By Ryan Murphy
The U.S. fire service focuses on situational awareness on the fireground, emergency medical services (EMS) calls, and other day-to-day firefighting responses. At this time in our history, with domestic and international threats a reality, our focus should include a global situational awareness as well. In the aftermath of September 11, 2001, the 9/11 Commission noted the lack of information sharing with Homeland Security partners. The solution was the creation of a network of state, local, and federal information sharing through fusion centers.
- JCAT: Linking Counterterrorism Intelligence to the Fire Service
- The Fire Service and Counterterrorism: Technology
- The Fire Service and Counterterrorism
- Managing Hazmat in an Era of Counterterrorism
Fusion centers were created by states and major urban areas as a counterterrorism tool after the 9/11 terror attacks in 2001, to improve the sharing of intelligence information related to terrorism among federal, state, and local authorities.1 The United States has at least one primary fusion center in each state. Some states have a primary and possibly other recognized centers that are typically associated with large metropolitan areas.
According to the U.S. Department of Justice’s Global Justice Information Sharing Initiative, integrating the fire service within fusion centers allows fire service personnel to do the following2:
- Contribute to the identification and reporting of threats that may lead to accidental, criminal, or terrorist incidents; serve as an information and analytical resource for the production of intelligence to support incident prevention efforts.
- Contribute to, receive, and share information and intelligence to support the effective response operations of all emergency services providers.
- Contribute to, receive, and share information and intelligence to support the continuity of government and reconstitution of critical infrastructure operations.
- Contribute to and receive information and intelligence on terrorism techniques, target hazards, and natural disaster trends; enhance situational awareness and proactive measures for protecting the health and safety of all emergency responders.
Prior to 2002, the fire service was historically left out of intelligence/information sharing, but fire/EMS partners are now included in written and oral intelligence products and briefings. Additionally, fire/EMS partners are valued participants in the intelligence cycle through suspicious activity reporting (SAR). Fire service representatives are contributors to intelligence products as well as members of the intelligence community on state and federal levels.
Around the country, regions host large sporting and political events as well as many local events that draw regional attention. With all these events comes risk, which can be prepared for by the sharing of information. Fusion centers and the intelligence community distribute many products that discuss risk mitigation. The intel community also provides situational awareness in the form of threat assessments and current threat environment bulletins.
The fire service has the opportunity to benefit from and help to improve local fusion center products and partnership. It can do its part in a variety of ways, including the following:
- Support fire service engagement with the intelligence process and cycle.
- Support and develop SAR training and standard operating procedures within the department in partnership with law enforcement.
- Attend fusion liaison officer (FLO) or threat liaison officer (TLO) training through the fusion center in your area and become a consumer of many products that fusion centers and federal agencies offer.
Real Threats
SAR or, as many people know it, “If You See Something, Say Something,” provides state and federal authorities with the opportunity to possibly connect the dots (see sidebar “What Is Suspicious Behavior or Activity?”). The fire service has a unique opportunity to notice activities or items that may be out of the ordinary and considered suspicious. Through fire prevention inspections and fire/EMS calls for service, you may stumble on a suspicious behavior or activity that warrants reporting.
What Is Suspicious Behavior or Activity?
|
It is observable behavior reasonably indicative of preoperational attack planning or other criminal activity. Federally designated behaviors that may be reported include potential criminal or noncriminal activity. |
|
|
ELICITING INFORMATION |
Questioning individuals at a level beyond mere curiosity about particular facets of a facility’s or building’s purpose, operations, security procedures, and so on, that would arouse suspicion in a reasonable person. |
|
TESTING OF SECURITY |
Interactions with or challenges to installations, personnel, or systems that reveal physical personnel or cybersecurity capabilities. |
|
RECRUITING |
Building operations teams and contacts, personnel data, banking data, or travel data. |
|
PHOTOGRAPHY |
Taking pictures or video of facilities, buildings, or infrastructure in a manner that would arouse suspicion in a reasonable person. Examples include taking pictures or video of infrequently used access points, personnel performing security functions (patrols, badge/vehicle checking), security-related equipment (perimeter fencing, security cameras), and so on. All reporting on photography should be done within the totality of the circumstances. |
|
OBSERVATION/SURVEILLANCE |
Demonstrating unusual interest in facilities, buildings, or infrastructure beyond mere casual or professional (e.g., engineers) interest such that a reasonable person would consider the activity suspicious. Examples include observation through binoculars, taking notes, and attempting to measure distances. |
|
MATERIALS ACQUISITION/STORAGE |
Acquisition of unusual quantities of precursor materials, such as cell phones, pagers, fuel, and timers, such that a reasonable person would suspect possible criminal activity. |
|
AQUISITION OF EXPERTISE |
Attempts to obtain or conduct training in security concepts (military weapons or tactics) or other unusual capabilities that would arouse suspicion in a reasonable person. |
|
WEAPONS DISCOVERY |
Discovery of unusual amounts of weapons or explosives that would arouse suspicion in a reasonable person. |
|
SECTOR-SPECIFIC INCIDENT |
Actions associated with a characteristic of unique concern to specific sectors (such as the public health sector) with regard to their personnel, facilities, systems, or functions. |
|
BREACH/ATTEMPTED INTRUSION |
Unauthorized personnel attempting to enter or actually entering a restricted area or protected site. Impersonation of authorized personnel (e.g., police/security, janitor). |
|
MISREPRESENTATION |
Presenting false or misusing insignia, documents, or identification to misrepresent one’s affiliation to cover possible illicit activity. |
|
THEFT/LOSS/DIVERSION |
Stealing or diverting something associated with a facility/infrastructure [e.g., badges, uniforms, identification, emergency vehicles, technology, or documents (classified or unclassified) that are proprietary to the facility]. |
|
SABOTAGE/TAMPERING/VANDALISM |
Damaging, manipulating, or defacing part of a facility/infrastructure or protected site. |
|
CYBERATTACK |
Compromising or attempting to compromise or disrupt an organization’s information technology infrastructure. |
|
EXPRESSED OR IMPLIED THREAT |
Communicating a spoken or written threat to damage or compromise a facility/infrastructure. |
|
AVIATION ACTIVITY |
Operation of an aircraft in a manner that reasonably may be interpreted as suspicious or posing a threat to people or property. May or may not be in violation of Federal Aviation Administration regulations. |
Source: https://wifusion.widoj.gov/.
