Integrating Preparatory Consequence Management and Law Enforcement Operations During “Left of Boom” Terrorist Threats

Suggested Citation

Glick, Scott. “Integrating Preparatory Consequence Management and Law Enforcement Operations During “Left of Boom” Terrorist Threats,” Homeland Security Affairs: Pracademic Affairs 2, Article 3, (July 2022). www.hsaj.org/articles/21159. 

Introduction

“Mother Nature” does not care if the nation is prepared for a hurricane. However, if the government is aware of a terrorist threat, but the public is not aware of that threat, and the government conducts highly visible preparatory consequence management operations, then an alerted terrorist could change tactics or attack a different target. To avoid this potential “no-win” scenario, response and prevention mission planners across all levels of government must consider the unique and complicating factors that can adversely affect their mission’s success during credible terrorist threats, particularly those involving a weapon of mass destruction (WMD). This article builds on my previous writing in “Preparatory Consequence Management & Weapons of Mass Destruction”[1] and proposes a new way to bridge a planning gap that currently exists in national planning guidance. If federal, state, local, tribal and territorial (FSLTT) officials adopt this new approach and cohesively integrate preparatory consequence management operations and law enforcement operations across all levels of government for “left of boom” terrorist threats, they will maximize their ability to stop the terrorist while minimizing the potential consequences of the terrorist’s actions.

Background

To ensure the government’s natural disaster response is not “late to need,”[2] dedicated specialists can use analytical tools to issue guidance[3] that can lead to a range of preparatory consequence management actions taken in the days and hours leading up to the event. Consequence management planners design their operations to maximize the government’s ability to protect public health and safety, restore government services, meet basic human needs, and provide emergency relief to those affected by an incident.[4] These operations, which are part of the federal government’s response mission, are led by the U.S. Department of Homeland Security (DHS), acting through the Federal Emergency Management Agency (FEMA).[5]

By way of contrast, the federal government’s prevention mission operations – which include law enforcement and/or counterterrorism operations and are sometimes referred to as “crisis management”[6] operations – are led by the U.S. Department of Justice (DOJ), acting through the Federal Bureau of Investigation (FBI). The prevention mission’s focus is different. The primary focus is to avoid, prevent or stop a threatened or actual act of terrorism.[7] However, while “Mother Nature” does not care if the public is warned and prepared before an impending natural disaster, profoundly different considerations are present when the government is confronted with a terrorist threat and the public is not aware of that threat. Unlike nature’s indifference to preparations and warnings, if the government conducts highly visible preparatory consequence management operations, it could alert the terrorist and therefore adversely affect the success of the prevention mission.[8]

The National Response Framework (NRF)[9] and the Response Federal Interagency Operational Plan guide response and prevention planners and direct them to integrate and synchronize their operations. These planning documents emphasize establishing “joint priorities, particularly in areas such as incident site/crime scene access, pre-positioning, operations to resolve threats, public information and warning, and fatalities management.”[10] Since the response mission focuses on saving lives as well as protecting property, critical infrastructure, and/or the environment after an incident,[11] how to achieve unity of effort with the prevention mission before a terrorist incident is not addressed in the NRF or the response FIOP. Indeed, while the goal is to “simultaneously save lives, investigate and resolve threats, and/or prevent follow-on attacks,”[12] these planning documents do not provide specific planning guidance.

The National Prevention Framework (NPF) defines imminent terrorist threats to be when “intelligence or operational information warns of a credible, specific, and impending terrorist threat … that is sufficiently specific and credible to recommend implementation of additional measures to thwart the attack.”[13] It then notes that an imminent terrorist threat may “emerge at any time and become known through one of several different vectors: the U.S. intelligence community, federal, state or local law enforcement, or the American public.”[14] Understanding this point raises the following important question: what if the knowledge of an impending terrorist attack is only within the government? Moreover, how should the federal government and/or its SLTT partners respond to a “left of boom” WMD terrorist threat when the public is unaware of the threat? Terrorists may “select soft targets or other vulnerable environments to maximize casualties.”[15] Because of this, forward-leaning response planners must consider that highly visible response operations may cause terrorists to “strike quickly and move to another location before law enforcement can interdict and disrupt.”[16]

FSLTT officials need a new way to integrate cohesively preparatory consequence management operations and law enforcement operations during “left of boom” terrorist threats when the public is not aware of the threat, particularly those that involve a WMD. This article proposes that response and prevention planners across all levels of government use the new approach discussed below to develop comprehensive and integrated plans that will enable them to maximize their ability to stop the terrorist, while simultaneously minimizing the potential loss of life, damage to property, critical infrastructure, and the environment.

