The National Strategy for Countering Weapons of Mass Destruction Terrorism

Earlier this month, the White House released a short document titled The National Strategy for Countering Weapons of Mass Destruction Terrorism.  This is a document I’m not sure we needed, and certainly does not meet the expectations of a national strategy document.  While it does outline eight distinct ‘lines of effort’ (objectives), which identify the priorities of this overall strategy, it provides no new approaches and very little substance, even for a national strategy document.

Those Lines of Effort are:

  • Deny terrorists access to dangers materials, agents, and equipment
  • Detect and defeat terrorist WMD plots
  • Degrade terrorist WMD technical capabilities
  • Deter support for WMD terrorism
  • Globalize the counter-WMD fight
  • Strengthen America’s national defenses against WMD terrorism
  • Enhance state, local, tribal, and territorial preparedness against WMD terrorism
  • Avoid technological surprise

The lines of effort are solid and practical, but are activities which are already taking place and are generally proven best practices.  Though most of the descriptions for each of the lines of effort are a page or less, making the whole document read more like an executive summary.  Most strategic plans usually identify some key activities (strategies) associated with each objective, which in this document are uninspiring and buried in narrative.  As mentioned previous, there are also no new information or novel approaches in this document.  It seems like it was prepared by an intern who was directed to synthesize some background information for a meeting.  A well-developed strategy is something that can be referenced in future related activities, but this document is so unremarkable, it really doesn’t seem to matter much.  Had direction been given to the National Security Council or the Department of Homeland Security, I’m confident that their subject matter experts could have developed a document that is much more meaningful.  This document was a swing and a miss, providing us with nothing new or tangible in our efforts to counter WMD.

What are your thoughts?

© 2018 – Timothy Riecker, CEDP

Emergency Preparedness Solutions, LLC

Changing The Lexicon on Terrorism Preparedness, Response, and Recovery

A couple months ago I posted about NFPA 3000: Standard for Active Shooter/Hostile Event Response Program.  Soon after posting, I ended up purchasing a copy of the standard and, combined with other readings and discussions, am fully bought into not only this standard but a change in our lexicon for this type of incident.

NFPA3000

First off, in regard to NFPA 3000, it’s not rocket science.  There is nothing in this standard that is earth shattering or itself wholly changing to what we do or how we do it.  But that’s not the intent of NFPA standards.  NFPA technical committees compile standards based upon best practices in the field. The standards they create are just that – standards.  They are a benchmark for reference as we apply the principles contained therein.  NFPA 3000 provides solid guidance that everyone in EM/HS should be paying attention to.

What NFPA 3000 has helped me realize is that our focus has been wrong for a while.  Terrorism isn’t necessarily the thing we need to be preparing for.  Why?

First, let’s look at what is generally referenced definition of terrorism in the United States.  This comes from Title 22 Chapter 38 US Code § 2656f.  It states that terrorism is “premeditated, politically motivated violence perpetrated against noncombatant targets by subnational groups or clandestine agents’.  Note that the definition focuses on motive more than action or consequence.  While motive is very important in prevention/intelligence and prosecution, it is far less important to most preparedness, response, and recovery activities.

The term ‘active shooter’ has been used quite a bit, yet it’s not a good description of what communities and responders can face when we consider that perpetrators could use means and methods instead of or in addition to firearms.  We’ve seen a wide variety of these instances that involve knives, vehicles, improvised explosives, and more.

This is why I prefer the term ‘active shooter/hostile event response’ or ASHER.  While the term has been around for a bit (a quick internet search shows references going back to at least 2013), NFPA 3000 has essentially canonized it in our lexicon.  The definition provided in NFPA 3000 is focused on the incident, rather than the motivation, and is comprehensive of any means or methods which could be used.  That definition is – Active Shooter/Hostile Event Response (ASHER): An incident where one or more individuals are or have been active engaged in harming, killing, or attempting to kill people in a populated area by means such as firearms, explosives, toxic substances, vehicles, edged weapons, fire, or a combination thereof.

