BY BRETT M. MARTINEZ
Since the attacks of September 11, 2001, the fire service has been at the forefront of training in response to terrorist attacks and technological developments to deal with weapons of mass destruction (WMD). Dealing with WMD attacks has led to the development of programs that are now used as models for other public and private safety organizations. To this point, all these efforts have focused on consequence management, also known as reactionary response. Although these developments play a role in counterterrorism (usually falling under the title of mitigation), it is not the only role the fire service should undertake. Most people believe that counterterrorism operations are being handled by agents within the clandestine services-the Federal Bureau of Investigation (FBI), the Central Intelligence Agency (CIA), and the National Security Agency (NSA)-or by the Special Forces Divisions within the U.S. Military. To a certain extent, this assumption is correct. These covert operations, although vital, are only a portion of the total counterterrorism operations effort.
A much larger role occurs in the intelligence- and information-gathering operations conducted through various human and electronic sources. It is this intelligence, and what is done with it, that covers the bulk of counterterrorism operations. The ultimate goal of these intelligence efforts is not only to disrupt attacks with countermeasures but also to prevent target availability. If we substitute the word “counter” with the word “prevent,” then most fire service personnel would be more familiar and comfortable with the concept of counterterrorism operations.
As mentioned earlier, most of the preparation within the fire service addresses the reactionary phase of a terrorist attack. As with our primary job of fire suppression, the bulk of our time, funding, and training is spent on responding to and suppressing fires. However, studies also show that when a small portion of funding is put toward fire prevention, the payoff is 10 to 20 times the investment. We proved this fire prevention fact in Suffolk County with fire deaths alone.1 If we introduce similar concepts to counterterrorism or terrorism-prevention operations, we will not only help fight this threat but also see dividends in all our other efforts. The approach to counterterrorism operations for the fire service is simple: First detect potential activity and then, through public safety efforts, deter suspected activity. The difficulty now lies in how to accomplish these goals.
In the past, much of the proactive or preventative actions have been relinquished to law enforcement and the nation’s intelligence agencies. Some would say that the intelligence agencies have done a good job since 9/11; only history will determine if that is the case. What is clearly known is that the sharing of intelligence among local assets and the training of those assets on how to conduct counterterrorism surveillance has led to many thwarted attacks. Simple information- and intelligence-sharing has discouraged some who wish to do us harm.
Why should the fire service be concerned about this? What role would we play in these counterterrorism operations? Many of our fellow firefighters have asked, “Why bother? It’s the cops’ job.” A few have even gone so far as to say that police only end up blocking firefighters out and taking all the credit. Prior to the tragic events of 9/11, there may have been some truth in these beliefs. Since that time, law enforcement not only has become more receptive to fire service information; I have found that the agencies I have worked with, including the intelligence component of police departments in New York City, Los Angeles, and South Carolina, and the Joint Terrorism Task Force (JTTF), have even become enthusiastic about it. The Los Angeles Fire Department also works closely with the Los Angeles Police Depart-ment. The idea here is for fire personnel to establish the points of contact. Obviously, they will not tell you everything, and we do not want to know everything-only what we need to know. That will happen only if we reach out and speak with these counterterrorism agencies.
TWO EXAMPLES
To help explain the role of the fire service and how prevention objectives can be accomplished, I would like to relate two examples that received national attention. Although the fire service was not directly involved in either of these cases, there are multiple points that relate to a community’s role in counterterrorism.
Case 1
During the summer of 2004 in the New York Tri-State area, an apartment manager of Middle Eastern descent had some concerns regarding some of his tenants, also of Middle Eastern descent. The tenants had been acting in an odd manner and had strange odors emanating from their apartment. The apartment manager spoke to his local patrol officer, who notified the precinct detective squad. Based on counterterrorism bulletins the local detectives had been briefed on, they forwarded the information they received to the JTTF.
