Volume 10, Issue 1

This article argues that the federal government lacks a cohesive approach to post-cyber incident mitigation – that is, the closing of vulnerabilities that become apparent during and after a cyber incident. To begin addressing this gap in cybersecurity capabilities, greater legal, cultural, and technological integration among the Department of Defense, Department of Homeland Security, and US Intelligence Community would be helpful in achieving a more unified strategy in post-cyber incident mitigation.

Deficiencies in cybersecurity may be the greatest national security threat facing the US in the 21st century. Public and private sector organizations as well as individuals are vulnerable, and the nation’s critical infrastructures are also put at risk by these deficiencies. Security professionals, designers, and engineers are currently faced with the challenge of securing cyberspace. Essential to this effort is the necessity to ensure that the nation’s laws are adequate to protect against, prevent, and deter cyberattacks. In this article we present a comprehensive review of current US laws and regulations that are being used to deter cybercrime activities and support cybersecurity. We describe legislation presented in the 112th Congress aimed at strengthening laws in fighting cybercrimes and ensuring a high level of cybersecurity, and we briefly review legislative efforts being undertaken in other countries. Finally, we discuss some future issues to be addressed in the growing area of cyberlaw.

The military’s increasing role in response to CBRNE events throughout the US has resulted in the need for a re-structuring of military forces. The development of the CBRNE Consequence Management Enterprise is a prime example of the military’s effort to support federal, state, and local disaster response agencies. The National Guard improved their response capabilities through the development of 57 Weapons of Mass Destruction Civil Support Teams, 17 CBRNE Enhanced Response Force Packages and 10 Homeland Response Forces. With their additional manpower, equipment, and response capabilities the active duty military still has a vital disaster response role. The active duty military does, however, have a primary mission of fighting and winning wars, therefore it is only practical to utilize the National Guard as the main element of a response to a major CBRNE incident. National Guard units are less restricted by both the Posse Comitatus Act and the Title 10 US Code (USC) allowing them greater flexibility during response to CBRNE events. Civilian leaders responsible for leading National Guard units must be well versed in the laws, structure and tactics pertaining to National Guard forces and must be familiar with the National Guard’s capabilities and limitations.

Emergency managers are embracing the Whole Community approach described in Federal Emergency Management Agency (FEMA) preparedness policy, doctrine, and guidance. The Whole Community approach entails broad collaboration and integration of effort among multiple disciplines and preparedness partners to coordinate solutions for all threats and hazards. Potential public health emergencies – to include foodborne and animal disease outbreaks – are issues on the emergency management agenda requiring such broad coordination. Scientists and public health practitioners across multiple disciplines describe a philosophy very similar to “Whole Community” known as “One Health,” linking efforts to address the shared threats to human, animal and environmental health. This paper recommends a coordinated strategy for FEMA to link “Whole Community” and “One Health” tenets as part of a national preparedness effort.

Previous studies on coordination have emphasis on managing coordination where conditions are stable and goals are well defined. In this study, we approach coordination from the perspective of a system working together as a whole rather than simply the parts themselves. We argue that organizational and individual actors’ behavior depends on the total structure and changes in structure could have impact on the changes of behavior. The behavior depends on how the parts are connected, rather than what the parts are (O’connor and Mcdermott 1997). Here, we argue that organizational learning prior to disaster have impact on the performance of a coordinated response. We apply coordination theory and network concepts to explore the problem of effective coordination for distributed bushfire teams. We present a network enabled coordination model suitable for dynamic disaster environments such as bushfire for exploring the value of coordination for effective response. We provide empirical investigations focusing on relationship between network and potential for coordination and suggest that facilitating network performance correlates to increasing coordination performance. Our findings highlight that network performance and organizational learning (in this article, training and education) correlate to the effectiveness of a response network.