When it comes to preparedness, response, and recovery ASHER is the focus we need to have.  Motivations generally make little difference in how we should respond.  We should always be looking for secondary devices or other attackers – these are not features unique to terrorist attacks.  As we do with any crime scene, we should always be mindful of evidence that can lead us to the motives and potential co-conspirators of an attacker.  That’s important for investigation, prosecution, and the prevention of further attacks.  Does the term ‘terrorism’ still have a place?  Of course it does.  In our legal system, that’s an important definition.  Philosophically, we can argue that all attacks are acts of terror, but because of the legal definition that exists of terrorism, we can’t – at least in the US.

I encourage everyone to start making the move to changing the lexicon to ASHER where appropriate.  It makes sense and gives us the proper perspective.

© 2018 – Timothy Riecker, CEDP

Emergency Preparedness Solutions, LLC ™

New Jersey Terrorism Threat Assessment – A Model for the Nation

Earlier in the month, the New Jersey Office of Homeland Security and Preparedness released their 2018 Terrorism Threat Assessment.  This unclassified document gives an outstanding review of matters of interest to the State of New Jersey, with relevant information no matter where you are in the US, or any other nation.  While the focus early in the document is specifically relevant to New Jersey and surrounding states, much of the document provides outstanding information and brief case studies on groups such as homegrown violent extremists (HVEs), domestic terror groups, international terror groups, and more.

Terrorism rarely pays attention to borders, especially those within the nation.  While some areas, particularly those with higher populations and higher value targets, have a greater risk profile than others, we’ve seen that terrorists, in the broadest definitions, can live, train, and execute attacks anywhere in the nation – from unincorporated lands, to small towns, to major metropolitan areas.

The document highlights the threat of HVEs, traditionally inspired, but not directly supported by larger terror groups or movements.  These tend to be lone wolves or small cells, having such a small footprint, they often leave intelligence for law enforcement to trace.  The document also mentions a changing trend in militia groups.  Several groups have been seen to change behaviors, seemingly to align with the government or law enforcement, but in actuality chasing their own vigilante agendas.

I encourage everyone who is interested to review this document.  The content is current, relevant, and informative.  I think it’s a model for states and communities around the nation, providing an excellent snapshot of the current landscape of terrorism.

© 2018 – Timothy Riecker, CEDP

Emergency Preparedness Solutions, LLC

Defining Terrorism

It seems odd that in 2017 we still need to be clear about what constitutes an act of terrorism.  For context, last night, the horrible shooting in Las Vegas occurred.  At the time of writing this, it’s already been the most fatal shooting in US history.  This is a horrible incident that, as usual, I’m not going to Monday morning quarter-back, as so much is still developing in the aftermath.

What I will comment on are statements by media outlets and ‘experts’, many of which proclaimed once it was released that the perpetrator of this crime was an older white guy local to the Las Vegas area, that this was not an act of terrorism.  So let’s clarify against stupidity, ignorance, and general bullshit.  While there are a variety of definitions of terrorism that can be found, no definition worth its salt includes any pre-determined profile based upon race, age, gender, religion, sexuality, nationality, or skin color.  Those factors alone have nothing to do with determining if an act was or was not terrorism.

The most common definition referenced in the US is what is known as the ‘FBI definition’.  This definition actually comes from a section of the US Code of Federal Regulations (28 CFR 0.85) which outlines the general functions of the Director of the Federal Bureau of Investigation.  In the Code, terrorism is defined as ‘the unlawful use of force and violence against persons or property to intimidate or coerce a government, the civilian population, or any segment thereof, in the furtherance of political or social objectives’.

It seems easy in these times to decry any act of violence as terrorism or, similarly, to dismiss certain acts because they are perpetrated by some old white guy with no known agenda.  Both of these actions would be wrong without further evidence.  The FBI definition focuses on motive and intent.  While the results of the incident may certainly be intimidating or coercive, the motivation may not have been to accomplish that – it may have been, not to understate any act of violence, simply to kill people.  It may not have necessarily been motivated by any specific social, political, or religious extremism.  At this moment, there has been no publicly-released information indicating that this person acted to ‘intimidate or coerce a government, civilian population, or segment thereof in furtherance of political or social objectives.’  But that could change at any moment.

