text:
The following guide was produced by the CNA Corporation under grant from the Department of Justice's Bureau of Justice Assistance.
Large-scale events provide local governments with a number of valuable opportunities, including increasing revenue, revitalizing a city, and providing an increased sense of community. With these benefits comes greater responsibility for local law enforcement to ensure the public's safety.
When law enforcement executives are tasked with managing a large event, they can maximize their efforts by learning from other agencies and adopting proven practices. Too often, however, past lessons learned are not documented in a clear and concise manner. To address this information gap, the U.S. Department of Justice's Bureau of Justice Assistance worked in partnership with CNA to develop this Planning Primer.
This Planning Primer synthesizes salient best practices pertaining to security planning for a large-scale event, specifically pre-event planning, core event operations, and post-event activities. The Planning Primer includes detailed information on 18 core operational areas that law enforcement executives can give to lead law enforcement planners as supplemental guidance. This guidance can be used as a foundation for coordinating area-specific operational plans and can be modified to accommodate event security requirements and existing protocols. Furthermore, supplementing each operational area presented in the Planning Primer are actionable templates, checklists, and key considerations designed to facilitate the planning process (see Appendix A: Planning Toolkit).
Determine Authorities of Participating Agencies
Authority for event security planning and operations is often the responsibility of the local law enforcement agency that has operational control over the jurisdictional area; however, other agencies inside and outside of law enforcement will likely serve key functions critical to successful security operations. Neighboring law enforcement agencies (including those with events in their jurisdiction) and other mutual aid partners should be brought to the table early to engage in the planning process. If grant funds are used to support personnel costs, these funds are typically administered by the lead agency; there must be an open and transparent process for those funds to be distributed among mutual aid partners to cover personnel and security event expenses and to related events in neighboring jurisdictions. The local police department should serve as the lead liaison between local response partners and all other partners for the purpose of developing the components of, and implementing the event security plan. In this role, the local police department will identify key stakeholders (which may include agencies outside of law enforcement) that will have authority over security-related operations. Activities that are typically outside of the local police department's purview tend to include: communications, fire/emergency medical services/public health response, transportation management, tactical/explosive support, consequence management, emergency management, and recovery. It will be the police department's responsibility to coordinate the inputs of these stakeholders into the event security operations plan.
Anticipate Crowd Behaviors and Actions
Prior to the event, understand the nature of the audience attracted by a particular event. Work with event planners and interagency partners to gather intelligence on expected demonstration groups, including their size, typical behaviors, and any adversary groups. Information on demonstrators is primarily obtained through criminal intelligence gathering, which is detailed in Section 3.8 – Intelligence/Counterterrorism/Counter Surveillance.
Common demonstrator tactics that police should be aware of include the following:
• Blocking roads, streets, and intersections;
• Heaving barricades, rocks, and sticks;
• Wearing masks or other protective equipment to block effects from chemical irritants;
• Spitting or yelling in police officers' faces; or
• Breaking windows or vandalizing property
Determine Officer Dress
Officer dress can impact public perceptions and actions. For example, officers in full riot gear may encourage demonstrators to be more aggressive. Determine how crowd control officers should dress and any equipment needs (e.g., helmets, shields, chemical irritants).
Determine if a common uniform or an officer's personal uniforms should be used. A common uniform can be valuable in providing a unified front for crowd control operations. Conversely, the local agency can allow visiting officers to wear their department's uniform, which can be a cost-effective approach to showing a wide-range of force.
Control Demonstrator Activities
Consider the following strategies for controlling demonstrator activities during a large-scale security event:
• Pre-designate parade and march routes to better manage traffic interruptions of planned demonstrations.
• Prior to the event scan the area to remove objects that could be thrown at officers or used to damage property.
• Pre-position officers out of sight in hatch/riot gear.
• Designate space for demonstrators to sleep and set up their base of operations to consolidate demonstrators to one location and allow police to maintain better awareness of demonstrator activities.
• Evaluate the need for and layout of a free speech platform.
Leverage Video Surveillance Technologies
Use video surveillance—in the form of wireless and wired cameras, high-definition backpack cameras, and cameras on cellular phones—to provide law enforcement with real-time information sharing and situational awareness. Such mechanisms improve commanders' ability to make well-informed decisions in real time (e.g., by zooming in on suspicious objects or persons) and to deploy field forces appropriately.
After appropriate video technology is selected, make sure that all event personnel are trained on how to use it. In addition, tests and exercises should be conducted to validate that technologies are operational. Finally, establish back-up plans, such as replacement technologies or technicians on standby to fix broken equipment, in the case that technologies fail during the event.
Conduct Traditional and Non-Traditional Crime Analysis
Traditional crime analysis activities can bolster the effectiveness of video surveillance technologies, police departments can conduct commonly used analysis strategies to identify threats, such as monitoring calls for service, license plate readers, and intelligence databases/watch lists (e.g., National Crime Information Center, local police department command center, and NSSE watch lists). Use more novel crime-intelligence strategies—such as social media monitoring (e.g., Facebook, Twitter, and Open Stream) or cellular network technologies—to compile and disseminate useful security information.
Use Intelligence Sources with Mobile Technologies
Deploy intelligence sources and intelligence officers to gather real-time intelligence on the suspicious persons or activity, intent, tactics, and challenges related to demonstrator groups. Intelligence sources can use text messages and cellular phones to communicate intelligence to command staff for operational responses. Consider using mobile technologies that also allow intelligence sources to send photos and allow commanders to track their locations. Intelligence sources can also receive covert responses from its command post through text messages.
Conduct Arrests Quickly
Event-related arrest plans and procedures may have to be modified and amended in real-time. For example, during the 2012 DNC, CMPD learned that if it modified its arrest process to moving the arrest scene to another location, it could open roads and deescalate the original site. Future host departments should consider immediately transporting arrested individuals to an off-site location for processing to effectively diffuse potentially violent situations during arrests.
Learn Airspace Security Plans and Protocols
Become familiar with event airspace security plans that will outline airspace control measures, restrictions (including temporary flight restrictions), detection/monitoring, operations communications and coordination, and an integrated air defense plan that includes the use of military aviation support. During the event, identify who will handle dispatch of air missions and resource requests at the event's designated interagency operations center, in the event of overlapping security operations.
Considerations for Managing Crowds
In the planning process for a forthcoming event, organizers must have an understanding of both individual and crowd dynamics, as well as how these elements interrelate. While this is a preliminary guide to crowd control problems that organizers most frequently encounter, planners need to expand upon the particular issues for each crowd and venue. All of this information will assist in predicting potential problems that agencies can then address in the planning process.
General Issues for Consideration
1. Major crowd issues that the planning process should address include:
• Size – Maximum numbers permitted are often established by regulation for safety reasons.
• Demographics – Consider the composition of the audience, including the age and gender mix. If you identify in advance that young children will constitute a high proportion of the audience, consider additional facilities, such as childcare, family bathrooms, and rental strollers. Audiences made up of young children or elderly people tend to require additional medical facilities, and children and the elderly are more susceptible to crush injury than teens or adults.
2. Different kinds of events may attract certain types of spectators that require special attention. Consider the following:
• Rock concerts, in contrast to other types of concerts, may experience a higher number of incidences with drug and alcohol abuse, underage drinking, and possession of weapons.
• Religious and "faith healing" events may attract a significant number of ill and infirm people, which may increase the need for on-site medical care.
• Events for senior citizens may also require higher levels of health services.
• Certain sports events may attract over-reactive and violent supporters.
• Cultural events may require special arrangements, including the provision of interpreter services; special food services; and multilingual signposting, brochures, and announcements.
• For outdoor concerts or events, consider:
− Control and distribution of spectators in the field;
− Suggested minimum space allocation of 4 to 5 square feet per person on grounds with no seats; and
− Some form of sectoring and barrier management by security.
Crowd Issues
1. Crowds are complex social structures.
Crowd roles:
• Active Core: carry out action of crowd
• Cheerleaders: provide oral support for leaders
• Observers: follow actions but rarely take part
Significance of crowds:
• Increase the probability of a dangerous occurrence
• Increase the potential number of victims
• Make communication slower and more difficult
• Make changes in action slower and more difficult
• Diffuse responsibility (someone else will do it)
2. Panics and Crazes
Panic in a group is the flight from a real or perceived threat from which escape appears to be the only effective response. What appears to be panic is usually the result of poor inputs (especially communications, or the lack of) and previous knowledge and experience.
Craze in a group is the temporary, short-lived competitive rush by a group toward some attractive object. A craze tends to occur on entering an event, and may be exacerbated by the lack of information.
3. De-individualization
De-individualization is a loss of self-awareness and evaluation apprehension in group situations that foster anonymity. Behavior may include:
• Mild lessening of restraint (e.g., screaming during a concert);
• Impulsive self-gratification (e.g., theft, vandalism, molestation); or
• Destructive social explosions (e.g., group violence, rioting and torturing).
4. Defusing
The tedium that may be created by waiting and/or by the perception that other gates are being opened first, or later arrivals are being admitted first, can create problems. The following can help defuse the situation: appropriate music, the use of humor, food and beverage services moving through the group, cheerful security staff moving through the group, and good communication that includes a public address system.
The following pamphlet was issued by the Department of Justice's Bureau of Justice Assistance and the Department of Homeland Security in 2011. The pamphlet was released along with a longer report on Law Enforcement Guidelines for First Amendment-Protected Events.
First Amendment Events—Rights of Participants
One of the freedoms guaranteed by the United States Constitution is the First Amendment right of persons and groups to peaceably assemble. Persons and groups engaging in First Amendment-related activities have the legal right to:
- Organize and participate in peaceful assemblies, including demonstrations, rallies, parades, marches, picket lines, or other similar gatherings.
- Conduct these assemblies/gatherings in designated public areas.
- Express their political, social, or religious views.
- Freely associate with other individuals and collectively express, pursue, promote, and defend common interests.
The Role of State and Local Law Enforcement at First Amendment Events
As part of their law enforcement duty to uphold the United States Constitution, state and local law enforcement officers have the responsibility to protect persons engaged in their First Amendment right to peaceably assemble. Public safety is the primary mission of officers assigned to these types of events, and as a part of this mission:
Officers will:
- Protect life and property.
- Ensure that all privacy, civil rights, and civil liberties protections are upheld.
- Practice fair and impartial enforcement of laws, statutes, and ordinances.
- Adhere to the event Operations Plan, unless otherwise directed by supervisors. Expanded activity should not be conducted without supervisory approval unless criminal activity is identified by the officer.
- Enforce reasonable time, place, and manner restrictions as discussed in the Operations Plan.
Officers should not:
- Engage in unauthorized enforcement activities, including unauthorized information collection.
- Document information on persons solely on the basis of:
- Ethnicity, national origin, or race.
- Religious, political, or social beliefs or associations.
- Sexual orientation.
- Support for unpopular causes.
- Conduct investigative activity without direct supervisory authorization or unless criminal activity is identified by the officer.
- Allow personal beliefs and opinions to interfere with their duties as a law enforcement officer.
- Express personal, political, or religious views during the assembly while on duty.
- Infringe on any person's right to peaceably assemble and associate with others.
The following document containing standards for the construction of DHS sensitive compartmented information facilities (SCIFs) was obtained from the public FTP server of a prominent architectural firm and was indexed by Google.
This handbook is issued under the authority of the Director Central Intelligence Directive (DCID) 6/9, "Physical Security Standards for Sensitive Compartmented Information Facilities" and The Department of Homeland Security, Management Directive 11043, "Sensitive Compartmented Information Program Management".
This handbook applies to the Department of Homeland Security (DHS), its Components (excluding the United States Coast Guard), Directorates, Offices, and Field Activities. References made in this handbook to DHS will be considered to include all Components (excluding the United States Coast Guard), Directorates, Offices, and Field Activities, and entities encompassed under the jurisdiction of the Homeland Security Act and amendments thereto. The United States Coast Guard maintains their designated membership in the Intelligence Community and will continue to manage and operate its own intelligence program.
This handbook also applies to contractors in SCI Facilities (SCIFs) accredited by the DHS and to DHS SCI contract efforts conducted within facilities accredited by other agencies and approved for joint use by co-utilization agreement.
Heads of DHS Intelligence Components may issue supplementary instructions when necessary, to address unique situations to meet mission requirements within their respective components. All supplementary instructions must be approved by the Cognizant Security Authority (CSA) prior to implementation. Provisions outlined in this handbook take precedence over previously issued legacy manuals, instructions, guidance and other publications.
This handbook contains standard security designs and procedures common to Sensitive Compartmented Facilities (SCIF) and physical security construction standard and established by the Director National Intelligence (DNI) for protection of classified intelligence information. Users should refer to Director of Central Intelligence Directives (DCIDS) and other documents cited under Authorities for guidance on specific security functions.
To prevent telephone lines and telephone instruments that service a SCIF from being used as clandestine listening devices, the following controls will be required:
1. All incoming telephone cables and wires which penetrate a facility's perimeter will enter the facility through one opening and be placed under control at the interior face of the perimeter by the following:
a. All active incoming lines will be accounted for by the number of pairs in use, by telephone and extension number, and the number of excess/unused pairs in existence. The accounting will be updated whenever the status of a pair of wires is changed.
b. All excess/unused incoming wires will be either removed or disconnected and grounded in a manner which prevents their unauthorized use.
2. The number of telephone instruments servicing a SCIF will be limited to those operationally necessary. All telephone instruments will be equipped with a non-resonating ringer, a positive disconnect either automatic or manual plug and jack, and, in certain installations a line filter. Specially designed, for U.S. Government use, telephone instruments and associated security devices are available from telephone companies. When planning the telephone system for a SCIF, advance consultation with SSPD is encouraged to obtain advice regarding recommended telephone instruments, associated security devices, installation design, and the required "certification of need" to obtain specially designed instruments and devices.
Computerized telephone systems (CTS) or Voice Over Internet Protocol (VoIP) systems within the SCIF must meet Telephone Security Group (TSG) TSG-2 standards or utilize approved TSG type 6 equipment.
If the room is a "discussion area", all telephones installed in the space must be TSG-6 approved telephones, as an alternative, a TSG-2 configuration may be approved and utilized.
1. Administrative telephone systems are a potential source for fortuitous conduction of Compromising Emanations (CE) due to their proximity to building maintenance areas and their signal line distribution outside the facility. Additional protection is recommended when commercial telephones are located in a RED electromagnetic environment. The most effective protection is provided by line disconnection switches and telephone line optical isolators that use waveguide below cutoff. The use of these devices or telephone filters must be approved by the CTTA. These devices should be considered only when installing. replacing or retrofitting telephone systems.
2. Remember that the administrative telephone system and its associated wiring are BLACK. The telephone system cabling should be routed in a separate distribution system. If filters or isolators are required and approved by the CTTA, the lines should be filtered/isolated where they egress the inspectable space or facility. Locating the filters/isolators at the controlled space is not recommended because the equipment TEMPEST zone may extend beyond the controlled space. In addition, fewer filters/, isolators will be necessary if the trunk lines rather than the individual phone lines are filtered/isolated.
3. CATV: Cable Television service into the SCIF must be electrically isolated at the point of entry. SSPD recommends the use of Fiber Plex Incorporated Uni-Directional (Simplex) Composite Video Optical Transmitter and Optical Receiver models (FOI-2170) and (FOI-2172) or similar isolation device also PCT International's 1310 nm Rackmount Transmitter (PCT-FTX3R) suitable for NTSC or PAL television signal transmission. Analog bandwidth to 870 MHz allows for advanced services such as HDTV, VOD, PPV, and high speed data as well as traditional cable TV.
4. Fire alarm horn strobes and horn enunciators installed inside of the SCIF will have a self amplified speaker configuration. Wheelock models SA-70 and SA-70s or similar device(s) are recommended.
Based upon a threat determination and analysis of the proposed SCIF site, location and mission, RF Attenuation may be required. A determination will be made by SSPD prior to construction of the facility in accordance with CNSS 7000 and NSTISSI 7000, TEMPEST countermeasures for facilities, date May 2004. If a determination is made that TEMPEST countermeasures are required the following information is provided:
1. On the interior (secure side), on top of the metal mesh, install two layers of 5/8 inch foil back drywall, with staggered seams, horizontally and vertically.
2. The preferred method of RF mitigation is to install to two layers of drywall: Install one layer of 5/8 inch drywall. Install a layer of TVM Ultra NT Radiant barrier foil (part # 1800 48 125s) or equivalent approved product. Seams must be overlapped and taped with metallic tape, or folded appropriately. Install a second layer of regular 5/8 inch drywall on top of the foil barrier.
The following are the technical recommendations for all clear window film installed as an after market item. The preferred method is the film to be installed between the glazing as part of the window construction process prior to being placed in the window frame.