A New Approach

There are three key elements to developing a plan that will cohesively integrate prevention and response mission operations when the public is not aware of a WMD terrorist threat: dividing response options into operational phases, using an OPSEC (operational security) construct to analyze activities during those phases, and attention to critical considerations.

Operational Phases

When the response mission leans forward for impending natural disasters, the instinct is to “go big, go early.”[17] However, if a goal is not to alert the terrorist, this approach presents a potential conflict. In the same way that public disclosure of a spy’s activities could cause the spy’s cover to be “blown,” the more significant the public visibility of the preparatory consequence management operations, the greater the likelihood of alerting threat actors and adversely affecting the success of the prevention mission. Yet, without a robust ability to lean forward, particularly for threats involving a WMD,[18] the response mission’s ability to succeed may be adversely affected.

Under President G.W. Bush’s direction, Homeland Security Presidential Directive 5, Management of Domestic Incidents (2003), developed the National Incident Management System (NIMS) and emphasized the importance that all levels of government use shared structures, systems, processes, and vocabulary to guide response personnel.[19] NIMS defines a “staging area” as a “temporary location for available resources in which personnel, supplies, and equipment await operational assignment.”[20] If we were to think about “staging” as one part of an operation and then were to think about the other phases, the following four operational phases emerge:

• Alert/Activation, in which personnel get notice;
• Staging, in which personnel and equipment are assembled and loaded in preparation for deployment;
• Deployment, in which  personnel and/or equipment are moved to or pre-positioned near a potential or actual incident site; and
• Employment, in which personnel and equipment are operationally used in activities in response to threats or incidents.

Operational Security

Although we divided response operations into four phases, we still need to address the instinct to “go big, go early.” Here we can look to the concept of OPSEC  which the U.S. government has long considered as a critical planning construct for sensitive operations. OPSEC involves the “implementation of procedures and activities to protect sensitive or classified operations.”[21] By following OPSEC principles, the FSLTT government officials can deny a potential adversary information about the government’s intentions. Thus, if we were to view each of the four operational phases listed above through an OPSEC construct, we can think about the public visibility of each phase of each potential preparatory consequence management action and assess how likely that phase of that action would be to alert the terrorist.

Critical Considerations

The success of the response mission is critically important. In this regard, the response FIOP notes the importance of looking at “interdependencies.”[22] An interdependency exists when the execution of one part of an operation depends upon another part being executed. Stated another way, the failure of one part of a response operation could very well affect the success of the entire response operation. Interdependencies, however, can be “pooled, sequential or reciprocal.”[23] For example, let’s assume that medical countermeasures are needed to save lives. However, this effort’s success depends on delivering and administering medical countermeasures by personnel to the affected population.[24] Thus, interdependencies that could affect the success of the response mission’s operations must be considered.

In addition to understanding interdependencies, other considerations, such as time must also be taken into account. For example, the time needed to go from the alert and activation phase to the deployment and employment phase is a critical consideration for response planners, as illustrated by this example noted by the Centers for Disease Control and Prevention (CDC). If someone has symptoms of anthrax infection, the CDC notes that it is critical to get them medical care “as quickly as possible.”[25] Indeed, the CDC points out that certain antibiotics can “prevent anthrax from developing in people who have been exposed but have not developed symptoms.”[26] Thus, as the response FIOP emphasizes, prevention and response  decision-makers “must be in communication during times of an imminent threat so that response assets, to the extent practical and appropriate, may be pre-positioned.”[27] However, while pre-positioning medical countermeasures is a necessary first step, these planners also need to factor in the time it will take to distribute and administer those medical countermeasures to the population.

Planners must also consider the cumulative effect that preparatory consequence management actions could have on the overall public visibility of the response  operations. For example, a few consequence management actions may be unlikely to alert a threat actor when viewed in isolation.  However, if numerous such actions all were to happen in the same place at the same time, their cumulative effect could very well alert a threat actor.

