March 30, 2006 InfoGram

This InfoGram will be distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures. For further information, contact the Emergency Management and Response - Information Sharing and Analysis Center (EMR-ISAC) at (301) 447-1325 or by email at emr-isac@fema.dhs.gov.

Safeguarding Critical Infrastructures

The Infrastructure Security Partnership (TISP) reported in their March newsletter of a subtle but important change in their focus from critical infrastructure protection (CIP) to critical infrastructure resilience (CIR). According to TISP, this paradigm shift is recognition by infrastructure security practitioners and policy makers alike that it is nearly impossible to protect critical infrastructures against all major disasters and, therefore, providing resiliency (CIR) should be the goal.

The TISP Regional Disaster Resilience Action Guide (http://www.tisp.org/rdr_guide) defines a resilient infrastructure as "one that has the capability to withstand significant incidents or attacks with some damage and then recover to provide critical services with minimum of downtime or damage to public safety and health, the economy, and security." Dr. Ruth David, Chair of the Homeland Security Advisory Council's Critical Infrastructure Task Force, explained resiliency as "the capability of a system to maintain its functions and structure in the face of internal and external change and to degrade gracefully when it must."

The Multidisciplinary Center for Earthquake Engineering Research in Buffalo (NY) created a framework for measuring resiliency and defined it in terms of the following four R's:

• Robustness (the strength to withstand the hit)
• Redundancy (contains elements that are substitutable to continue the function)
• Resourcefulness (capacity to identify problems and mobilize resources)
• Rapidity (the speed of recovery)

Although the critical infrastructure resiliency (CIR) activities discussed above are imperative for infrastructure security, the Emergency Management and Response-Information Sharing and Analysis Center (EMR-ISAC) submits that CIR actions should complement critical infrastructure protection (CIP) by explicitly addressing and resolving the protection gaps (i.e., critical infrastructures that cannot be protected for various reasons). The EMR-ISAC maintains that CIP measures are appropriate and necessary to safeguard truly indispensable infrastructure (i.e., must remain entirely intact and operational) prior to and during a deliberate or accidental catastrophe.

Training and Exercises Bolster CIP

In a speech to the National League of Cities (NLC) last week, Homeland Security Secretary Michael Chertoff stated: "the first, most significant level of government in terms of people's day-to-day lives, is the government that they touch locally." He added that "he has no intention of superseding state and local emergency responders in handling a wide variety of future disasters." With some emphasis on local capabilities, Secretary Chertoff further challenged state and local responders "to extend their training and exercises to cover nontraditional threats."

Experience dictates that meaningful training significantly contributes to the proficiency and protection of first responders, who are the most critical of infrastructures belonging to emergency departments and agencies. The Emergency Management and Response-Information Sharing and Analysis Center (EMR-ISAC) submits that quality training activities will additionally prepare personnel to recognize and protect organizational internal physical assets and communication/cyber systems against both traditional and nontraditional threats. Therefore, the EMR-ISAC encourages emergency department trainers to appropriately integrate critical infrastructure protection (CIP) when planning and conducting training events.

It is commonly accepted throughout the Emergency Services Sector that exercises provide practical and beneficial opportunities to rehearse emergency plans, incident command protocols, operational procedures, mission-essential skills, etc. When efficiently planned and executed, tabletop, functional role-play, and full-scale exercises will reinforce the survivability, continuity of operations, and mission success of participating organizations according to the NLC. Consequently, in order to derive the maximum CIP benefits, the EMR-ISAC recommends training be supplemented with exercises as often as resources permit to identify and correct weaknesses that could potentially degrade local response capabilities.

Local Emergency Planning Committees

Throughout the nation, countless localities have organized a local emergency planning committee (LEPC) to achieve local and regional coordination, address common problems, develop solutions, focus limited resources, and prepare effective multi-jurisdictional emergency operations plans. In most areas, scarce resources such as money required this time-efficient and cost-restrained (LEPC) approach to community emergency management.

LEPCs were originally designed to prepare and maintain emergency plans addressing hazardous substances and weapons of mass destruction. However, natural and man-made events during the past five years necessitated that LEPCs appropriately adjust to changing circumstances and accept increased responsibilities to plan and prepare for all possible hazards.

Typically, LEPC membership includes a diverse representation of local and regional stakeholders: elected officials, fire, police, emergency medical, public works, public health, hospitals, environmental, transportation, education, media, and any others who could bring specific expertise to the planning process. The positive synergy achieved by the cooperation of this broad-based membership frequently produces emergency plans that successfully integrate local and regional resources and adeptly orchestrate mutual aid.

In general terms, the current goals of the LEPC are to facilitate community-based emergency preparedness and hazard mitigation initiatives. Nevertheless, the Emergency Management and Response-Information Sharing and Analysis Center (EMR-ISAC) considers each LEPC a potential advocate for critical infrastructure protection (CIP) and the principal CIP catalyst in its area of responsibility. Moreover, the EMR-ISAC urges these committees (LEPCs) to deliberately incorporate provisions to protect local and regional critical infrastructures into the next update of their emergency preparedness plans.

Unmarked Railroad Crossings

News sources report that vehicle-train accidents occur too frequently in the United States. Unfortunately, Emergency Services Sector (ESS) apparatus are especially vulnerable at railroad crossings because they are usually larger and move more slowly than passenger vehicles.

A recent emergency responder accident at an unmarked railroad crossing reminded the Emergency Management and Response-Information Sharing and Analysis Center (EMR-ISAC) of the danger to ESS personnel posed by thousands of unmarked crossings throughout the nation. In this incident, a properly trained volunteer firefighter driving a 1500 gallon fire tanker truck attempted to traverse an unmarked railroad crossing. The vehicle was struck by a locomotive that killed the driver, destroyed the tanker truck, and seriously degraded the volunteer department's critical infrastructure.

The nonprofit organization, Operation Lifesaver, uses 49 state coordinators and several thousand certified presenters to promote railway safety, and has developed specific programs, including one for emergency vehicles and drivers. The group's website offers tips for the ESS that could be useful for creating a railway crossing Standard Operating Procedure (SOP): (http://www.operationlifesaver.org/training/emergency_safety_tips.html. This organization also offers information about state and federal laws: (http://www.operationlifesaver.org/training/emergencyresponders_federal_state_laws.htm). To contact a state coordinator, visit the following website: http://www.operationlifesaver.org/contact/contact_state.htm.

The U.S. Department of Transportation's Federal Railroad Administration provides a recently redesigned website that provides railroad safety information (including public and private crossings), and allows users to run queries, download safety database files, and view current statistical railroad safety information: (http://safetydata.fra.dot.gov/OfficeofSafety/).