Book Review – Failures of Imagination by Michael McCaul

Failures of Imagination: The Deadliest Threats to our Homeland – and how to Thwart Them by Michael McCaul.  A few months ago I put up a short post when I heard about this book coming out.  I speculated a bit on what I anticipated and fortunately those were good assumptions.

Michael McCaul is chairman of the House Homeland Security Committee.  Congressman McCaul (R-TX) has served with the US Department of Justice and was chief of Counterterrorism and National Security for the US Attorney’s Office in Texas.  Along with chairing the House Homeland Security Committee, he is also a member of the Committee on Foreign Affairs.  The background all contributes to some interesting insights and perspectives on the threats our nation faces.  Several of those threats have been presented to us in this book. FoI

Failures of Imagination presents several scenarios including an attack on our seat of government, a radiological dispersion device (RDD), foreign influence on an election, a mass shooting in a public space, a cyberattack on finance and infrastructure, a bioterrorism attack, an airplane bombing, and an invasion by foreign powers.  Each scenario is introduced with what I will term a short story, followed by a fictionalized executive situation report, and concluded with a factual review of how the scenario is plausible.

The short stories that introduce each scenario are fairly compelling.  They read like any popular thriller novel, establishing two or three converging story lines with a brief bit of character development which quickly establish motive, plot, and execution.  The timelines are set anywhere from two to 10+ years from now.

With the those scenarios set further in the future, I feel the author has taken some liberties assuming that little has changed in comparison to the current global politics and state of affairs, but that doesn’t bother me too much.  I expect that some readers might feel these fictionalized stories sensationalize the scenarios a bit.  While on the surface that is understandable, consider that the plots as they unfold in these stories may not be far from reality, and that the Congressman has discovered that a mix of fiction and non-fiction can help enhance the readers’ experience and sell more books.  Also consider that we often do the same thing when doing scenario-based planning, training, and exercises.

As a follow-on to each scenario’s short story, a mock executive-level situation report is provided which gives an overview of the impacts of each scenario as presented in the short story.   The basis of this is something we also do in many of our preparedness efforts as we try to gauge a realistic scope of impact.  The Congressman outlines in many of these not only the casualties, but broader impacts such as those to the economy, and takes some realistic stabs at longer term recovery matters.  These situation reports give a good perspective to the reader about the potential impacts of each scenario beyond the more narrow scope of the short story.

Lastly, McCaul provides some narrative on how each scenario presented is rooted in reality.  These summaries provide information on the current situation as it relates to each scenario, typically regarding the modus operandi of certain terrorist groups or state sponsors of terrorism, relationships these groups may have with each other across the globe, and weaknesses in our own security construct which may permit these groups to gain access to the US and do us harm.  While much of the information and recommendations provided by Mc Caul in these sections are factual, practical, and eye-opening, I have to admit that I was significantly turned off by several instances of what I can only call antagonistic political finger pointing.  While I don’t disagree with what the Congressman was saying about certain policies and actions of other elected officials which have influenced our ability to prevent, protect, and prepare for these types of attacks, the messages often came across as snarky and partisan – something I have little patience for, especially in this election cycle.

Failures of Imagination certainly delivered.  While the focus of this book is on threats to the US, I would suggest that the foundational issues identified can apply to most nations and are a good read for anyone in emergency management and homeland security.  The short stories included in each scenario feed our desire to be entertained and contribute to the book being a quick read.  While the scenarios overall don’t serve as much of a resource for emergency management planning, as many of these types of scenarios are already in use in our efforts, the book does provide some context for each scenario which could be referenced, especially in regard to impacts.  Of most importance are the recommendations which Congressman McCaul provides for each scenario.  Many of the recommendations indicate higher-level actions we as a government need to take to prevent, protect, and prepare for attacks of these types.  Increased awareness of these actions will hopefully lead to development, funding, and implementation.

© 2016 – Timothy Riecker

The Force Awakens – A Potential Soft Target?

“There has been an awakening.  Have you felt it?”  This line from the first trailer of the new Star Wars movie is chilling.  Many of my readers are aware that I am a HUGE Star Wars fan.  As you would expect, I am incredibly excited about the release of Star Wars: The Force Awakens next week.

download

Image courtesy of Disney and Lucasfilm Ltd.

With the recent terror attacks and shootings, though, safety at the theater has certainly been on my mind.  We need to work together as a whole community – theater goers, theater owners/managers and staff, law enforcement, and municipalities.