Another critical consideration is the dynamic nature of some terrorist threat scenarios. Concerns about potentially compromising prevention operations could change as the facts and circumstances evolve, including if the public becomes more aware of the threat. As the federal government has emphasized, “suspected or actual involvement of terrorists adds a complicating dimension to incident management.”[28] Thus, whereas a public warning may be inadvisable at a certain point in time, evolving circumstances, including media disclosures, may indicate that such warnings or other publicly visible actions may be advisable.[29]

The Path to Development of a Plan

Guidance from the DHS’s Planning Considerations: Complex Coordinated Terrorist Attacks (CTTA) states that terrorists may select “soft targets or other vulnerable environments to maximize casualties,” and may move to a new target “before law enforcement can interdict and disrupt.”[30] As the CCTA guidance notes, one of the “major challenges” of responding to terrorist attacks is the integration of “crisis management (e.g., law enforcement, interdiction), consequence management (e.g., emergency management), and investigatory functions (e.g., evidence gathering, forensics, attribution). All must be performed simultaneously and involve entities that may not habitually operate together.”[31]

The CCTA guidance, like the NRF and the response FIOP, focuses on “right of boom.” Nonetheless, and building on FEMA’s multi-step planning process,[32] which is already well known to FSLTT planners, the CCTA guidance provides a roadmap for them to develop a plan to address “left of boom” terrorist threats when the public is not aware of the terrorist threat. The following steps are therefore recommended for response planners to ensure the development of a comprehensive plan that will lead to risk-informed decisions.

• Assemble a planning team of relevant stakeholders from the response and prevention mission communities (e.g., law enforcement, counterterrorism, first responders, public health officials, private sector).
• Ensure a common understanding of all the complexities, interdependencies, and other factors and the need for cohesive, integrated planning and operations.
• Identify each potential preparatory consequence management action that can be taken.
• Break down each potential preparatory consequence management action into one of the following major phases: alert/activation, staging, deployment, and employment for resources and personnel.
• Agree on a default public visibility rating in each phase for each potential preparatory action. Using common terminology, assess whether the action is unlikely, likely, or highly likely to alert a threat actor.[33]
• Develop an integrated and cohesive plan that considers all appropriate factors, including but not limited to the nature of the threat and the threat actor, interdependencies that exist, the effect that cumulative preparatory consequence management actions can have on the overall public visibility of the Response Mission’s operations, and the fact that circumstances can evolve; and
• After developing the plan, exercise it regularly and revise it as part of a continuous improvement cycle, including based on lessons learned from exercises and responses to real-world events.

Planning Across All Levels of Government

The seven planning steps discussed above need to involve all levels of government to maximize the chances for the success for both prevention and response missions, particularly for terrorist threats involving chemical, biological, radiological, and nuclear (CBRN) materials, weapons, and/or dispersal devices. For example, the federal government has a new interagency coordination mechanism for coordinating the federal government’s response to WMD terrorist threats, namely, the Weapons of Mass Destruction Strategy Group (WMDSG).[34] The WMDSG is an FBI-led interagency crisis action team supporting information exchange and the deconfliction of consequence management and law enforcement operations.[35] The federal government co-locates the Consequence Management Coordination Unit (staffed and managed by FEMA) directly in the WMDSG. This allows “real-time” information sharing, strategic advice, and recommended consequence management courses of action that can take into account ongoing law enforcement and counterterrorism operations.[36] SLTT governments should mirror this approach and co-locate and integrate law enforcement and consequence management operations.

Indeed, as the federal government has pointed out, it cannot combat WMD terrorism alone. As a result, the federal government’s response to a terrorist threat may need to be augmented by assets and resources under the control of SLTT governments.[37] These may be tasked with locating the terrorist and the weapon the terrorist intends to use to carry out the attack or to assist in mitigating the potential consequences of the threat. For example, let us assume a terrorist threatens to use a WMD. The National Guard has 57 WMD-civil support teams across the country. These civil support teams can “identify chemical, biological, radiological and nuclear agents and substances, assess current and projected consequences, advise on response measures, and assist with requests for additional support.”[38]