1. Radio Frequency attenuation greater than or equal to: 30dB from 30MHz to 1.5 GHz.
2. Infrared attenuation greater than or equal to: 80% at 800 nm (nanometer) 90% at 900 nm 94% at 1000 nm 98% at 1550 nm – 2300 nm
3. Ultra Violet attenuation greater than or equal to: 70% at wavelengths less than 400 nm 90% at 375 nm 90% at 350 nm
4. Total visible (400nm – 780 nm ) transmission greater Than or equal to 60%
5. Glazing system blast rated to GSA Glass Fragment Hazard Ranking 2. Can also be put within the PVB of the glass, (preferred and much cheaper).
The DHS only aware of two manufacturers that provide a window glazing product that meet or exceed these requirements, 3M and Signals Defense. DHS SSPD is available to review any other product that may be used in lieu of these suggested vendors.
The Afghanistan Opium Survey is implemented annually by the Ministry of Counter Narcotics (MCN) of Afghanistan in collaboration with the United Nations Office on Drugs and Crime (UNODC). The survey team collects and analyses information on the location and extent of opium cultivation, potential opium production and the socio-economic situation in rural areas. Since 2005, MCN and UNODC have also been involved in the verification of opium eradication conducted by provincial governors and poppy-eradication forces. The results provide a detailed picture of the outcome of the current year's opium season and, together with data from previous years, enable the identification of medium- and long-term trends in the evolution of the illicit drug problem. This information is essential for planning, implementing and monitoring the impact of measures required for tackling a problem that has serious implications for Afghanistan and the international community.
The opium survey is implemented within the technical framework of the UNODC Illicit Crop Monitoring Programme (ICMP). The objective of ICMP is to assist the international community in monitoring the extent and evolution of illicit crops in the context of the Plan of Action adopted by the United Nations (the 53rd session of the Commission on Narcotic Drugs in March 2009). Under ICMP, monitoring activities currently supported by UNODC also exist in other countries affected by illicit crop cultivation: in Asia, Myanmar and the Lao People's Democratic Republic; in Latin America, the Plurinational State of Bolivia, Colombia, Ecuador, Mexico and Peru; in Africa, Nigeria.
The Afghanistan Opium Survey 2014 was implemented under project AFG/F98, "Monitoring of Opium Production in Afghanistan", with financial contributions from the Governments of Germany, Norway, the United Kingdom of Great Britain and Northern Ireland, and the United States of America.
Key Findings
- The total area under opium poppy cultivation in Afghanistan was estimated at 224,000 hectares in 2014, a 7% increase from the previous year.
- The vast majority (89%) of opium cultivation took place in nine provinces in Afghanistan's Southern and Western regions, which include the country's most insecure provinces.
- Hilmand remained Afghanistan's major opium-cultivating province, followed by Kandahar, Farah, and Nangarhar.
- Opium cultivation increased in most of the main poppy-cultivating provinces, but stabilized in Hilmand itself (+3%).
- Interestingly, differing trends could be observed in Hilmand. Inside the former "Food Zone" (an alternative livelihood programme), opium cultivation increased by 13% in 2014 (to 41,089 hectares from 36,244 hectares in 2013). However, outside the former Food Zone, where the increases in poppy cultivation seen in previous years were mainly achieved through artificial irrigation, the area under poppy cultivation decreased slightly.
- Total eradication of opium poppy decreased by 63% in 2014, to 2,692 hectares. Average opium yield amounted to 28.7 kilograms per hectare in 2014, which was 9% more than in 2013 (26.3 kilograms per hectare).
- Opium yields in the Southern region, which drive overall production, increased by 27%, from 23.2 kilograms per hectare in 2013 to 29.5 kilograms per hectare in 2014. However, yields in the Southern region were still at relatively low levels in comparison to their levels prior to 2010.
- Potential opium production was estimated at 6,400 tons in 2014, an increase of 17% from its 2013 level (5,500 tons). This increase can be mainly attributed to a strong increase in production in the Southern region, where yields increased by 27% (from 23.2 kilograms per hectare in 2013 to 29.5 kilograms per hectare in 2014).
- Accounting for 69% of national production, the Southern region continued to produce the vast majority of opium in Afghanistan. With 16% of national production, the Western region was the country's second most important opium-producing region in 2014.
- At US$ 0.85 billion, or the equivalent of roughly 4% of Afghanistan's estimated GDP, the farm-gate value of opium production decreased by 13% in 2014.
- In 2014, opium prices decreased in all regions of Afghanistan. One probable reason for the decrease was an increase in supply due to an increase in production.
- Based on recent data on the morphine content of Afghan opium, the heroin conversion ratio, which describes the amount of opium needed to produce a kilogram of heroin, has been updated. For converting opium to pure heroin base, a ratio of 18.5:1 is estimated; for heroin of export quality (impure heroin of 52% purity), a ratio of 9.6:1 is estimated. These ratios replace the former ratio of 7:1 for converting opium to heroin of unknown purity.
In 2014, 98% of total opium cultivation in Afghanistan took place in the Southern, Eastern and Western regions of the country: in the Southern region, 67% was concentrated in Day Kundi, Hilmand, Kandahar, Uruzgan and Zabul provinces; in the Western region, 22% was concentrated in Badghis, Farah, Hirat and Nimroz provinces; in the Eastern region, 9% was concentrated in Nangarhar, Kunar, Laghman and Kapisa provinces. These are the most insecure provinces, with a security risk classified as "high" or "extreme" by the United Nations Department of Safety and Security (UNDSS), and they are mostly inaccessible to the United Nations and NGOs. Day Kundi is the only province in the South where security is generally good, with the exception of Kejran district.
Hilmand remained the country's major opium-cultivating province (103,240 hectares), followed by Kandahar (33,713 hectares), Farah (27,513 hectares), Nangarhar (18,227 hectares), Nimroz (14,584 hectares), Uruzgan5 (9,277 hectares), Badghis (5,721 hectares), Badakhshan (4,204 hectares), Zabul (2,894 hectares), Laghman (901 hectares), Kunar (754 hectares), Hirat (738 hectares) Day Kundi6 (587 hectares), Ghor (493 hectares), Kapisa (472 hectares), Kabul (233 hectares) and Sari Pul (195 hectares).
The following National Institute of Standards and Technology draft guide on cyber threat information sharing was released October 28, 2014 for public comment.
This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Management Act (FISMA), Public Law (P.L.) 107-347. NIST is responsible for developing information security standards and guidelines, including minimum requirements for Federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate Federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems, as analyzed in Circular A-80 130, Appendix IV: Analysis of Key Sections. Supplemental information is provided in Circular A-130, Appendix III, Security of Federal Automated Information Resources.
As the magnitude and complexity of cyberspace increases, so too does the threat1 landscape. Cyber attacks have increased in both frequency and sophistication resulting in significant challenges to organizations that must defend their infrastructure from attacks by capable adversaries. These adversaries range from individual attackers to well-resourced groups operating as part of a criminal enterprise or on behalf of a nation-state. These adversaries are persistent, motivated, and agile; and employ a variety of tactics, techniques, and procedures (TTPs) to compromise systems, disrupt services, commit financial fraud, expose sensitive information, and steal intellectual property. To enhance incident response actions and bolster cyber defenses, organizations must harness the collective wisdom of peer organizations through information sharing and coordinated incident response. This publication expands upon the guidance introduced in Section 4, Coordination and Information Sharing of NIST Special Publication (SP) 800-61, Computer Security Incident Handling Guide and explores information sharing, coordination, and collaboration as part of the incident response life cycle.
This publication assists organizations in establishing, participating in, and maintaining information sharing relationships throughout the incident response life cycle. The publication explores the benefits and challenges of coordination and sharing, presents the strengths and weaknesses of various information sharing architectures, clarifies the importance of trust, and introduces specific data handling considerations. The goal of the publication is to provide guidance that improves the efficiency and effectiveness of defensive cyber operations and incident response activities, by introducing safe and effective information sharing practices, examining the value of standard data formats and transport protocols to foster greater interoperability, and providing guidance on the planning, implementation, and maintenance of information sharing programs.
Implementing the following recommendations enables organizations to make more efficient and effective use of information sharing and collaboration capabilities throughout the incident response life cycle. Organizations should perform an inventory that catalogues the information an organization currently possesses, the information that it is capable of producing, and document the circumstances under which this information may be shared.
By conducting an information inventory, an organization gains a better understanding of where its critical information resides, who owns it, how must it be protected, and when it can be shared. When deciding what incident-related information to share with other organizations, the following factors should be considered:
• Risk of disclosure
• Operational urgency and need for sharing
• Benefits gained by sharing
• Sensitivity of the information
• Trustworthiness of the recipients
• Methods and ability to safeguard the information
The following bulletin provides valuable translations of Islamic State propaganda distributed on Twitter providing guidance to potential lone offender jihadists seeking to conduct attacks against law enforcement. The document was obtained from a public web forum where it was being disseminated by employees of a private security company.
(U//FOUO) Propaganda providing guidance and/or encouraging "individual jihad" or small cell operations against the West continues to be a prevalent theme in jihadist messaging. This bulletin was created by the CFIX in order to address recent propaganda from the Islamic State and its supporters which provides guidance on targeting law enforcement officers. The CFIX bases its analysis in this bulletin from open source reporting and internet postings with varying degrees of reliability, especially in regards to the true intention and capabilities of terrorist organizations and their supporters. This information is intended to support local, state and federal government agencies along with other entities in developing / prioritizing protective and support measures relating to an existing or emerging threat to homeland security.
(U) Key Judgments
(U//FOUO) We assess with medium confidence that there will be a continued call – by the Islamic State and their supporters – for lone offender attacks against Western security forces (both military and law enforcement). These threats will likely increase as the U.S. and its allies continue to carry out airstrikes against the Islamic State in Syria and Iraq.
(U//FOUO) The CFIX assesses with medium confidence based on historical trends and recent guidance provided in jihadist propaganda, that law enforcement officers could be targeted by HVEs inspired by the Islamic State, Al-Qa'ida and their supporters. Attacks carried out by a lone offender or a small cell of individuals remains the greatest threat.
(U//FOUO) We assess that law enforcement officers would most likely be targeted individually in spontaneous 'ambush' style attacks similar to the 2013 machete attack against a British soldier in the U.K. Although the victim in the machete attack was a Solider, this type of spontaneous attack has also been encouraged against law enforcement and government officials.
(U//FOUO) Current airstrikes in Syria and Iraq by the U.S. and its allies is being used by the Islamic State and its supporters as a means to mobilize individuals in the West to carry out retaliatory attacks. On 18 September 2014, Abu Muhammad al-Adnani, the official spokesman for the Islamic State, released an audio message via jihadist forums and Twitter calling for lone-wolf attacks in the West by any means possible. Within the message Adnani specifically identifies law enforcement, military and other government officials as viable targets. He states:
(U//FOUO) "…Do not let this battle pass you by wherever you may be. You must strike the soldiers, patrons, and troops of the tawaghit. Strike their police, security, and intelligence members, as well as their treacherous agents. Destroy their beds. Embitter their lives for them and busy them with themselves. If you can kill a disbelieving American or European – especially the spiteful and filthy French – or an Australian, or a Canadian, or any other disbeliever from the disbelievers waging war…against the Islamic State…If you are not able to find an IED or a bullet, then single out the disbelieving American, Frenchman, or any other of their allies. Smash his head with a rock, or slaughter him with a knife, or run him over with your car, or throw him down from a high place, or choke him, or poison him…If you are unable to do so, then burn his home, car, or business. Or destroy his crops…"
(U//FOUO) Adnani's video message is the first official statement from the Islamic State advocating for lone-wolf attacks; however, supporters and Western fighters from the group began suggesting this tactic in April 2014. As a result of Adnani's statement, there have been numerous posts, in English and Arabic, on jihadist forums and social media platforms by Islamic State supporters which provide targeting guidance for Muslims in the West.
(U//FOUO) Islamic State Supporter Provides Guidance for Targeting Law Enforcement
(U//FOUO) In response to Abu Muhammad al-Adnani's statement, Abu Safiya al-Iraqi, a jihadist who identifies himself as an "engineer" for the Islamic State, wrote an Arabic-language article titled "Retaliation Advice for Those Who are Missing Bullets". The article was posted to Abu Safiya's Twitter account on 22 September 2014 and provides instructions for making explosive devices and specific recommendations for targeting law enforcement officials. He states: "We will present a collection of advice for those who are lacking weapons but are determined on revenge against officers and military of the nonbelievers…make the world of the police a hell they live every moment, thinking they will be killed. Do not let them feel secure even in their home".
(U//FOUO) Abu Safiya emphasizes the importance of gathering intelligence on selected targets prior to carrying out an attack. He states: "You can take out the police one by one when they leave, or before they enter home, but you must first gather information about them". He also suggests:
− (U//FOUO) After identifying the home address of the police officer, the first suggestion provided is to stab him as he enters or leaves his home. After killing the officer, Abu Safiya suggests beheading him as a warning. The second solution is to burn the officer's house or vehicle.
− (U//FOUO) Monitor the officer's activities and identify his shift change. Watch for the officer to leave in civilian clothing, get him alone on the street or a deserted location and kill him.
− (U//FOUO) If you know of a detective but cannot kill him yourself "spread his photo until he's killed by someone else and do not allow him to ever stay comfortable".
(U//FOUO) Listed below are additional recommendations provided by Abu Safiya:
− (U//FOUO) Abu Safiya mentions that "placing suspicious objects in the streets might stop traffic for hours". He also mentions that police officers can be targeted by providing "false news" to "lure them to a remote area" where the brothers can "finish them off".
− (U//FOUO) If a brother knows that he is being surveilled by law enforcement, he should evacuate his family then "lure the officer into your home" and blow it up.
− (U//FOUO) Terrorize the officers by calling them from an anonymous number in the middle of the night and telling them "ISIS is coming for you now and your head will fly off".
− (U//FOUO) He suggests that they remove the tag from their vehicles, cover their face, then search for the officers and run them over.
− (U//FOUO) Drive an explosive laden toy car under their police vehicle. Once the officer enters the vehicle, remotely detonate the explosives.
− (U//FOUO) For those who no longer have the ability to travel, Abu Safiya advises that they can kidnap and murder military personnel of Western and allied countries.
(U//FOUO) Abu Safiya ends his post by advising prospective lone-wolves to allow large scale attacks to speak for themselves; however, smaller attacks should be filmed or photographed and distributed via social media.
Why Are You a Target?
• Publicly available information helps foreign intelligence entities identify people with placement and access.
– Contract information (bid, proposal, award or strategies)
– Company website with technical and program information
– Connections (partnerships, key suppliers, joint ventures, etc.) with other cleared or non-cleared companies
• Employee association with companies or technologies made public through scientific journals, academia, public speaking engagements, social networking sites, etc.
What Do They Target?
• Company unclassified networks (internal and extranets), partner and community portals, and commonly accessed websites
• Proprietary information (business strategy, financial, human resource, email, and product data)
• Export controlled technology
• Administrative and user credentials (usernames, passwords, tokens, etc.)
• Foreign intelligence entities seek the aggregate of unclassified or proprietary documents that could paint a classified picture
How Do They Compromise Networks, Systems, and Technical Data?
Reconnaissance: Research phase used to identify and select targets by browsing websites to obtain names, emails, business and social relationships, and technical information.
Weaponization: The foreign intelligence entities assemble the payload and wrapper, such as coupling a remote access exploit with a prepared spear-phishing email.
Delivery: The foreign intelligence entity infects the target, most commonly using email, website hijacking, or removable media (through insiders). Exploitation: Successful compromise of targeted vulnerability to allow malicious code to be run. Installation: Executed malicious code inserts malware, such as a Remote Access Trojan or opens a backdoor connection to the target system – may allow for persistence. Command and Control (C2): The malware will communicate to a controller server to send or receive instructions from the foreign intelligence entity.
Actions on the Objective: After completing the above actions, the foreign intelligence entity can fulfill their requirements. Intelligence requirements can range from exfiltration, using the system as a strategic position to compromise additional systems within the targeted network (hop-point), or sabotaging the system and network.
Countering Threats to Networks and Cleared Individuals
• Everyone is a potential target
• Use complex passwords, change them regularly, and don't reuse
• Be wary when connecting with unknown individuals on social networking sites
• Spear-phishing can happen on any account, including personal email accounts
– Do not open emails, attachments, or click links from unfamiliar sources, even if they look official
IT Department & Management
• Train all personnel on:
– Spotting a spear phishing, phishing, or whaling email attempt
– Social networking site connections
– Proper cyber security procedures and concerns
• Implement defense-in-depth: a layered defense strategy that includes technical, organizational, and operational controls
• Implement technical defenses: firewalls, intrusion detection systems, internet content filtering, and a DNS proxy
• Update your anti-virus software daily and download vender security patches for all software
• Do not use manufacturers' default passwords on software or hardware
• Monitor, log, analyze and report attempted and successful intrusions to your systems and networks – even unsuccessful intrusions present a counterintelligence value!
