InfoGram

April 10, 2003

NOTE: This InfoGram will be distributed weekly to provide members of the emergency management and response sector with information concerning the protection of their critical infrastructures. It has been prepared by NATEK Incorporated for the Emergency Preparedness and Response Directorate. For further information, contact the Emergency Management and Response - Information Sharing and Analysis Center (EMR-ISAC) at (301) 447-1325 or by email at emr-isac@fema.dhs.gov.

Strengthening CIP with CERT

Given the perpetuating resource constrained environment throughout the nation, the CIPIC recommends that local emergency managers and the chief officers of emergency first responders consider the formation, training, and utilization of a Community Emergency Response Team (CERT) as a viable and cost-effective way to strengthen local critical infrastructure protection (CIP). CERT training will provide valuable CIP benefits for the community because any citizen who takes it will be better prepared to respond to and cope with the aftermath of a disaster. Additionally, CERT personnel can supplement the local response capability, particularly during those times when people will have to rely on each other for help to meet their immediate life saving and sustaining needs.

Anticipating receipt of a portion of the FEMA Citizen Corps grant money allocated to the State of Virginia for local application, Arlington County (Virginia) recently constituted its first CERT, whose members returned to their neighborhoods with emergency kits and county-issued credentials. During eight weeks of classes conducted by the Arlington County Fire Department, the CERT students learned basic emergency management for disasters including: community hazards, fire suppression, medical intervention, team organization, search and rescue, terrorism issues, and some disaster psychology. The training culminated in a final exam and practical exercise.

To get the CERT program started, county funds were used to cover the approximately $200 per-student cost until award of the grant money last week. The Arlington County emergency manager stated that some of this money will be used to develop a brochure to publicize the CERT, to purchase equipment for CERT members, and to design a train-the-trainer program to reach Spanish speaking citizens of the county.

In a related matter, the CIPIC learned that Washington County (Maryland) will imminently receive FEMA Citizen Corps grant money from the State of Maryland to create a Citizen Corps to manage the education, training, and volunteer opportunities for its residents. An emergency management official indicated that the county plans to make the Citizen Corps a subcommittee of the Washington County Local Emergency Planning Committee. Doing so will effectively integrate Citizen Corps activities and CERT into local CIP and disaster or emergency planning. The county also plans to conduct the same type of CERT training as Arlington County described above.

Instant Messaging for First Responders

According to an article in GovExec.com, nearly 5,000 emergency first responders are taking advantage of an instant messaging service "to help bridge communication gaps among federal, state, and local emergency relief workers." The Homeland Security Department bought the technology from a Washington-based company, and it was ready for use by first responders in late March. The technology enables users to send out secure notes or alerts from any location with Internet access. "This system is relatively safe from hackers," a FEMA official said, "unlike some commercial instant messenger services now available." Messages are encrypted and the service contains firewalls to protect against viruses, etc.

Because the system is so secure, Homeland Security information technology specialists are encouraging first responders to become registered users by logging onto https://disasterhelp.gov, an e-government site designed by FEMA to help coordinate emergency workers. Subscribers first need to obtain a user name and password for access to select areas of the site by filling out registration information in the upper right corner of the homepage. Be aware that no one will be allowed to use the instant messenger service unless FEMA has verified that they are professional career or volunteer first responders.

For more information about this action, contact Mr. Robert Coxe, the FEMA program executive officer of e-government initiatives, at (202) 646-4389 or by email at Robert.coxe@dhs.gov.

Apply Resources to Vulnerabilities

Catastrophe risk modelers attempt to determine where and how terrorists are most likely to strike. They collect data and analysis from terror experts, who study the strategies and capabilities of terrorist groups such as al Qaeda. They then use mathematical models to assess the probable frequency, location, and aftermath of an attack. The risk modelers conclude that, despite al Qaeda's fluid nature, high-profile targets are more likely than others to be attacked. This conclusion begs the question: "What is a high-profile target?" Their answers to this question are not always identical, which may be misleading or confusing to state and local planners who must decide where to apply scarce resources to protect critical infrastructures.

As before, the CIPIC advises that local emergency planning committees, emergency managers, and the chief officers of emergency first responders use the CIP process to confidently select what should be protected by extremely limited resources regardless of whether or not it is a high-profile target. The CIP process is a security-related, time-efficient, and resource-restrained practice to resolve what really, really needs to be protected against natural and man-made disasters. Its purpose is to ensure the protection of only threatened and vulnerable personnel, physical assets, and cyber systems that are truly indispensable to survivability, continuity of operations, and mission success.

CIP practitioners accept that some supposedly high-profile targets may not be threatened and also vulnerable. Additionally, followers of the discipline agree that, sometimes, low-profile entities may be both threatened and vulnerable. To clarify this matter and avoid the misallocation of resources, the CIPIC suggests that those involved in disaster or emergency planning should consult the CIP Process Job Aid at: http://www.usfa.fema.gov/fire-service/cipc-jobaid.cfm.

The process described within consists of the following five steps:

• Identifying the critical infrastructures essential for mission accomplishment.
• Determining the threat against the identified infrastructures.
• Analyzing the vulnerabilities of the threatened infrastructures.
• Assessing the risk of degradation or loss of threatened, vulnerable infrastructures.
• Applying countermeasures to those infrastructures where risk is unacceptable.

Two More Events Affecting Infrastructure Protection

The CIPIC received information that on two occasions in February, an adult male approached emergency workers at an accident scene, identified himself as an EMT, and offered his help. Soon after the second event, members of the involved fire and rescue department (in Wisconsin) realized the individual was actually posing as an EMT, which potentially endangered the lives of the accident victims. The perpetrator was apprehended and charged with two counts of falsely acting as a public official. He faces seven years in prison if convicted on both counts.

The CIPIC also received notification that on 1 April a Georgia volunteer fire department was burglarized. An inventory revealed that a Bullard Thermal Imaging Camera was missing from the station. The camera was described as red in color with either ENFD or ENVFD marked on it with a black permanent marker. To provide or acquire information about this incident, contact the Newton County (GA) Sheriff's Investigator, Marty Roberts, at (770) 784-2103, extension 3.