In 1995, Filipino firefighters uncovered activity that led to the discovery of the “Bojinka Plot,” a plot to blow up 11 airliners headed from Asia to the United States, assassinate Pope John Paul II, and crash a plane into the CIA Headquarters. The plot was purportedly designed by Khalid Sheikh Mohammed and Ramzi Yousef, who planned the 1993 World Trade Center bombing.3
In 2010, with early recognition that “something wasn’t right,” the Fire Department of New York (FDNY) terrorism prevention and recognition program guided firefighters to respond to the failed vehicle-borne improvised explosive device in Times Square. According to the FDNY, “This incident proves the validity of FDNY terrorism awareness initiatives and how the decisions of emergency responders can drastically alter an incident’s outcome.”4
Training/Information Sharing
The Nationwide SAR Initiative (NSI) has free online training specifically for fire/EMS at https://courses.dhs.gov/courses/course/nsi-training-fireems. This training has been developed to assist fire and EMS personnel in recognizing what kinds of suspicious behaviors are associated with preincident terrorism activities; understanding how and where to report suspicious activity; and protecting privacy, civil rights, and civil liberties when documenting information.
The fire service currently has an intelligence sharing group with representatives from around the country that distributes information with local, regional, and national implications. The Bureau of Alcohol, Tobacco, Firearms and Explosives, through the U.S. Bomb Data Center, established the Interagency Fire Intelligence Exchange (IFIX) in 2018.
During the 2020 civil unrest and presidential election, IFIX shared real-time information with members that assisted in creating a situational awareness for police and fire service assets. IFIX serves as an informational hub of intelligence regarding emerging and historical fire threats and compiles data from local, state, federal, and international agencies.
IFIX promotes a collaborative information sharing environment among authorities charged with investigating crimes involving arson and the use of fire as a weapon. It also provides arson and explosives training to interagency partners as part of this collaboration initiative.
Additional fire service information/intelligence resources are non-For Official Use Only (FOUO) and are as follows:
Fire Service Intelligence Enterprise (FSIE) has goals that include supporting fire service collaboration within state and major urban area fusion centers and facilitating the identification and development of information and intelligence sharing requirements, mechanisms, technical assistance, and training for fire service personnel. For more information, contact the United States Fire Administration.
Emergency Management & Response–Information Sharing & Analysis Center (EMR-ISAC) is a primary hub for the dissemination of critical infrastructure protection and emerging threat information to Emergency Services Sector departments and agencies nationwide. For information, contact the EMR-ISAC office at fema-emr-isac@fema.dhs.gov.
Joint Counterterrorism Assessment Team (JCAT) consists of federal intelligence analysts and state, local, and tribal public safety personnel working at the National Counterterrorism Center (NCTC) to enhance the sharing of intelligence with our state, local, tribal, and private sector partners through established mechanisms within the Department of Homeland Security and the Federal Bureau of Investigation (FBI). The JCAT produces the Roll Call Release and the Fire Line products to ensure that federal terrorism, homeland security, and weapons of mass destruction intelligence is being provided to state, local, tribal, and territorial first responders. For more information about JCAT, go to http://www.nctc.gov/jcat/jcat_about.html.
FBI WMD (WMDD) focuses on addressing emerging threats and risk-based vulnerabilities. A strategic approach ensures that the WMDD can better communicate its purpose and goals to internal and external audiences, including other FBI divisions, other U.S. government agencies, Congress, and the American public. These key relationships afford the WMDD opportunities for collaboration and integration that help maintain the safety and security of our country. Each FBI Field Office has a WMD agent who is a resource for everything WMD.5
Years ago, I had a conversation with FDNY Deputy Assistant (Ret.) Chief John Norman; we were discussing terrorism for an undergraduate project. He expressed a concern he had regarding intelligence and the need to see the big picture. “Do you think the Oklahoma City bomb was constructed across the street from the Murrah Building?” he asked. Situational awareness that includes SAR is not limited to career departments or metropolitan areas. All of us in the fire service as public safety professionals should be active members in the intelligence process. The fire service is an integral intelligence partner within the U.S. intel community with many resources to prepare, mitigate, and respond as an all-hazard asset.
References
1. https://www.openthegovernment.org/dhs-fusion-centers-full-report/#:~:text=%E2%80%9CFusion%20centers%E2%80%9D%20were%20created%20by,federal%2C%20state%20and%20local%20authorities.
3. Homeland Security Intelligence, By James E. Steiner, CQ Press, Jul 6, 2014.
4. FDNY Counterterrorism and Risk Management Strategy, 2011, Prepared by FDNY Center for Terrorism and Disaster Preparedness (CTDP), www.nyc.gov/fdny.
5. https://www.fbi.gov/news/stories/weapons-of-mass-destruction-directorate-marks-10-years.
Ryan Murphy is a battalion chief with the Janesville (WI) Fire Department and the fire/EMS liaison with the Wisconsin Statewide Intelligence Center in Madison, WI. He is a safety officer with Wisconsin Task Force 1 Urban Search and Rescue Team. Murphy has a BS in fire science from Columbia Southern University.
