InfoGram 16-07: April 26, 2007

This InfoGram will be distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures. For further information, contact the Emergency Management and Response - Information Sharing and Analysis Center (EMR-ISAC) at (301) 447-1325 or by email at emr-isac@fema.dhs.gov.

7 Habits of Highly Effective CIP

For several years, the Emergency Management and Response—Information Sharing and Analysis Center (EMR-ISAC) has been collecting, analyzing, and disseminating critical infrastructure protection (CIP) information relevant to Emergency Services Sector (ESS) departments and agencies. During this time of extensive research and study of CIP matters potentially affecting the plans and operations of emergency services organizations, the EMR-ISAC has resolved there are seven habits or practices that typify a highly effective CIP program:

1. Comprehension of the Threats
   Comprehension of the multiple hazards that threaten ESS infrastructures including those of the community served by ESS organizations.
2. Knowledge of Vulnerabilities
   Knowledge of the weaknesses in ESS infrastructures and how they are vulnerable to the hazards that threaten them.
3. Implementation of Protective Measures
   Implementation of measures to protect or provide redundancy for those emergency infrastructures that are credibly threatened and vulnerable to degradation by all hazards.
4. Business Continuity Plan
   The existence of a plan that specifies straight-forward, step-by-step procedures to follow during and after a disaster, including details about critical personnel, crisis communications, functions, processes, order of succession, vital records, credentialing, crisis counseling, educating the workforce, site relocation, etc.
5. Multidisciplinary Regional Planning
   Planning for prevention, protection, response, and recovery actions that are thoroughly coordinated among the major public and private stakeholders across local, county, and state lines.
6. Education and Enforcement
   A quality education for all assigned personnel that minimally includes CIP policies, procedures, and plans; methods of enforcement with consequences; and a complete understanding of the hazards that may degrade or destroy the infrastructures.
7. Rehearse and Test Plans
   Periodic rehearsals that sufficiently test emergency plans and the personnel executing them, which identify shortcomings in the plans or deficiencies in training for corrective action.

Suspicious Activity Reporting

As the Emergency Management and Response—Information Sharing and Analysis Center (EMR-ISAC) proactively attempts to push critical infrastructure protection (CIP) information to the leaders, owners, and operators of the Emergency Services Sector (ESS), it petitions ESS departments and agencies to do their part as well. Emergency personnel are continuously moving around their areas of responsibility in the performance of duties. This perpetual service to communities provides frequent opportunities to observe suspicious activities, unexplainable behaviors, strange objects, unusual circumstances, etc. Reporting observations directly to the National Infrastructure Coordinating Center (NICC) will give Department of Homeland Security (DHS) analysts the input necessary to fulfill their responsibilities in preventing a future terrorist attack.

DHS infrastructure protection and intelligence officials requested the EMR-ISAC reemphasize the importance for ESS organizations to report suspicious activities to the NICC in addition to their local authorities. DHS officials offered the following reasons to sharply increase the reporting by the emergency services:

• Analysts cannot know what is happening without suspicious activity reports.
• Suspicious activity reports help to track potential threats.
• Security experts cannot “connect the dots” when there are no dots to connect.
• Reporting directly to the NICC saves valuable time.

The National Infrastructure Coordinating Center (NICC) can be contacted preferably by email at nicc@dhs.gov, facsimile at 703-487-3570, or by voice at 202-282-9201.

Chlorine Bombs Pose Terror Threat

The U.S. Department of Homeland Security (DHS) has alerted the Emergency Services Sector (ESS), especially bomb squads, to guard against chlorine truck bombs. According to Robert Stephan, DHS Assistant Secretary for Infrastructure Protection, “chlorine truck bombs are now being used as a tactic against us in another part of the world…. We’ve got to be prepared for it.”

At least five chlorine truck bombs have exploded in Iraq in the past two months. In the U.S., the Chlorine Institute recently notified the FBI of several thefts or attempted thefts of 150-lb. chlorine tanks from water treatment plants. Although there is no intelligence indicating chlorine truck bombings are imminent in the U.S., or that terrorists have stolen chlorine from chemical or water treatment plants, the Emergency Management and Response—Information Sharing and Analysis Center (EMR-ISAC) encourages responder organizations to consider resources useful in protecting internal critical infrastructures (i.e., personnel, physical assets, and communication/cyber systems).

One resource is the CHEMical TRansportation Emergency Center (CHEMTREC), established in 1971 by the chemical industry to serve the ESS and shippers. CHEMTREC can be contacted 24x7
(800-424-9300) to coordinate and communicate essential information for hazmat leaks, fires, exposures, or accidents. Linked to the largest network of chemical and hazmat experts in the world, CHEMTREC gathers incident details, provides immediate technical information, relays it to shipper or manufacturer, creates a written report that is faxed or sent electronically to the shipper, and provides medical treatment support information. Its telephone conferencing capabilities enable communication among shippers, product experts, carriers, and incident personnel on scene. To help responder organizations better understand its resources and services, CHEMTREC also participates in local exercises and provides assistance as in an actual emergency.

Available at its website are no-cost downloadable guides for responders, ordering information for the free Emergency Response Guidebook, and an emergency checklist.

ESS Products & Services Clearinghouse

To acquire information on equipment, training, and services before purchase, the Emergency Management and Response—Information Sharing and Analysis Center (EMR-ISAC) suggests that Emergency Services Sector (ESS) organizations may find the Responder Knowledge Base (RKB) useful.

The RKB is a web-based clearinghouse sponsored by the Department of Homeland Security (DHS) and the National Memorial Institute for the Prevention of Terrorism. The database of information on responder products and services is organized into two lists: the Authorized Equipment List (AEL) and the Standardized Equipment List (SEL). According to DHS, items on the AEL are eligible for purchase using grant monies; qualified grants are mentioned in each entry with links to specific grant programs. The SEL contains items recommended by the InterAgency Board for Equipment Standardization and Interoperability, which seeks to improve standardization across local, state, and federal agencies.

Database users can search for information by keyword, browse all available entries through an expandable outline, or search the lists by category. Once an item is found, it is accompanied by “knowledge links” to locate similar items. Much of the listed equipment includes access to message pages where field personnel who have used specific equipment have volunteered to respond to requests for information.

The EMR-ISAC understands that responder organizations are challenged to spend limited resources wisely. The RKB is not a store, but a repository of information that can assist ESS departments and agencies to make informed pre-purchase decisions regarding equipment, training, and services. Its website includes links to best practices and lessons learned. Users not already registered with the RKB can simply log in as a “guest” to use the database.