ESF #13 - Public Safety and Security Annex.&.Terrorism Incident ...

National Response PlanESF #13 – Public Safety andSecurity Annex&Terrorism Incident LawEnforcement and InvestigationAnnexOSC Readiness TrainingNovember 18, 2004

ESF #13 Public Safety and SecurityAnnex! ESF Coordinators: Department of Homeland Security ANDDepartment of Justice! Primary Agencies: Department of Homeland Security ANDDepartment of Justice! Support Agencies:Department of AgricultureDepartment of CommerceDepartment of DefenseDepartment of EnergyDepartment of the InteriorDepartment of Veterans AffairsEnvironmental Protection AgencyNASASocial Security AdministrationU.S. Postal Service

ESF #13 Public Safety and SecurityPurpose and Scope! Integrates Federal public safety and security capabilities andresources to support the full range of incident managementactivities associated with potential or actual Incidents ofNational Significance (INS)! Federal to Federal support or Federal support to State or localauthorities to include non-investigative/non-criminal lawenforcement, public safety, and security capabilities andresources during potential or actual INSs! Examples: Force and critical infrastructure protection, securityplanning and technical assistance, technology support, andpublic safety in both pre-incident and post-incident situations

ESF #13 Public Safety and SecurityPolicies! State, local, tribal, private-sector, and specific Federalauthorities have primary responsibility for public safety andsecurity-first line of response and support! In most situations, local jurisdictions have primary authorityand responsibility for law enforcement activities using ICS. Inlarge scale incidents…additional resources should first beobtained via mutual aid agreements with neighboring localitiesor state resources-Unified Command! Through ESF #13 Federal resources supplement whenrequested or required-NIMS

ESF #13 Public Safety and SecurityPolicies! ESF #13 primary agencies facilitate coordination amongsupporting agencies! ESF #13 coordinates the implementation of Federal authoritiesthat are appropriate for the situation! Relationship to NRP Terrorism Incident Law Enforcement andInvestigation Annex: As the lead LEO in the United States, theAttorney General, generally acting through the FBI, maintainsthe lead for criminal investigations of terrorist acts or terroristthreats by individuals or groups inside the U.S., or directed atU.S. citizens or institutions abroad – All ESF #13 activitiescoordinated through AG

ESF #13 Public Safety and SecurityPolicies! In the event that State or local police forces (including theNational Guard) are unable to adequately respond to a civildisturbance, the State legislature may request, through the AG,Federal military assistance under 10 U.S.C. Chapter 15.! The President may also use the military in a state to enforceFederal law or to protect constitutional rights. (DOD and DOJcoordination procedures during responses to law enforcementemergencies are set forth in DOD Civil Disturbance Plan,February 15, 1991)! *This annex does not usurp or override the policies or mutualaid agreements of any local, or tribal jurisdiction orgovernment, State government or Federal agency. LE activitiesand criminal investigations are conducted in conformance withexisting codes and statutes.

ESF #13 Public Safety and SecurityRelationship to Other Plans:! ESF #13 Incorporates the existing network of public safety andsecurity interagency plans:National Infrastructure Protection PlanSector-Specific PlansNational Maritime Security PlanArea Maritime Security PlansVessel and Facility Security Plans

ESF #13 Public Safety and SecurityRelationship to Other Plans:! ESF #13 Incorporates the existing network of public safety andsecurity interagency plans:National Infrastructure Protection PlanSector-Specific PlansNational Maritime Security PlanArea Maritime Security PlansVessel and Facility Security Plans

ESF #13 Public Safety and SecurityConcept of Operations! ESF #13 is activated when Federal public safety and securitycapabilities or resources are needed to support incidentoperations. Includes threat or pre-incident as well as postincidentsituations.! Actions:HeadquartersWhen activated, primary agencies deploy rep to NationalResponse Coordination Center (NRCC) at HSOCAssess the need for ESF #13 resources and coordinateresponse assistance and support in closecooperation with regional and field ESF #13elementsMay convene a conference call with supporting agenciesMay provide subject matter experts to the IIMG and othervarious special teams (ERT-A, etc.)