Similarly, SLTT public health resources may be needed to augment the distribution and administration of medical countermeasures or to otherwise prepare for mass casualty events, as illustrated by the federal government’s delivery of Covid-19 vaccines to “loading docks” that needed states and localities to “take over from there.”[39] An act of terrorism involving CBRN materials that may “overwhelm the capabilities of many local, state and/or tribal governments to respond” may also “seriously challenge existing Federal response capabilities.”[40] As a result, unity of effort will be required, which mandates the seamless integration of law enforcement and consequence management operations. In the same way that unity of effort was improved through the adoption of NIMS, the federal government and its SLTT partners should adopt the new approach discussed above to develop a cohesive plan for integrating preparatory consequence management and law enforcement operations during “left of boom” terrorist threats when the public is not aware of the threat, particularly for those involving the threatened use of a WMD.

Finally, while some preparatory consequence management actions can alert a terrorist and adversely affect the prevention  operations, response planners may nonetheless recommend those actions to decision-makers to minimize the potential negative effect on the mission. While these recommendations may raise difficult discussions and require difficult decisions, senior government officials must also consider the success of the response.

Conclusion

Since 2003, national policy has treated law enforcement crisis management operations and consequence management as a single integrated function.[41] However, responding to terrorist threats can be more complicated than responding to natural disasters. Moreover, when a terrorist is threatening the use of a WMD, effective response can be even more complex because of the unique challenges that exist in responding to threats involving CBRN materials, dispersal devices, and weapons.[42] If the public is not aware of the terrorist threat and the government conducts highly visible preparatory consequence management operations, the terrorist could be alerted, potentially jeopardizing the success of the prevention mission’s efforts. At the same time, it is essential to consider interdependencies and other factors that can affect the success of the response mission’s efforts.

All levels of government must adopt a unified approach that cohesively integrates preparatory consequence management and law enforcement operations during “left of boom” terrorist threats. The successful resolution of imminent terrorist threats will require more than cohesive and integrated planning and operations. Senior government officials may need to make tough decisions involving competing risk and value trade-offs. To best support them, the federal government’s and SLTT government’s approach to “left of boom” terrorist threats and the coordination mechanisms should be similar and integrate seamlessly. This will ensure that decision-makers across all levels of government have the same understanding of the threat and that course of action options are developed with the risk-informed input from stakeholders in all mission areas.

About the Author

Scott J. Glick is vice president and general counsel for Summit Exercises and Training LLC (SummitET^®), a veteran-owned small business that specializes in providing proven preparedness solutions to systematically address all threats and hazards through a wide range of services, including planning, training, and exercises, as well as operational and policy support, for its government and private sector clients. He has four decades of experience in law enforcement, counterterrorism, critical incident response, exercises, and emergency preparedness. He previously served as the director of preparedness and response and senior counsel in the National Security Division at the U.S. Department of Justice (DOJ), where he led DOJ’s national preparedness policy and planning efforts, including in regard to countering weapons of mass destruction. He has investigated and prosecuted international terrorism cases as a federal prosecutor, and organized crime cases as a state prosecutor in New York. Since his retirement from DOJ, he has provided substantial advice and guidance to numerous federal departments and agencies on the cohesive integration of law enforcement, counterterrorism, and consequence management operations in response to terrorist threats. This article contains no classified or confidential government or business information, and the views expressed in this article are solely those of the author and do not necessarily represent the views of any government department or agency, or any private sector company.

Notes

[1] Scott J. Glick, Preparatory Consequence Management & Weapons of Mass Destruction, DomPrep Journal (November 2020), https://www.domesticpreparedness.com/preparedness/preparatory-consequence-management-weapons-of-mass-destruction/.

[2] Karen Roganov, FEMA, State, Military, Guard, CAP, Volunteers, Rehearse Whole-of-Government Crisis Response, Joint Task Force Civil Support News (June 18, 2019), https://www.jtfcs.northcom.mil/MEDIA/NEWS-ARTICLES/Article/1879772/fema-state-military-guard-cap-volunteers-rehearse-whole-of-government-crisis-re/.

[3] E.g., “Severe T-Storms Prompt Tornado Watch in Parts of Tri-State Area,” WCBS NewsRadio 880 (August 27, 2020), https://www.audacy.com/wcbs880/articles/news/cuomo-ny-agencies-to-pre-deploy-emergency-response-assets.