When I first starting thinking about writing a post on this, I quickly realized that I needed some input from an expert in security.  I reached out to a colleague that not only has the qualifications, but is also a fellow blogger and consultant: Ralph Fisk.  You can find Ralph’s blog here: https://fiskconsultants.wordpress.com/.  He has some great insights on security and risk assessment matters – I strongly suggest you check out his blog, follow, participate, etc.  Ralph agreed to collaborate on a piece related to this global event.  He is also posting this same article on this blog.  Enjoy – and May the Force be With You!

– TR

~

(This article, cross-posted and co-authored by Ralph Fisk and Tim Riecker, draws collectively on our experiences and expertise to provide guidance to municipalities, theaters, and movie goers on awareness, preparedness, and response concerns as we look toward this global event.)

The rapidly approaching release of Star Wars: The Force Awakens stands to be the largest premiere in theater history.  It has already broken a multitude of pre-sale records, with more records certainly to be broken on opening day and opening weekend, both domestically and internationally.  Even if you aren’t a Star Wars fan, you must certainly be at least aware of a new movie being released.  But what does this have to do with emergency management and homeland security?

On July 20, 2012 James Eagan Holmes killed 12 and injured 70 others when opening fire on patrons in an Aurora, CO theater.  This mass murder took place at the midnight premiere of the Batman film The Dark Knight Rises. The recent terrorist attacks in Paris involved a music venue, in which nearly 100 people were killed.  Gathering places like movie theaters are just one more item on the list of potential soft targets for people wishing to do harm, be they terrorists, disgruntled, or disturbed.

IMDB provides a listing of international release dates for The Force Awakens here.  We caution that this list isn’t entirely accurate.  For example, while December 18th is the official release date of The Force Awakens in the US, thousands will be seeing the movie at a select list of theaters participating in a 7pm special premiere time on the 17th.  While you should certainly be aware of the date and time of this premiere at your local theaters, it should be emphasized that theaters will be packed with fans for some time.

While there are no credible threats involving this premiere that we are aware of, municipalities, theaters, and movie goers all need to be aware of the potential for an attack and what each can do.  Surprisingly, despite high visibility active shooter and terrorist events of the past few years, most municipalities still do not have appropriate preparedness measures in order.  While there isn’t time to assemble a solid response plan prior to the premiere of The Force Awakens, there is still plenty of time for beneficial, albeit ad-hoc preparedness efforts.

Our thoughts are below…

With the release of the much anticipated next chapter of the Star Wars Saga, The Force Awakens; theaters and local first responders need to have a heightened level of awareness. There are a number of potential threat indicators associated with this release:

1)            Of course the current terrorism threat situation is first and foremost in our minds

2)            The history of an Active Shooter Attacks on movie theaters goes back to 1989 during the screening of Harlem Nights in Chicago, Sacramento, and Richmond California; on 20 July 2012 during the midnight release, in Aurora, Colorado, of the much anticipated film – Batman: The Dark Knight Rises; another Active Shooter Incident that involved another movie theater in Lafayette, Louisiana on 23 July 2015 during the screening of Train Wreak.

3)            But also other considerations should be given to just the more than “normal” volume of theater goers, and which possible incidents could result from that.

Theaters are known to be soft targets and as such we need to be aware of the threat and how to address it.

We are going to cover the first two indicators listed above as they are not only the largest possible casualty producers, but also pose the greatest immediate impact.

Below are some suggestions and considerations for an ad hoc plan not just for the venues featuring these events; but also for those that maybe in attendance.

Introduction:

Most Active Shooter Incidents, an estimated 90%, are single actor attacks, meaning unless that person has been overt in their planning, little is known about the possibility of an Active Shooter Attack;

Unlike Terrorist Cells; which typically contain up to 4 – 6 members, not just for ease of control and planning, but also for the strict adherence to Operational Security, on the part of the Terrorists.

The difference between the two attacks may appear to be subtle to the uninitiated;

The main goal of an Active Shooter incident is to cause as much destruction as possible in a very short time span; Active Shooter incidents are different from other weapons related crimes in that they intend to commit mass murder.

Terrorist Attacks however have a very distant signature. They are commented for a number of political or ideological reasons; and may result in mass murder or hostage taking. Terrorist attacks may seem very methodical in nature of the execution.

