Integrating Preparatory Consequence Management and Law Enforcement Operations During “Left of Boom” Terrorist Threats

Abstract 

National policy now treats consequence management and law enforcement operations as a  single integrated function. However, responding to an imminent terrorist threat, particularly  one involving a weapon of mass destruction, is more complex than responding to an  impending natural disaster. If the government conducts highly visible preparatory consequence  management operations, a terrorist could be alerted, which could potentially jeopardize the  government’s efforts to stop the terrorist. This article offers a new planning approach enabling  all levels of government to integrate cohesively their operations to maximize their ability to stop  the terrorist while minimizing the potential consequences if those efforts are unsuccessful. 

Introduction 

“Mother Nature” does not care if the nation is prepared for a hurricane. However, if the  government is aware of a terrorist threat, but the public is not aware of that threat, and the  government conducts highly visible preparatory consequence management operations, then  an alerted terrorist could change tactics or attack a different target. To avoid this potential “no win” scenario, response and prevention mission planners across all levels of government must  consider the unique and complicating factors that can adversely affect their mission’s success  during credible terrorist threats, particularly those involving a weapon of mass destruction  (WMD). This article builds on my previous writing in “Preparatory Consequence Management &  Weapons of Mass Destruction”¹ and proposes a new way to bridge a planning gap that currently  exists in national planning guidance. If federal, state, local, tribal and territorial (FSLTT) officials  adopt this new approach and cohesively integrate preparatory consequence management  operations and law enforcement operations across all levels of government for “left of boom”  terrorist threats, they will maximize their ability to stop the terrorist while minimizing the  potential consequences of the terrorist’s actions. 

Background 

To ensure the government’s natural disaster response is not “late to need,”² dedicated  specialists can use analytical tools to issue guidance³ that can lead to a range of preparatory consequence management actions taken in the days and hours leading up to the event.  Consequence management planners design their operations to maximize the government’s ability to protect public health and safety, restore government services, meet basic human needs, and provide emergency relief to those affected by an incident.⁴ These operations, which are  part of the federal government’s response mission, are led by the U.S. Department of Homeland  Security (DHS), acting through the Federal Emergency Management Agency (FEMA).⁵ By way of contrast, the federal government’s prevention mission operations – which include  law enforcement and/or counterterrorism operations and are sometimes referred to as “crisis  management”⁶ operations – are led by the U.S. Department of Justice (DOJ), acting through the  Federal Bureau of Investigation (FBI). The prevention mission’s focus is different. The primary focus is  to avoid, prevent or stop a threatened or actual act of terrorism.⁷ However, while “Mother Nature”  does not care if the public is warned and prepared before an impending natural disaster, profoundly  different considerations are present when the government is confronted with a terrorist threat and  the public is not aware of that threat. Unlike nature’s indifference to preparations and warnings, if  the government conducts highly visible preparatory consequence management operations, it could  alert the terrorist and therefore adversely affect the success of the prevention mission.⁸ 

The National Response Framework (NRF)⁹ and the Response Federal Interagency Operational  Plan guide response and prevention planners and direct them to integrate and synchronize their  operations. These planning documents emphasize establishing “joint priorities, particularly  in areas such as incident site/crime scene access, pre-positioning, operations to resolve  threats, public information and warning, and fatalities management.”¹⁰ Since the response  mission focuses on saving lives as well as protecting property, critical infrastructure, and/or  the environment after an incident,¹¹ how to achieve unity of effort with the prevention mission  before a terrorist incident is not addressed in the NRF or the response FIOP. Indeed, while the  goal is to “simultaneously save lives, investigate and resolve threats, and/or prevent follow-on  attacks,”¹² these planning documents do not provide specific planning guidance.  

The National Prevention Framework (NPF) defines imminent terrorist threats to be when  “intelligence or operational information warns of a credible, specific, and impending terrorist  threat … that is sufficiently specific and credible to recommend implementation of additional  measures to thwart the attack.”¹³ It then notes that an imminent terrorist threat may “emerge  at any time and become known through one of several different vectors: the U.S. intelligence  community, federal, state or local law enforcement, or the American public.”¹⁴ Understanding  this point raises the following important question: what if the knowledge of an impending  terrorist attack is only within the government? Moreover, how should the federal government  and/or its SLTT partners respond to a “left of boom” WMD terrorist threat when the public is  unaware of the threat? Terrorists may “select soft targets or other vulnerable environments to  maximize casualties.”¹⁵ Because of this, forward-leaning response planners must consider that  highly visible response operations may cause terrorists to “strike quickly and move to another  location before law enforcement can interdict and disrupt.”¹⁶ 

FSLTT officials need a new way to integrate cohesively preparatory consequence management  operations and law enforcement operations during “left of boom” terrorist threats when the  public is not aware of the threat, particularly those that involve a WMD. This article proposes  that response and prevention planners across all levels of government use the new approach  discussed below to develop comprehensive and integrated plans that will enable them to  maximize their ability to stop the terrorist, while simultaneously minimizing the potential loss of  life, damage to property, critical infrastructure, and the environment.

A New Approach 

There are three key elements to developing a plan that will cohesively integrate prevention and  response mission operations when the public is not aware of a WMD terrorist threat: dividing  response options into operational phases, using an OPSEC (operational security) construct to  analyze activities during those phases, and attention to critical considerations. 

Operational Phases 

When the response mission leans forward for impending natural disasters, the instinct is to “go  big, go early.”¹⁷ However, if a goal is not to alert the terrorist, this approach presents a potential  conflict. In the same way that public disclosure of a spy’s activities could cause the spy’s  cover to be “blown,” the more significant the public visibility of the preparatory consequence  management operations, the greater the likelihood of alerting threat actors and adversely  affecting the success of the prevention mission. Yet, without a robust ability to lean forward,  particularly for threats involving a WMD,¹⁸ the response mission’s ability to succeed may be  adversely affected. 