The JTTF, based on interviews and surveillance of the apartment in question, gained search warrants. This then led to the arrest of the apartment occupants and their associates. Charges included bomb manufacturing, planning to commit acts of terrorism, and associating with known terrorist organizations, specifically Al Qaeda.2 The key point of this case proves that knowledge and education are major tools when dealing with terrorism issues. The first key point in this process is a concept that has come to be known as “boots on the ground.” During the opening days of the war on terror, U.S. Army Central Command General Tommy Franks said that air power alone will not defeat the terrorists in Afghanistan. “You must have boots on the ground” were his exact words.
The same idea holds true for counterterrorism: Electronic eavesdropping or satellite imaging alone cannot win the battle; only boots on the ground or, more specifically, local eyes and ears, will help accomplish this task. No one knows a jurisdiction better than the local residents, who are the heart and soul of a community. The apartment manager, along with the local law enforcement officer, were the boots of that neighborhood. This concept holds true for fire service personnel as well.
The one group that knows a jurisdiction better than most others is the local fire company assigned to protect that community. We know occupancy types, structural conditions, and times of activity (domestic and commercial) as well as the means of access to and egress from the area. Furthermore, we know jurisdictional demographics (the people who live and work there) as well as an entire host of factors too numerous to list. By using this knowledge to observe our protection district, we can note odd or unusual activity. When peculiar activity is observed, proper notifications can be made (to be discussed in a future article).
Let’s return to the question, “Why worry about it? It’s the cops’ job.” Why should the fire service be concerned about counterterrorism operations? The answer is simple. It relates back to the communities we serve, the brothers and sisters with whom we work, our families, and our way of life. During their interviews, the terror suspects from the above case admitted to JTTF investigators that they had trained in the mountains of Afghanistan with other motivated individuals from Yemen, Indonesia, and other hotbeds of Al Qaeda activity. The point here is simple: Just as firefighters attend national training conferences to learn new techniques and share concepts with our fellow professionals, terrorists travel halfway around the world to meet and train with other terrorists to learn and improve their techniques. We train to learn how to save a life; they train to learn how to destroy life. The lives they want to destroy belong to the people in the communities we protect, our friends, our fellow firefighters, our families, and ours. That is their only goal. Failure to believe that this concerns us or our department is foolish.
If departments and their personnel long for the days of pre-9/11 and fail to educate themselves on WMD and all its issues, they are on a course for disaster. Remember, terrorist groups are constantly developing and improving techniques for attacks. Most terrorist groups’ planning cycles are long term (years, not weeks or months). They plan for the big target but are equally satisfied practicing on the softer targets. Vigilance is the key to thwarting their attacks.
The only way to stop these attacks is by counterterrorism education and practices. Those who think it is only the big cities the terrorists are after should think again. Terrorist plots have been thwarted in places such as Lackawanna (New York), South Carolina, Oregon, and throughout the Midwest. These cases were well into the advanced stages and focused on killing American citizens.
Another factor that should not be overlooked is the threat of domestic terror. Domestic terrorists do not limit their focus to larger targets. Domestic terror groups are just as satisfied attacking the heartland as foreign terrorists are attacking major metropolitan cities.
Case 2
The second example of prevention through observation is a case with ties to various parts of the country, showing the need to share information, to keep channels open, and to be proactive in counterterrorism. In 2002, in Lackawanna, New York, during interviews of suspects arrested for their ties with Al Qaeda, it was learned that the suspects were interested in purchasing postal vehicles. When the suspects were questioned, they revealed that their objective was to make these vehicles into ice cream trucks.
In 2003 during an entirely separate investigation conducted in the mid-Atlantic region, suspects were inquiring about purchasing old postal vehicles. During the inquiries, the suspects wanted to know how much weight could be carried by the used postal vehicles. When asked by the reseller why the interest in old postal trucks, the suspects replied, “To use them for ice cream delivery trucks.”
When this became public knowledge, incidents of unknown subjects asking questions about fire trucks and ambulances began to surface in our “County of Suffolk Terrorism Response Task Force Information Alert” bulletin.