Terrorism:

Terrorism is all around us, whether we chose to look for it or not. Terrorist Groups tend to fall into one of six different categories;

  • Nationalist/Separatist – Sometimes referred to as Freedom Fighters
  • Religious – and we are not just talking about Radical Islamic terrorists here
  • Political – which include; right and left-wing
  • Anarchist – Freedom without the burden of a Central Government
  • ECO/Animal Rights – Motivated by Environmental/Animal Political Policies
  • Single Issue Causes – involves the use of force and violence for the purpose of coercing a government and/or population to modify its behavior with respect to a specific area of concern. Typically, these types of organizations do not have an overall political agenda

Which any number of these groups with related or different causes are already operating in the heart of the Country. Terrorist Attacks could have one or more of these four main objectives;

  • Recognition of the groups’ cause or purpose
  • Coercion toward the populace and/or government to the groups’ ideology
  • Intimidation to cause fear or terror; to cause the populace to lose faith in their governments’ ability to protect them
  • Provocation: attacks are aimed to cause the ruling government to take repressive actions against the population; demonstrate the weakness of the government and the strength of the terror organization

It would be almost impossible to go into the ideology of every single group. Suffice it to say, that they all mean to get their points across, sometimes with protesting, sometimes with criminal destruction of property, and yes, sometimes they will introduce violence.

Violence could be in almost any form imaginable. The most used form of violence directed towards a population tends to lean toward Armed Attacks and/or Bombings (Including suicide bombings); because for the most part these are relatively inexpensive approaches, the logistics to effect these types of attacks are relatively easy to obtain and these tend to produce the most casualties and incite the most fear in the general population. Between 1998 and 2007 out of the estimated 28000 terrorist attacks around the world, almost 21000 involved one of these two types of tactics.

Other terror techniques also used could include; Assassination, Arson, Hijacking, Hostage Taking, Kidnapping, Sabotage, Seizure, Sniper Attacks/Mass Shootings, Threats or Hoaxes, Cyber Terrorism, Agricultural Terrorism, Civil Disturbances and Weapons of Mass Destruction (WMD). WMD is the use of any weapon or device that is intended or has the capability to cause death or serious bodily injury to a significant number of people through the release; dissemination; or impact of one of the following means; Toxic or poisonous chemicals or their precursors; diseases, biological organisms; radiation or radioactivity.

Combined attacks of different types have also been used in the recent past. The attacks on the United States on 11 September 2001 included the use of Airplanes as Weapons of Mass Destruction; the Terrorists Hijacked the planes through the use of an armed attack, albeit the arms were box-cutters, and crashed the planes into buildings causing the planes themselves to be used as WMD’s

Terrorists seek to create public fear and anxiety in order to influence government policy. Through the randomness and unpredictability of their acts, terrorists attempt to undermine confidence in government’s ability to protect the public. Terrorists hope the resulting insecurity fuels public demands for government concessions in order to stop the terrorist acts.

Today, as has been evident with recent terror attacks and attempted attacks, terrorist target selection wants to affect the maximum number of innocent people, in order to generate the fear, they desire. As the government has mobilized to protect our infrastructure from attack, our less protected target; schools, universities, shopping malls, et al., become more attractive targets.

As other sites and venues are “hardened” for security, these measures cannot be implemented across all avenues of society. One, it would infringe on our basic constitutional rights, two, the potential cost associated with “hardening” every facility would surely bankrupt the organization or governmental body imposing such restrictions, and three, we would become a “jailed” society.

Planning for terror incidents doesn’t require you have access to CIA, FBI or other intelligence organizational files, it, for the most part, only requires Common Sense, Situational Awareness of your surroundings, and a Communications Plan.

Some things to take into consideration when you’re making your plans to be in these potential soft target environments:

  • Remain Alert
  • Develop an informed vigilance; meaning, know what possible terror threats could be in your area or the area you’re going to
  • Let someone, not going with you, know your plans; where you’re going; when you expect to return
  • Attempt to blend in with your surroundings, Don’t try to stand out
  • Know your surroundings; Know how to exit the area you will be in; what is the shortest way out; have an alternate plan should that not be a viable opinion should there be an issue
  • Communicate that information to your family and others with you
  • Identify a meeting place if you become separated

Report any suspicious activity. Again remember to use your common sense; examples of suspicious actions could include:

  • People loitering in the same general area without a recognizable legitimate reason; people who appear preoccupied with a specific building or area; electronic audio and video devices in unusual places
  • Just because someone seems to belong there, they might not be whom they seem especially if they are exhibiting any of the actions stated above
  • DO NOT TRY TO DEAL WITH ANY INDIVIDUAL YOURSELF contact the venue security or Law Enforcement Personnel
  • Look for things out-of-place; bags left unattended; packages; persons attempting to conceal items either on their person or receptacles

In threatening situations, take steps to reduce your exposure – leave the immediate area

If an incident does occur; follow the instructions of venue staff, emergency personnel and first responders.  If you are close to the incident walk away with your hands visible.  Walk, do not run as secondary injuries can occur to you or others; move toward the walls as people evacuating a building tend to gravitate in the center

Active Shooter:

Although mass killings have been around for some time, Active Shooter incidents have only relatively recently come into the main stream. I’m not going to mention them as most of you reading this post know the infamous locations of these horrific incidents.