In the hours and days ahead, more details will be uncovered on the perpetrator of this crime and their possible motives.  Some people simply want to call it terrorism so they have a label for it or because they think that the crime is somehow elevated by calling it terrorism.  Over 50 were killed and over 500 were injured.  Whatever label you apply doesn’t make the crime any better or worse.  It’s still horribly tragic.  Some people, particularly those with pre-conceived notions of what is or is not terrorism, will hold that this couldn’t possibly be terrorism because it was committed by an older, local, white guy; and not a radicalized individual from the middle east.  Assumptions either way are dangerous.

Regardless of how the investigation shakes out and what labels may be applied to this act, the loss of life and impact to families and loved ones is horrific.  Let us all take some time to consider that and what must be done to prepare for and prevent further mass shootings such as this.

No matter what the disaster is, be informed!

© 2017 – Timothy Riecker, CEDP

Emergency Preparedness Solutions, LLC

Public Area Security National Framework

The Transportation Security Administration (TSA) recently released this report in cooperation with a variety of stakeholders which provides information and guidance on preparedness, prevention, and response activities to strengthen the public spaces of transportation venues.  While the focus of the document is on airports, the information in the document is great not only across all transportation venues, but other public spaces as well.  I think there are great takeaways for other areas of vulnerability, such as malls, convention centers, event spaces, and others.

To be honest, there is nothing particularly earthshattering in this document.  The document is brief and identifies a number of best practices across emergency management and homeland security which will help agencies and organizations prevent, protect, prepare, and respond to threats, particularly attacks.  That said, the document does accomplish providing concise information in one document on key activities that absolutely should be considered by entities which control public-access spaces.  I would also suggest that this document is still 100% relevant to those which have some access controls or entry screenings.

Information in the document is segmented into three key tenets: Information Sharing, Attack Prevention, and Infrastructure and Public Protection.  Within these tenets are found recommendations such as relationship building, communication strategies, vulnerability assessments, operations centers, planning, training, and exercises.  Most of the recommendations provide examples or leading best practices (although no links or sources of additional information, which is a bit disappointing).

The framework is worth a look and can probably serve as an early foundation of activity for those who haven’t yet done much to prepare their spaces for an attack.

© 2017 – Timothy Riecker, CEDP

Emergency Preparedness Solutions, LLC

A Review and 3 Highlights of the DHS Active Shooter Preparedness Workshop

Last month I had the opportunity to attend a day-long active shooter workshop in Rochester, NY conducted by the DHS Office of Infrastructure Protection.  The focus was awareness of, preparedness for, and response to an active shooter event, with a lean towards a facilities-based audience rather than public safety.

The workshop began with discussions on recognition, then worked through each of the five mission areas (Prevention, Protection, Mitigation, Response, and Recovery).  The primary speaker was excellent, with real-world experience in active shooter situations.  While they referred to the offering as a pilot, the workshop has been around for a few years in various versions.  Understandably, and unfortunately, it’s difficult for the workshop to keep up with lessons learned from recent events.

As mentioned, the workshop weaves through the five mission areas, rather awkwardly trying to also align with the CPG 101 planning process.  I’m not sure that the two really fit well and it was clearly something new to the course, as the primary speaker missed some of the indicators for activities.  The workshop agenda also fell short, with the facilitators clearly offering a higher than usual number of breaks and of longer than usual length to maintain the workshop as a full day.

The activities were table-based, and focused on the primary steps as outlined in CPG 101, with the goal of giving some ideas and structure to the creation of an active shooter preparedness plan for a facility.  Ideas and discussion generated at our table and others were great, as attendees came from a broad array of facilities, such as schools, night clubs, health care, office buildings, and others.  The most disappointing comments were those about roadblocks people faced within their own organizations in planning and other preparedness activities for active shooters.  There is clearly a lot of denial about these incidents, which will only serve to endanger people.

With a number of public safety professionals in attendance, there was some great reflection on coordination with public safety in both preparedness and response.  One of the gems of the workshop was the number of audio and video clips provided throughout.  The segments included media and 911 clips, as well as post incident interviews with victims and responders.  The insight offered by these was excellent and they were a great value add.