ESF #13 Public Safety and SecurityConcept of Operations! Actions:Headquarters (continued)During terrorism incidents, ESF #13 activities will be closelycoordinated with the FBI Strategic Information andOperations Center (SIOC) and the National Joint TerrorismTask Force (NJTTF)*SIOC works in coordination with HSOC and IIMG

ESF #13 Public Safety and SecurityConcept of Operations! Actions:Regional and Field Levels:ESF #13 rep may participate in assessment efforts of ERT-AWhen ESF #13 is activated, the on-call rep of primaryagencies deploy to Regional ResponseCoordination Center (RRCC) and coordinates untilJFO is establishedESF #13 is included in the Operations Section of the RRCCand JFODuring terrorism incidents, ESF #13 activities are managedfrom the FBI Joint Operations Center (JOC) prior toJFO, but closely coordinated with the RRCC. AfterJFO, ESF #13 goes to JFO Operations Section

ESF #13 Public Safety and SecurityConcept of Operations! Actions:Regional and Field Levels (continued):During non- terrorism incidents, ESF #13 activities aremanaged from the RRCC and later the JFO. All ESF#13 activities are closely coordinated with the localFBI field office and Joint Terrorism Task Force (JTTF).JFO Coordination Group will resolve resource and missionconflicts involving Federal public safety and security assetsengaged in emergency operations.

ESF #13 Concept of Operations! Actions:Incident Management Activities:ESF #13 provides Federal public safety and security assistanceto support prevention, preparedness, response, and recoverypriorities when locally available assets are overwhelmed orinadequate, or where unique Federal capability is required.Pre-Incident CoordinationTechnical Assistance (e.g., Vas risk analyses)Public Safety and Security Assessment (e.g., mapping,modeling)Badging and CredentialingForce Protection (e.g., responders and other workers)Security SurveillanceSpecialized Security Resources (e.g., CBRN and explosivesdetection devices, LEO personal protective gear, etc.)

ESF #13 Concept of Operations! ResponsibilitiesESF Coordinators/Primary Agencies:! Coordinate preparedness activities with ESF #13 supportingagencies! Provide expertise to IIMG when requested! Maintain close coordination during operations betweenaffected regions, NRCC (HSOC) other ESFs, local JTTFs andthe NJTTF, as required! De-conflict any potential overlap issues re missionassignments! Resolve conflicting demands for resources and expertise.! Coordinate backup support from other regions of country

ESF #13 Concept of Operations! ResponsibilitiesESF Support Agencies:*Each support agency maintains its authority.! Staff HSOC, NRCC, RRCC, Incident Command Post, JFO,Joint Information Center, FBI SIOC or FBI JOC (for terrorismincidents)! Provide periodic reports, regarding agency responseoperations to the JFO Planning Section! Provide technical and subject-matter expertise, data, advice,and staff support for operations that fall within the domain ofeach agency.

ESF #13 Concept of Operations! Agencies/Functions! USDA/Forest Service! Commerce/ NOAA, National Weather Service, Office ofOceanic and Atmospheric Research! DOD/U.S. Army Corps of Engineers! Energy! Homeland Security/U.S. Secret Service, U.S. Coast Guard,Directorate of Border and Transportation Security (BTS),Customs and Border Protection, Immigration and CustomsEnforcement (ICE), Transportation Security Administration(TSA), Science and Technology Directorate (S&T),Information Analysis and Infrastructure ProtectionDirectorate (IAIP)! Interior! Veterans’ Affairs

ESF #13 Concept of Operations! Agencies/Functions! EPA/Office of Criminal Enforcement, Forensics, and Training(OCEFT), Criminal Investigation Division (CID), NationalEnforcement Investigations Center (NEIC), National CounterterrorismEvidence Response Team (NCERT), CounterTerrorism Response Team (CTRT)! NASA! SSA! U.S. Postal Service

Terrorism Incident Law Enforcementand Investigation Annex! Coordinating Agency:Department of Justice/Federal Bureau of Investigation! Cooperating Agencies:Department of DefenseDepartment of EnergyDepartment of Health and Human ServicesDepartment of Homeland SecurityDepartment of StateEnvironmental Protection Agency

Terrorism Incident AnnexPurpose and Scope! The purpose of this annex is to facilitate an effective Federallaw enforcement and investigative response to all threats oracts of terrorism within the United States, regardless ofwhether they are deemed credible and/or whether they escalateto an INS. This annex establishes the structure for asystematic, coordinated, unified, timely, and effective nationallaw enforcement and investigative response to threats or actsof terrorism within the United States.! Provides planning guidance and outlines operational conceptsfor the Federal law enforcement and investigative response to athreatened or actual terrorist incident within the United States.! Acknowledges and outlines the unique nature of each threat orincident, the capabilities of local jurisdictions, and the lawenforcement and investigative activities necessary to preventor mitigate a specific threat or incident.