 The National Tactical Officers Association defines an Active Shooter as:

  • One or more subjects who participate in a random or systematic shooting spree
  • Demonstrating their intent to continuously cause serious physical injury or death to others
  • Their overriding objective appears to be that of mass murder, rather than some other criminal conduct such as robbery, hostage taking, etc.
  • In most cases some type of firearm is used, however, the Active Shooter may use any weapon that may be available
  • A suspect is considered an active shooter if he or she is still actively shooting, has access to additional potential victims, and has a willingness to harm others until stopped by authorities or his/her own suicide

Most Active Shooter incidents are often over within 10 to 15 minutes, in a 2012 FBI Active Shooter report, 37% of Active Shooter incidents last under five minutes, before law enforcement arrived on the scene, individuals must be prepared both mentally and physically to deal with an active shooter.

We will cover some very basic steps to plan for, react to and recover from an Active Shooter Incident. As with every planning recommendation I give; this is not all inclusive, I would highly recommend you attend an Active Shooter Training Seminar or ask for a visit from your local law enforcement organization that can give you a block of instruction on Active Shooter.

No matter where you find yourself, at work, in a restaurant, or any other venue where people congregate, you could very well be a target for an individual or individuals’ intent on causing great harm.

First rule in any Emergency Situation, Active Shooter included;

YOU ARE THE MOST IMPORTANT PERSON IN THE EQUATION! YOUR SAFETY IS PARAMOUNT!

I have talked numerous times about maintaining your situational awareness. When you arrive at any venue take a few seconds to find the exits; which one is closest to you; how will you evacuate the area should you have too? What is around you that could protect you? I personally like sitting at booth tables in restaurants; with my back against a wall or other solid object: having a complete view of the whole restaurant if possible and facing the door.

Remember there are three basic fundamentals to reacting to an Active Shooter Incident;

RUN – Leave everything behind; find that exit and GET OUT! Encourage others to come with you, but if they don’t want to leave, REMEMBER YOU ARE THE MOST IMPORTANT PERSON IN THE EQUATION!

HIDE – Put as many barriers/walls between you and the shooter as you can, turn off cell phones, radios, any device that could make a noise and give up your position! Lock or block the door; hide under a desk, remain quiet and claim!

FIGHT — AS A LAST RESORT, AND ONLY WHEN YOUR LIFE IS IN IMMINENT DANGER: Act as aggressively as possible against him/her; Throwing items and improvising weapons; Committing to your actions; Attempt to incapacitate the active shooter; (EXERCISE EXTREME PREJUDICE IN YOUR ACTIONS) That last part isn’t a fancy movie catch phrase; remember you are in a fight for your life!

Once police arrive on the scene here are a few do’s and don’ts;

DON’T:

  • Run up to the police; Their first priority will be to eliminate the threat(s) and secure the scene to allow EMS to come in and assess and treat casualties
  • Avoid making quick movements toward officers such as attempting to hold on to them for safety
  • Don’t stop to ask officers for help or direction when evacuating, just proceed in the direction from which officers are entering the premises.

DO:

  • Be VERY AWARE! That once Law Enforcement Personnel arrive on the scene you may very well be considered a suspect. That is normal response protocol
  • DO AS YOUR TOLD, it is BETTER YOU PLACE YOUR HANDS OVER TOP YOUR HEAD
  • YOU may be told to get on the ground…. Just do it…… Better to be treated like a criminal at first and then cleared, than being shot. You made it that far, go home at the end of the day

Active Shooter Preparedness is also becoming a very large part of Workplace Violence Planning and Training.

Although it is good to receive some rudimentary training on Active Shooter; each organization will need to tailor their response plans to fit into their building lay out.

Corporate Climates cannot afford to have a lackadaisical approach to workplace violence, emergency response or security, this is a leadership/management issue. Corporate Leadership must take ownership of safety, emergency response and workplace violence responsibilities for their organizations and require their First-tier leaders to stress the importance of these processes and procedures, one of the first things I learned about leadership was, led by example. You can direct more people into doing what you want if you first do it yourself! If you don’t, what makes you think that the employees will!

