InfoGram

October 17, 2002

NOTE: This InfoGram will be distributed weekly to provide members of the emergency services sector with news and information concerning the protection of their critical infrastructures. For further information please contact the U.S. Fire Administration's Critical Infrastructure Protection Information Center at (301) 447-1325 or email at usfacipc@dhs.gov.

Sensitive Information Security

Since discussing the issue of sensitive information security in previous InfoGrams, the CIPIC received requests to provide additional elaboration regarding what fire and emergency medical services information warrants protection. These requests were based on recent experiences with telephonic, electronic, and visitor solicitations for various details about department plans and operations. When communicating with solicited organizations, some expressed the desire not to withhold information or remove data from websites that has value for their citizens.

Unfortunately, the usefulness to terrorists of department information in the public domain will not always be readily apparent. What seems like harmless information by itself may actually be dangerous when used by adversaries in conjunction with other publicly available data. This collection of sensitive information can ultimately weaken or negate measures to protect personnel, physical entities, and cyber assets. Therefore, under present threat level conditions, the CIPIC recommends there be no risk taking with sensitive information security. The importance of securing sensitive information from potential domestic or foreign terrorists cannot be over-emphasized.

Because the degradation or destruction of the critical infrastructures of any emergency first response agency must be unacceptable and avoided, the CIPIC advises that public access be denied to the following information. The CIPIC cautions, however, that this listing is NOT complete and will differ from one fire/EMS department to another:

• Emergency response, mitigation, and recovery plans.
• Mutual aid agreements and assistance.
• Security and continuity plans and procedures.
• Threat analysis and vulnerability assessment results.
• Training, awareness, and other preparedness materials.
• Operations manuals, response routes, run cards, and station box maps.
• Communications assets, network systems, and the dispatch CAD system.
• Radio frequencies and channels.
• Numbers and types of apparatus and equipment.
• Engineering blueprints, plans, and architectural drawings.
• Phone lists with leadership names and addresses (e.g., shift commanders).

More About Terrorism Preparedness

U.S., Western, and Mid-Eastern intelligence officials believe that al Qaeda loyalists have initiated a new terror campaign using rudimentary, smaller-scale operations aimed at creating economic hardship. These experts warned that "al Qaeda and affiliated extremist groups are resorting to more indiscriminate attacks against 'soft' targets". They further cautioned that "the simplicity of these attacks might make them more difficult to predict and prevent".

Given the enduring lack of specificity of method, target, and timing, emergency first responders throughout the United States continue to inquire about the minimum essential precautions appropriate for their departments. Realistically, exact answers for each department are difficult to provide because they depend on many functional and environmental factors. Nevertheless, in order to promote proactive terrorism preparedness, the CIPIC suggests that fire and EMS leaders consider the following fifteen general actions:

• Review, revise, or implement as necessary the (FIRESCOPE) Incident Command System and Unified Command System.
• Ensure provisions exist to communicate between and among agencies.
• Train with multiple agencies to practice communications and unified command.
• Review or revise as necessary all emergency response, mitigation, and recovery plans.
• Coordinate emergency response, mitigation, and recovery plans with adjacent or nearby jurisdictions.
• Review, revise, or implement as necessary Mutual Aid Agreements with adjacent or nearby communities.
• Ensure all emergency supplies are stocked and ready.
• Ensure the availability of food and fuel under emergency circumstances.
• Ensure procedures exist for apparatus and equipment repair and maintenance under emergency circumstances.
• Conduct a new threat analysis and vulnerability assessment of department critical infrastructures.
• Apply countermeasures to protect department infrastructures that are threatened and vulnerable.
• Become familiar with the crisis action plans of local schools, businesses, and industries.
• Implement screening practices for incoming postal and electronic mail, phone calls, deliveries, and visitors.
• Organize a strong and active Family Support Team from among the spouses of firefighters and EMS personnel to care for each other during emergencies.
• Report suspicious activities to local authorities and also the National Infrastructure Protection Center (NIPC). NIPC phone: 202-323-3205.

Hazard Mitigation Planning

Last month, the Federal Emergency Management Agency (FEMA) released FEMA Publication 386-7, entitled: State and Local Mitigation Planning how-to Guide for Integrating Human-Caused Hazards into Mitigation Planning. The guide thoroughly explains the hazard mitigation planning process. According to this guide, "hazard mitigation planning is the process of determining how to reduce or eliminate the loss of life and property damage resulting from natural and human-caused hazards." The planning process uses four basic phases: organize resources, assess risks, develop a mitigation plan, and implement the plan and monitor progress.

A CIPIC review of the guide and process reveals important similarities between the hazard mitigation planning process and the critical infrastructure protection (CIP) process. Both processes lead the practitioner to accomplish the following regarding natural and human-caused hazards:

• Understanding the threat.
• Appreciating how life and property are vulnerable.
• Assessing the risks involved in failing to act upon the consequences.
• Implementing measures to avoid or minimize the undesirable effects.

Essentially, both processes foster proactive activities to reduce or eliminate the loss of life and property. The major difference between the two processes is that hazard mitigation planning generally concerns the protection of all life and property; however, the CIP process addresses only critical infrastructures. Critical infrastructures are the people, physical entities, and cyber systems that are indispensably necessary to sustain an organization's survivability, continuity of operations, and mission success. The CIP discipline recognizes that in this tremendously resource-restrained environment, where time, money, personnel, and materials are scarce, an organization cannot protect everything. Therefore, the CIP process is a decision sequence that assists leaders in determining the critical assets that really need protection as well as when.

For more information about the Hazard Mitigation Planning Guide (FEMA 386-7), see the following website where the guide will be posted within the next couple of weeks: http://www.fema.gov/fima/planresource.shtm. To learn more about the CIP Process, see the USFA CIP website at: http://www.usfa.fema.gov/fire-service/cipc.cfm.

Bioterror Attack Warning System

This week, the Centers for Disease Control (CDC) announced plans for a national early warning system for bioterrorism. The system was pioneered at Harvard University and will watch for signs of an anthrax, smallpox, or other disease outbreaks in the aches, pains, and sniffles among U.S. patients. CDC committed over one million dollars to a trial of the computerized surveillance network, which will review thousands of daily diagnoses for unusual patterns, such as a sudden increase in reports of symptoms that could signal a biological attack. Additionally, the system could provide early warnings of less sinister disease outbreaks, such as the flu or food poisoning. If trials are successful, the system may be fully operational nationwide within a year.

A CDC spokesperson stated that early detection is pivotal. "If smallpox and anthrax infections are caught in their first stages, patients can be treated much more effectively. In the case of smallpox, the spread of the illness can be contained."

"A system like this may give public-health officials a three-day lead time. And that lead time may result in the saving of a great number of lives," said Dr. James Nordin, a clinical investigator at HealthPartners Research Foundation in Minnesota, which is participating in the experiment.