• Maintain open communication between company counterintelligence and network defense personnel. Defense only is not a comprehensive strategy
Reporting Definitions
Cyber Espionage: The act of obtaining, delivering, transmitting, communicating, or receiving information about the national defense using cyberspace with an intent, or reason to believe, that the information may be used to the injury of the United States or to the advantage of any foreign nation.
Cyberspace: A global domain within the information environment consisting of the interdependent network of information technology infrastructures and resident data, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers.
What to Report
• Advanced techniques and/or advance evasion techniques, which imply a sophisticated adversary
• Password cracking, key logging, encryption, steganography, privilege escalation, and account masquerading
• Pre-intrusion aggressive port scanning
• Social engineering, electronic elicitation, email spoofing, spear phishing, whale phishing, or direct questioning, such as through social networking sites
• Unauthorized network access
• Actual or attempted unauthorized access into U.S. automated information systems
• Tampering with or introducing unauthorized elements into information systems
• Unexplained user accounts, administrator accounts, and expansion of network privileges
• Data exfiltrated to unauthorized domains affecting classified information, systems or cleared individuals
• Malicious codes or blended threats such as viruses, worms, trojans, logic bombs, malware, spyware, or browser hijackers, especially those used for clandestine data exfiltration
• Unauthorized email traffic to foreign destinations
• Use of DoD account credentials by unauthorized parties
• Unexplained storage of encrypted data
• Network spillage incidents or information compromise
• Unauthorized transmissions of classified or controlled unclassified information
• Any cyber activity linked to suspicious indicators provided by the Defense Security Service (DSS), or by any other cyber centers and government agencies
The following document was obtained from the website of the Central Florida Disaster Medical Coalition.
(U//FOUO) The purpose of this brief is to provide law enforcement, first responders, corrections officers, and other personnel who interact with the general public, with guidance and protective measures when coming in contact with individuals demonstrating symptoms of the Ebola Virus Disease (EVD). Personnel who become familiar with the identification of possible exposure, proper response protocols and protective measures will be better prepared to respond, secure, transport and decontaminate to prevent further spread of this deadly disease.
(U) According to the Center for Disease Control (CDC), the 2014 Ebola epidemic is the largest in history, affecting multiple countries in West Africa. The CDC is working with other U.S. government agencies, the World Health Organization (WHO), and other domestic and international partners to prevent further spread of the Ebola virus within the United States.
(U) Law enforcement, first responders, corrections officers, health care providers and personnel who are in close contact with the general public should be familiar with Ebola signs and symptoms, methods of contamination and guidance on handling claims of illness during routine encounters.
(U) The likelihood of contracting Ebola in the United States is low unless a person has direct unprotected contact with the blood or bodily fluids (like urine, saliva, feces, vomit, sweat, and semen) of a person who is sick with Ebola Virus Disease.
(U) Law enforcement, first responders, corrections officers, health care providers and personnel who interact with the general public are at higher risk of coming in contact with an infected individual due to the unique challenges and uncontrolled nature of their work environment. These factors may increase the risk of exposure to blood and bodily fluid during an encounter with a combative subject, or from an ambulatory or custodial transport.
(U) Symptoms of Ebola may appear anywhere from 2 to 21 days after exposure, although the average is 8 to 10 days. Ebola can only be spread to others after symptoms begin.
(U) Ebola can be spread by direct contact (through broken skin or mucous membranes) with a sick person's blood, bodily fluids. The virus also can be spread through contact with objects (like clothes, bedding, needles, syringes/sharps or medical equipment) that have been contaminated with the virus.
(U) Immediate identification of symptoms is critical for personnel who are exposed or come in direct contact with a potentially infectious person.
The DSS Counterintelligence (CI) Directorate seeks to identify and counter unlawful penetrators of cleared U.S. industry to stop foreign attempts to obtain illegal or unauthorized access to classified information and technology resident in the U.S. cleared industrial base.
DSS CI articulates the foreign intelligence threat to U.S. government cleared industry leaders.
DSS CI special agents are deployed across the country to support facility security officers (FSOs) and other cleared industry representatives in recognizing and appropriately reporting unlawful foreign attempts to acquire classified and controlled sensitive technology. DSS CI's risk-based approach incorporates a realistic assessment of threats to critical DoD research, technology, and classified information, and tailors CI services through objective criteria and threat categorization to mitigate the risk.
United States cleared industry is a prime target of many foreign intelligence collectors and foreign government economic competitors. Cleared employees working on America's most sensitive programs are of special interest to other nations.
The number of reported collection attempts rises every year, indicating an increased risk for industry. While any geographic region can target sensitive or classified U.S. technology, DSS has consistently found that the majority of suspicious contacts reported by cleared industry originate from East Asia and the Pacific regions.
Every region has active collectors. Cleared contractors should remain vigilant regardless of the collector's assumed country of origin.
The nature and extent of industry reported suspicious contacts suggest a concerted effort to exploit cleared contractors for economic and military advantage. These contacts range from outright attempts to steal technology to seemingly innocuous business ventures.
One of the fastest growing areas of concern is the exploitation of cyberspace for surreptitious access to cleared contractor data systems and cleared individuals. The potential for blended operations where cyberspace contributes to traditional tradecraft presents the greatest risk to cleared industry. An increase in unsolicited contacts made with cleared industry employees from compromised accounts amplifies the potential for compromise of cleared individuals, classified programs, or classified systems occurring in the unclassified cyber domain
Through analysis of industry reporting, DSS has found that foreign intelligence services utilize both commercial and government-affiliated entities.
• The large number of commercial contacts likely represents an attempt by foreign governments to make the contacts seem more innocuous by using non-governmental entities as surrogate collectors
• The number of government-affiliated contact reports is likely due to foreign governments' increased reliance on government-affiliated research facilities that contact cleared U.S. contractors under the guise of information-sharing
Collection Methods
Recent industry reporting indicates that while foreign entities continue to use direct and overt means in their attempts to gain access to classified/sensitive information and technologies or to compromise cleared individuals, foreign entities are also returning to indirect collection methods.
>> Cyber Exploitation
• Spear phishing was the most common malware delivery technique; this technique allows the malicious actors to send targeted emails with low risk and potentially high payoff
• Watering Hole attacks (compromised third-party websites) may provide a means for malicious actors to gain unauthorized access to your network or device.
• Removable media (USB devices) can provide a means to quickly spread malicious software from a trusted position
• Use of removable media (USB drives) can initiate attempted intrusions
>> Attempted acquisition of and requests for information about controlled technology
• Represent a low-risk/high gain method of operation
• Usually involve emailing, mailing, faxing, or cold calling U.S. cleared contractor employees; web-card submissions; or use of a website's "contact us" page
• Collectors ask for everything from price quotes and technical specifications to the outright sale of the technology
>> With academic solicitation, foreign students seek post-graduate positions, thesis assistance, or reviews of drafts of scientific publications
>> Representatives of foreign companies often solicit or market their services to cleared U.S. companies and offer to market the cleared company's products overseas, provide technical and business services, or seek employment on classified cleared contractor projects
>> During foreign delegation visits to cleared facilities, visitors may show up unannounced, attempt to gain access to restricted areas, or add unvetted visitors to their party at the last minute Reportable Suspicious Contacts Include
• Efforts by any individual, regardless of nationality, to obtain illegal or unauthorized access to classified information or to compromise a cleared employee
• Contact by cleared employees with known or suspected intelligence officers from any foreign country
• Any contact that suggests the employee concerned may be the target of an attempted exploitation by a foreign intelligence entity
• Attempts to entice cleared employees into compromising situations that could lead to blackmail or extortion
• Attempts by foreign customers to gain access to hardware and information that exceeds the limitations of the export licenses on file
• Attempts to place cleared personnel under obligation through special treatment, favors, gifts, or money
• Requests for protected information in the guise a of price quote or purchase request, market survey, or other pretense
Suspicious Purchase Requests
The following may indicate an attempt by a foreign entity to illegally acquire classified or export-controlled technology or information:
• End user is a warehouse or company that organizes shipments for others
• No end-user certificate
• Multiple sales representatives
• Unusual quantity
• Requested modifications of technology
• Rushed delivery date
• No return address
• End user address is in a third country
• Address is an obscure PO Box or residence
• Multiple businesses using the same address
• Vagueness of order — quantity, delivery destination, or identity of customer
• Buyer requests all products be shipped directly to him/her
• The request is directed at an employee who does not know the sender and is not in the sales or marketing office
• Solicitor is acting as a procurement agent for a foreign government
• Military-specific technology is requested for a civilian purpose
• Company requests technology outside the requestor's scope of business
• Visitors request last-minute change of agenda to include export-controlled technology
• Requestor offers to pick up products rather than having them shipped
• Requestor uses broken English or poor grammar
• Individual has a lack of/no knowledge of the technical specifications of the requested type of technology
(U//FOUO) The Transportation Security Administration's Office of Intelligence (TSA-OI) unclassified annual Freight Rail Threat Assessment addresses the overall threat to the U.S. freight rail industry and presents conclusions regarding likely targets and actors based upon a review of successful attacks against rail systems overseas.
(U//FOUO) The U.S. freight railroad sector incorporates 565 railroads operating on 139,679 miles of track throughout North America, including the United States, Canada, and Mexico. According to the Association of American Railroads (AAR), seven large freight, or Class I, railroad companies own and operate the majority of railroad track and rail property in the country. The AAR defines Class I railroads in the United States as those with the highest revenue. These seven Class I companies share trackage rights among themselves with shortline freight, and with commuter and passenger railroads. Freight railroads employ 168,891 people, maintain more than 1.5 million rail cars in North America, and transport approximately 43 percent of U.S. domestic freight and valuable commodities—including petroleum, chemicals, farm products, automobiles, food, lumber, and coal. Freight and passenger rail operations are often interdependent and use the same infrastructure, including track, signals, and in some cases control centers.
(U//FOUO) TSA-OI has no specific, credible intelligence to suggest violent transnational or domestic extremist groups are planning to attack the U.S. freight rail system, or use the system to facilitate an attack against another target. TSA-OI assesses with moderate confidencei that the risk of an attack to the U.S. freight rail industry is low.
(U//FOUO) TSA-OI assesses with high confidence that passenger trains or stations are more likely to be targeted than freight trains. The interdependency of the freight and passenger rail infrastructure in the United States increases the likelihood that any threats or attacks against passenger rail could impact freight rail as well.
(U//FOUO) TSA-OI judges that al-Qa'ida (AQ), its affiliates, and other terrorists motivated by violent extremist views would be the most likely actors to target the U.S. freight rail system. This judgment is based on recent attacks against freight rail and passenger trains overseas and the recent stated goals of al-Qa'ida's senior leadership to attack U.S. transportation.
(U//FOUO) Based upon a review of worldwide attacks on freight rail targets, TSA-OI assesses that improvised explosive devices (IEDs) would be the most likely means of attack against the U.S. freight rail system.
(U//FOUO) There is little evidence of a specific terrorist threat to freight rail Supervisory Control and Data Acquisition (SCADA) or other Industrial Control Systems (ICS), but al-Qa'ida and other violent extremist groups have a sustained interest in acquiring the skills to conduct cyber attacks.
(U) Toxic Inhalation Hazards (TIH)
(U//FOUO) According to the Association of American Railroads Bureau of Explosives, each year, more than
76,000 bulk rail shipments of materials poisonous by inhalation, commonly referred to as toxic inhalation
hazard (TIH), traverse nearly all major American cities and metropolitan regions. Because of its pervasiveness
(more than 30,000 shipments per year) and toxic effects (500 parts-per-million can cause health problems),
chlorine is of particular concern to the freight rail industry.
(U//FOUO) No terrorist group has ever attacked a rail car transporting TIH commodities. Additionally, TSA-OI
has no current intelligence to indicate that al-Qa'ida or any other terrorist organization is planning to conduct
an attack on a TIH car. Nevertheless, a successful attack on a freight rail car transporting TIH through a
densely populated urban area could meet al-Qa'ida's strategic goals of attacking targets that would generate
mass casualties, economic damage, and fear.
(U//FOUO) Although there is little evidence of a specific terrorist threat to freight rail Supervisory Control and Data Acquisition (SCADA) or other Industrial Control Systems (ICS), intelligence reporting indicates al-Qa'ida and other violent extremist groups have a sustained interest in acquiring the skills to conduct cyber attacks. Independent hackers, as well as foreign governments, have also been linked to repeated intrusions into U.S. business and control system computer networks.
(U//FOUO)• In 2003, a U.S. freight rail company's business systems became infected with a non-directed computer worm. Much of the consequent degradation of rail operations stemmed from mitigation efforts to contain the intrusion, highlighting how computer system performance can be directly affected in unexpected or unanticipated ways (whether intentionally or otherwise).
(U//FOUO) This Transportation Security Administration's Office of Intelligence (TSAOI) annual Mass Transit Threat Assessment provides an overview of possible threats to the U.S. mass transit system, and presents conclusions regarding likely perpetrators, as well as their targets and weapons.
(U//FOUO) The U.S. mass transit system incorporates the passenger rail, heavy rail, light rail, and transit bus sectors. Approximately 6,000 mass transit agencies/authorities in the United States transport approximately 14 million people daily.
(U) Key Findings
(U//FOUO) TSA-OI assesses with high confidence that the current threat assessment level to U.S. mass transit systems is "medium". TSA-OI's assessment of the threat is based on recent disrupted plots in the Homeland, al-Qa'ida's (AQ) stated intent, and worldwide terrorist attacks on mass transit systems. TSAOI has no current, credible threat information regarding imminent attacks on U.S. mass transit systems.
• (U//FOUO) Based on disrupted plots, TSA-OI assesses that AQ and its affiliates have demonstrated a continuing desire, intent, and capability to attack mass transit systems in the Homeland and remain the primary terrorist threat to the U.S. transportation industry.
• (U//FOUO) TSA-OI assesses that a terroristii attack against mass transit systems in the United States will most likely occur in a passenger rail car or station to generate fear and the greatest number of casualties.
• (U//FOUO) A review of terrorist attacks on overseas mass transit systems during the reporting period indicates that terrorists will most likely utilize improvised explosive devices (IEDs) or conduct armed assaults in a future terrorist attack against the U.S. mass transit system.
(U//FOUO) Terrorist groups aligned or in consultation with AQ have shown intent or demonstrated the capability to attack or engage in planning attacks against U.S. mass transit systems. TSA-OI assesses that AQ and its affiliates are the primary threat to mass transit systems in the Homeland.
(U//FOUO) For both rail and bus attacks, terrorists with secular, political, or anarchistic motives accounted for 47 percent of the 197 attacks on mass transit systems. Violent Islamic extremist groups—usually Sunni extremists—accounted for 20 percent of attacks. Shia and Jewish extremists accounted for 1 percent of all attacks. Perpetrators motivated by unknown causes were responsible for 32 percent of all attacks. (See Figures 2 and 3)
• (U//FOUO) May 2010: Faizal ShahzadUSPER was arrested in connection with a failed attack on Times Square in New York City. Shahzad admitted to law enforcement authorities that had his New York City's Times Square attack been successful, he would have attacked other targets, including mass transit. Shahzad was trained for his attack by Tehrik-e Taliban Pakistan, a group allied with AQ.
• (U//FOUO) March 2010: In a video entitled "A Call to Arms," AQ spokesperson Adam GadahnUSPER emphasized how even unsuccessful attacks on Western mass transportation systems could bring cities to a halt and cost billions in increased security measures.
• (U//FOUO) February 2010: Najibullah Zazi, a legal permanent resident of the United States from Afghanistan, admitted to bringing triacetone triperoxide (TATP) explosives to New York City in September 2009, as part of a plan to attack the New York City subway system. Zazi had previously traveled to Afghanistan and Pakistan to join the Taliban and fight against the United States and allied forces, and was recruited there by AQ to return to the United States and conduct a suicide bombing.
(U//FOUO) No U.S. domestic terrorist groups have expressed the intent to carry out an attack on U.S. mass transit systems.
(U) Targets
(U//FOUO) During this reporting period, terrorists conducted attacks on a variety of rail and bus targets overseas, with the majority being against railroad tracks and bridges, and buses targeted from the outside. Sometimes a single operation included one or more targets (e.g., railcars were blown up inside a railway station or an IED damaged a bus stop and the bus).
(U//FOUO) TSA-OI currently has no credible intelligence suggesting that transnational or domestic extremists are actively plotting an attack against the mass transit system in the Homeland. AQ and its affiliates remain the primary threat to U.S. mass transit systems, and remain intent on planning attacks against transportation systems inside the Homeland. TSA-OI assesses that IEDs and assaults will be the most likely tactics and that a passenger rail car or station will be the most likely targets for any future terrorist attack against the U.S. mass transit system. TSA-OI assesses with high confidence that the terrorism threat to U.S. mass transit system is medium.