Active Shooter Awareness has to be incorporated with emergency response planning and work place violence planning; you are setting yourself and your company up for failure by not planning, training and conducting exercises.

This next point has greatly concerned me, I have seen some reports lately that companies are being sued for conducting Active Shooter Awareness Training and most, if not all claimants say they were traumatized by the training. Well I’ll simply put it this way, would you rather have some knowledge and a sense of what to expect should you ever have to act in an Active Shooter Situation; or would you rather be a victim. A 2012 FBI Active Shooter report indicated that over 50% of Active Shooter Incidents occurred at a business.

I’d also recommend that you receive some treatment for Post-Traumatic Stress (PTSD) after the incident, as you would have seen and experienced things that no person should every have too.

Recommendations both for Active Shooter and Terror Attacks for those that may not have a developed response plan

Municipalities;

  • Consider activating, even with minimum staffing, the local Emergency Operations Center
  • Consider “up-staffing” Law Enforcement, Fire and EMS Personnel, not only the first night but a number of consecutive nights as well
  • Consider a review of local mutual aid plans (Police, Fire, EMS)
  • Consider having a Public Safety Organizational meeting prior to release

Law Enforcement Organizations;

  • Consider high visibility patrols in theater areas, not only the first night, but a number of consecutive nights as well
  • Meet with theater owners/management to discuss awareness, protocols, and expectations
  • Consider reviewing your Active Shooter and Terrorism Response Plans
  • Act immediately on any reported perceived threats
  • Consider “Up-staffing” patrol personnel
  • Consider a review of local mutual aid plans
  • Check with local FBI Field office, Joint Terrorism Task Force, or if so supported, Fusion Center; prior to release night for any updates of possible threats

Fire/EMS

  • Consider having one medical and one fire unit “staged” close to the venue
  • Consider reviewing your Active Shooter and Terrorism Response Plans
  • Consider “up-staffing” the closet Engine/Ladder/EMS Companies
  • If possible, predesignate locations for Medical and Fire Staging Locations
  • Consider Review Local Mutual Aid Plans

Theater Company

  • Consider coordinating with local law enforcement for security
  • Brief Theater Staff that will be working those nights, on Emergency Response and Active Shooter Plans
  • Maintain a Passive Security Posture the entire night; Some Passive Security measure suggestions can be found above
  • Know the limitations of the theater rooms and know when they are close to capacity
  • Assign personnel with no other responsibility but to observe theater patrons; Only in an observe and report capacity
  • Consider review of local mutual aid plans
  • All theater staff must know where all the exits are and how to lead patrons to them; remind the staff the closest exit maybe behind them

Conclusion

As a sociality we have become increasingly dangerous, in that we have to worry about the seemingly random act of an Active Shooter; although most are not random at all, but go through as many as five phases before the shooter executes his/her actions. I fear that we will continue on this path of wanton violence and the better educated you are, not to these types of incidents, but any type, the better you will be to handle the situation.

As with any planning you do, whether you’re planning for a natural disaster or human initiated events/incidents, you need to take into account your own special considerations, also keep in mind that these planning and situational mindset ideas will not always be all inclusive. Your primary focus should be on personal safety, continued situational awareness and exercise your common sense.

The world has changed over the last few decades, more than anyone of us could have ever imagined. Thirty years ago, the only emergency-related thing we had to worry about at school was the surprise annual fire drill. The escalating violence in our world and attacks on soft targets like schools, churches, and hospitals has taught us that we are no longer safe in those places we once considered as morally protected sanctuaries. We must strive to provide a safe environment for all of us.

Planning for an Active Shooter Incident

Yesterday’s email from Campus Safety magazine highlighted this article on planning for an active shooter incident.  Since this is Campus Safety magazine, the focus is on campus environments, such as colleges and hospitals, but the points in the article are applicable to any jurisdiction or organization.

Their main points, I’m happy to see, are reflective of our usual planning efforts.  (their points are listed below)

  • Engaging leadership in the process
  • Developing a collaborative effort
  • Allocating resources most effectively
  • Considering all possible hazards/threats
  • Determining the best course of action
  • Establishing a threat assessment team
  • Adopting and exercising the plan

Create an account with Campus Safety and you can download the entire document.  I was very pleased that the document indicates early on that an active shooter plan is a component of a more comprehensive emergency operations plan.  I can’t stress this enough!  I’ve seen campuses and other entities have a handfull of hazard-specific plans yet no central plan, which provides overall response information and can be referenced for all hazards, even those you may not have a specific plan for.