Terrorism Incident AnnexPolicies! This annex provides overall guidance to Federal, State, local,and tribal agencies concerning the Federal Government’s lawenforcement and investigative response to potential or actualterrorist threats or incidents that occur in the United States,particularly those involving weapons of mass destruction(WMD), or chemical, biological, radiological, nuclear, or highexplosive(CBRNE) material.! Federal Agencies:! The following Federal agencies have primary responsibilityfor certain aspects of the overall law enforcement andinvestigative response:DOD, DOE, HHS, DHS, FBI, EPA

Terrorism Incident AnnexPolicies! According to HSPD-5, “The Attorney General has lead responsibilityfor criminal investigations of terrorist acts or terrorist threats byindividuals or groups inside the United States, or directed at U.S.citizens or institutions abroad, where such acts are within the Federalcriminal jurisdiction of the United States…! Generally acting through the FBI, the Attorney General, in cooperationwith other Federal departments and agencies engaged in activities toprotect our national security, shall also, coordinate the activities of theother members of the law enforcement community to detect, prevent,preempt, and disrupt terrorist acts against the United States.Following a terrorist threat or an actual incident that falls within thecriminal jurisdiction of the U.S., the full capabilities of the U.S. shall bededicated, consistent with U.S. law…to assisting the Attorney Generalto identify the perpetrators and bring them to justice.”

Terrorism Incident AnnexDeployment/Employment Priorities! First priority of Operations: Preserving life or minimizing risk to health! Preventing a threatened act from being carried out or an existingterrorist act from being expanded or aggravated! Locating, accessing, rendering safe, controlling, containing,recovering, or disposing of a WMD that has not yet functioned, anddisposing of CBRNE material in coordination with appropriatedepartments and agencies (e.g., DOD, DOE, EPA)! Apprehending and successfully prosecuting perpetrators of terroristthreats or incidents

Terrorism Incident AnnexPlanning Assumptions and Considerations! A terrorist threat or incident may occur at any time of day with little orno warning, may involve single or multiple geographic areas, and mayresult in mass casualties.! The suspected or actual involvement of terrorists adds a complicatingdimension to incident management.! The response to a threat or actual incident involves FBI lawenforcement and investigative activity as an integrated element! In the case of a threat, there may be no incident site, no externalconsequences…there may be no need for traditional ICS elements(e.g., Incident Command Post, JFO)! An act of terrorism…may overwhelm capabilities of State, local, tribal,governments and may seriously challenge existing Federal responsecapabilities

Terrorism Incident AnnexPlanning Assumptions and Considerations! In the case of a biological attack, the effect may be temporally andgeographically dispersed, with no clearly defined “incident site”.! A biological attack employing a contagious agent may requirequarantine by Federal, States, local, and tribal health officials, tocontain the disease outbreak.! If appropriate personal protective equipment and capabilities are notavailable and the area is contaminated with CBRNE or otherhazardous materials, it is possible that response actions into acontaminated area may be delayed until the material has dissipated toa level that is safe for emergency response personnel to operate oruntil appropriate personal protective equipment and capabilitiesarrive, whichever is sooner.

Terrorism Incident AnnexSituation! The resolution to an act of terrorism demands an extraordinarylevel of coordination of law enforcement, criminal investigation,protective activities, emergency management functions, andtechnical expertise across all levels of government. Theincident may affect a single location or multiple locations, eachof which may be an incident scene, a hazardous scene, and/ora crime scene simultaneously.

Terrorism Incident AnnexConcept of Operations/Command and Control! The FBI is the lead agency for criminal investigations ofterrorist acts or terrorist threats and intelligence collectionactivities within the United States. Investigative andIntelligence activities are managed by the FBI from an FBIcommand post or Joint Operations Center (JOC). FBI SpecialAgent in Charge (SAC) of the local field office establishes thecommand post.! JOC generally consists of three functional groups (unlessincident involved WMD/CBRNE materials-then a fourth groupmay be incorporated):! Command Group! Operations Group! Operations Support Group! *Consequence Management Group*In an incident involving WMD or CBRNE material

Terrorism Incident AnnexConcept of Operations/JOC! JOC is an interagency command and control center used formanaging multiagency preparation for, and the lawenforcement and investigative response to, a credible terroristthreat or incident.! Similar to Area Command concept within ICS, to coordinateand organize multiple agencies and jurisdictions during criticalincidents or special events. JOC is modular and scalable tomeet specific operational requirements.! JOC may be established in pre-incident, pre-emptive role insupport of a significant special event.

Terrorism Incident AnnexConcept of Operations/JOC! Law enforcement/public safety functions are managed throughthe Operations Section of the ICS.! Criminal investigation and the collection, analysis,dissemination of intelligence are sensitive law enforcementoperations that require a secure environment and well-definedorganizational management structure.! JOC provides mechanisms for controlling access to anddissemination of sensitive or classified information.! Management of crisis information and intelligence isrecognized under the NIMS as a sixth functional area withinICS.