Scientists have extensively debated the effectiveness of different emergency response management models, with a particular focus on the “command and control” versus “coordination” models. This debate, which focuses on centralized coordination at the tactical and strategic levels, assumes that the activity of frontline units within and between response organizations must be aligned and that it is possible to exercise control over frontline units. In this article, we discuss these assumptions and argue that researchers overestimate the degree to which frontline units can and should be centrally coordinated during the acute phase of emergency situations. Instead, we provide a mechanism in which coordination naturally emerges from the task at hand when frontline units follow a few simple decision rules. In addition, two managerial intervention strategies are presented that only may work in specific situations when frontline units are likely to misinterpret the environment in which they operate.

This article examines selected print media coverage of a domestic natural disaster and domestic industrial failure in each of three Westminster countries: Australia, Canada, and the UK. It studies this coverage from several perspectives: the volume of coverage; the rate at which the articles were published; the tone of the headlines; and a content analysis of the perceived performance of key public and private institutions during and following the events. Its initial findings reveal that the natural disasters received more coverage than the industrial failures in each of the newspapers considered. There was also no significant difference in the publication rate across event type or newspaper. In each case, government was assessed at least as frequently and negatively as non-government actors, particularly during and following industrial failures. The manner in which government and non-government actors were assessed following these events suggests that, contrary to government claims that owners and operators of critical infrastructure (CI) are responsible for its successful operation, government in fact is “in the frame” as frequently as the industry owners and operators are. In addition, the negative assessments of governments following industrial failures in particular may prompt over-reaction by policy makers to industrial failures and under-reaction to natural disasters. This inconsistency is indeed ironic because the latter occur more often and cost more, both financially and socially. We reviewed 340 newspaper articles from three different newspapers: The Australian ’s coverage of the Canberra bushfires and the Waterfall train accident, The Globe and Mail ’s (Canada) coverage of Hurricane Juan and the de la Concorde overpass collapse, and The Daily Telegraph ’s (UK) coverage of the 2007 floods and the Potters Bar train wreck. Our sample size is small; our ability to compare across newspapers and countries limited. Further research is warranted.

The following article introduces the concept of “spontaneous planning” and examines its applicability in response to the September 9th, 2010, gas pipeline explosion in San Bruno, California. Our case study offers a detailed picture of the unique nexus between planning and improvisation, and argues that spontaneous planning may facilitate more effective post-disaster operations. The article is divided into six main sections. First, we present a brief overview of pertinent planning and improvisation literature. Second, the contextual details of the San Bruno gas explosion event are reviewed. Thirdly, the research methodology for data collection and theory development is discussed. Fourth, we present research findings as they relate to spontaneous planning activities. Fifth, we discuss the impact of spontaneous planning in the San Bruno incident. Finally, we conclude with an exploration into the implications for future research and our recommendations for practitioners.

The chemical industry is responsible for process management safety at all of its facilities, especially those that have off-site consequences in the event of an unplanned release. This research is analyzing the current practices for emergency response for chemical facilities and will provide a model that could be utilized by small or large chemical facilities. Business process modeling was used to capture information requirements of extant incident response for chemical facilities. It will determine what technologies, specifically software and information systems, could be utilized to improve the chemical facility emergency response mechanism. The results will provide an optimal process model for an improved solution for an emergency response mechanism. This research-in-progress will produce a model emergency response mechanism, represented in a business process model, for a typical chemical facility.

Local health departments (LHDs), in concert with many other organizations, have begun to explore the potential of social media sites during emergencies. The most widely discussed and adapted social media site is Facebook. Apparently, once a decision to include Facebook is made, the Facebook logo is displayed on the organization’s homepage. The focus of this study was to assess the presence of Facebook on LHD websites and then determine whether LHDs actually used them as tools for communicating with the public or planned to do so during emergency or disaster situations. Secondary objectives were to test for the presence of two-way communications and to measure how quickly LHDs with two-way Facebook walls responded to a request for information received after regular office hours. We looked at 1970 LHD websites. Of those, 489 (24.6%) displayed the Facebook logo; 458 (93.7%) had a wall; 208 had walls with bi-directional (inbound and outbound) capability. A message was posted on each of the 208 bi-directional Facebook walls. Of the 208 LHDs receiving a message, 25 (12.0%) sent responses. The mean time for a response was 77.7±94.2 h.