[4] FEMA Mission Areas and Core Capabilities, (Last updated July 20, 2020), https://www.fema.gov/emergency-managers/national-preparedness/mission-core-capabilities.

[5] PDD-62, Protection Against Unconventional Threats to the Homeland and Americans Overseas, at 5-6 (May 22, 1998) (“When the Attorney General, acting on the advice of the Director, FBI, and in coordination with the Director, FEMA, determines that the incident or threat of an incident has subsided, lead agency responsibility may be transferred to FEMA.”), https://clinton.presidentiallibraries.us/items/show/16200.

[6] Presidential Decision Directive (PDD) 39, U.S. Counterterrorism Policy, 6, (June 21, 1995), (“Within the United States, the Department of Justice, acting through the FBI, shall have lead responsibility for management of terrorist incidents,”   https://clinton.presidentiallibraries.us/items/show/12755.

[7] National Prevention Framework, 1, (2d Ed. 2016), https://www.fema.gov/sites/default/files/2020-04/National_Prevention_Framework2nd-june2016.pdf.

[8] Scott J. Glick, Preparatory Consequence Management & Weapons of Mass Destruction, DomPrep Journal (November 2020), https://www.domesticpreparedness.com/preparedness/preparatory-consequence-management-weapons-of-mass-destruction/.

[9] National Response Framework, 2, (4^th Ed. 2019), https://www.fema.gov/sites/default/files/2020-04/NRF_FINALApproved_2011028.pdf.

[10] Response FIOP, 5, (2d Ed. 2016), https://www.fema.gov/sites/default/files/documents/fema_response-fiop.pdf .

[11] National Response Framework, 12, (4^th Ed. 2019), https://www.fema.gov/sites/default/files/2020-04/NRF_FINALApproved_2011028.pdf.

[12] Ibid.

[13] National Prevention Framework, 3, (2d Ed. June 2016), https://www.fema.gov/sites/default/files/2020-04/National_Prevention_Framework2nd-june2016.pdf.

[14] Ibid., 3.

[15] DHS, Planning Considerations: Complex Coordinated Terrorist Attacks, 2, (July 2018), https://www.fema.gov/sites/default/files/2020-07/planning-considerations-complex-coordinated-terrorist-attacks.pdf.

[16] Ibid.; See also U.S. Department of State, International Travel, Terrorism (Listing recommendations for travelers to “avoid becoming a target of opportunity”), https://travel.state.gov/content/travel/en/international-travel/emergencies/terrorism.html.

[17] FEMA, Leaning Forward: Go Big, Go Early, Go Fast, Go Smart, https://www.fema.gov/pdf/about/state_of_fema/state_of_fema.pdf.

[18] Podcast: Spotlight on FEMA’s CBRN Office (November 29, 2019), https://cbrnecentral.com/the-fema-podcast-spotlight-on-femas-cbrn-office/21038/ (FEMA official noting “We’re always trying to lean forward in the CBRN realm as well.”).

[19] National Incident Management System (Third Ed. 2017), https://www.fema.gov/sites/default/files/2020-07/fema_nims_doctrine-2017.pdf. For a historical chronology of FEMA and the management of the consequences of terrorism from 1972 through 2009, see Baldwin, “FEMA’s Terrorism Consequences Role as Assigned by Section 2-103 of E.O. 12148,” https://fas.org/irp/agency/dhs/fema/chron.pdf.

[20] National Incident Management System, Glossary, 70, (3^rd Ed. 2017), https://www.fema.gov/sites/default/files/2020-07/fema_nims_doctrine-2017.pdf.

[21] National Incident Management System, Glossary, 68, (3^rd Ed. 2017), https://www.fema.gov/sites/default/files/2020-07/fema_nims_doctrine-2017.pdf.

[22] Ibid., 4.

[23] Profit Management Solutions, “How Are You Managing Your Team Interdependence,” (August 3, 2020), https://proffittmanagement.com/how-are-you-managing-your-team-interdependence/.

[24] Richard Sisk, “Shots in Arms Within 24 Hours: Army General’s Complex Vaccine Delivery Task Takes Shape,” Military News (October 26, 2020), https://www.military.com/daily-news/2020/10/26/shots-arms-within-24-hours-army-generals-complex-vaccine-delivery-task-takes-shape.html (large scale distribution of vaccines is complex from a “logistical standpoint).