Terrorism Incident AnnexConcept of Operations/Command and Control! Command Group: Provides recommendations and advice to theFBI SAC regarding the development and implementation ofstrategic situations to resolve the situation.! Strategic Legal Team! Joint Information Center (JIC)! Domestic Emergency Support Team (DEST)

! Field Operations Units! Evidence Response! WMD/CBRNE! Surveillance! TechnicalTerrorism Incident AnnexConcept of Operations/Command and Control! Operations Group: Handles all investigative, intelligence, andoperational functions related to the threat, critical incident, orspecial event.! Information Control Unit! Intelligence Unit! FBI/SIOC! DHS/HSOC! JFO Coordination Group! Investigations Unit

Terrorism Incident AnnexConcept of Operations/Command and Control! Operations Support Group: Units are based on the specificneeds of the threat, critical incident, or special event. Staffed bysubject matter experts in specialized areas.! Administrative Unit! Logistics Unit! Legal Unit! Media Unit! Liaison Unit! Communications Unit! Information Technology Unit

Terrorism Incident AnnexConcept of Operations/Command and Control! Consequence Management Group: Consists of representativesof agencies that provide consequence-focused expertise insupport of law enforcement activities. JOC does not manageconsequence functions; it ensures law enforcement activitieswith emergency management implications are communicatedand coordinated to appropriate personnel in a complete andtimely manner.! FBI and DHS representatives screen threat/incidentintelligence for the Consequence Management Group.! Agencies comprising the CMG may also have personnelassigned to other units within the JOC structure. (OtherSpecialized Units)

Terrorism Incident AnnexConcept of Operations/Command and Control! When, in the determination of the Secretary of HomelandSecurity, in coordination with the Attorney General, the incidentbecomes an incident of National Significance and a JFO isestablished, the JOC becomes a section of the JFO and the FBISAC becomes the Senior Federal Law Enforcement Official(SFLEO) in the JFO Coordination Group. In this situation, theJOC Consequence Management Group is incorporated into thecomponents of the JFO (see NRP Base Plan, Figure 4 andfigure 7).

Terrorism Incident AnnexConcept of Operations/The Response! Upon receipt of a threat of terrorism within the U.S., the FBIconducts a formal threat credibility assessment in support ofoperations with assistance from select interagency experts.! For a WMD or CBRNE threat, this assessment includes threeperspectives:! Technical Feasibility! Operational Practicability! Behavioral Resolve

Terrorism Incident AnnexConcept of Operations/The Response! Upon receipt of a threat of terrorism within the U.S., the FBIconducts a formal threat credibility assessment in support ofoperations with assistance from select interagency experts.! If threat is credible-prevent or resolve the threat. Tailor theresponse actions.! Threat Assessments:! Presence of CBRNE device or WMD capable of causingsignificant damage confirmed?! After an incident occurs, threat assessment is focused oncriminal intent, extent of the threat, and the likelihood ofsecondary devices

Terrorism Incident AnnexConcept of Operations/The Response! Upon determination of credible threat, FBI Headquartersactivates SIOC to coordinate and manage national-levelsupport to a terrorism incident (SIOC generally mirrors JOCstructure in the field).! SIOC is staffed by liaison officers from other Federal agencieswho coordinate with and provide assistance to the FBI.! Maintain direct connectivity with HSOC! HSOC may activate NRP components in coordination with theFBI once notified of a credible threat.! DEST deployment will be considered

Terrorism Incident AnnexConcept of Operations/The Response! When an incident occurs and an ICP is established on scene, FBIpersonnel integrate into the ICP. Three specific position within theICP are provided:! The first FBI Special Agent (SA) or Joint Terrorism Task Force(JTTF) member responding receives the initial briefing from the ICand works closely with the IC as a member of Unified Command.The FBI rep then informs the local FBI Field Office of the currentsituation. When a more senior FBI SA arrives on the scene he/sheassumes the role of the FBI rep to the Unified Command.! The first arriving SA or JTTF member moves to the OperationsSection as the Deputy Chief of Operations to manage Federal lawenforcement and investigative assets in support to the IncidentAction Plan! An additional FBI SA assumes the position of Deputy Chief ofPlanning within the ICP.

National Response PlanESF #13 Public Safety and Security AnnexTerrorism Incident Law Enforcementand Investigation AnnexTed J. StanichSenior CoordinatorHomeland Security ProgramOffice of Criminal Enforcement,Forensics, and TrainingU.S. EPATel: 202 564-5484