1. The current Ebola virus disease outbreak was declared a 'Public Health Emergency of International Concern' by WHO on 8 August 2014. On 8 September, the UN Secretary-General activated the UN system-wide crisis framework and subsequently announced the establishment of the 'United Nations Mission on Ebola Emergency Response' – UNMEER. UNMEER is described as a 'unified mission', different from a 'regular' or 'integrated' mission, with HQ UNMEER in Accra, Ghana, and offices in each of Liberia, Sierra Leone and Guinea.
Aim and Scope
2. This guidance draws mainly on the Position Paper on 'Civil-Military Coordination during Humanitarian Health Action' developed by the Inter-Agency Standing Committee (IASC) Global Health Cluster (GHC) (provisional version, February 2011). These in turn draw on the internationally agreed and IASC-endorsed 'Guidelines on the Use of Foreign Military and Civil Defence Assets in Disaster Relief', a.k.a. the 'Oslo Guidelines' (rev. 1.1, Nov. 2007). These and other related documents can be found in the resource centre of the online 'Humanitarian // Military Dialogue':
3. While this is not a 'humanitarian operation', the present guidance is primarily intended to guide aid workers of international and non-governmental health and humanitarian organizations supporting the Ebola crisis response effort, and their implementing and operational partners, interacting with foreign military commanders and staff and/or civil defence and civil protection units deployed to support the affected state(s). It may also help guide health and humanitarian workers in their interaction with national military or civil defence units. Decision-makers in Member States and Regional Organizations may also find it useful when considering the use of military and civil defence assets (MCDA) to support the crisis response.
4. The guidance is intended as generic reference that can be adapted to the specific situations and needs in the three main Ebola-affected countries – Liberia, Guinea and Sierra Leone – and as relevant and necessary in other countries within the region.
Civil-Military Coordination and Use of MCDA
5. Under international human rights law, health is recognized as a fundamental right of the individual that must be protected in all circumstances. In addition, health is addressed in international humanitarian law provisions related to the protection of health facilities and personnel (during conflict).
6. In view of the uniqueness and magnitude of the current Ebola public health crisis and the overall international support and commitments to address the situation with all means possible, including Member States' military and civil defence assets, it is understood that civil-military interaction is overall based on a cooperative relationship.
7. Dialogue and information sharing between military and health and humanitarian personnel is essential. It creates a common situational awareness to guide planning and decision-making, including on the use of available foreign military assets. Coordination should take place with all foreign military actors through relief activities and information shared through established coordination mechanisms, to avoid duplication.
8. Task division between military and health and humanitarian personnel is also an important factor. This includes identifying potential or actual capacity gaps and the critical window of delivery of goods and services.
9. Joint planning and task management, to the extent possible, will ensure maximum efficiency and avoid overlaps and gaps. Co-location in the established mechanisms, such as national Ebola Operation Centres, would optimise the use of assets. Any parallel mechanisms or structures should be avoided as far as possible.
10. In some specific settings as described in para 13 below, in order to preserve respect for humanitarian principles, these activities may be limited or non-applicable, unless they are immediately life-saving and/or directly related to a context of protection of civilians.
11. The current Ebola public health crisis is unique in that, so far, all requests to Member States for assets and services have included civilian, civil protection, as well as military and civil defence assets (MCDA), due to the scarcity of the specific medical assets and services required to address this specific crisis. It is recognized, therefore, that the basic principles for the appropriate use of foreign MCDA are in accordance with the Oslo Guidelines, notably:
- MCDA should meet the specific needs and requirements presented to Member States.
- MCDA should complement overstretched civilian capabilities.
- MCDA should provide unique advantages in terms of capability and timeliness.
- MCDA should be used for a limited duration.
- MCDA contributions should be at no cost to the affected State(s).
12. Any consideration of use or deployment of MCDA and related consultations should be channelled through either the affected state(s) or UNMEER.
13. Due to the insecure operational environment in some countries in the region, the respective military forces present and involved in any Ebola response or preparedness activity could be a potential party to a conflict. In accordance with the 'Guidelines on the Use of Military and Civil Defence Assets to Support United Nations Humanitarian Activities in Complex Emergencies', a.k.a. the MCDA Guidelines (Rev. I Jan. 2006), should these or other foreign military resources be considered or deployed in active security-related functions or operations, the civil-military relationship has to be managed carefully and on a case by case basis to avoid association and maintain a clear distinction between military and health and humanitarian aid workers. The perception by local actors and populations of foreign military and peacekeeping troops is also a factor to be taken into account.
Operational Civil-Military Interaction
14. As a general rule, interaction with the military and the pursuing of common goals must not compromise the actual or perceived neutrality, impartiality and operational independence of health and humanitarian aid workers.
15. At the request of UNMEER, OCHA has identified a number of Civil-Military Coordination experts for employment within the Mission structure. The role of these experts is to facilitate the interaction between Mission personnel, health and humanitarian aid workers, and military actors involved in the current Ebola public health crisis. Their primary tasks are to:
- Establish and sustain collective dialogue, communication and interaction with foreign military forces deployed to support the Mission.
- Establish a mechanism for information exchange and interaction between health and humanitarian aid workers and military forces and other armed actors, appropriate to the operational context.
- Support the development and dissemination of context-specific guidelines on civil-military relations and the appropriate use of foreign MCDA, as relevant and required.
- Ensure appropriate use of foreign MCDA to support the Mission and its health and humanitarian components.
- Ensure coherence of relief efforts to avoid duplication of military and health and humanitarian activities.
- Monitor activities by foreign military forces and ensure they have no negative impact on affected people or the health and humanitarian community.
- Assist in negotiating issues in critical areas of civil-military coordination.
- Maintain a clear distinction of the identities, functions and roles of health and humanitarian and military personnel, particularly in situations described in para 17 above.
16. Much of the support provided by foreign and UN military forces will be logistic in nature and WFP may also provide capability to ensure best use of military assets.
Possible Military Support
17. Key messages of the Global Health Cluster Position Paper relevant to this guidance are:
- Health and humanitarian actions should not be used to advance security and/or political agendas.
- Health services provided by military actors must be in line with the assessed needs of the affected population.
- All actors – civilian and military – involved in the provision of health services should follow the national government's health priorities and plans.
- Health and humanitarian aid workers must constantly review the evolution of the crisis and, when necessary, adapt civil-military coordination modalities to possible emerging conflict dynamics and new roles played by the military.
- Maintaining humanitarian identity is paramount. Health and humanitarian aid workers should be aware of the perceptions of stakeholders and how different degrees of civil-military coordination may change local perceptions of their impartiality.
18. Military and civil defence / protection support could include both 'indirect' and 'direct' health assistance.
Examples of health specific indirect assistance are:
- Assisting in preparedness/contingency planning for humanitarian health response.
- Assisting in joint health assessments and information sharing with health authorities and assisting actors.
- Rehabilitation/construction of public health facilities.
- Coordination with civilian health authorities (national and/or international) to avoid duplication of initiatives and different health care standards.
- Provision of equipment to health facilities/institutions, consistent with national health guidelines.
- Rehabilitation of health infrastructures.
- Provision of water and sanitation systems, in compliance with the minimum humanitarian standards.
- Construction of camps/provision of shelters, in compliance with the minimum humanitarian standards.
- Transport of medical and other relief items. In certain situations only the military possesses the appropriate means of transport (e.g. helicopters) to reach isolated populations.
19. Examples of direct health assistance are:
- Triage; first aid; medical evacuations, regardless of nationalities or affiliation.
- Direct patient care (including trauma and non-trauma care).
- Assisting in health care life-saving activities, in coordination with civilian health authorities (national and/or international).
- Vaccinations and other public health interventions.
- Distribution of medical supplies and relief goods where no other viable civilian option is available.
- Properly coordinated health monitoring and surveillance.
- Training of civilian and military health personnel.
Security of Health and Humanitarian Aid Workers and Health Facilities
20. Several cases have been reported of attacks against teams collecting bodies believed to be infected with Ebola or conducting community based information campaigns. While the overall operational environment is considered non-conflictual, national and/or foreign military or civil defence units may be called on to protect the civilian population and health facilities and prevent looting thereof, as well as create an environment where health and humanitarian personnel can deliver health and humanitarian assistance.
21. In exceptional cases as described in para 13 above, military escorts may be requested in high risk areas to facilitate access to affected areas and people and ensure security for health and humanitarian personnel and facilities. The updated IASC-endorsed Guidelines on the Use of Armed Escorts for Humanitarian Convoys (February 2013) refer in these extreme cases.
22. Related queries and/or assistance can be addressed to OCHA's Civil-Military Coordination Section at email@example.com or to UNMEER at firstname.lastname@example.com
In major emergencies or conflict situations, a variety of individuals, groups and organizations provide assistance to people affected by the crisis. This ranges from neighbours; community-based organizations; local, regional and national government actors; to national and international humanitarian organizations; and military and security forces.
The need for assistance can result from the consequences of natural disasters, or from armed conflict and displacement. If a humanitarian crisis takes place in an environment 'characterized by a breakdown of authority resulting from conflict', the humanitarian community refers to this as a complex emergency.
National and foreign military forces can play a vital role in the response. In natural disasters, many national militaries are designated auxiliary or even primary first responders in-country. If a large-scale disaster exceeds the response capacity of an affected country, the Government may seek assistance from the international community or neighbouring and partner countries. As part of their response, foreign Governments tend to deploy their military forces, especially if these are already deployed in the region. In armed conflicts and complex emergencies, humanitarian and military actors share the same operating space, but not the same mission. They are likely to have very distinct roles and mandates.
Given the very different settings, the interaction between humanitarian and military actors ranges from close cooperation to sheer co-existence. Humanitarian – military dialogue at all levels is essential in any case – and the basis for effective civil-military coordination on the ground. Mutual understanding of each other's role, mandate, objectives, principles and concerns is essential to succeed.
There are 11 global clusters (see figure 2). At the operational level, clusters are activated according to need. The global level clusters may be merged or further sub-divided for specific needs in a country and are established from the operational to the sub-national level as required. The cluster activation is time-limited and is agreed by the HC and HCT, in consent with the national Government, and approved at the global level through the ERC and IASC.
The following report was released by the U.S. Army on September 26, 2014.
(U) This document is intended to provide first responders with a summary of current information about the Ebola virus as well as provide awareness on safety guidelines for first responders. First responders are defined as law enforcement, fire service, and emergency medical service professionals.
(U) Background
(U) The 2014 Ebola outbreak in West Africa is the largest in history. The first case associated with the outbreak was reported in March 2014; it is believed to have started in Guinea and then spread to Sierra Leone, Liberia, Nigeria, and Senegal. As of 30 September 2014 the number of patients with Ebola in Guinea, Liberia and Sierra Leone surpassed 6500 with more than 3000 deaths. On 08 August 2014, the World Health Organization (WHO) Director-General declared the West Africa outbreak a 'Public Health Emergency of International Concern.'
(U) On 30 September 2014, the Centers for Disease Control and Prevention (CDC) confirmed the first case of Ebola in the United States in an individual who traveled from West Africa. This individual is currently hospitalized in Dallas, Texas. The patient did not have symptoms when leaving West Africa, but developed symptoms approximately five days after arriving in the United States.
(U) About Ebola
(U) Ebola is a viral illness. It is a form of viral hemorrhagic fever that is caused by a group of viruses known as Ebolaviruses (four of the five viruses identified to date can cause illness in humans). Viral hemorrhagic fever illnesses typically impact more than one organ system within the human body and often has an abrupt onset. Ebola virus disease in humans was first discovered in 1976 near the Ebola River (Yambuku) in the Democratic Republic of Congo. While its origin is still unknown, it is believed to originally be animal-borne, most likely bats.
(U) Symptoms of Ebola
(U) Ebola illness may appear 2 to 21 days after exposure to an individual ill with the disease although the average incubation is 8 to 10 days. According to the WHO, the first symptoms of illness are: sudden onset of fever, fatigue, muscle pain, headache, and sore throat. This is followed by: vomiting, diarrhea, rash, impaired kidney and liver function, and (in some cases) both internal and external bleeding.
(U) Transmission of Ebola
(U) A person infected with the Ebola virus is not able to spread the illness to others until they develop symptoms (U) It is spread from person-to-person through direct contact (via broken skin or mucous membranes – eyes, nose, and mouth) with blood or body secretions/body fluids from an infected individual (e.g. urine, saliva, feces, vomit, sweat, and semen). All body fluids are considered a risk. Exposure may also occur from coming in contact with surfaces or materials contaminated with blood or body fluids of an infected person such as contaminated medical supplies, bedding, or clothing.
(U) Environmental Cleaning and Disinfection
(U) Following proper environmental cleaning and disinfecting procedures of surfaces, vehicles, and equipment reduces the risk of additional exposures to Ebola. The CDC 'Interim Guidance for Environmental Infection Control in Hospitals for Ebola Virus' provides detailed information to assist responders in developing their own agency's procedures for such situations. It includes decontamination of the vehicle and equipment, hand hygiene, cough and respiratory hygiene, and proper use FDA approved medical PPE.
(U) These guidelines state that those who perform the environmental cleaning and disinfection should wear recommended PPE (described above) and consider wearing shoe and leg coverings. Face protection (facemask with goggles or face shield) is recommended when performing tasks such as liquid waste disposal that can generate splashes. The use of an EPA-registered hospital disinfectant that is intended for non-enveloped viruses such as norovirus, rotavirus, adenovirus, and poliovirus is ideal for disinfecting surfaces.
The following is a collection of recent intelligence summaries for Operation United Assistance which is being conducted by U.S. Africa Command through U.S. Army Africa. The operation began in September and provides "coordination of logistics, training, and engineering support to the U.S. Agency for International Development (USAID) in West Africa to assist in the overall U.S. Government Foreign Humanitarian Assistance/Disaster Relief efforts to contain the spread of the Ebola Virus/Disease, as part of the international assistance effort supporting the Governments of Liberia, Sierra Leone and Guinea."
Updated November 11, 2014.
|DOD West Africa Ebola Surveillance Summary #48 11-7-14
|7 pages
|U.S. Army Civil Affairs Psychological Operations Command
Civil Information Management Cell Update 11-4-14
|5 pages
|U.S. Army Civil Affairs Psychological Operations Command
Civil Information Management Cell Update 10-27-14
|5 pages
|Operation UNITED ASSISTANCE Security Update 11-5-14
|2 pages
|Operation UNITED ASSISTANCE Security Update 10-22-14
|2 pages
|Operation UNITED ASSISTANCE Security Update 10-15-14
|2 pages
|Operation UNITED ASSISTANCE Security Update 10-8-14
|4 pages
|Operation UNITED ASSISTANCE Security Update 10-1-14
|3 pages
|ZIP archive of all updates
|3 pages
|4 pages
|4 pages
|4 pages
|3 pages
|3 pages
|4 pages
|4 pages
|3 pages
|4 pages
|4 pages
|5 pages
|6 pages
|5 pages
|2 pages
|4 pages
|3 pages
|2 pages
|3 pages
|4 pages
|2 pages
|2 pages
|4 pages
|3 pages
|4 pages
|4 pages
|4 pages
|3 pages
|3 pages
|3 pages
|4 pages
|4 pages
|3 pages
|4 pages
|4 pages
|5 pages
|5 pages
|8 pages
|5 pages
|5 pages
|4 pages
|3 pages
|5 pages
|4 pages
|4 pages
|4 pages
|3 pages
|4 pages
|5 pages
|3 pages
|ZIP archive of all summaries
The following manual which is only authorized for distribution to "U.S. government agencies and their contractors only due to the sensitive nature of information contained in the manual" was obtained directly from the official, public U.S. Army publications website.
Multi-Service Tactics, Techniques, and Procedures for Installation Emergency represents a significant renaming and revision to the November 2007 publication Multiservice Tactics, Techniques, and Procedures for Installation CBRN Defense. It expands the scope from chemical, biological, radiological, and nuclear (CBRN) defense to all-hazards installation emergency management (IEM), including the management of CBRN events. This publication defines the roles of Department of Defense (DOD) installation commanders and staffs and provides the tactics, techniques, and procedures (TTP) associated with installation planning and preparedness for response to, and recovery from, hazards to save lives, protect property, and sustain mission readiness. The purpose of this publication is to summarize existing policies, responsibilities, and procedures for IEM programs at DOD installations worldwide for all hazards, as defined by DODI 6055.17, and to translate this policy into tactical terms applicable to military installation commanders. The contents have been written to complement Service IEM program manuals, standard operating procedures (SOPs), response standards, training support packages, collective task training development products, training center and unit exercises, and Service school curricula related to IEM.
2-10. If a risk area is identified, the EOC is located away from the area of highest risk. Risk areas may include major fault lines; flood surge zones; floodplains; dam inundation zones; fire pathways; central areas subject to conflagration; avalanche paths; areas of unstable soil; HAZMAT production or storage facilities; nuclear plants, waste storage, or transportation pathways; and railways that transport HAZMAT. The following are additional location considerations:
- Determine the level of mitigation that may be required in response to the hazard if the location options place the EOC within—
- A hazard source zone.