Three pieces of information resonated above all others in this workshop:

  • Run, Hide, Fight (or variants thereof) was stressed as the best model for actions people can take in the event of an active shooter.
  • The inclusion of planning for persons with disabilities is extremely important in an active shooter situation. They may have less of an ability to Run, Hide, and/or Fight, and this should be accounted for in preparedness measures.
  • Essential courses of action for planning include:
    1. Reporting
    2. Notification
    3. Evacuation
    4. Shelter in Place
    5. Emergency Responder Coordination
    6. Access Control
    7. Accountability
    8. Communications Management
    9. Short Term Recovery
    10. Long Term Recovery

Since the workshop was in pilot form, there were no participant manuals provided, which a number of people were hopeful to have.  They did, however, provide a CD with a plethora of materials, including references, some videos, and planning guides.  Many of these I’ve seen and used before, but some were new to me.  There was a commitment to send us all an email with a link to a download of the participant manual once it was available.  Some of those resources can be found here.

All in all, this was a good workshop.  The mix of an audience (numbering over 60, I believe) contributed to great discussion and the primary speaker was great.  The presentation materials were solid and provided a lot of context.  While I was disappointed in the lack of a participant manual and the inclusion of too many breaks, I certainly understand that this is the pilot of a redeveloped program which they are trying to keep as timely and relevant as possible.  While I already knew of many of the concepts and standards, there was some great material and discussion, especially in the context of facilities rather than public safety response.  This is a good program which I would recommend to facility owners, managers, and safety/emergency management personnel as well as jurisdiction emergency management and public safety personnel.

© 2016 – Timothy Riecker, CEDP

Emergency Preparedness Solutions, LLC Your Partner in Preparedness

A Decontamination Game Changer

Last week, the way we remove chemical contamination from victims of a terror attack or chemical accident has changed… well, not quite yet, but it should soon.  A partnership between the US Department of Health and Human Services’ (HHS) Office of the Assistant Secretary for Preparedness and Response (ASPR) and the University of Hertfordshire in England and Public Health England found that “…removing clothes removes up to 90 percent of chemical contamination and wiping exposed skin with a paper towel or wipe removes another nine percent of chemical contamination.  After disrobing and wiping with a dry cloth, showering and drying off with a towel or cloth provides additional decontamination, bringing contamination levels down 99.9 percent.”

100_2534

Essentially, what they discovered was that despite recommendations for doing so, victims have often not been required to disrobe for decontamination.  When victims would progress through a decontamination (water spray down), much of the chemical they have been exposed to remains in the clothing and trapped against the skin.  Clearly this is not effective.

I see this new methodology being a significant change to how we decontaminate victims.  As the study hypothesizes, decontamination is much more effective when the chemical is wiped from the body after the victim disrobes.  Following this, they may progress then through a water spray.  This, essentially, adds a step to the typical protocols used in North America, Europe, and other locations.  I’m told the wipe methodology has been used in Japan for some time now.  I also believe that wipes have been in use by the US (and other) military forces for units in the field.

Links of interest:

HHS Press Release on the study.

Implementation of new protocols in the UK and other European nations

Many thanks to my colleague Matt for passing this information on to me.

As with any new procedure, the devil is in the details.  Standards must be established and adopted, supplies and equipment must be identified and obtained, personnel must be trained, and exercises must be conducted to validate.

I’m interested to hear opinions on these findings and recommendations, as well as thoughts on implementation in the US and abroad.

© 2016 – Timothy Riecker, CEDP

Emergency Preparedness Solutions, LLC Your Partner in Preparedness

 

DHS Says Low Risk of Destructive Cyberattack

Published in The Hill yesterday, this article states that a DHS intelligence assessment rates a destructive cyberattack on the US energy grid as a low threat.  While I’m not a cybersecurity expert, this just doesn’t sit right with me.  So many other sources are talking about how serious of a threat a cyberattack is, especially the destructive impacts on infrastructure.  It seems pretty short sighted to think that criminal hackers will only enter systems to poke around and look for information.

The article cites that this is from a ‘leaked’ intelligence assessment.  Let’s hope they have their information wrong.

TR

~Edit~

About two hours after posting this, I read an article on Homeland Security Today which blows away the premise of the supposed DHS intelligence assessment.  Worth reading.