[25] Centers for Disease Control and Prevention, Treatment of Anthrax Infection (Last reviewed November 20, 2020), https://www.cdc.gov/anthrax/treatment/index.html.

[26] Centers for Disease Control and Prevention, Antibiotics to Prevent Anthrax After Exposure, (Last reviewed November 20, 2020), https://www.cdc.gov/anthrax/prevention/antibiotics/index.html.

[27] Ibid., 5.

[28] FEMA, Terrorism Incident Law Enforcement and Investigation Annex, 3, (December 2004), https://www.fema.gov/sites/default/files/2020-07/fema_incident-annex_terrorism-law-enforcement.pdf.

[29] Connor Simpson, “F.B.I. Released the Tsarnavev’s Photos Because of Reddit and the Post,” The Atlantic (April 21, 2013), https://www.theatlantic.com/national/archive/2013/04/fbi-released-tsarnaev-brothers-photos-because-reddit-and-post/316075/.

[30] DHS, Planning Considerations: Complex Coordinated Terrorist Attacks, 2, (July 2018), https://www.fema.gov/sites/default/files/2020-07/planning-considerations-complex-coordinated-terrorist-attacks.pdf.

[31] Ibid.,3.

[32] FEMA, Developing and Maintaining Emergency Operations Plans: Comprehensive Preparedness Guide (CPG) 101, 43, (Ver. 3 2021), https://www.fema.gov/sites/default/files/documents/fema_cpg-101-v3-developing-maintaining-eops.pdf.

[33] Intelligence Community Directive (ICD) 203 (January 2, 2015) highlights the importance of expressing likelihood or using the same terminology (i.e., not mixing words with percentages). By thinking about each phase of each potential preparatory consequence management action and placing that action in a default category of its likelihood to alert the threat actor, Response and Prevention Mission planners can collectively, using the same terminology, effectively understand the degree to which each potential action could adversely affect the success of the Prevention Mission.

[34] U.S. Department of Homeland Security, Protection Federal Interagency Operational Plan (FIOP), First Edition, C-3-12, (January 2016), https://www.fema.gov/sites/default/files/documents/fema_protection-fiop.pdf; See also U.S. Department of Homeland Security, FIOP Response and Recovery, Oil/Chemical Incident Annex, 4-8, (June 2016), https://www.fema.gov/sites/default/files/2020-07/fema_incident-annex_oil-chemical.pdf.

[35] Ibid.

[36] FEMA, Protection Federal Interagency Operational Plan, Appendix C to Annex C, C.3-12, (1^st ed. January 2016), https://www.fema.gov/sites/default/files/documents/fema_protection-fiop.pdf.

[37] National Strategy for Countering Weapons of Mass Destruction Terrorism, 11, (December 1, 2018), https://www.hsdl.org/?view&did=819382 (WMD terrorism cannot be “combatted exclusively by Federal authorities” and many others, including first responders, and health care professionals play a key role in protecting the nation against WMD threats).

[38] National Guard, Weapons of Mass Destruction (WMD) Civil Support Team (CST) (Current as of December 2017), https://www.nationalguard.mil/Portals/31/Resources/Fact%20Sheets/Weapons%20of%20Mass%20Destruction%20Civil%20Support%20Team%20Fact%20Sheet%20(Dec.%202017).pdf .

[39] Karen Weintraub and Elizabeth Weise, Analysis: What Went Wrong with COVID-19 Vaccine Distribution and How It Has Tarnished The ‘Miracle,’” USA Today (January 31, 2021), https://www.usatoday.com/story/news/health/2021/01/31/covid-vaccine-what-went-wrong-distribution-whats-being-changed/4275954001/.

[40] FEMA, Terrorism Incident Law Enforcement and Investigation Annex, 3, (December 2004), https://www.fema.gov/sites/default/files/2020-07/fema_incident-annex_terrorism-law-enforcement.pdf.

[41] Homeland Security Presidential Directive 5, para. 3, Management of Domestic Incidents (February 23, 2003).

[42] FEMA, Federal Interagency Operational Plans, (Last updated April 30, 2021), https://www.fema.gov/emergency-managers/national-preparedness/frameworks/federal-interagency-operational-plans.

Copyright

Copyright © 2022 by the author(s).