- The explosive safety quantity distance arc.
- A prescribed 10-mile radius of a nuclear power plant emergency planning zone.
- Identify utility locations, including underground and overhead lines for electrical power, water
supply, sewer, gas or petroleum, communications, and other utilities that may be in the planning
- Ensure that the EOC is located in an area where it can be secured.
- Identify site perimeters, perimeter barriers and fences, control gates, and other means of securing site perimeters.
- Make soil bores to determine subgrade conditions that could impact EOC survivability in a disaster incident.
- Identify where the command administration is located, and provide access for military command personnel to the EOC.
- Identify the location of emergency response and support services including law enforcement (LE), fire, medical, transportation, public works and engineering, munitions range control, and other relevant support services.
- Locate the EOC where congestion will not hinder access and where other contiguous facilities cannot impair EOC functions.
- Locate the EOC where radio and other communication systems can operate most advantageously, have the most coverage, and are away from radio interference such as power lines and tall metal structures.
- Verify that the site has an adequate area for the EOC building, required setbacks, and parking.
- Determine the type of available parking (surface versus garage) and if the parking can be secured.
- Determine if the site can accommodate helicopter access.
- Identify flight paths near the EOC site.
- Identify nearby active commercial, private, and military airports.
- Ensure that the EOC is not exposed to overhanging trees or forest from which wind-blown debris can strike the EOC.
I-1. Mass care operations include meeting the needs of a displaced population by providing access to a shelter or safe haven, food and water, emergency supplies, emergency pharmaceuticals, and other goods from the time they are displaced until the time they return to the original residence or workplace. Sheltering can occur at civilian community shelters, at local or remote safe havens (on the installation itself or on a remote installation), or in a SIP scenario.
I-2. Mass care also includes continuous communication to evacuees throughout mass care operations. In particular, up-to-date information is continuously provided to the displaced population about shelter locations, transportation options, mass feeding operations, points of distribution for emergency goods and pharmaceuticals, the evolution of the incident, and the extent and duration of displacement.
I-3. Mass care procedures include the capability to activate and manage the following:
- Assistance center on the installation.
- Local safe-haven operations consisting of one or more facilities on the installation.
- Coordination with one or more civilian shelters provided by one or more civil jurisdictions.
- Remote safe-haven operations at one or more predesignated, geographically remote receiving installations.
- Mass feeding operations at one or more locations on the installation.
- Point of distribution (POD) operations for the distribution of goods and services at one or more locations.
- Installation call center (or information hotline) operations for the distribution of approved information to friends and family of evacuees, casualties, and fatalities.
- Preexisting hazard-specific shelter locations (tornado shelters, fallout shelters).
I-4. Agreements with civilian authorities are established, when possible, to assist the installation population with mass care at local civilian locations. On the installation, basic mass care operations are also coordinated by organic assets, such as community assistance centers or family assistance centers that are usually directed by the department of morale, welfare, and recreation. Fleet and family support centers onboard Navy installations also have organic mass care capabilities that can be leveraged during an incident.
I-5. For information on mass care, including mass feeding, see ESF 6 in the NRF and FEMA CPG 101. The American Red Cross disaster services program also has several helpful resources that are available online.
I-6. Despite the existence of civilian shelters in the local community, installations are also prepared to provide and maintain short-term mass care services. These safe havens are able to accommodate the protected population on base during an emergency if it is still safe to remain on base, or they are able to protect a population from a neighboring base in the event that the incident is occurring elsewhere. Safe havens are able to operate for a short period of time before transportation to other, off-base accommodations is secured. The installation emergency manager and the mass care coordinator collaborate with providers of emergency assistance before an event in order to provide necessary assistance at a safe haven during an incident. Safe havens and other emergency family assistance centers are able to provide the following services as outlined in DODI 6055.17 and DTM 10-023:
- Registration, tracking, and personnel locator assistance.
- Temporary lodging.
- Access to sanitary facilities, potable water, food, and sufficient lighting.
- Medical triage and information on available medical services.
- Family assistance center to integrate victim and family services.
- Behavioral health support and psychosocial services.
- Religious and pastoral care.
- Support services for special needs populations, including medical needs.
- Support services for animal needs.
- Communication about services available and the nature of the incident.
- Adequate security.
- Legal and financial assistance.
- Coordination with casualty and mortuary affairs.
- Transportation.
- Translation services.
- Child and youth services.
I-7. Local safe havens are generally only capable of providing temporary mass care for 5 to 7 days. After 72 hours (or less depending on the incident and the preparedness of the community), these temporary safehaven residents are completely dependent on mass care operations for feeding, emergency supplies, shower and sanitary facilities, laundry services, and even clothing. Remote safe havens vary significantly, and the associated timeline for transition to temporary or permanent housing depends on the capabilities of the receiving DOD installation. During this period, it is imperative that installations quickly identify temporary housing, on- and off-post and if available on nearby DOD installations in which to relocate safe-haven residents. Constant, honest engagement with safe haven residents on the process and the expected timeline is a key component of the ongoing EPI process.
I-8. The safe-haven management team is responsible for the coordination of safe-haven operations. The safe haven management team plans how to accommodate small- and large-scale evacuation operations for people sent to or seeking local or remote safe havens. The general rules for safe-haven operation and special instructions are prepared, distributed, and available in each safe haven. The special instructions include capacity; facility employees and their family members who will seek shelter in the safe-haven facility; a list of preassigned personnel designated to the safe haven; limits of the safe-haven area; proposed layout; and the location of communications facilities, emergency equipment, and utility cutoffs. Telephone directory and emergency communications procedures are also available. The safe-haven management team works in coordination with the evacuation management team as described in appendix H.
On 8 August, the International Health Regulations Emergency Committee of the World Health Organization (WHO) declared the ongoing epidemic of Ebola virus to be a Public Health Emergency of International Concern (PHEIC). As of 14 October 2014, the WHO and U.S. health officials acknowledge 8,400 cases of Ebola virus disease (EVD) and 4,033 deaths since the outbreak was first recognized in March 2014. As of 14 October, six American citizens have been diagnosed with Ebola while in West Africa, one Liberian national was diagnosed with Ebola virus while in the U.S., and a healthcare worker who provided care for the Liberian travel-associated EVD case has tested positive for Ebola. The most recent U.S. case, announced on 12 October 2014 is the first reported domestic transmission in the U.S. Three of the American EVD patients recovered and were discharged from the hospital, while three remain hospitalized. One American died while receiving treatment in Nigeria. The Liberian EVD patient was not symptomatic upon arrival and determined not to be infectious during travel. The Liberian patient died while in isolation on 8 October 2014. On 11 October 2014, the CDC and the Department of Homeland Security's Customs & Border Protection (CBP) began enhanced entry screening of passengers with recent travel to West Africa at New York's JFK International Airport. Enhanced entry screening is scheduled to begin on 16 October 2014 at Washington-Dulles, Newark, Chicago-O'Hare, and Atlanta international airports. Based on the recent domestic transmission, state and federal officials are re- examining whether equipment and procedures were properly followed, and whether additional protective steps and guidance are needed. The CDC believes the U.S. medical, public health infrastructure/responses are sufficient to prevent the spread of the Ebola virus in the U.S. The ongoing EVD outbreak in West Africa is unlikely to affect public health in the U.S. significantly. This epidemic is not related to the Ebola virus Disease (EVD) outbreak in the Democratic Republic of Congo. (Please see the Biosurveillance Event Report titled "Ebola virus in Democratic Republic of Congo" for more information related to this separate and unrelated outbreak).
On 12 October 2014, the Centers for Disease Control and Prevention (CDC) announced that a healthcare worker at Texas Presbyterian Hospital had tested positive for Ebola virus. The healthcare worker is a nurse who had cared for the Liberian national that was diagnosed on 30 September 2014 with Ebola virus disease (EVD) at the same Texas hospital. This marks the first domestic transmission of EVD in the U.S. The healthcare worker had been self-monitoring for fever and EVD-symptoms. The patient was isolated after the initial report of fever and is reported to be in stable condition at Texas Presbyterian Hospital. The patient has received a blood transfusion from one of the American medical aid workers who was infected while providing care in Liberia that has since recovered.
As of 13 October 2014, the CDC and local health officials were compiling a list of healthcare workers who were involved in the care of the Liberian national who subsequently died.
State and federal health officials are examining existing Ebola-related protocols at healthcare settings, determining whether equipment and procedures were properly followed in Texas, and whether additional protective steps and guidance are needed.
As of 14 October 2014, six American citizens have been diagnosed with Ebola while in West Africa, one Liberian national was diagnosed with Ebola virus in the U.S., and one U.S. healthcare worker was domestically infected while caring for the Liberian national. A single case died while in Nigeria. Five were diagnosed in West Africa before traveling to the U.S. for treatment. Of these five, three have recovered and have been discharged from the hospital, and two remain hospitalized.
As of 14 October 2014, the WHO and U.S. health officials acknowledge 8,400 cases of EVD and 4,033 deaths since the outbreak was first recognized in March 2014.
On 11 October 2014, the CDC and the Department of Homeland Security's Customs & Border Protection (CBP) began enhanced entry screening of passengers with recent travel to West Africa at New York's JFK International Airport. Enhanced entry screening is scheduled to begin on 16 October 2014 at Washington-Dulles, Newark, Chicago-O'Hare, and Atlanta international airports. These five U.S. airports are reported to receive approximately 94% of travelers originating from Ebola-stricken nations of Guinea, Liberia, and Sierra Leone.
On 6 October 2014, the WHO released a situational assessment describing the known routes of transmission of the Ebola virus among humans. In the assessment the WHO re-emphasized that Ebola virus is not an airborne virus and there is no evidence that the viral mode of transmission has changed from previous outbreaks.
On 6 October 2014, Spanish health officials announced the first instance of domestic EVD transmission known to have occurred outside the epidemic region in West Africa. The patient, a nurse assistant, assisted in the care of a Spanish missionary that was transported to Madrid, Spain after developing symptoms of EVD in West Africa.
On 5 October 2014, Uganda health officials released a statement confirming a fatal case of Marburg in a healthcare worker. One contact of the individual developed symptoms and has been placed in isolation. The last recorded outbreak of Marburg virus, a virus closely related to Ebola virus, occurred in Kabale, Uganda during 2012.
On 2 October 2014, NBC news has reported that a freelance American cameraman contributing to coverage in Liberia has tested positive for Ebola virus. The infected American cameraman was transported to the U.S. for treatment at the Nebraska Medical Center.
On 30 September 2014, the CDC announced that a traveler was diagnosed with EVD while receiving medical care at the Texas Health Presbyterian Hospital in Dallas, Texas. This is the first case of EVD diagnosed in the U.S. The patient left Liberia on 19 September and arrived in the U.S. on 20 September 2014. The traveler, reported to be a Liberian resident, develop symptoms on 24 September, sought medical care on 26 September, and was admitted to the hospital and placed in isolation on 28 September. The Liberian EVD patient identified in the U.S. traveled to Texas from Liberia while asymptomatic and was determined not to be infectious during travel. The patient died while in isolation on 8 October 2014. Public health officials continue to monitor contacts of the patient's domestic U.S. contacts.
On 26 August 2014, the Ministry of Health, Democratic Republic of Congo (DRC) notified the World Health Organization (WHO) of an outbreak of Ebola Virus Disease (EVD) in a rural region of the northern providence of Equateur after two patients tested positive for Ebola virus. The Ebola outbreak in DRC is independent and unrelated to the Ebola Virus Disease outbreak in West Africa (Please see the Biosurveillance Event Report titled "Ebola virus in the Democratic Republic of Congo" for more information related to that outbreak).
1. (U) Situation.
a. (U) General.
(1) (U) As of 15 October 2014, the Ebola virus outbreak continues to expand and has infected nearly 4,249 and killed more than 2,458 people in Liberia. Although the Government of Liberia (GoL) continues an aggressive campaign of trying to inform and educate the population, overburdened medical infrastructure and cultural practices continue to hinder containment efforts. Isolated incidents of unrest have occurred, including demonstrations outside health care clinics and attacks on health care workers. The GoL has declared a National Emergency in order to (IOT) prevent the further spread of Ebola Virus Disease (EVD).
(2) (U) EVD transmission continues to occur through direct contact with blood and bodily fluids of critically ill or recently deceased Ebola patients or infected animals. Ebola Treatment Units (ETU) will greatly contribute to the identification, separation, and treatment of EVD patients. ETUs will also help educate the local governments and population.
b. (U) Area of Concern.
(1) (U) Area of Responsibility. The Operational Area (OA) for OPERATION UNITED SHIELD (OUS) is defined as the country of Liberia and associated coastal areas.
(2) (U) Area of Interest. The OUS Area of Interest (AI) includes the country of Senegal due to Intermediate Staging Base (ISB) located in Dakar.
(3) (U) Joint Operations Area (JOA).
(a) (U) From Senegal/Mauritania border at waterline; Follow Senegal/Mauritania border to Senegal/Mali border; follow Senegal/Mali border to Senegal/Guinea border; follow Senegal/guinea border to Guinea/Cote D'Ivoire border; follow Guinea/Cote D'Ivoire border to Cote D'Ivoire/Liberia border; follow Cote D'Ivoire/Liberia border to waterline; to n 01 30′ / w 007 30′; to n 05 00′ / w 015 00′; to n 11 00′ / w 020 00′; to n 16 03′ / w 020 00′; to start point.
(b) (U) Note: JOA includes the Gambia and Guinea Bissau for the purpose of over flight. No operations are anticipated in these countries.
c. (U) Enemy. See Annex B.
d. (U) Friendly. See Annex B.
(1). (U) Multinational Forces
(a) Armed Forces of Liberia
(b) Armed Forces of the United States
(2). (U) Supporting Commands and Agencies
(a) (U) United Nations Mission in Liberia (UNMIL).
(b) (U) Liberian National Police (LNP).
(c) (U) Liberian Coast Guard (LCG).
(d) (U) Other Liberian Security Agencies.
(e) (U) USMC Forces operating under OPERATION ONWARD LIBERTY.
(f) (U) Defense Logistics Agency (DLA).
(g) (U) United States Department of Health and Human Services (HHS).
(h) (U) World Health Organization.
1. (U) Mission. On order, Armed Forces of Liberia (AFL) in conjunction with the US Marine Corps forces operating in OPERATION ONWARD LIBERTY (OOL), and Joint Force Command-United Assistance (JFC-UA) construct Ebola Treatment Units (ETUs) to facilitate the combined overall GoL and United States Government (USG) effort to contain and erradicate the Ebola Virus Disease (EVD) in Liberia.
2. (U) Execution.
a. (U) Concept of Operations. Combined Command-United Shield (CC-US) deploys to multiple locations within the Republic of Liberia IOT support the effort to contain the spread of EVD. The operation will be conducted in four cyclical stages until all ETUs are complete. The Pre-deployment/Recon stage begins with the preparation and deployment of the CC-US Recon Teams and ends with Notice to Proceed (NTP). The ADVON/Main Body stage begins with the deployment of the advanced party and ends with the arrival of the CC-US Main Body. The Site Prep/Construction Complete stage begins with the site preparation and ends when ETU constuction is complete. The Transition ETU/Redeployment stage begins with the transition of the last ETU to U.S. Assistance for International Development (USAID) and ends with the redeployment and CC-US end of mission.
As of 3 October 2014, 43 states and the District of Columbia have reported 538 cases (+325 since 23 September 2014) of Enterovirus D68 (EV-D68) to the U.S. Centers for Disease Control and Prevention (CDC). Most of the cases have been identified among children; however, one case was identified in an adult. This outbreak was first announced in a media conference held on 8 September 2014. In this announcement, the CDC stated that EV-D68 was detected in clusters of individuals with respiratory illness in Kansas City, Missouri and Chicago, Illinois. Many of the initial identified cases had a history of asthma or wheezing. Recent increases in cases can be attributed to awareness of this issue among health officials and the amount of time necessary for disease investigation and confirmation. Current surveillance tools for influenza-like illness may not be appropriate for the detection of EV-D68 because many of the identified cases failed to develop fever. The CDC is involved in the ongoing investigation of a possible link between EV-D68 and acute paralysis. Furthermore, the CDC has identified EV-D68 in specimens from patients who have died, but the role of EV-D68 in these deaths remains unclear. EV-D68 has rarely been reported in the U.S. since first recognized in California in 1962. Enterovirus infections are not reportable in the U.S., so the illness is likely underreported because most enterovirus infections are self-limiting and do not require medical attention. The CDC estimates that non-polio enteroviruses are very common and are responsible for 10 to 15 million U.S. infections each year.
• As of 3 October 2014, the U.S. Centers for Disease Control and Prevention (CDC) had confirmed Enterovirus D68 (EV-D68) cases in 43 states and the District of Columbia affecting 538 (+325 since 23 September 2014) people. The affected regions include Alabama, Arkansas, California, Colorado, Connecticut, Delaware, District of Columbia, Georgia, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, Rhode Island, South Carolina, South Dakota, Texas, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, and Wyoming.
