InfoGram 41-09: October 15, 2009

This InfoGram will be distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures. For further information, contact the Emergency Management and Response - Information Sharing and Analysis Center (EMR-ISAC) at (301) 447-1325 or by email at emr-isac@fema.dhs.gov.

Receive InfoGrams and Bulletins by Email

“8 Signs of Terrorism” includes Surveillance

The Emergency Management and Response—Information Sharing and Analysis Center (EMR-ISAC) noted that Emergency Services Sector (ESS) departments and agencies continue to notify law enforcement officials of suspected surveillance of their facilities or operations. This fact motivated a look at the video “8 Signs of Terrorism,” produced through a partnership between the Colorado Office of Homeland Security, the Colorado Department of Agriculture, the Colorado Information Analysis Center, and the Center of Empowered Living and Learning under the Department of Homeland Security (DHS) Grant Program.

In the DHS October 6, 2009 press release, DHS Secretary Janet Napolitano stated: “The vigilance of individual citizens is critical to protection our country from the treat of terrorism. The video provides essential information on how to identify the warning signs and emphasizes the vital role of such assistance in state and local law enforcement’s counterterrorism efforts.”

The eight signs that indicate possible terrorism planning are as follows:

• Surveillance
• Elicitation (or trying to get information out of people close to the target)
• Tests of security
• Funding
• Acquiring supplies
• Impersonation
• Rehearsal
• Deployment

The EMR-ISAC also reviewed “Using 911 Calls to Detect Terrorism Threats” (PDF, 529.2 Kb) by the National Institute of Justice, which states that terrorists frequently engage in surveillance activities when selecting a target and planning an attack. This document explains that pre-attack surveillance can include videotaping, photographing, or taking notes about or drawing sketches of a building’s structural components or security defenses. Other activities might involve asking questions seeking details about a target’s occupants or defenses, or leaving suspicious packages or making bomb threats to study emergency response procedures.

Landslides

Wildland fires leave large amounts of scorched and barren land. When heavy rains follow a fire, other natural disasters can occur including landslides, mudflows, and floods. Once ground cover has been burned away, little is left to hold soil in place on steep slopes and hillsides. Considering recent heavy rains and mudslides in California, the Emergency Management and Response—Information Sharing and Analysis Center (EMR-ISAC) researched landslide hazards.

According to United States Geological Survey (USGS) landslide hazards fact sheet (PDF, 540.4 Kb), landslide hazards include fast-moving debris flows or slow-moving landslides. Debris flows triggered by intense rainfall are one of the most dangerous post-fire hazards because they tend to occur with little warning. The Landslides Hazards-A National Threat (PDF, 2.2 Mb) document states that landslides often accompany earthquakes, floods, storm surges, hurricanes, wildfires, or volcanic activity. They are often more damaging and deadly than the triggering event.

Areas that are generally prone to landslides include the following:

• Existing old landslides.
• On or at the base of slopes.
• In or at the base of minor drainage hollows.
• At the base or top of an old fill slope.
• At the base or top of a steep cut slope.
• Developed hillsides where leach field septic systems are used.

The following are features that might be noticed prior to a major landslide:

• Springs, seeps, or saturated ground in areas that have not typically been wet before.
• New cracks or unusual bulges in the ground, street pavements or sidewalks.
• Soil moving away from foundations.
• Ancillary structures such as decks or patios tilting and/or moving relative to the main house.
• Tilting or cracking of concrete floors and foundations.
• Broken water lines and other underground utilities.
• Leaning telephone poles, trees, retaining walls or fences.
• Offset fence lines.
• Sunken or down-dropped road beds.
• Rapid increase in creek water levels, possibly accompanied by increased turbidity (soil content).
• Sudden decrease in creek water levels though rain is still filling or just recently stopped.
• Sticking doors and windows, and visible open spaces indicating jambs and frames out of plumb.
• A faint rumbling sound that increases in volume is noticeable as the landslide nears.
• Unusual sounds, such as trees cracking or boulders knocking together, might indicate moving debris.

Additional information can be seen at the USGS Website.

Next Generation 9-1-1 Procurement Tool Kit

The Emergency Management and Response—Information Sharing and Analysis Center (EMR-ISAC) learned that the U.S. Department of Transportation (USDOT) released the Next Generation (NG) 9-1-1 Tool Kit (PDF, 1.2 Mb). According to the 30 September press release, the tool kit is a collection of resources to assist agencies as they transition from today’s 9-1-1 systems to NG9-1-1. The tool kit is to provide guidance in developing procurement specifications for transition services and network equipment.

The NG9-1-1 system will enhance 9-1-1 service to the public, allowing callers to request emergency assistance by sending text, images, and video (in addition to voice) from several different kinds of access networks and communications devices using open standards.

The tool kit states that it has four parts, and while mostly independent of one another, each is designed to support an iterative process building on the previous part. The tool kit includes the following sections:

• Preliminary Assessment Tool–identifies current state of emergency communications readiness for NG9-1-1.
• NG9-1-1 Planning Tool–describes the recommended plan components and process steps.
• Procurement Tool–offers guidance with procuring goods and services associated with a transition to NG9-1-1.
• Post-Implementation Evaluation Tool–evaluates efforts and identify lessons learned.

Computer-Forensics Tool

Microsoft has teamed up with the national White Collar Crime Center (NW3C) to distribute a computer-forensics tool to law enforcement for free. The Emergency Management and Response—Information Sharing and Analysis Center (EMR-ISAC) learned that the Computer Online Forensic Evidence Extractor (COFEE) makes it easy for an officer to record the current processes of a suspect’s computer.

Microsoft states that COFEE brings together a number of common digital forensics capabilities into a fast, easy-to-use, automated tool for first responders. By inserting a USB device into the computer, volatile live evidence can be collected. The fully customizable tool allows officers to run more than 150 commands on a live computer system at the scene. It also provides reports in a simple format for later interpretation by experts or as supportive evidence for subsequent investigation and prosecution. In addition, Microsoft states that COFEE can be tailored to effectively meet the needs of a particular investigation.

COFEE is available to individuals employed by law enforcement agencies within the United States and Canada. More information is available at cofee.nw3c.org.