This is good information that ties in well with what I expect to be my next post, which is my first co-authored article and centers on an upcoming high profile event which will be experienced around the world.

© 2015 – Timothy Riecker

Emergency Preparedness Solutions, LLC

A book of worst-case scenarios

I came across this article yesterday about US Rep Michael McCaul from Texas (who happens to chair the House Homeland Security committee) penning a book titled “Failures of Imagination: The Deadliest Threats to Our Homeland — and How to Thwart Them”.  The book, set to be published in January, will apparently outline a variety of terrorist attack scenarios against the US and how they can be stopped.

I’ve written in the past about the necessity to consider credible worst-case scenarios (natural and human-caused) which can impact your jurisdiction or organization.  Following the model outlined by Comprehensive Preparedness Guide (CPG) 201 for the Threat and Hazard Identification and Risk Assessment (THIRA) process, it’s not just enough to say you are vulnerable to flood or wild fire.  To identify what your specific vulnerabilities are (location, duration, severity), it is necessary to flesh these out into scenarios.  Identification of these vulnerabilities will then help identify impacts, such as those to infrastructure, resources, and populations.  Plans should then be based upon these impacts.

I’m doubtful that Rep McCaul’s book will provide any foundation for planning (although I don’t think it’s intended to), however the scenarios contained may be eye opening to EMHS professionals and even citizens.  Regular readers of this blog know I feel that we are on borrowed time regarding terrorist attacks.  Yes we have experienced some on US soil (and the UK, Canada, Australia, France, India, and many other nations), and they have been devastating, but we have to know that with organizations such as ISIS thriving on our planet, more will come.  Mumbai-type scenarios, with multiple coordinated simultaneous attacks can be crippling and certainly demonstrate what a credible worst-case scenario could look like.

I’m interested to see what Rep McCaul’s book contains.  I’ll be sure to publish a review once it comes out and I’ve had an opportunity to read it.

© 2015 – Timothy Riecker

Emergency Preparedness Solutions, LLC

WWW.EPSLLC.BIZ 

Adapting to the Cyber Threat – Who Holds Liability?

Over the past year or so, even the past few months, we have seen a huge increase in high visibility hacks and cyber attacks.  Among the highest profile attacks are:

  • Target department stores suffered the theft of credit card holder data
  • the US government had a huge theft of information of government employees as well as theft of tax payer data from the IRS
  • and just recently the theft and subsequent public release of information of Ashley Madison account holders.

While cyber attacks and hacking didn’t just start occurring recently, our society, laws, and policies have yet to grow to truly keep up with prevention, mitigation, protection, response, and recovery from these incidents.  This is a familiar place we find ourselves in with other human-caused incidents such as mass shootings.  We have recently seen some insurance companies offering cybersecurity policies.  I’m not knowledgeable of the terms and conditions of these policies, but I’m hopeful policy holders are required to have cybersecurity policies and programs in place to help prevent and mitigate against the impacts of a cyber attack.  Presumably, the insurance  policy covers financial losses to the company and perhaps even litigation.  Consumers have a variety of protections available for identity theft offered through banks and credit cards.

With the recently announced class action lawsuit against Ashley Madison, I began thinking about where the real liability for a cyber attack lies.  Certainly those individuals whose personal information was stolen (moral issues aside) may suffer some measure of financial loss.  The same can be held true for those whose data was stolen from the Target and US government hacks.  Those individuals trusted and were generally assured that their personal and financial information would be protected.  These assurances place a liability on the entity that holds their information.  However, we tend to treat liability differently for disasters and acts of terrorism where entities, so long as they made reasonable and prudent efforts to avoid impacts, are held harmless; or in the event of a criminal act, we see liability shifted to the perpetrators of the criminal act.

I’m convinced that any system can eventually be hacked and suffer either data loss or data theft.  Unlike a natural disaster, intentional human-caused incidents include the factor of persistence.  Persistence is a unique element which requires constant and concerted efforts on the part of other humans to prevent, protect, and mitigate against criminal acts.  Given the law of averages and the constant need for cybersecurity experts to keep up with all tactics used by criminals, the good guys are bound to lose a battle once in a while.  While I don’t disagree that those who have their personal information stolen through no fault of their own may be deserving of financial compensation for their losses, I’m left wondering about the real liability of those entities who make reasonable and prudent efforts to protect that data.