• The CDC is prioritizing testing of specimens from children with severe respiratory illness; there may be more children infected with EV-D68 with milder illness that have not yet been identified.
• Similar to the initial clusters, many of the children confirmed to be infected with EV-D68 have a history of asthma or wheezing.
• Media and state public health reports have indicated that three additional states may be involved in the current EV-D68 outbreak. Increased respiratory cases under investigation are reported to be in Alabama, Tennessee, and Oregon.
• Numerous hospitals and local jurisdictions are reporting an increase in respiratory illness activity in children. Not all clusters or cases in clusters have tested positive for the presence of EV-D68. Only about half of the specimens submitted to the CDC have been positive for EV-D68; an estimated one-third of specimens have been positive for other enteroviruses/rhinoviruses.
• In a media conference held on 8 September 2014, the CDC announced the first 30 cases confirmed positive of EV-D68 in Chicago, IL and Kansas City, MO. Several more cases remain under investigation as reported by state public health departments and the media.
o Sequencing of nasophaygenal specimens from patients in Chicago, IL and Kansas City, MO confirmed that 30 patients, ages six months to sixteen years, from the two locations were positive for EV-D68.
o Of those patients confirmed to be infected with EV-D68 from both locations, 21 (70%) of them are reported to have a history of asthma or wheezing and only seven (23.3%) patients are presenting with a fever. Twenty-nine of the confirmed patients have been admitted to pediatric intensive care for respiratory distress. Eight patients require artificial ventilation.
• On 29 August 2014, the Missouri Health Department issued a health alert noting an increase in respiratory illnesses in children at hospitals in Kansas City and St. Louis.
• On 23 August 2014, the University of Chicago Medicine, Comer Children's Hospital, in Chicago, IL, notified the CDC of an increased number of patients hospitalized with severe respiratory symptoms.
• On 19 August 2014, the Children's Mercy Hospital in Kansas City, MO notified the CDC of an increased number of patients hospitalized with severe respiratory symptoms. Similarly, laboratory surveillance detected an increase in nasopharyngeal specimens collected from 5-19 August 2014 testing positive for rhinovirus/enterovirus.
Possible link between EV-D68 and unexplained paralysis
• Media reports recognize cases of paralysis possibly linked to EV-D68 in an additional six states beyond those reported by the CDC. These states are Alabama, New York, Michigan, Missouri, Rhode Island, and Virginia.
• On 12 September 2014, the Colorado Department of Public Health notified the CDC of a cluster of nine children, aged 1-18 years, with acute neurologic illness onset between 8 August and 15 September 2014. All of these children suffered fever, most with accompanying respiratory symptoms, 3-16 days prior to the onset of neurologic illness. While nasopharygngeal specimens in six of eight patients tested were positive for rhinovirus/enterovirus, no enterovirus was identified in the cerebrospinal fluid (CSF). Of those six specimens from patients positive for enterovirus, only four typed as EV-D68.
o On 19 September 2014, the Colorado Department of Public Health released a health alert to inform clinicians of a cluster of children with acute neurologic illness and requested reports of any similar cases within the state. One additional case was reported and is under investigation.
o On 26 September 2014, the CDC released a health advisory regarding acute neurologic illness with focal limb weakness of unknown cause in nine children in Colorado. They defined clinical criteria for cases and requested clinicians to report any patients meeting these criteria to their local and state health departments. The case definition is a patient 21 years old or younger with acute onset of focal limb weakness no earlier than 1 August 2014, and a magnetic resonance imaging (MRI) scan suggestive of spinal cord lesion primarily in the grey matter.
o Most of the children in Colorado did show abnormalities in their spinal cord on MRI.
• In August 2012, the California Department of Public Health (CDPH)was contacted by a private local clinician requesting poliovirus testing for an unvaccinated patient with acute flaccid paralysis associated with anterior myelitis and no international travel history during the month prior to symptom onset. Two additional cases with similar symptoms of unknown etiology were reported to the CDPH within two weeks.
o The CDPH posted official alerts for local health departments during December 2012, July 2013, and February 2014 to find additional cases of acute flaccid paralysis and uncover possible etiologies.
o Twenty-three cases of acute flaccid paralysis with anterior myelitis of unknown etiology were identified. The CDPH Viral and Rickettsial Disease Laboratory tested nasopharyngeal swabs, rectal swabs, serum, and CSF specimens from 19 patients. No common etiology was identified among these specimens. EV-D68 was only detected in the upper respiratory tract specimens from two of these patients.
During the last decade, the U.S. military, along with its interagency and international partners, has generated significant capability to counter the irregular threats presented by non-state terrorists, insurgents, and criminal groups. During these same years, a distinct challenge to America and its partners in NATO and beyond has arisen through an innovative mix of such irregular threats. This challenge is Hybrid Warfare combining conventional, irregular, and asymmetric means, to include the persistent manipulation of political and ideological conflict. Foreshadowed by Iranian actions throughout the Middle East and by Chinese "unrestricted warfare" strategists in the 1990s, Hybrid Warfare has now reached its most brazen form in Russia's support for separatist insurgents in Ukraine.
Hybrid Warfare involves a state or state-like actor's use of all available diplomatic, informational, military, and economic means to destabilize an adversary. Whole-of-government by nature, Hybrid Warfare as seen in the Russian and Iranian cases places a particular premium on unconventional warfare (UW). As such, a response capitalizing on America's own irregular and unconventional warfare skills, as part of a whole-of-government and multinational strategy, can best counter actions of emergent adversaries to destabilize global security. Counter-Unconventional Warfare (C-UW) should thus prove central to U.S./NATO security policy and practice over the next several decades.
The Geopolitical Context: From Resurgent UW to Counter-UW
C-UW is a relatively new term coined by veterans of global special operations, who have combined a keen grasp of emerging challenges to international security with lessons learned from our struggle against violent extremism from rising states and non-state actors. C-UW begins with an understanding of unconventional warfare (UW) itself, defined in Joint doctrine as "activities conducted to enable a resistance movement or insurgency to coerce, disrupt, or overthrow a government or occupying power by operating through or with an underground, auxiliary, and guerrilla force in a denied area." Central to Irregular Warfare (IW), UW involves external parties aiding indigenous actors against governments. Such aid can involve training, organizing, recruiting, operational advising, coordinated diplomatic support, and even use of kinetic action and logistical support to increase the advantage of indigenous insurgents or rebels.
Over the past decade, both states and non-state actors in Iraq, Syria, Afghanistan, Georgia, and other areas have conducted this kind of UW to coerce, disrupt, and overthrow established governments. Novel forms of UW persist even to the present moment. Among non-state actors, Sunni Jihadi extremists claiming a boundless "Islamic State" now seek to overthrow national governments, local administrations, and social-political structures in a wide swathe from eastern Syria to northwestern Iraq, replacing them with a Muslim Caliphate across the region.
Among state actors and on the very frontiers of NATO, Russia's actions in Ukraine embrace UW fully. Russia currently employs special operations forces, intelligence agents, political provocateurs, and media representatives, as well as transnational criminal elements in eastern and southern Ukraine. Funded by the Kremlin and operating with differing degrees of deniability or even acknowledgement, the Russian government uses "little green men" for classic UW objectives. These objectives include causing chaos and disrupting civil order, while seeking to provoke excessive responses by the state's security organs—thus delegitimizing the Kiev government. Additionally, Russian elements have organized pro-Russian separatists, filling out their ranks with advisors and fighters. Russia's UW has also included funding, arming, tactical coordination, and fire support for separatist operations. While enabling a frequency of tactical success against Ukrainian forces putting the latter at a distinct strategic disadvantage, insurgency aided by Russian UW has gained local supporters, while intimidating dissenters into acquiescing to a separation from the government in Kiev.
Russian UW is thus the central, most game-changing component of a Hybrid Warfare effort involving conventional forces, economic intimidation of regional countries, influence operations, force-posturing all along NATO borders, and diplomatic intervention. Sponsorship of separatist insurgency in Ukraine accords well with current Russian military doctrine and strategy, which embrace "asymmetrical actions… [including] special-operations forces and internal opposition to create a permanently operating front through the entire territory of the enemy state."
While the "Islamic State" crisis demonstrates just how cascadingly disruptive non-state UW can be, the brazen audacity of UW within Russian Hybrid Warfare has produced urgent concern among America's NATO and non-NATO partners that Russia may apply similar approaches to other regional countries in the region with dissenting Russophile populations, such as the Baltic States, Moldova, and Georgia (Refer to Appendix B for more details on Russian doctrine).
Together, examples of state- and non-state-sponsored UW over the past decade have highlighted the requirement for C-UW expertise to meet the challenges of insurgency, Hybrid Warfare, and the shocks to international security these produce. Among the concept's chief advocates, retired Special Forces COL David Maxwell describes counter-unconventional warfare as "operations and activities conducted by the U.S. Government and supported by SOF [special operations forces] against an adversarial state or non-state sponsor of unconventional warfare." These SOF-supported government initiatives can "decrease the sponsor's capacity to employ unconventional warfare to achieve strategic aims." As C-UW campaigns are likely "protracted and psychological-centric in nature" they should "comprehensively employ political, economic, military, and psychological pressure" in order to degrade both the will and capability of an adversary to sponsor unconventional warfare. The chief advantage of C-UW is thus its focus on decreasing an adversary's ability and will to persist in Hybrid Warfare or to support elements of a resistance or insurgency.
Given its "comprehensive" nature, effective C-UW calls for an adaptive, holistic U.S. Government approach embracing local partners. Successful C-UW will thus emerge from dedicated policies; strategies informed by a thorough grasp of UW itself; and operations implemented patiently through regional and global networks of Joint, Interagency, Intergovernmental, and Multinational (JIIM) partners.
Develop Strategies and Policies. We have seen that the future operating environment will feature state competition for regional and global influence, frequently in the form of ideological battles in the human domain. Russia, China, and Iran currently conduct political warfare activities to further their individual goals. By contrast, the U.S. has "gotten out of the habit of waging political warfare since the end of the Cold War" focusing instead on "public diplomacy aimed at 'telling America's story.'" C-UW should thus be scoped as a strategy enabling the U.S. to influence local struggles in a positive direction, and policies should be developed assigning political warfare as a core mission of government agencies responsible for C-UW doctrines and capabilities. Several synergistic initiatives serve this goal:
1) Establish Political Warfare Strategies. George Kennan's definition of political warfare emphasizes both overt and covert activities "short of war." There are many such activities applicable to countering adversary strategies. The following comprises a sampling:
• Economic sanctions against countries, groups, and individuals, as well as coercive trade policies
• Diplomacy, including boycotting international events, establishing treaties or alliances to counter adversary UW, severing diplomatic relations, or excluding offending states from membership in international forums
• Support for "friendly" insurgent groups to coerce, disrupt, or overthrow an adversary regime,
• Support for friendly governments to counter adversary political warfare activities,
• Support for foreign political actors and parties opposing adversarial regimes
• Strategic communications and information operations to expose adversary activities.
2) Designate a Lead Organization to Coordinate and Synchronize Efforts. Whole-of-government political warfare efforts must have a designated lead organization to coordinate and synchronize planning and execution to achieve unified action. Presidential Policy Directive (PPD) 23 U.S. Security Sector Assistance Policy advocates strengthening allies and partner nations to build their own security capacity. To do that, officials must "foster United States Government policy coherence and interagency collaboration." Further,
"Transparency and coordination across the United States Government are needed to integrate security sector assistance into broader strategies, synchronize agency efforts, reduce redundancies, minimize assistance-delivery timelines, ensure considerations of the full range of policy and operational equities, improve data collection, measure effectiveness, enhance and sustain the United States Government's security sector assistance knowledge and skills, and identify gaps."
Related to this Directive, the Council on Foreign Relations recommends the current counterterrorism apparatus as a useful example of what might serve for political warfare. It suggests the following key points at the strategic level:
• Assign a political warfare coordinator in the National Security Council (NSC),
• Create a strategic hub—an interagency coordinating body that pulls all of the local efforts together—in the State Department, and
• Create political warfare career tracks in the Department of State (DOS), Department of Defense (DOD), U.S. Agency for International Development (USAID), and the Central Intelligence Agency (CIA).
3) Develop Political Warfare and C-UW Strategies Nested across Multiple Echelons. Political warfare and C-UW strategies and policies must be planned, coordinated, and synchronized from the strategic national level down to the tactical level. Kennan is again suggestive in this regard. At the strategic level, he recommended a covert political warfare operations directorate or board under the NSC Secretariat, with the director designated by and responsible to the Secretary of State. In this approach, the directorate's staff would be divided equally between State Department and Defense Department representatives selected by the Secretaries, and the directorate would have complete authority over covert political warfare operations.
Taking an approach inspired by Kennan's suggestions, an NSC director for political warfare or C-UW activities should oversee development of policies and directives; prioritize efforts and manage interagency concerns; coordinate activities and funding across the government; and provide oversight for the implementation of Presidential Policies or Directives. The Department of State would be the lead for political warfare and C-UW activities, with other Departments and Agencies in a supporting role.
Given State Department leadership in C-UW, in appropriate countries, The U.S. Country Team, , should be the focal point to plan, coordinate, and synchronize political warfare and C-UW activities. Led by the Ambassador, The Country Team will develop specific country plans and strategies for U.S unilateral activities, integrating host nation activities to obtain mutual objectives.
The following is part of a series produced by the State Department's Humanitarian Information Unit. A map produced in late June for the same series is also available.
1. Purpose. Provide notice to the Joint Force on the minimal required training and force health protection procedures for Service Members deploying to Ebola Virus Disease (EVD) affected areas.
1. The Tier I minimally required training for all deploying Service Members includes:
a. Basic disease process, transmission and symptoms
b. Avoidance awareness of treatment and population centers
c. Avoidance of persons with an EVD contact
d. EVD symptom recognition
e. Contact decontamination
f. Adherence to safe encounter distances
g. Instruction on proper hand washing
h. Use of approved food and water sources
i. Donning and removal of Personal Protective Equipment (PPE)
j. Procedures on responding to a breech in PPE
k. Daily symptom and temperature screening
1. Training on indications and use of readily available equipment: 2 sets of impermeable gloves, 2 hand sanitizers, face shields/eye protection
2. The Tier II Training for personnel required to interact with the local populace includes:
a. Tier 1 Training and equipment plus the following:
(1) Training on non-lethal methods with those providing Force Protection
(2) Training on indications and use of readily available protective suits
3. The Tier III Training for personnel assigned to supporting medical units or expected to handle exposed remains includes:
a. Tier I Training plus Tier II Training and equipment plus the following:
(1) Training in clinical care, out~reak epidemiology, control measures and safety within an Ebola Treatment Unit (ETU)
(2) Cleaning and disinfection procedures training
(3) Psychological support training for patients and staff training in full PPE in provision of care, patient or body transport
(4) Training in waste disposal
(5) Response to a breech in PPE
(6) Training on indications and use of equipment: impermeable suit, boots, heavy apron, face shield and surgical gloves over surgical scrubs, with no jewelry
(7) Training on proper use of air-purifying respirators used during aerosol generating procedures or suspicion of airborne droplet spread diseases such as tuberculosis
4. Tier IV Training required for Ebola Testing Laboratory Workers must adhere to U.S. Army Medical Research Institute of Infectious Disease (USAMRIID) Biolevel 3 protocols.
|October 2008
|172 pages
|December 2008
|370 pages
The following document was obtained from SCADAHacker.com.
The Department of Homeland Security's (DHS) Homeland Infrastructure Threat and Risk Analysis Center (HITRAC) produced this National Risk Estimate (NRE) to provide an authoritative, coordinated, risk-informed assessment of the key security issues faced by the Nation's infrastructure protection community from malicious insiders. DHS used subject matter expert elicitations and tabletop exercises to project the effect of historic trends on risks over the next 3 to 5 years. In addition, DHS used alternative futures analysis to examine possible futures involving insider threats to critical infrastructure over the next 20 years. The results are intended to provide owners and operators a better understanding of the scope of the threat and can inform mitigation plans, policies, and programs, particularly those focused on high-impact attacks.
The malicious insider threat is complex and dynamic, and it affects the public and private domains of all 16 critical infrastructure sectors. Owners and operators responsible for protecting our nationally-critical assets must recognize the nuances and breadth of this threat in order to develop appropriate risk-based mitigation strategies.
Current Risk Assessment
Understanding and mitigating insider threat are complicated by factors such as technological advances, globalization, and outsourcing. These factors increasingly blur the line between traditional insiders and external adversaries such as terrorists, organized crime groups, and foreign nation-states, who may collude with or exploit physical insiders as vectors to do harm to a targeted asset or system. The threat of supply chain sabotage by third-party vendors and contractors was a recurring theme that subject matter experts discussed during the NRE workshops and tabletop exercises. All agreed that the third-party insiders constitute an underestimated threat to U.S. critical infrastructure, particularly when their organizations are foreign-owned or are working under the auspices of foreign intelligence services.
