams – and by massive I mean over five or six dozen people – or more.  These are just sheer insanity.  Not every agency or organization involved in the exercise needs to be directly represented, nor does each organization need to send a small army of people.  What you do need is consensus from those organizations on the objectives and their scope of play.  That doesn’t mean they have to be involved in every aspect of planning the exercise.  Just like any other meeting or group project, a large exercise planning team can be cumbersome and management by committee is never efficient.  If need be, stakeholder groups can be developed based upon function.  For example, a fire service exercise planning team would develop their contributions to the exercise.  Just make sure that these groups are well coordinated and the overall exercise planning effort is unified, otherwise you’ll end with a disjointed exercise effort.

In the end, simplicity rules.  As you begin planning your exercise, consider, in every step if it can or should be simplified.  Always refer back to your intent and your objectives.  Chances are you can create a simpler exercise that is just as impactful, or perhaps more impactful.  When our inclination is to make things overly complicated, we often miss the point entirely.

© 2017 – Timothy Riecker, CEDP

Emergency Preparedness Solutions, LLC

 

 

NIMS is Worthless, Unless You Put it into Action

Tim Riecker, The Contrarian Emergency Manager Leave a comment

It’s so often that I hear people proclaim in response to a problem that NIMS will fix it.  I’ve written in the past that many organizations reference the National Incident Management System (NIMS) and the Incident Command System (ICS) in their plans, as they should, but it’s often a reference with no substance.  The devil is in the details, as the saying goes; and the details of implementation are necessary to ensure that difficulties can be overcome.

The premise is simple… NIMS is a doctrine, only as valuable as the paper you print it on.  So fundamentally, NIMS has no value – unless it is implemented.  This human factor is the biggest hurdle organizations and jurisdictions must face, yet so many are lulled into a false sense of security because they cite it in their plans and they’ve taken some ICS courses.  I encourage every organization to review the NIMS doctrine and give your organization an honest assessment of how you are actually following it.  It’s bound to be pretty eye opening for many.

nims_document

We also have to keep in mind that NIMS isn’t just for your own organization.  While there are plenty of great practices in NIMS for your own organization, the greatest value in it is for multi-agency responses.  These don’t have to be to the extent of Hurricane Katrina or a massive wildfire, either.  Multi-agency responses occur in most jurisdictions every day – even what we regard as some of the most simple or routine incidents require multiple agencies to respond.  While the actions and responsibilities of these agencies are fairly rote and well-practiced, a slight increase in complexity can cause significant changes.

Consider that different agencies, even those within the same discipline have some different ways of doing things.  These can be simply in the mechanics of what they do, or they can be driven by procedures, equipment, or personality.  Some of this may be in writing, some may not.  Where this matters is in tactics.  NIMS won’t solve differences in tactical application or ensuring interoperability.  Only preparedness can accomplish that.  Before an incident occurs, we need to be having regular conversations with other agencies within our jurisdiction and outside of it.  How often do you exercise with your mutual aid partners?  I mean really exercise with them…  It’s great that you all arrive to the exercise site and set up your own stuff, but how about mixing and matching equipment?  What will work?  What won’t?  How will it impact tactical application?  These are some of the most meaningful lessons learned.

Bottom line – don’t try to pencil-whip NIMS as the solution to your problems.  It’s meaningless unless it’s actually put into action – and the way to proactively do that is through preparedness efforts.   Work together through POETE activities – Planning, Organizing, Equipping, Training, and Exercises.  Once you put the concepts of NIMS into action, then it will work for you!

How has your organization implemented NIMS concepts?

© 2017 –  Timothy Riecker, CEDP

Emergency Preparedness Solutions, LLC

Management and Organization of EOCs

Tim Riecker, The Contrarian Emergency Manager 1 Comment

I’ve always been fascinated by emergency operations centers (EOCs).  Through my career I’ve worked in many of them across the nation as a responder, trainer, and exerciser (is that a word?).  I’ve seen EOCs large and small, dedicated facilities and multi-use rooms.  I’ve been in EOCs on the top floor of buildings, so as to have a bird’s-eye view; and those underground, originally designed to withstand a Soviet nuclear attack.  I’ve seen technology that rivals NASA’s Mission Control, and EOCs that drop phone and internet lines from the ceiling when needed.  While the size, layout, and technology can all support an EOC’s mission, it’s really all about the people.

IMG_3226Over the past several months I’ve seen an even greater variety of EOCs due to a broad range of consulting projects I’ve led for my company.  These projects have brought me to EOCs in states, cities, and airports across the nation.  While coordination is the commonality, there are a great deal of differences between and among these EOCs, not only in their physical space, but also in how they operate.  While all pay heed to the National Incident Management System (NIMS) in some fashion, some lean more heavily on the Incident Command System (ICS) than others, while some prefer the emergency support function (ESF) model, and others yet seem to be in limbo, searching for the best model.

It’s been over a year since the National Integration Center (NIC), charged with maintaining NIMS, released a draft for public comment of the NIMS Refresh, which included the Center Management System (CMS) concept.  CMS is/was intended as a model for organizing EOCs and other such incident support functions.  Despite promises, we have yet to see any of that come to fruition.  That said, there are certain expectations and activities that must still exist for an EOC to be successful and productive.

With tactics being managed by the Operations Section in the Incident Command Post (ICP), planning is really the focal point of an EOC.  The perspective of an EOC is generally much bigger picture than that of an ICP.  Assuming a traditional coordination and support role of an EOC, the Operations Section of an EOC is really geared toward pulling agencies together and facilitating strategic-level problem solving through proper coordination.  For an EOC to function properly, current information is just as important as the ability to anticipate future needs so that problems can be solved and resources obtained.  This information management and forecasting is the responsibility of the Planning Section in an ICS-centered model, or of a planning function in any other model.