Since 9/11, air transportation has been one of the most important and closely watched areas of homeland security under federal control. Despite this centralization of authority, some states have begun to question some of the policies enacted by the Transportation Security Administration (TSA). In 2011, Texas passed legislation that would have criminalized TSA officers for carrying out such policies, specifically enhanced pat downs of airport travelers. In light of threats from the Department of Justice, Texas ultimately backed down from the legislation, but the legal arguments made by participants on both sides remain relevant to future conflicts between state and federal authority on homeland security. The events in Texas are particularly interesting because they make public the tension between citizen preferences for security and civil liberties, highlighting the role of federalism in the homeland security domain. Using legal analysis, we find that federal power in the realm of aviation security given by the Constitution’s Supremacy Clause is less clear-cut than generally argued. Therefore, Texas’ attempt to assert its authority in this domain was not necessarily legally unsound.

There has been considerable controversy about the economic impacts of the federal Gulf deepwater oil drilling suspensions following the oil spill. In this study, we elaborate and apply the National Interstate Economic Model (NIEMO) to estimate direct, indirect and induced economic losses in each of the 50 states (and the District of Columbia). We simulate the effects of three separate, 6-month direct loss scenarios of media guestimates reported by several local sources. While the traditional NIEMO application only captured direct and indirect impacts, we developed a new module to estimate local induced impacts as well. This methodology could be applied to any similar scenario. Our model extension and application suggest a useful approach to tasks such as the one assigned to Gulf Coast Claims Facility administrator Kenneth Feinberg. The terror threat, as well as the possibility of other mishaps and natural disasters, suggests that this is always a serious possibility that these sorts of calculations will have to be made. Our innovation was to estimate the Type-II effects in the impacted states and to trace their trade effects through the NIEMO system with only minor methodological elaborations.

As municipalities, utilities and communities place more emphasis on security, resilience and disaster planning, it is increasingly more important to have an accurate dollar value to assess the economic importance of water for a community. This allows community level decision makers to accurately plan and implement pre-disaster mitigation strategies and effectively allocate resources post-disaster. This decision-making is based in part on a benefit cost analysis framework established by FEMA that establishes several per capita, per day (pcpd) dollar values that capture the total economic impact of the loss of potable water service. A primary motivation of this work is to acknowledge some of the uncertainties and data parameters in the FEMA model so that water utilities can downscale loss projections to the appropriate level of analysis. This study recommends using population weighted state level data and finds an estimated range of economic losses per capita per day between $67 and $457. This research allows utilities to better understand and estimate supply disruption valuations for their own service areas and choose the appropriate risk level for their benefit-cost decisions with regards to security preparedness infrastructure improvements.

Little attention has been given to the differences in information dispersion and interpretation during emergencies in collegiate environments which utilize diffusion. This manuscript seeks to add to social science knowledge via an expansion of diffusion of information literature by combining it with third-person effects and message credibility literature. In 2010, at a large Northeastern University, an alert went from the university warning students of a potential gunman on campus. Results indicate that high levels of third person effect were associated with greater sharing of information, and early knowers were more trusting of messages from both interpersonal and mass media channels than late knowers. Desire to share information was also more associated with early knowers, and theoretical implications are also discussed. Finally, suggestions for streamlining communication with regards to classroom policy are discussed.