TR

7 Emergency Management Priorities for the Next Administration

Heritage.org recently published a piece outlining the top four homeland security priorities for the next administration, which can be found here.  It’s a thought provoking article that certainly identifies some important issues.  In the same spirit, I’d like to offer what I think are the emergency management priorities for the next administration.

1) Support an Effective FEMA Organizational Model

The Heritage.org model pointed out several issues with the DHS organization that need to be addressed sooner rather than later.  I’d like to add some FEMA-specific items to their suggestions, regardless of if FEMA is kept within DHS or not (honestly, I think that ship has sailed and FEMA is there to stay).

In building a bit of background for this article, I took a look at FEMA’s current strategic plan, knowing that the document already identifies some of their priorities.  Within in that list of priorities, they mention mission and program delivery, becoming an expeditionary organization, posturing and building capability for catastrophic disasters, and strengthening their organizational foundation.  To me, these four all directly relate to their organizational model.

Along with having a strong central administration of programs, FEMA needs to have agility in their program delivery.  This is best accomplished through the FEMA regional offices, which act as an extension of the ‘central administration’ by coordinating directly with states and neighboring regions to apply those programs in the best possible manner within the guidelines of the program.  While this is currently performed, it is not performed to the greatest extent possible.  John Fass Morton provides some great perspective on this approach in his book ‘Next-Generation Homeland Security’.  Info on the book can be found here.

2) Bolster Risk Reduction Programs

I write often about preparedness, as that has always been a focus of my career.  Risk reduction, however, is essential to eliminating or reducing the impacts of hazards on communities.  Risk reduction includes all aspects of hazard mitigation and resilience, which are ideally applied at the local level but supported by state and federal programs, policies, and resources.

While the National Weather Service has implemented and promoted the StormReady program, which encourages community resilience, the best program we have ever had in our field is Project Impact.  I’d love to see a revival of Project Impact (call it that or something else – I don’t really care), incorporating the concepts of StormReady as well as other best practices in risk reduction.  A big part of this program MUST be incentivization, especially access to funds that can be applied for in the present for hazard mitigation activities.

3) Build a Better Cybersecurity Program

This item was added to the list by a colleague of mine.  It’s also found on the Heritage.org list.  It must be pretty important, then.

Yes, there are a LOT of initiatives right now involving cybersecurity, but I think there can be more.  Jon, the same colleague who suggested this for my list has also stated repeatedly that cybersecurity is really a Core Capability that cuts across all mission areas – Prevention, Protection, Response, Mitigation, and Recovery.  The recent update of the National Preparedness Goal suggests this, but sadly doesn’t commit.

What do we need in regard to cybersecurity?  First of all, we need to demystify it.  There are plenty of people out there who have just enough tech savvy to turn on their computer, send some email, and post to Facebook.  While that may work for them, they are likely intimidated by talk of cybersecurity, hackers, and the like.  We need to continue programs in plain speak that will help to inform the average consumer about how to protect themselves.

Better coordination with the private sector will pay off heavily when it comes to cybersecurity.  Not only is the private sector generally better at it, they also have a tendency to attract experts through better incentives than the government can offer, such as higher pay.  Cybersecurity also impacts everyone.  We’ve seen attacks of all types of systems.  The only way to stop a common enemy is to work together.  Let’s think of it as a virtual whole-community approach.

4) Prepare for Complex Coordinated Attack

Another of Jon’s suggestions.  While terrorism is often quickly shoved into the category of homeland security, there is a lot that emergency management can assist with.  These types of attacks (think Mumbai or Paris) have a significant impact on a community.  They require a multi-faceted approach to all mission areas – again, Prevention, Protection, Response, Mitigation, and Recovery.  While law enforcement is clearly a lead, they must be strongly supported by emergency management as part of a whole-community approach to be successful. Preparedness across all these mission areas must be defined and supported by federal programs.

5) Infrastructure Maintenance

We have roads, bridges, rail, pipes, and other infrastructure that MUST be maintained.  Maintenance (or replacement) will not only prevent failure of the infrastructure as a disaster itself, but will also make it more resilient to impacts from other disasters.  Yes, these are projects with huge price tags, but what alternative do we have?

