InfoGram

September 1, 2005

NOTE: This InfoGram will be distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures. For further information, contact the Emergency Management and Response - Information Sharing and Analysis Center (EMR-ISAC) at (301) 447-1325 or by email at emr-isac@fema.dhs.gov.

"For Official Use Only" CIP Information

The Emergency Management and Response-Information Sharing and Analysis Center (EMR-ISAC) provides sensitive, but unclassified critical infrastructure protection (CIP) information to the validated senior leaders of the Emergency Services Sector (ESS): police/fire/EMS department chiefs, assistant/deputy chiefs, emergency managers, fire marshals, FEMA Region staff officers, etc. Much of the CIP information originates from the Department of Homeland Security and normally contains timely, important, and useful information FOR OFFICIAL USE ONLY (FOUO) regarding the threats to and vulnerabilities of ESS organizations. FOUO document contents typically assist emergency planning and operations for all hazards, particularly terrorist attacks.

Recipients of EMR-ISAC CIP (FOUO) Notices are reminded that the sensitive (FOUO) information is exclusively for the ESS validated senior leaders described in the preceding paragraph. These CIP (FOUO) Notices are "for official use only" and NOT to be released either in written or oral form to the media, the general public or other personnel who do not have the valid "need-to-know" without prior approval from the EMR-ISAC.

Those individuals currently serving in an ESS leadership position mentioned above and not receiving CIP (FOUO) Notices should follow the directions seen at the following link: https://disasterhelp.gov/usfacip.html. Although the directions appear to be for the CIP InfoGram, following these instructions will give incumbent sector leaders access to the CIP (FOUO) Notices upon completion and validation of the required application. However, if more information is desired, contact the EMR-ISAC at emr-isac@fema.dhs.gov or 301-447-1325.

Self-Dispatching Prohibition

Hurricane Katrina caused the disruption and displacement of Emergency Services Sector (ESS) departments and agencies in the states of Louisiana, Mississippi, and Alabama. Most of the affected organizations were able to provide some response and recovery operations from alternate sites. Many other ESS organizations are investigating the correct coordination channels to send these three states emergency personnel and equipment/apparatus to bolster actions of the local infrastructure.

In a 29 August press release, Michael Brown, Under Secretary of Homeland Security for Emergency Preparedness and Response and the Federal Emergency Management Agency (FEMA) Director, urged all emergency services departments not to send assets to the counties and states impacted by Hurricane Katrina without first being requested and lawfully dispatched by state and local authorities under mutual aid agreements and the Emergency Management Assistance Compact.

The EMR-ISAC supports the prohibition on self-dispatching because of its potential to complicate response and recovery continuity of operations and to degrade the critical infrastructure protection of both the sending and receiving jurisdictions. Therefore, any responder agency that has resources available to deploy should first contact their local and state emergency management officials for coordination, approvals, and details.

Facility Shutdown Considerations

The Hurricane Katrina threat to Gulf Coast states was the impetus to close numerous emergency departments in that area in advance of the storm. The need to close and relocate so many first responder stations ahead of an impending disaster is not a frequent event in the Emergency Services Sector, but necessary to protect organizational critical infrastructures. Accepting that facility shutdown activities will be necessary again in the future, the EMR-ISAC offers several considerations related to this matter. The following items are excerpted and abbreviated from a 39-page document, ASIS Disaster Preparation Guide, prepared by the American Society of Industrial Security (ASIS) International:

• Under what conditions should shutting down department facilities be considered?
• Who will make the final decision to conduct emergency shutdown activities?
• Who has primary responsibility for specific shutdown tasks, e.g., water, gas, etc.?
• Is there a complete checklist to follow when completing shutdown tasks?
• Is there an evacuation list for all equipment and systems that will be relocated?
• Are there procedures for protecting any equipment and materials stored outside the facility?
• Are there damage assessment and control techniques to minimize property loss?
• What precautions can be taken to protect equipment during extended periods of nonuse?
• Have shutdown procedures been tested and practiced?

To access the full ASIS Disaster Preparation Guide, visit the URL: http://www.asisonline.org/newsroom/crisisResponse/disaster.pdf.

National Preparedness Month

September is "National Preparedness Month," co-sponsored by the Department of Homeland Security and the American Red Cross. Communities planning to conduct "preparedness month" activities for their citizens are encouraged to seek the counsel and participation of their emergency managers and first responders. The EMR-ISAC recommends emergency managers and the chief officers of emergency departments offer their assistance to ensure worthwhile events during the month that promote citizen preparedness.

Additionally, the EMR-ISAC suggests that responder organizations use this month each year to enhance the readiness and protection of their department personnel, physical assets, and communication/cyber systems (i.e., their internal critical infrastructures). Basically, readiness results from quality training, excellent equipment maintenance, and systems upgrades. Generally, protection results from the implementation of passive, active, and procedural measures. Passive measures function simply because they exist such as doors, windows, and fences. Active measures involve actions such as installing barriers, locks, alarms, and intrusion detection systems. Finally, procedural measures entail the preparation or revision of standard operating procedures, preparedness plans, safety checklists, training, etc. Procedural methods can be an alternative to unaffordable resource expenditures while doing something positive about protecting critical infrastructures.