Although alerts were sent out by state and local public safety agencies, fire service personnel did not take many of these incidents seriously. Early in 2005, an attack on U.S. Marines occurred in the Iraqi city of Husaybuh, near the Syrian border. During this attack, one of the weapons used was a fire truck packed with explosives. Based on other intelligence, it is known that terrorist cells have used fire trucks in at least half a dozen other attacks around the world and that terrorist groups continue to study different delivery systems for vehicle-borne improvised explosive devices (IEDs). We should not assume that this interest and inquiries were for attacks in Iraq alone.
The concepts of counterterrorism operation for the fire service are not complicated or dangerous; they simply involve doing the same things we do every day. The only difference is that now it has become necessary for us to stay informed, be alert to everything we can, and pass any concerns or information gained onto the proper agencies. What to look for and how to pass it on are the key factors. This is nothing different from what the Department of Homeland Security has asked from everyone. A good place to start is to learn more about the area you protect and the people who inhabit it. At the same time, stay alert to media reports on terrorist threats and trends.
THE DHS COLOR-CODED THREAT SYSTEM AND THE FIRE SERVICE
The Department of Homeland Security Threat Advisory System is designed to target our protective measures when specific information to a specific sector or geographic region is received. It combines threat information with vulnerability assessments and provides communications to public safety officials and the public.3
• Homeland Security Threat Advisories contain actionable information about an incident involving, or a threat targeting, critical national networks or infrastructures or key assets. They could, for example, relay newly developed procedures that, when implemented, would significantly improve security or protection. They could also suggest a change in readiness posture, protective actions, or response. This category includes products, formerly named alerts, advisories, and sector notifications. Advisories are targeted to federal, state, and local governments; private sector organizations; and international partners. (3)
• Homeland Security Information Bulletins communicate information of interest to the nation’s critical infrastructures that do not meet the timeliness, specificity, or significance thresholds of warning messages. Such information may include statistical reports, periodic summaries, incident response or reporting guidelines, common vulnerabilities and patches, and configuration standards or tools. It also may include preliminary requests for information. Bulletins are targeted to federal, state, and local governments; private sector organizations; and international partners.
• Color-Coded Threat Level System is used to communicate with public safety officials and the public at large through a threat-based, color-coded system so that protective measures can be implemented to reduce the likelihood or impact of an attack. Raising the threat condition has economic, physical, and psychological effects on the nation so the Homeland Security Advisory System can place specific geographic regions or industry sectors on a higher alert status than other regions or industries, based on specific threat information.
Government Recommendations
Government recommendations related to the Color-Coded Threat System are discussed below and have been integrated with concerns specific or related to the fire service.
1. Low Condition (Green) is declared when there is a low risk of terrorist attacks. The fire service should consider the following general measures in addition to the agency-specific protective measures they develop and implement:
• Refine and exercise all appropriate preplans related to multiagency response.
• Ensure that personnel receive proper training on the Homeland Security Advisory System and have preplans for family members in case of an attack. Prepare individual family members for an attack: Advise them of the items they will need to survive and how to communicate with the family members of responders who are deployed. Although doing this is not a specific counterterrorism requirement, it enables fire personnel to make sure their families are safe while they work a catastrophic event.
• Institutionalize a process to ensure that all facilities and regulated sectors are regularly assessed for vulnerabilities to terrorist attacks and that all reasonable measures are taken to mitigate these vulnerabilities.
Target assessment should begin with each agency securing its facilities in the case of greater threat. Make it a priority to contain and limit to agency personnel access to uniforms, vehicles, and personnel identification.
2. Guarded Condition (Blue) is declared when there is a general risk of terrorist attacks. In addition to the protective measures taken in the previous threat condition, the fire service should also consider the following general measures:
• Conduct studies and develop plans to deal with target hazards within your jurisdiction.
• Check communications with designated emergency response or command locations.
• Review and update emergency response procedures.
• Monitor counterterrorism and anti-terror intelligence reports at the local and national level.
Look at government facilities (local, state and federal) as well as vital infrastructure facilities (power plants, bridges, tunnels, telecommunication networks, water treatment facilities, ports, and financial trading centers) within the response area. Analysis of these areas should emphasize alternate access in an attack as well as critical systems that require prioritized response during terrorist and WMD events. Examples of prioritization would include maintaining water-pumping stations during dirty bomb or large-scale explosive device attacks. Another example would be giving priority to protecting and maintaining telecommunication hubs from fire.