Resilience building has become one of the most promising strategies for crisis managers to improve the security and proper functioning of critical infrastructures (CIs). Therefore, crisis managers will benefit from both general and detailed guidance for building and maintaining CI resilience levels. This paper aims to contribute to this purpose by presenting a framework that helps crisis managers improve the resilience level of CIs based on internal and external aspects of the CI that are often overlooked. This framework proposes sixteen resilience policies that have been suggested as influential in developing resilience. The influence and relative effectiveness of each policy in promoting the resilience of the system is postulated. The framework was reviewed and validated through an expert panel and a Delphi process providing grounded support for the evaluation and prioritization of the resilience policies. The results show that internal policies are the most influential ones when avoiding a crisis occurrence and external policies are most helpful when bouncing back to the usual state.

The Department of Homeland Security has funded an array of threat, risk and vulnerability assessment methodologies for use by law enforcement jurisdictions throughout the US. Yet, in spite of this effort, many law enforcement agencies either do not conduct assessments or do not understand and use operationally, the information gathered in assessments. This article discusses a practitioner/researcher partnership model which successfully developed and delivered a training course to assist homeland security professionals in understanding and using operationally, information gathered by various threat, risk, and vulnerability methodologies. The model takes into consideration not only what participants needed to learn but also how they were going to learn it. This article discusses initial background research, course development, implementation, delivery, and lessons learned. The results demonstrate the effectiveness of a model which incorporates the strength of both practitioners and researchers and can be replicated to provide effective training throughout homeland security.

As part of the US Department of Homeland Security Regional Catastrophic Preparedness Grant Program, a plan was developed for a region-wide public-private sector communications strategy for the Illinois-Indiana-Wisconsin combined statistical area (CSA). Key to this plan is the implementation of a governance structure and web-based communications platform for the entire CSA. A governance structure is outlined at the organizational, operational and technology levels. This governance takes the form of a coalition of public agencies, private companies, and non-profit organizations throughout the CSA. One of the responsibilities of the coalition is to coordinate situational awareness and resource requests among participants during a catastrophic event. A web-based portal is developed to facilitate this kind of information exchange, overlaid on cloud computing infrastructure for extra resiliency. The portal services and architecture are outlined, along with actual views obtained from a prototype that was developed. Evaluations conducted using a simulated disaster drill showed that a portal concept can be highly effective in establishing common situational awareness and consolidating resource requests across public and private organizations during adverse events. Implementation of a portal within the CSA would be best accomplished on a gradual basis using a phased approach.

Once, a walrus and a carpenter were walking along the beach, chatting about many fundamental issues affecting the security of the nation, including the workings of the Department of Homeland Security (DHS). “The time has come,” the Walrus said, “To talk of many things: Of shoes – and ships – and sealing-wax – Of cabbages – and kings – And why the sea is boiling hot – And whether pigs have wings.”        “and how to fix the current DHS regional structure…” The last line is not in the original poem. 1 However, it represents the subject of this analysis, which not only gives the history of and rationale for the need to restructure the DHS at the regional level, but also presents a proposal for how to do so.

Intelligent agents known as malware are rapidly becoming the tool of choice for nations, criminals, and terrorists in finding the high ground of the 21st Century’s cyber battlefields. Malware is making information control the capital of peace and the currency of cyber war.

Differences between the emergency management and cybersecurity professions create a barrier to effective communication based on technical jargon and specialized language. This article discusses the nature of professions and the need for common terms in order to improve the ability of organizations to respond to cyber emergencies. Recommendations are provided and include action by the Emergency Management Institute, professional organizations, and improvements in sharing information.

Congress mandated the Department of Homeland Security to regulate chemical facilities with the goal of increasing security at these facilities to prevent future terrorist attacks. In 2007, DHS issued an interim rule known as the chemical facility anti-terrorism standards (CFATS). This paper takes a look at CFATS 5 years after implementation and discusses the achievements and the challenges confronting this important piece of legislation. In addition, this paper poses several questions and discusses some CFATS issues and concerns that have far-reaching implications for CFATS stakeholders, homeland security, and emergency management.