6) Continuity of Existing Model Programs

There are few things more infuriating than a new administration wiping the slate clean of all predecessor programs to make room for their own.  While every administration is entitled to make their own mark, getting rid of what has been proven to work is not the way to do that.  Eliminating or replacing programs has a significant impact all the way down the line, from the federal program administrators, to the state program people, to the local emergency managers who are often understaffed and underfunded to begin with.

Changing gears is not as simple as using a different form tomorrow, it requires research and training on the new program and costs time to re-tool.  While I would never say there is nothing new under the emergency management sun, as I believe we are still innovating, I’m pretty skeptical of some new appointee walking into their job and making wholesale changes.  While improvements can certainly be made, summary execution of successful programs does no one any good.  Let’s not make change simply for the sake of change.

Related to this, I fully support the efforts of FEMA in the last few years to gain comprehensive input on changes to documents and doctrine through the formation of committees and public comment periods.  This approach works!

7) Pull Together Preparedness Programs

NIMS, HSEEP, NPG, THIRA, etc… While each of these programs have their own purpose and goals, more  can be done to bring them together.  I’m not suggesting a merger of programs – that would simply make a huge mess.  What I’m suggesting is to find the connections between the programs, where one leads to another or informs another, and highlight those.  Things like better application of the Core Capabilities within HSEEP exercises to have a more effective evaluation of NIMS capabilities (I suggested this while being interviewed for a GAO report), or referencing the THIRA when building a multi-year training and exercise plan.  While some jurisdictions may already do this, these are best practices that should be embraced, promoted, and indoctrinated.  These links typically don’t add work, in fact they capitalize on work already done, allowing one project/program/process to be informed or supported by another, creating efficiencies and supporting a synchronization of efforts and outcomes.

There is my list of seven.  What are your thoughts on the list?  There are certainly plenty of other ideas out there.  If you had the ear of the next President, what would you suggest be their administration’s emergency management priorities?

© 2016 – Timothy Riecker

Emergency Preparedness Solutions, LLCYour Partner in Preparedness

FBI vs Apple – iPhone Security

The struggle over encryption and device security continues.  This time it’s more visceral, representing the most relevant case on the side of criminal justice yet.  In the wake of the San Bernardino shooting, the FBI is seeking to gain access to an iPhone discovered in the vehicle where the shooters made their last stand with law enforcement.  The FBI is hoping to find additional evidence on this phone – phone records, emails, texts, etc. that might lead them to information on other conspirators of the attack, other potential targets and attackers, and anything else that might lead to prosecuting those involved in this attack or stopping future attacks.  Gaining access to this information is obviously extremely important.

The problem – the phone is locked with a passcode, and the FBI doesn’t know what that code is. While trial and error is certainly a viable methodology, Apple’s architecture limits passwords attempts to 10.  Once the tenth attempt fails, the iPhone will go into a sort of self-destruct, wiping all data from the device.  The FBI needs help, and they are seeking it from Apple.  Apple declined requests and is now being compelled by a federal judge who ordered Apple to assist the FBI in gaining access to the phone.  Apple is fighting the order – but why?

First of all, Apple states there is no ‘back door’ into their system that will allow them to bypass a security code.  On principal, they decided not to create one since if it exists, it can be exploited.  Based upon this, the FBI has requested that Apple at least disable the 10 attempt fail safe in the iOS programming, allowing the FBI to press on with many more attempts to crack the code.  Apple continues to refuse, again citing the potential for someone with criminal intent exploiting this.  Essentially, Apple feels they are protecting their customers from criminal acts and loss of personal information.  The CEO of Google recently voiced support for Apple’s stand.

This debate poses two strong arguments, each pulling at our values.  On one side, we need to support the efforts of law enforcement to prevent, protect, and prosecute.  The evidence gathered from a situation such as this can potentially lead to finding co-conspirators in these horrible shootings, and can potentially stop other crimes from occurring.

On the other side, there is also concern over preventing future criminal activity by those who would steal information.  Keeping in mind that what we have on our phones is not only a browsing history and Disney World selfies, but also private information such as bank accounts, and even access to business information; the theft of which can be devastating to individuals and entire organizations.

There are valid arguments on both sides, and consequences to action and inaction all around, with implications much broader than this one case.  I’m interested in seeing how this shakes out.

What are your thoughts?

© 2016 – Timothy Riecker