3. Elevated Condition (Yellow) is declared when there is a significant risk of terrorist attacks. In addition to the protective measures taken in the previous threat condition, the fire service should also consider the following general measures:
• Secure critical locations within the services.
• Determine if the precise characteristics of the threat require further refinement of preplanned protective measures.
• Implement, as appropriate, contingency and emergency response plans.
• Coordinate emergency plans, as appropriate, with nearby jurisdictions and concepts for sharing unique resources (such as overhead staff).
Become familiar with outside agencies’ official forms for identifying personnel; at the same time, be sure they are aware of your agency’s official form of personnel identification.
4. High Condition (Orange) is declared when there is a high risk of terrorist attack. In addition to the protective measures taken in the previous threat condition, the fire service should also consider the following general measures:
• Restrict threatened facility access to essential personnel only. Coordinate necessary security efforts with federal, state, and local law enforcement agencies or any National Guard or other appropriate armed forces organizations.
Take additional precautions at public events; consider alternative venues or even cancellation.
• Review bulletins and threat advisories related to any targets, and enact “be on the lookout” for (BOLO) operations at all key sites. These operations should include increased inspections, company size-up of sites, and verifying sensitive site personnel points of contact.
• Confirm that all specialized equipment and personnel are operational; if not, rectify.
• Prepare to execute contingency procedures, such as moving to an alternate site or dispersing the department’s workforce.
• Contact venders that supply to the fire service critical equipment (such as communications, fuel, vehicles, and specialized rescue equipment); be sure they can support you in a direct attack or in mutual-aid response.
• Stay alert to specific threat and targets through law enforcement and intelligence bulletins. In a future article, specific ways to establish counterterrorism communication networks will be addressed.
5. Severe Condition (Red) reflects a severe risk of terrorist attacks. Under most circumstances, the protective measures for a Severe Condition are not intended to be sustained for substantial periods of time, although recovery operations could be long term. In addition to the protective measures in the previous threat conditions, the fire service should also consider the following general measures:
• Increase or redirect personnel to address critical emergency needs.
• Assign emergency response personnel; preposition and mobilize specially trained teams or resources.
• If not under direct attack, monitor events and see what targets similar to those attacked are within your agency’s jurisdiction or mutual-aid response area.
• Try to ID any specialized equipment and personnel being employed. Verify that these assets in your jurisdiction are operational.
• ID personnel available for mutual-aid response during long-duration operations (most major attacks will continue for extended operational periods).
It is easy to see how a lack of planning and preparation could seriously strain departments and agencies. Simply elevating staff levels based on the threat increase alone is futile if there is no consideration of the above factors.
By following this threat assessment concept, agencies will be better prepared to employ their personnel and resources in a manner that best deals with threats within their jurisdiction or region. Using the DHS system in conjunction with coordinated mutual-aid plans will cut down on confusion, miscommunication, and self-dispatch issues-all problems that have beleaguered response and mitigation during large-scale events. (3) ■
Endnotes
1. Martinez, Brett M.,“Fatal Fires: One County’s Perspective,” Fire Engineering, Jan. 2005.
2. Based on the intelligence developed during the case involving bomb manufacturing, arrests were made in Great Britain in the summer of 2004. These arrests and the information gained led to the raising of the National Threat Level to orange just before the 2004 Republican National Convention in New York City.
3. The Department of Homeland Security Web site is at www.DHS.gov.
■ BRETT M. MARTINEZ, a veteran of the fire service since 1983, is a fire marshal for the Suffolk County (NY) Fire Rescue and Emergency Services. He is a State of New York-certified Level II fire investigator and peace officer and ATF-certified accelerant detection canine handler. He is a member of the U.S. Attorney’s Anti-Terrorist Advisor Council (ATAC). He has an associate’s degree in fire science from Suffolk County Community College and is the author of Multiple Fire Setters: The Process of Tracking and Identification (Fire Engineering, 2002).
