InfoGram

September 18, 2003

NOTE:This InfoGram will be distributed weekly to provide members of the emergency services sector with news and information concerning the protection of their critical information systems. It has been prepared by NATEK Incorporated for the US Fire Administration. For further information please contact the U.S. Fire Administration's Critical Infrastructure Protection Information Center at (301) 447-1325 or email at email at usfacipc@dhs.gov.

Analyzing the Vulnerabilities

This is the fourth in a series of six brief articles that review the critical infrastructure protection (CIP) process as it applies to emergency first responders. The first ("A CIP Review"), the second ("Identifying Critical Infrastructures"), and the third ("Determining the Threats") articles can be seen in the 28 August, 4 September, and 11 September InfoGrams respectively.

Knowing the organizational critical infrastructures is the first step of the CIP process. The second step involves determining the "all-hazards" threats against each of these critical infrastructures. This article will review the necessity to analyze the vulnerabilities of those critical infrastructures that are credibly threatened-the third step of the CIP process. Specifically, once department leaders confirm that there is a deliberate (people), and/or natural (disasters), and/or accidental (HazMat accident) threat, the CIP process guides the practitioner to a vulnerability analysis of only those critical infrastructures against which a threat exists. It is imprudent to perform this and the following steps of the process for critical infrastructures that are not credibly threatened. Such actions will only squander precious time and resources.

A vulnerability is the weakness in a critical infrastructure that renders the infrastructure susceptible to degradation or destruction by the source of the threat. An effective vulnerability analysis will examine each threatened infrastructure from the "threat point of view." In other words, the analysis will seek to understand the ways by with each threat might disrupt or destroy each particular infrastructure because of existing vulnerabilities. The eventual mitigation or elimination of present weaknesses (vulnerabilities) cannot be accomplished without knowing what or where they are!

A thorough explanation of CIP and the five-step process can be seen in the CIP Process Job Aid available as a Microsoft Word Document (81kb) to read and download at: www.usfa.fema.gov/fire-service/cipc/cipc-jobaid.shtm.

Hurricanes versus Emergency Services

It is common knowledge that hurricanes, regardless of category, are capable of substantial destruction and even loss of life. Too often, throughout the history of this nation, hurricanes have attacked, degraded or destroyed critical infrastructures. Although it is more inconvenient than dangerous when communities lose their public utilities, it becomes life threatening when emergency services are lost for any reason. This is why emergency first responders located in states susceptible to hurricanes have implemented numerous measures to ensure their uninterrupted response-ability during and immediately after these major storms.

Recognizing that Hurricane Isabel will attack the East Coast of the United States, the CIPIC collected some lessons-learned by emergency departments after previous hurricanes. Believing that a few of these lessons may provide insights when preparing for future weather events, they are listed as follows for further consideration by affected emergency responders:

• Revise department emergency plans to include methods to transport stranded department personnel to and from their stations when necessary.
• Ensure plans include all roads expected to flood during heavy rains, ways to avoid them, and methods to access emergencies along these roads.
• Update plans to address "last refuge," and "shutdown," as well as sudden storm change contingencies.
• Know how to access mass communication technologies to push or pull storm information.
• Examine the benefits of participation in the National Weather Service (NWS) Storm Ready Program.
• Look at incorporating geographical information systems (GIS) into the planning process.
• Be prepared to reset generators that have failed because of the low air pressure commonly associated with hurricanes.
• Be prepared to reset generators that have failed because of high winds causing the fan to spin faster than it was designed to rotate.
• Move apparatus and equipment to safe, but accessible locations.
• Guarantee each station has sufficient food and supplies for at least 72 hours of continuous emergency operations.
• Remain alert for gas leaks, electrical system damage, downed or loose power lines, sewage and water line damage, etc.
• Remember terrorists may take advantage of the distraction cause by natural disasters.

Terrorist Threat Information

According to Department of Homeland Security (DHS) Information Bulletins, dated 12 and 16 September, analysts believe terrorists will utilize novel methods to attack American critical infrastructures. These adversaries have already demonstrated capabilities to recruit and employ suicide bombers who artfully conceal their devices in jackets, shoes, belts, vests, gym bags, and briefcases. The emergency services must be aware of the potential for terrorists to use multiple suicide/homicide bombers in which the first attack is designed to cause casualties and draw first responders to the scene specifically to expose them to a second attack.

Additionally, terrorist interest in toxic chemical materials and delivery methods has been growing and probably will increase further in the near term. Reasons for this include the relative ease with which some materials can be acquired and produced, the potential for large numbers of casualties and psychological impact on the targeted population, and disruption at the scene of the event and to related infrastructures. Captured documents indicate that terrorists have designed a chemical dispersal device fabricated from commonly available materials designed to asphyxiate its victims. Little or no training is required to assemble and deploy such a device due to its simplicity.

Considering these threats, DHS security experts suggest the following (minimum) protective measures for emergency first responders, who comprise a national critical infrastructure:

• Stay alert and immediately report any situation that appears to constitute a threat or suspicious activity.
• Report unattended packages, devices, briefcases, or other unusual materials.
• Do not handle or attempt to move any suspicious objects, especially near air intakes.
• If an attack occurs, assume that a follow-on attack is possible.
• Although some EMS personnel will accept personal risk, all other responding personnel and vehicles should not enter the immediate attack site.
• Immediately disperse any crowds and actively search for a secondary explosive or chemical dispersal device on loitering individuals, in packages, trash receptacles,
• parked vehicles, etc.
• Enter the attack site only after crowds are dispersed and the area has been properly searched and secured by appropriately trained personnel.

Disaster Management Interoperability Services

Emergency planners without a budget for off-the-shelf disaster management software can download free of charge an interactive program from the Federal Emergency Management Agency (FEMA). The Disaster Management Interoperability Services (DMIS) program allows real-time sharing of response and recovery data and graphics. DMIS also includes federal agency mapping capabilities in a secure, web-based environment among fire, rescue, police, medical, and any other responder group. Many DMIS functions can be performed without Internet access.

"Because DMIS is a set of tools, emergency managers don't have to change their business practices to use it," according to Mark Zimmerman, DMIS program manager. FEMA is working with IBM, Microsoft, Oracle, and other hardware and software vendors to ensure that emergency responders will be able to operate DMIS from any computing environment, he said.

For more information about DMIS, contact Scott Eyestone, DMIS responder liaison team leader at (540) 288-5622. Alternatively, register for DMIS at www.disasterhelp.gov.