The common feature of all malicious insiders is tactical advantage. Sometimes the insiders are organizational vulnerabilities—adversarial force multipliers—who can operate relatively unfettered. Malicious insiders are not only aware of an organization's vulnerabilities; they also may have purposefully created the very vulnerabilities they intend to exploit.
Although the importance of understanding and mitigating the insider threat is clear, two major factors complicate current efforts to assess the likelihood of malicious insider attacks:
The challenge of identifying and predicting the stressors or triggers that can cause a trusted employee to become a malicious actor; and
The lack of detailed and reliable empirical data on insider breaches and attacks that can be shared across the full spectrum of critical infrastructure owners and operators.
The available data do not characterize in detail the full scope of insider threat to U.S. critical infrastructure and do little to explain why the United States has not experienced a significant increase in insider attacks, particularly those that could result in high-to-catastrophic consequences. They do, however, provide a starting point from which to create a baseline threat profile that can be used to assess insider threats across the 16 critical infrastructure sectors.
The Threat: Malicious Insiders
- Access and specialized knowledge give insiders tactical advantages over security efforts.
- Technological advances, globalization, and outsourcing increasingly blur the line between traditional insiders and external adversaries.
- Insiders who combine advanced technological understanding with traditional espionage/terrorist skills have a significantly increased asymmetric capability to cause physical damage through cyber means.
The Vulnerabilities: Expanding Organizational Security Boundaries
- Even sectors with relatively robust preventative programs and guidelines in place face a dynamic and expanding threat that cannot be eliminated altogether.
- Some organizations are likely underestimating the threat from third-party insiders such as vendors and contractors.
- Industrial control systems in critical infrastructure are attractive insider targets for remote sabotage in an increasingly networked world.
- Without credible and sector-specific insider risk information, critical infrastructure owners and operators are likely to underestimate the scope of the malicious insider threat and make insufficient or misdirected investments in security.
The Consequences: Asymmetric Impacts
- If the goal of malicious insider activity is exploitation rather than destruction of assets, it will be more difficult to detect, potentially resulting in serious cumulative consequences.
- The impacts of a cyberattack that is designed to cause physical damage to critical infrastructure could be much more severe than those of a conventional cyberattack.
- The Government and private sector should work to develop comprehensive and scalable insider threat program standards that incorporate long-term employee monitoring policies, including background checks and re-investigations, employee training and termination of access at separation.
- Effective prevention and mitigation programs must be driven by better understanding the insider's definition of success against a particular sector.
- Organizations should establish workforce behavioral and access baselines, including an understanding of hiring, oversight, access, and security policies, in order to identify anomalies.
- Employees used as a monitoring force may be the best way to identify malicious insiders, and they must have access to recurring training to do so effectively.
- Public and private organizations must consider how to balance the best risk-based security procedures against the myriad of policy, legal, and employees' rights issues associated with obtaining and analyzing relevant threat data in the workplace, especially data derived from social media and behavioral monitoring.
The following assessment and market survey were released in May 2014 by the National Institute of Justice Sensor, Surveillance, and Biometric Technologies (SSBT) Center of Excellence (CoE) and were produced by ManTech Advanced Systems International.
|Body Cavity Screening: Technology Assessment (Version 1.1)
|April 10, 2014
|38 pages
|Body Cavity Screening for Criminal Justice: Market Survey (Version 1.1)
|April 24, 2014
|35 pages
Body scanners are used to screen for contraband in a variety of places. Airports, schools, government buildings, and corrections facilities are examples of the types of places that have employed body scanners. Different types of body scanners have different capabilities based on the imaging technologies used and the sophistication of the internal system analysis. Metal detection was one of the first technologies developed to identify metallic objects on a person, but contraband can take many other forms, such as powders (e.g., drugs), paper (e.g., money), and even ceramic or plastic weapons. Correctional facilities in particular are faced with various forms of contraband, and with elaborate methods of evading detection employed by the local population. Manufacturers have responded by producing scanners that are able to detect nonmetallic contraband, as well as systems that can detect contraband inside body cavities. This report identifies commercially available body scanners and discusses the technologies used by these products. Technological limitations pertaining to the type of materials detected and/or the ability to detect contraband inside body cavities are discussed.
1.2 Need for Contraband Scanners
Body scanners have been in use for the detection of contraband in many different scenarios where there is a heightened risk of individuals attempting to pass contraband materials into a controlled environment. Environments such as airports, corrections facilities, government buildings, and schools are some examples where contraband screening has been incorporated.
A large number of weapons are constructed (at least in part) out of metal. Metal detectors have been used for this purpose for many years, but they do not detect non-metallic objects, such as drugs, explosives, or plastic weapons. Pat-downs are effective at finding items concealed on a person, but these are time consuming, and have heightened scrutiny with respect to privacy and appropriate officer conduct. Body scanners may help reduce the burden of manually searching for contraband, however there are technological limitations.
Ideally, a body scanner would be able to detect metallic as well as non-metallic contraband that is hidden underneath clothing as well as detect contraband hidden inside body cavities. The ideal scanner would also perform these tasks without the possibility of harmful effects (short or long term) to the subject or the operator(s) of the scanner, and maintain the privacy of individuals to the fullest extent possible.
5.2 Body Cavity Screening System Requirements
Question 2: A working set of operational requirements for Body Cavity Screening technologies is listed below:
- Detection Goals:
- Nonferrous metal the size of a .22 caliber bullet
- Ferrous metal the size of a single razor blade
- Plastic the size of a plastic toothbrush handle (i.e., cylinder 1/4 inch diameter by 4 inches long)
- Scanning does not require contact with the subject's skin
- Accommodate subjects up to the 95th percentile in girth
- Device is stowable when not in use
- Easy to use and provide intuitively understandable results
- Cost similar to the $6,000 now paid for metal detection portals
- Scan times of several tens of seconds per subject
Responses (provided unedited):
1. Respondent #1 –The ability to located smaller ferrous, non-ferrous, plastic, and ceramic items, such as plastic bags containing drugs, Sim cards, plastic chargers, ceramic blades, etc. Low dosage x-ray will safely accomplish this mission and the technology already exists. Many states have existing laws in place, written for the medical diagnostic community years ago, requiring an x-ray technician certification when using any type of x-ray device on humans. This requirement virtually eliminates law enforcement/detention use since it is not practical to send officers to a two year x-ray technician course design for medical applications. If we focus on re-writing the laws to accept low dosage x-ray for security screening (actually less radiation than experienced by a three hour flight at 30,000 feet in a commercial airliner for example) we will have a solution. It works very well and is in use in several states already.
2. Respondent #2 – what about smaller plastic containers e.g. condoms that contain liquids, powders, and/or pills
3. Respondent #3 – The goals speak to a portable device with the requirement for it to be stowable. While portability can be beneficial, pass through devices similar to metal detectors should not be ruled out or excluded.
4. Respondent #4 – Must not be harmful to human subjects after repeated exposure (i.e., no x-rays). User interface display must provide appropriate masking of genitalia to accommodate privacy concerns.
The following policy was obtained from the website of the Automated Regional Justice Information System.
These policies are intended to provide law enforcement agencies uniform guidance regarding their appropriate use of a facial recognition field identification tool. Nlets sponsored the preparation of its Privacy Impact Assessment Report for the Utilization of Facial Recognition Technologies to Identify Subjects in the Field to better describe the privacy issues surrounding law enforcement agencies' utilization of facial recognition technologies in the field. These policies were generated in response to the discussions contained in that report.
The intent of these policies is to:
Address the privacy issues raised by the use of facial recognition systems to identify individuals in public.
The language used in these proposed policies must be assigned its plain and ordinary meaning and individual sections should be implemented in such a way as to give effect to the entire policy. Where two proposed provisions deal with the same subject but one is specific and the other general, the more specific policy provision controls.
Part A: PURPOSES FOR COLLECTING FACIAL RECOGNITION INFORMATION
101 Law enforcement agencies collect, compare, and disseminate facial images to aid in the
visual identification of:
a) Individuals who come into direct contact with criminal justice practitioners;
b) Individuals who are reasonably suspected of having committed a crime; and
c) Individuals who a law enforcement officer reasonably suspect is about to commit a crime.
102 Law enforcement agencies may request facial recognition comparison information from a criminal justice booking system or other photo repository:
a) To assist an officer in assessing the situation and evaluating any threats to his own safety;
b) To conduct a criminal investigation;
c) To gather information for an intelligence purpose in accordance with 28 C.F.R. Part 23; and
d) To conduct a government security clearance background check.
103 Where appropriate, facial image databases may be accessed to aid in locating a missing person or an individual for whom a warrant has been issued.
Part B: COLLECTION OF FACIAL IMAGES BY LAW ENFORCEMENT AGENCIES
201 Individuals in personal contact with law enforcement officers. Law enforcement officers may collect facial images of individuals with whom they are in personal contact for the purpose of submitting those images to a facial recognition field identification tool in the following circumstances:
a) With the individual's consent;
b) When identifying the individual will assist the officer in assessing the situation and evaluating any threats to his own safety;
c) When state law requires individuals to identify themselves to police officers;
d) When the individual is lawfully detained and when the suspect's identity is related to the investigation of the suspicion that originally justified the detention; and
e) When the individual is lawfully detained and using the facial recognition field identification tool does not prolong the detention beyond the time reasonably required to complete the investigation of the suspicion that originally justified the detention.
202 Individuals not in personal contact with law enforcement officers. Law enforcement officers may capture facial images for the purpose of submitting those images to a facial recognition field identification tool in the following circumstances:
a) As part of the investigation of a crime; and
b) As part of an intelligence‐gathering effort that:
i) Is conducted in compliance with the U.S. Department of Justice's rules and policies governing criminal intelligence systems at 28 C.F.R. Part 23; and
ii) Limits the collection of facial images from areas that reasonably relate to an individual's political, religious or social views, associations, or activities to instances directly related to criminal conduct or activity.
203 No individual shall be physically detained, nor the individual's movement otherwise hindered, for the exclusive purpose of collecting their facial image for submission to a facial recognition field identification tool.
Part C: ACCESS TO FACIAL RECOGNITION FIELD IDENTIFICATION RESULTS
301 Law enforcement officers should not request facial recognition field identification results when an individual presents a valid driver license or state identification card unless:
a) The officer reasonably suspects the driver license or identification card is forged, altered, or otherwise fraudulent; or
b) The officer reasonably suspects the individual is presenting, as his or her own, a driver license or identification card issued by a DMV to another person.
302 Where practical, and where it will not negatively impact officer safety, law enforcement officers should first request verification of an individual's identity through a query of their name, date of birth, and other self‐reported identifiers. When verification is not possible, or if the officer reasonably suspects the self‐reported information is false, officers may request facial recognition field identification results.
303 Where practical, law enforcement officers should submit publicly observable demographic information related to the facial image when requesting facial recognition field identification results.
304 Law enforcement officers shall only access the personally identifying or biographical information of individuals whose facial image is contained in the results of a facial recognition field identification query:
a) After determining that the individual's enrolled image reasonably matches the facial image submitted for comparison; or
b) When the personally identifying or biographical information would reasonably assist the officer in verifying the identity of the person.
On 8 August, the International Health Regulations Emergency Committee of the World Health Organization (WHO) declared the ongoing epidemic of Ebola virus to be a Public Health Emergency of International Concern (PHEIC). According to the WHO, regional health authorities in western Africa have reported 7,178 cases of Ebola virus disease with 3,338 deaths to the WHO since the outbreak was first recognized in March 2014. On 30 September 2014, The U.S. Centers for Disease Prevention and Control (CDC) announced that an unidentified man, who is receiving treatment at Texas Health Presbyterian Hospital in Dallas, Texas, has been diagnosed with Ebola virus. All previous cases associated with the U.S. were diagnosed in West Africa. One patient died while in Nigeria, and four were diagnosed in West Africa before traveling to the U.S. for treatment. Of these four, three have recovered and have been discharged from the hospital, while the fourth remains hospitalized. This newly identified case developed symptoms in the U.S. and was not symptomatic, and therefore not infectious, while traveling from Liberia. He is currently hospitalized and contacts are being traced, including one who has been identified by media source as a possible second case. The CDC believes the U.S. clinical and public health systems will work effectively to prevent the spread of the Ebola virus and the ongoing EVD outbreak in West Africa is unlikely to affect public health in the U.S. significantly.
On 30 September 2014, the CDC announced that an unidentified man, who is receiving medical treatment at Texas Health Presbyterian Hospital in Dallas, Texas, has been diagnosed with Ebola virus. This is the first EVD diagnosis performed in the U.S. The patient had returned from Liberia on 19 September and arrived in the U.S. on 20 September 2014. The traveler develop symptoms on 24 September, sought medical care on 26 September, and was admitted to the hospital and placed in isolation on 28 September.
Individuals infected with Ebola are not infectious until they develop symptoms. This patient developed symptoms in the U.S. and therefore, was not infectious, while traveling from Liberia into Dallas, Texas. He is currently hospitalized and contacts being traced, including one who has been identified by media source as a possible second case. His nationality has not been made public.
This is the sixth person closely associated with the U.S. to be diagnosed with Ebola virus. All previous such cases were diagnosed in West Africa. One case died while in Nigeria. The remaining four were diagnosed in West Africa before traveling to the U.S. for treatment. Of these four, three have recovered and have been discharged from the hospital and the fourth remains hospitalized.
The WHO indicates that regional health authorities in West Africa have reported (as of 1 October 2014) 7,178 cases of Ebola virus disease with 3,338 deaths since the outbreak was first recognized in March 2014.
The following was presented September 16, 2014 at the 2014 Global Identity Summit.
The FBI Cyber Division has issued a notification to private industry and law enforcement to be aware of the potential for retaliatory cyber attacks following recent U.S. military actions in the Middle East. While the FBI has "no information at this time to indicate specific cyber threats to US networks or infrastructure in response to ongoing US military air strikes against the terrorist group known as the Islamic State of Iraq and the Levant (ISIL)" the bulletin states that the FBI believes that "extremist hackers and hacktivist groups, including but not limited to those aligned with the ISIL ideology, will continue to threaten and may attempt offensive cyber actions against the United States in response to perceived or actual US military operations in Iraq or Syria."
The bulletin titled "Threat of Cyberterrorist and Hacktivist Activity in Response to US Military Actions in the Middle East" was released last Wednesday and is based on "recent, nonspecific, and probably aspirational threats made on social media platforms to carry out cyber as well as physical attacks in response to the US military presence in the Middle East." The bulletin, which was obtained by Public Intelligence, states that "Middle East-based hacktivist groups and extremist cyber actors have previously targeted US commercial and government Web sites in response to a range of US military actions and foreign policy positions" using tactics such as "Cross Site Scripting (XSS), Structured Query Language (SQL) Injection, and TCP/UDP Flooding for defacement and DDoS attacks." According to the FBI, web site defacements "conducted by these actors will likely contain messages expressing support for ISIL, and/or contain imagery such as the black ISIL flag or graphic imagery, e.g., pictures or videos of ISIL executions."
Previous examples of hacktivist attacks motivated by U.S. military actions are included in the bulletin including an incident in May 2014 in which the "Tunisian Hackers Team threatened Distributed Denial of Service (DDoS) attacks against the US financial sector unless US military forces were withdrawn from presumed-Islamic lands." The bulletin also cites numerous threatening posts on Twitter and identifies several accounts that have expressed support for ISIL, some of which have even provided guidance on tools that could potentially be used in a cyber attack. One particularly interesting example cited in the bulletin is the case of Junaid Hussain, a British man who pleaded guilty in 2012 to charges related to the hacking of an email account connected with former Prime Minister Tony Blair. Hussain, who was just sixteen at the time the hacking occurred, was involved in the compromise of a Gmail account used by Blair's adviser Katie Kay and later posted private contact information obtained from the account. As part of the hacking group TeaMp0isoN, Hussain also participated in an attack that flooded the the U.K.'s national anti-terror hotline with automated calls, including some prank calls that are still available on YouTube. After serving six months in a youth detention facility, Hussain was arrested on suspicion of "violent disorder" in late 2013 and while on bail fled to Syria with a 24-year-old rapper named Abdel-Majed Abdel Bary. He is now reportedly fighting with ISIL and goes by the name Abu Hussain Al Britani. A Twitter account reportedly operated by Hussain features a profile photo depicting him pointing an AK-47 at the camera and a bio that reads "random British mujahid somewhere in the Islamic State."