Certainly the perpetrators, when found guilty, are at fault and hold the ultimate responsibility, but we have difficulty in identifying and persecuting these attackers.  Even if the perpetrators are found and convicted, is there still a shared liability among other parties?

Like climate change, we struggled for many years fighting the inevitable and thinking we could stop or reverse its effects.  We are finally shifting to a new philosophy of adaptation.  While we do what we can to slow the speed of climate change, many have accepted that climate change, and thus its impacts, are an inevitability.  This leads me to suggest that we need to take the same stance with all disasters, including those caused by humans.  Incidents will occur.  While we MUST do what we can to prevent, protect, and mitigate against them, we need to shift the thinking of society to response, recovery, and adaptation for when, inevitably, it does occur.

While I’m no attorney or expert in liability and litigation, it seems to be a fairly unexplored area in terms of cybersecurity.  I welcome your thoughts and ideas on this.

© 2015 – Timothy Riecker

Emergency Preparedness Solutions, LLC

WWW.EPSLLC.BIZ

Deadly Explosions

By now I’m sure you’ve all heard of the two horrible explosions that took place over the last 24 hours – one in Tianjin, China; the other in Baghdad, Iraq.  The explosion in the port city of Tianjin occurred soon after fellow consultant Ralph Fisk and I had both separately published posts about the dangers of human caused disasters.  The explosion in Baghdad, the result of a terror attack, occurred less than 12 hours ago.

The explosions in Tianjin occurred in the port area of the city and originated as fires among shipping containers.  The origin of the fires is yet unknown or released to the public by the Chinese government.  Chemicals and explosives were within some of the containers, with reports of chemical odors still lingering there hours after the explosions occurred.  At this point, according to CNN, 50 persons are confirmed dead with more than 500 hospitalized.  Among the dead are 12 firefighters.  Many more people are missing, including dozens more firefighters.  If you’ve not seen any of video of the explosions, it is grimly spectacular.  CNN has obtained several videos from people who were recording the fire turned explosion.  http://www.cnn.com/2015/08/13/asia/china-tianjin-explosions/index.html.  This will certainly be a continuing story to keep an eye on.

In Baghdad, ISIS has reportedly claimed responsibility for a truck bomb which was detonated in in a busy market, killing dozens and injuring nearly 100 people.  Sadly we have become practically desensitized to occurrences of violence in the Middle East.  While each of them is horrible, this incident is particularly tragic with the loss of this many lives.

I rarely post about current disasters or incidents as there is plenty of commentary already out there from the media and quasi-media.  The tragedy of these, however, underscores our need to be aware of the potential for these incidents to occur and what we need to do to prepare for and respond to them.  We also need to be prepared to address the cascading impacts of these incidents – mass care, mass casualty, and mass fatality issues are certainly paramount, but we also need to consider matters such as business and government continuity.

Foundationally, it helps to know something about explosives.  For my readers who are US citizens, be sure to check out the first responder training available from the New Mexico Tech Energetic Materials Research and Testing Center (EMRTC).  They run DHS sponsored training programs such as Incident Response to Terrorist Bombings (IRTB).  These courses are intensive and greatly valuable, diving into the physics and chemistry of different explosive types and classes, terrorist methodologies, and plenty of show and tell in their range.  The course gives a solid appreciation for what explosives can do and gives you a relative awareness of how much explosive it takes to cause a certain amount of damage.  For those who are not US citizens, I believe they do work with the US State Department to review applications on a case by case basis.  I’m curious as to what type of similar training is available in other countries to domestic responders.

We are truly lucky to not suffer incidents such as these as often as other nations do.  Understand, though, that this is only due to safety and security measures that we have in place.  Accidents, however, are inevitable, as are the successful efforts of those who wish to do us harm.  We must continue to do what we can to prevent these types of incidents but also be ready for when they do occur.

© 2015 – Timothy Riecker

Emergency Preparedness Solutions, LLC

WWW.EPSLLC.BIZ

Well OF COURSE Drones Can Be Used As WEAPONS

It’s rather insane that it took this long for the US Department of Homeland Security to issue a warning to law enforcement about the potential use of drones/UAVs as weapons or to further the criminal enterprise.  If you’re not familiar with the DHS bulletin, see this CBS News story.

For those of you who have been steady readers of mine, you can probably tell that I’m pro-drone.  However, just like anything else, someone is bound to adapt the technology for their own malicious purposes.  While we are still getting our act together in figuring out how to apply UAV technology for myriad good and purposeful things, there have been those out there trying to figure out how to use the same technology for advancing criminal and terrorist agendas.