Every agency that contributes to the EOC, regardless of the model, should be prepared to contribute time and potentially even staff to this planning function.  Often, the incident is ‘routine’ enough that the planning staff are familiar with the various facets of the incident to do proper information collection, analysis, and forecasting; but on occasion subject matter experts are needed to support each of these critical activities.  Those subject matter experts often come from the agencies or emergency support functions represented in the EOC.  As forecasting is performed, opportunities are identified for needs that may need to be supported.  This is where the forecasting loops back to Operations to coordinate the agencies/emergency support functions to solve these problems.

None of this actually means that an EOC doesn’t oversee tactics, even indirectly.  While an ICP, for most incidents, doesn’t report to the EOC, there may be ancillary organizations developed to address other matters which the ICP isn’t overseeing.  While the ICP is focused on immediate life-safety issues, the EOC may be coordinating evacuation, sheltering, or public health matters.  In each of these examples, or numerous others which could be contrived, someone has to be in charge of them.  If the incident commander’s attention is focused on the highest priorities, these other matters are likely to be run by the EOC.  Typically, these would be within the chain of command of the EOC’s Operations Section or through an ESF.

I love seeing how different EOCs address problems and manage their own functions.  I’m all for creativity, but there fundamentally should be some standardization to the organization and management structure.  What’s unfortunate, however, is that so many EOCs don’t have proper plans which identify these functions or how they will be managed.  Some simply insert the phrase ‘NIMS/ICS’ into their plan, and assume that’s enough (it’s not).  Others have no plan at all.  The enemy of coordination is chaos, and if you don’t have quality plans in place, which have been trained to and exercised, the EOC stands to add even more chaos to the incident at hand.

Put some thought into your EOC management structure and plans.    How would the EOC run if you or someone else who usually runs it weren’t there?  Are plans and procedures detailed enough for it to operate smoothly?  Are personnel from all agencies trained properly in their roles and responsibilities?  Have you exercised these plans recently?  If so, what lessons learned do you usually see and have you worked to address them?

Feedback is always welcome!

© 2017 – Timothy Riecker, CEDP

Emergency Preparedness Solutions, LLC

Awareness of Public Health Preparedness Requirements – CMS

Tim Riecker, The Contrarian Emergency Manager 2 Comments

Emergency management and homeland security are collaborative spaces.  Think of these areas a Venn diagram, with overlapping rings.  Some of the related professions overlap with each other separately, but all of them overlap in the center.  This overlap represents the emergency management and homeland security space.  What’s important in this representation is the recognition that emergency managers and homeland security professionals, regardless of what specific agency they may work for, need to have awareness of that shared space and the areas of responsibility of each contributing profession.  One of the biggest players in this shared space is public health.Presentation1

For nearly a year, public health professionals have been talking about new requirements from CMS, which stands for The Centers for Medicare and Medicaid Services.  How does Medicare and Medicaid impact emergency management?  CMS, part of the Department of Health and Human Services (HHS) covers over 100 million people across the US – far more than any private insurer.  As an arm of HHS and a significant funding stream within public health, they set standards.

The most relevant standard to us is the Final Rule on Emergency Preparedness Requirements for Medicare and Medicaid Participating Providers and Suppliers.  The rule establishes consistent emergency preparedness requirements across healthcare providers participating in Medicare and Medicaid with the goal of increasing patient safety during emergencies and establishing a more coordinated response to disasters.

The CMS rule incorporates a number of requirements, which include:

  • Emergency planning
  • Policies and procedures
  • Communications planning with external partners
  • Training and exercises

These are all things we would expect from any emergency management standard.  Given the different types of facilities and providers, however, the implementation of the CMS rule can be complex.  A new publication released by the HHS ASPR (Office of the Assistant Secretary for Preparedness and Response) through their TRACIE program (Technical Resources, Assistance Center, and Information Exchange), provides some streamlined references to the CMS rule.  It’s a good document to study up on and keep on hand to help keep you aware of the requirements of one of our biggest partners.

© 2017 – Timothy Riecker, CEDP

Emergency Preparedness Solutions, LLC

Public Area Security National Framework

Tim Riecker, The Contrarian Emergency Manager Leave a comment

The Transportation Security Administration (TSA) recently released this report in cooperation with a variety of stakeholders which provides information and guidance on preparedness, prevention, and response activities to strengthen the public spaces of transportation venues.  While the focus of the document is on airports, the information in the document is great not only across all transportation venues, but other public spaces as well.  I think there are great takeaways for other areas of vulnerability, such as malls, convention centers, event spaces, and others.

To be honest, there is nothing particularly earthshattering in this document.  The document is brief and identifies a number of best practices across emergency management and homeland security which will help agencies and organizations prevent, protect, prepare, and respond to threats, particularly attacks.  That said, the document does accomplish providing concise information in one document on key activities that absolutely should be considered by entities which control public-access spaces.  I would also suggest that this document is still 100% relevant to those which have some access controls or entry screenings.

Information in the document is segmented into three key tenets: Information Sharing, Attack Prevention, and Infrastructure and Public Protection.  Within these tenets are found recommendations such as relationship building, communication strategies, vulnerability assessments, operations centers, planning, training, and exercises.  Most of the recommendations provide examples or leading best practices (although no links or sources of additional information, which is a bit disappointing).

The framework is worth a look and can probably serve as an early foundation of activity for those who haven’t yet done much to prepare their spaces for an attack.

© 2017 – Timothy Riecker, CEDP

Emergency Preparedness Solutions, LLC