Several recent law enforcement bulletins issued by the Department of Homeland Security and local fusion centers have warned about online threats made by supporters of ISIL. A joint DHS-FBI intelligence bulletin from August 22, 2014 obtained by Fox News warned that following the "start of US military air strikes on 8 August against the ISIL in Iraq, ISIL supporters launched a Twitter campaign threatening retaliatory violence against the Homeland and US interests overseas." The bulletin went on to say that social media is increasingly being used by ISIL supporters to encourage violent attacks on U.S. interests. Another fusion center bulletin from early July, also obtained by Fox News, cited specific tweets threatening the lives of U.S. military personnel. One tweet from a British jihadist cited in the bulletin reportedly instructed supporters to use LinkedIn and Facebook to look up information on U.S. service members prior to staging attacks: "You could literally search for soldiers, find their town, photos of them, look for address in Yellowbook or something. Then show up and slaughter them."
While no specific plots have been identified, online threats against U.S. service members are evidently credible enough to warrant a response from the U.S. Army. The Army Threat Integration Center (ARTIC) issued a special assessment on Thursday warning soldiers about the threat posed by the "Islamic State of Iraq and the Levant (ISIL), its supporters, those swayed by radical Islam, and lone offenders with the intent or inclination to act on ISIL's behalf." Given the "continued rhetoric being issued by ISIL's media services and supporters through various social media platforms," the assessment states that ARTIC is concerned of the possibility of attacks conducted against U.S. military personnel and their families:
Over the past year, ISIL has threatened violence against the United States and US interests overseas in response to ongoing counterterrorism pressure. Following the start of US air strikes in Iraq in early August 2014, and then Syria in late September 2014, ISIL supporters launched a Twitter campaign threatening retaliatory violence against the United States. Additionally, a recent audio message from an ISIL spokesman called, for the first time, for lone offender attacks in the Homeland in retaliation for US military operations in Iraq and Syria.
The assessment includes tips on basic home security precautions that service members should take to protect against an individual "conducting an attack while you or your family members are home." These tips include using the "peephole before opening the door to anyone" and not opening the door to "solicitors or strangers."
(U//FOUO) This ARTIC Special Assessment provides an overview of potential threats posed by the Islamic State of Iraq and the Levant (ISIL), its supporters, those swayed by radical Islam, and lone offenders with the intent or inclination to act on ISIL's behalf. Presently, the Intelligence Community has not identified any corroborative or definitive extremist plots focused on the US Army, its Soldiers, Government Civilians, and Family Members. However, terrorist groups and their supporters have the capability of conducting attacks with little to no warning in the Homeland and against US military installations and facilities worldwide. Given the continued rhetoric being issued by ISIL's media services and supporters through various social media platforms the ARTIC is concerned of the possibility of an attack. Soldiers, Government Civilians and Family Members are reminded to be vigilant of their surroundings and report suspicious activities to their respective military or local law enforcement.
(U) ISIL Threatens Attacks against Civilians and Military in the Homeland; Urges Supporters
(U//FOUO) Over the past year, ISIL has threatened violence against the United States and US interests overseas in response to ongoing counterterrorism pressure. Following the start of US air strikes in Iraq in early August 2014, and then Syria in late September 2014, ISIL supporters launched a Twitter campaign threatening retaliatory violence against the United States. Additionally, a recent audio message from an ISIL spokesman called, for the first time, for lone offender attacks in the Homeland in retaliation for US military operations in Iraq and Syria.
(U) On 22 Sep 14, an ISIL spokesman urged its followers to attack citizens of the US, France and other countries that joined the US-led coalition against the group.
(U) Based on a law enforcement bulletin citing a jihadist tweet ISIL has called on lone offenders in the US to use the "yellow pages," social media sites like Facebook, Linkedin, and Twitter to find the addresses of service members, "show up [at their homes] and slaughter them."
(U) According to the US Government as many as 300 Americans are fighting with ISIL; an increase from an initial estimate of 100. There is concern that these Americans could return to the US and commit attacks using the skills they learned overseas. Efforts are being made to track these foreign fighters, however, those not being tracked by law enforcement may be able to reenter the US without raising suspicions. During a news conference on 22 Sep 14, a senior Obama Administration official admitted that some Americans that fought alongside ISIL have returned to the US.
(U) Prior to the initiation of US airstrikes against ISIL in Iraq, Twitter posts were disseminated depicting ISIL supporters in front of the White House in Washington, DC and the Old Republic Building in Chicago. These tweets stated "We are in your state, We are in your cities, We are in your streets." Another tweet added "we are here #america near our #target…sooooooooooooon."
(U) Examples of Islamic Extremism outside the Middle East
(U) Generally, terrorist attacks committed against Westerners occur in countries where the terrorist has a greater presence and freedom of movement. In the past, attacks typically consisted of spectacular, massive bombings such as the bombing against transportation systems in Madrid (2004) and London (2005). Recently, more attacks are taking the form of small scale attacks with the use of knives, small caliber weapons, and bombs that can be made "in the kitchen of your mom."
(U) Between 11 and 19 Mar 12, three French soldiers, as well as three Jewish children and a Jewish rabbi were killed by the same gunman in the towns of Toulouse and Montauban in southern France. The shooter, reportedly radicalized in prison, was said to have conducted the attacks in retaliation for France's involvement in Afghanistan, its ruling on the wear of the burqa, and his anti-Semitic views. He was subsequently killed by a police sniper following a several hour standoff.
(U) On 22 May 13, two al Qa'ida inspired males targeted and attacked a British soldier with knives and a meat cleaver in Woolwich in the southeast area of London, United Kingdom. The British soldier presented a target of opportunity as he walked down the street. He was attacked in broad daylight within 400 meters of the Royal Artillery barracks. Prior to being confronted and detained by police one attacker was videotaped stating the attack was "an eye for an eye, a tooth for a tooth."
(U) On 24 May 13, a French soldier was stabbed from behind in the neck while conducting a group patrol as part of a national protection program. At the time, the French Government did not want the country to jump to any conclusions given that this incident occurred with days of the Woolwich attack. The attacker in this incident was not caught and his motivations are unknown.
(U) On 15 Apr 13, two brothers detonated two pressure cooker bombs along the final stretch of the Boston Marathon killing three and wounding 250. A manhunt ensued resulting in the death of one suspect and the capture of the other. Resultant investigations determined that the brothers used detailed instructions cited in an online al Qa'ida in the Arabian Peninsula magazine titled Inspire.
(U) On 19 Sep 14, Australian federal and state police raided more than a dozen properties across Sydney and Brisbane foiling an ISIL plot to conduct beheadings in Australia. ISIL-affiliated members in Australia planned on videotaping the beheadings and sending the footage to ISIL media service in Iraq and Syria to disseminate via social media sites for propaganda purposes.
(U//FOUO) The FBI has no information at this time to indicate specific cyber threats to US networks or infrastructure in response to ongoing US military air strikes against the terrorist group known as the Islamic State of Iraq and the Levant (ISIL), also known as the Islamic State of Iraq and al-Shams (ISIS) or the Islamic State (IS). However, the FBI assesses extremist hackers and hacktivist groups, including but not limited to those aligned with the ISIL ideology, will continue to threaten and may attempt offensive cyber actions against the United States in response to perceived or actual US military operations in Iraq or Syria. The FBI bases this assessment on recent, nonspecific, and probably aspirational threats made on social media platforms to carry out cyber as well as physical attacks in response to the US military presence in the Middle East.
(U//FOUO) In mid-May 2014, the hacktivist group Tunisian Hackers Team threatened Distributed Denial of Service (DDoS) attacks against the US financial sector unless US military forces were withdrawn from presumed-Islamic lands (for additional information, see PIN# 140624-015).
(U) As of early-2014, Twitter user @AnonArabOps expressed support for ISIL, provided guidance on the use of various hacking tools, and called for cyber attacks against the United States and Israel.
(U) As of early-September 2014, a British media outlet identified the hacker known as Abu Hussain Al Britani as a Syria-based ISIL fighter. Al Britani previously served a six-month sentence in the United Kingdom for hacking the e-mail account of former Prime Minister Tony Blair, according to the media report.
(U) On 7 September 2014, Twitter user @Dawlamoon posted messages encouraging attacks against Twitter employees, likely in response to Twitter's takedown of several pro-ISIL accounts.
(U) Impact:
(U//FOUO) Middle East-based hacktivist groups and extremist cyber actors have previously targeted US commercial and government Web sites in response to a range of US military actions and foreign policy positions. Analysis by the FBI and the private cyber security industry suggests that the most likely tactics, techniques, and procedures utilized by these groups are Cross Site Scripting (XSS), Structured Query Language (SQL) Injection, and TCP/UDP Flooding for defacement and DDoS attacks. Web site defacements conducted by these actors will likely contain messages expressing support for ISIL, and/or contain imagery such as the black ISIL flag (Figure 1) or graphic imagery, e.g., pictures or videos of ISIL executions.
(U) Defending Against Hacktivism
(U//FOUO) In general, hacktivism cyber attacks may result in Denial of Service, defacement of a Web site, and compromise of sensitive information which may lead to harassment and identity theft. Although the specific claims referenced above do not speak specifically to a particular attack vector, precautionary measures to mitigate a range of potential hacktivism threats include:
(U//FOUO) Implement a data back-up and recovery plan to maintain copies of sensitive or proprietary data in a separate and secure location. Backup copies of sensitive data should not be readily accessible from local networks.
(U//FOUO) Have a DDoS mitigation strategy ready ahead of time and keep logs of any potential attacks.
(U//FOUO) Scrutinize links contained in e-mail attachments.
(U//FOUO) Regularly mirror and maintain an image of critical system files.
(U//FOUO) Encrypt and secure sensitive information.
(U//FOUO) Use strong passwords, implement a schedule for changing passwords frequently and do not reuse passwords for multiple accounts.
(U//FOUO) Enable network monitoring and logging where feasible.
(U//FOUO) Be aware of social engineering tactics aimed at obtaining sensitive information.
(U//FOUO) Securely eliminate sensitive files and data from hard drives when no longer needed or required.
(U//FOUO) Establish a relationship with local law enforcement and participate in IT security information sharing groups for early warnings of threats.
The following consolidated text of the Comprehensive Economic and Trade Agreement (CETA) was released publicly by the European Commission on September 26, 2014.
The text of the CETA agreement is made public here exclusively for information purposes. The text presented in this document is the text at the end of the negotiations conducted by the European Commission. It will be subject to legal revision in order to verify the internal consistency and to ensure that the formulations of the negotiating results are legally sound. It will thereafter be transmitted to the Council of the European Union and to the European Parliament for ratification. The text presented in this document is not binding under international law and will only become so after the completion of the ratification process.
DESIRE to further strengthen their close economic relationship and build on their respective rights and obligations under the Marrakesh Agreement Establishing the World Trade Organization and other multilateral and bilateral instruments of cooperation;
CREATE an expanded and secure market for their goods and services through the reduction or elimination of barriers to trade and investment;
ESTABLISH clear, transparent and predictable mutually advantageous rules to govern their trade and investment;
REAFFIRMING their commitment to promote sustainable development and the development of international trade in such a way as to contribute to sustainable development in its economic, social and environmental dimensions;
DETERMINED to implement this Agreement in a manner consistent with the enhancement of the levels of labour and environmental protection and the enforcement of their labour and environmental laws and policies, building on their international commitments on labour and environment matters;
ENCOURAGE enterprises operating within their territory or subject to their jurisdiction to respect internationally recognized standards and principles of corporate social responsibility, notably the OECD Guidelines for multinational enterprises and to pursue best practices of responsible business conduct;
RECOGNIZING that the protection of investments, and investors with respect to their investments, stimulates mutually beneficial business activity;
RECOGNIZING the importance of international security, democracy, human rights and the rule of law for the development of international trade and economic cooperation;
REAFFIRMING their strong attachment to democracy and to fundamental rights as laid down in the Universal Declaration of Human Rights and sharing the view that the proliferation of weapons of mass destruction poses a major threat to international security;
RECOGNIZING that the provisions of this Agreement preserve the right to regulate within their territories and resolving to preserve their flexibility to achieve legitimate policy objectives, such as public health, safety, environment, public morals and the promotion and protection of cultural diversity; and
AFFIRMING their commitments as Parties to the UNESCO Convention on the Protection and Promotion of the Diversity of Cultural Expressions and recognizing that states have the right to preserve, develop and implement their cultural policies, and to support their cultural industries for the purpose of strengthening the diversity of cultural expressions, and preserving their cultural identity, including through the use of regulatory measures and financial support.
RECOGNIZING the strong link between innovation and trade, and the importance of innovation to future economic growth, Canada and the European Union affirm their commitment to encourage the expansion of cooperation in the area of innovation, as well as the related areas of research and development, and science and technology, and promoting the involvement of relevant public and private sector entities;
HAVE AGREED as follows:
The following document was released in January 2011 as part of the final report of the Financial Crisis Inquiry Commission.
This is a report by David Beim and Christopher McCurdy in consultation with the following team: Beverly Hirtle, Meg McConnell, Patricia Mosser, Marc Saidenberg, Michael Silva, Kevin Stiroh, Ronald Stroz and Til Schuermann. In addition Anna Kovner took detailed notes on all the interviews and meetings and made many useful suggestions.
We were asked to draw on bank supervisory lessons learned from the recent financial crisis and to make an assessment of changes the Federal Reserve Bank of New York (FRBNY) might make in its organization and practices, with a particular focus on Bank Supervision, if the Federal Reserve is designated as the nation's systemic risk regulator. In this process we looked at areas where FRBNY has done well, that should be reinforced, and also at areas for improvement. Drawing on these lessons, we make a number of recommendations that should be applied to future conduct of standard bank supervision. Further, we believe that systemic risk in the major financial institutions has become such a powerful issue for bank health that we recommend these changes even if the "systemic risk regulator" designation does not occur.
The 2007-2009 financial crisis was a systemic collapse – a sudden collapse of asset prices and the failure or near-failure/rescue of almost all large financial institutions. The United States has not witnessed a systemic collapse since the 1930s, and many thought it was impossible for the United States to have such an event, given the apparent advances in risk management that preceded it. However, the collapse occurred and was very large, damaging to the real economy and extremely expensive to resolve. A desire not to let such an event happen again pervades the body politic, indeed is demanded by many.
But preventing such an event is neither easy nor costless. Financial crises typically follow large economic booms. While such booms may be characterized as bubbles in retrospect, they are extremely popular while they are occurring. The Federal Reserve has long seen its mission against inflation "to take away the punch bowl just when the party is getting good"; if it now becomes the systemic risk regulator it must be prepared to do the same against rising systemic risk, using tools beyond monetary policy. This is likely to be unpopular unless the ground is extremely well prepared and broadly understood. We return to this threshold problem in more detail below.
Assuming that systemic risk above some level should be controlled, the regulator has two problems: recognition and action. Recognition requires insight and creative thinking, a willingness to make inferences based on partial information. It also requires communication across organizational lines to "connect the dots" when financial innovations occur and new risks appear. It requires people willing to challenge the prevailing orthodoxy, even the Fed's own orthodoxy.
C. The FRBNY Culture Is Marked by Insufficient Individual Initiative and Lacks Fluid Communication
A very frequent theme in our reviews was a fear of speaking up:
"No one feels individually accountable for financial crisis mistakes because management is through consensus."
"Grow up in this culture and you learn that small mistakes are not tolerated."
"Don't want to be too far outside from where the management is thinking."
"No opportunity to earn enough merit from ten right policy decisions to compensate for one wrong decision."
"The organization does not encourage thinking outside the box."
"After you get shot down a couple of times you tend not to "go there" any more."
"Until I know what my boss thinks I don't want to tell you."
"Members of the vetting committee fight their way through a giant document rather than risk prioritizing and being wrong. People are risk-averse, so they include everything."
It is not always clear whether these comments describe the speakers' own attitudes or their perception of the attitudes of others. Nevertheless, the strength of this theme is unmistakable and implies an organizational culture that is excessively risk-averse. If officers feel intimidated and passive, they will never be effective in communicating with other areas, forming their own views and signaling when something important seems to be wrong – they will just follow orders.
All organizations give people both positive and negative signals – every car needs both an engine and a brake. But some organizations, usually without realizing it, send too many negative signals. This management behavior has a chilling effect on individual initiative. Members of an organization will only take the risk of speaking up if they feel they will be rewarded for this rather than punished. This is a cultural issue of the greatest importance. Consider how other organizational cultures encourage the best ideas to rise to the surface. Academic cultures, for example, value strong criticism because it will make everyone's work better; such criticism is not dependent on organizational rank but is a function of intelligence and insight, which can occur at any level of seniority. Shutting out critique would leave vulnerabilities in the final product. Consulting firms have regular brain-storming sessions at which individuals at all levels are expected to speak their minds without fear of reprisal; law firms sometimes behave in much the same way.
FRBNY needs to adopt some of these characteristics, to develop a culture of critical challenge. A systemic risk focus will require individual initiative and out-of-the-box thinking; these attributes will lead to robust inquiry in day-to-day bank supervision. This issue is the responsibility of the senior managers. They need to encourage dissent rather than stifle it. Even if the senior officers are themselves unafraid of speaking up, they may inadvertently be encouraging those below them not to do so.