Amazon and others want to use UAVs to deliver packages.  Well guess what –drug cartels will certainly be using them to deliver packages of drugs.  The US military uses UAVs to strike at terrorists in unfriendly territory.  Terrorists, criminals, or even your run-of-the-mill stupid people, can do the same.  Have you seen this article about a teen who mounted a handgun to a UAV?  UAVs are great for providing a birds-eye view of any situation, but when operating in a disaster environment they can’t impede responders as they did in the recent wildfires in California.

I have no doubts that terrorists somewhere, foreign or domestic, are playing with UAV electronics and explosives to determine how best to deliver those deadly packages.  As inevitable as it is, do we ban the use of UAVs?  Well we haven’t banned cars or moving vans, and both have been used to transport explosives.  The good outweighs the bad, so we have to figure out how best to deal with it.

The fact of the matter is that all well intended technology can be used for not so good purposes.  Does this mean we do away with the technology?  No.  Does this mean we do away with innovation?  No.  It does mean that we have to stay a step ahead of those who have ill intent or practice in stupidity.  Prevention, protection, and mitigation against these things is a constant challenge.  We now need to be aware of a new threat and address it.  It’s something we’ve done through time.  People built walls around their towns to protect themselves and their property from people and animals who would do them harm.  Attackers innovated and approached walls with ladders, so defenders built taller walls and other defensive technologies.  Today we use physical barriers to prevent vehicles from getting too close to buildings, locked doors to prevent entry, and cameras to monitor.  Perhaps the threat of an attack from the air will require other measures.

Has your company or jurisdiction considered the threat UAVs may pose to your interests?  What are your thoughts on deterring attacks?

© 2015 – Timothy Riecker

EMERGENCY PREPAREDNESS SOLUTIONS, LLC

WWW.EPSLLC.BIZ

Attacks on Electrical Infrastructure

A February 10, 2014 article in Emergency Management Magazine titled Attack on California Electric Grid Called Terrorism brings about some very interesting speculation on an incident that occurred at an electrical substation near San Jose last year.  Unfortunately the article saves some critical information for the end and left me with a poor initial impression (i.e. assuming that the weapons used were assault rifles).  My early impression of the article, particularly having grown up in the country, was that this was the result of ‘Billy-Bob and Joe decided after a bunch of brewskis they were going to shoot up a substation’, as stated by Mark Johnson, recently retired VP of Pacific Gas and Electric. 

Toward the end of the article, the author identifies information associated to the shooting of the transformers, including the removal of 75 lb manhole covers and the cutting of fiber optic lines.  With this and other information revealed in the article, it seems likely this was more than Billy-Bob and Joe.  It’s suggested by the author that this activity could have been a ‘dress rehearsal’ for terrorists.  While I’m no terrorism expert, I offer that it’s not likely to involve any major entities such as Al-Qaeda, who are, unfortunately, must more clandestine than this – just look at how long it took us to find Bin Laden.  My guess is that this was perpetrated by a local, semi-organized, domestic group.  They did some research, but were clearly sloppy and ultimately unsuccessful, if, in fact, their goal was to cause an outage.  Nonetheless, an act such as this should certainly be categorized as terrorism, despite the origin of the perpetrators and their cause. 

This scenario, however, provides some important food for thought.  I’ve posted previously on the vulnerability of our electrical system to both intentional acts as well as natural disasters.  There are some efforts under way to increase the redundancies of our system and to create micro-grids, which would isolate impacts, which are great mitigation strategies.  The occurrence of this intentional act should bring strong consideration to prevention and protection activities to heighten security and resiliency of this infrastructure.  We need to call on our law makers to work with emergency managers, regulators, and the industry itself to require a multi-faceted approach to include protection, prevention, and mitigation efforts. 

Alan Weiss’ Weekly Morning Memo

From Dr. Weiss’ weekly e-mail to members…

This week’s focus point: The Boston tragedy demonstrated more than anything the basic goodness in people. Strangers helped others without hesitation. The requests of the authorities were accepted without whining or demands for exceptions. The capacity that we all possess to support, assist, and help others is extraordinary. Sometimes it takes trauma to highlight it, but the potential is there every day. It may be appropriate this week to think about donating time or money to a charity, coaching someone who needs help, or even giving someone a break trying to turn across traffic. We shouldn’t need catastrophe to bring out our true character.

Some great words to consider.

To my readers – sorry for my absence these last few weeks – I’ve been (and continue to be) on a disaster deployment. More to come!