Under President G.W. Bush’s direction, Homeland Security Presidential Directive 5, Management  of Domestic Incidents (2003), developed the National Incident Management System (NIMS)  and emphasized the importance that all levels of government use shared structures, systems,  processes, and vocabulary to guide response personnel.¹⁹ NIMS defines a “staging area” as a  “temporary location for available resources in which personnel, supplies, and equipment await  operational assignment.”²⁰ If we were to think about “staging” as one part of an operation and  then were to think about the other phases, the following four operational phases emerge: 

1. Alert/Activation, in which personnel get notice;
2. Staging, in which personnel and equipment are assembled and loaded in preparation for  deployment;
3. Deployment, in which personnel and/or equipment are moved to or pre-positioned  near a potential or actual incident site; and
4. Employment, in which personnel and equipment are operationally used in activities in  response to threats or incidents.

Operational Security 

Although we divided response operations into four phases, we still need to address the instinct  to “go big, go early.” Here we can look to the concept of OPSEC which the U.S. government  has long considered as a critical planning construct for sensitive operations. OPSEC involves the  “implementation of procedures and activities to protect sensitive or classified operations.”²¹ By following OPSEC principles, the FSLTT government officials can deny a potential adversary  information about the government’s intentions. Thus, if we were to view each of the four operational phases listed above through an OPSEC construct, we can think about the public  visibility of each phase of each potential preparatory consequence management action and  assess how likely that phase of that action would be to alert the terrorist. 

Critical Considerations 

The success of the response mission is critically important. In this regard, the response FIOP  notes the importance of looking at “interdependencies.”²² An interdependency exists when  the execution of one part of an operation depends upon another part being executed. Stated  another way, the failure of one part of a response operation could very well affect the success  of the entire response operation. Interdependencies, however, can be “pooled, sequential  or reciprocal.”²³ For example, let’s assume that medical countermeasures are needed to  save lives. However, this effort’s success depends on delivering and administering medical  countermeasures by personnel to the affected population.²⁴ Thus, interdependencies that could  affect the success of the response mission’s operations must be considered. 

In addition to understanding interdependencies, other considerations, such as time must  also be taken into account. For example, the time needed to go from the alert and activation  phase to the deployment and employment phase is a critical consideration for response  planners, as illustrated by this example noted by the Centers for Disease Control and  Prevention (CDC). If someone has symptoms of anthrax infection, the CDC notes that it is  critical to get them medical care “as quickly as possible.”²⁵ Indeed, the CDC points out that  certain antibiotics can “prevent anthrax from developing in people who have been exposed  but have not developed symptoms.”²⁶ Thus, as the response FIOP emphasizes, prevention and  response decision-makers “must be in communication during times of an imminent threat  so that response assets, to the extent practical and appropriate, may be pre-positioned.”²⁷ However, while pre-positioning medical countermeasures is a necessary first step, these  planners also need to factor in the time it will take to distribute and administer those medical  countermeasures to the population.  

Planners must also consider the cumulative effect that preparatory consequence management  actions could have on the overall public visibility of the response operations. For example, a  few consequence management actions may be unlikely to alert a threat actor when viewed in  isolation. However, if numerous such actions all were to happen in the same place at the same  time, their cumulative effect could very well alert a threat actor. 

Another critical consideration is the dynamic nature of some terrorist threat scenarios.  Concerns about potentially compromising prevention operations could change as the facts and  circumstances evolve, including if the public becomes more aware of the threat. As the federal  government has emphasized, “suspected or actual involvement of terrorists adds a complicating  dimension to incident management.”²⁸ Thus, whereas a public warning may be inadvisable at  a certain point in time, evolving circumstances, including media disclosures, may indicate that  such warnings or other publicly visible actions may be advisable.²⁹

The Path to Development of a Plan 

Guidance from the DHS’s Planning Considerations: Complex Coordinated Terrorist Attacks (CTTA)  states that terrorists may select “soft targets or other vulnerable environments to maximize  casualties,” and may move to a new target “before law enforcement can interdict and disrupt.”³⁰ As the CCTA guidance notes, one of the “major challenges” of responding to terrorist attacks  is the integration of “crisis management (e.g., law enforcement, interdiction), consequence  management (e.g., emergency management), and investigatory functions (e.g., evidence  gathering, forensics, attribution). All must be performed simultaneously and involve entities  that may not habitually operate together.”³¹ 

The CCTA guidance, like the NRF and the response FIOP, focuses on “right of boom.”  Nonetheless, and building on FEMA’s multi-step planning process,³² which is already well  known to FSLTT planners, the CCTA guidance provides a roadmap for them to develop a plan to  address “left of boom” terrorist threats when the public is not aware of the terrorist threat. The  following steps are therefore recommended for response planners to ensure the development  of a comprehensive plan that will lead to risk-informed decisions.  

1. Assemble a planning team of relevant stakeholders from the response and prevention  mission communities (e.g., law enforcement, counterterrorism, first responders, public  health officials, private sector).
2. Ensure a common understanding of all the complexities, interdependencies, and other  factors and the need for cohesive, integrated planning and operations.
3. Identify each potential preparatory consequence management action that can be taken.
4. Break down each potential preparatory consequence management action into one of  the following major phases: alert/activation, staging, deployment, and employment for  resources and personnel.
5. Agree on a default public visibility rating in each phase for each potential preparatory  action. Using common terminology, assess whether the action is unlikely, likely, or highly  likely to alert a threat actor.³³
6. Develop an integrated and cohesive plan that considers all appropriate factors, including  but not limited to the nature of the threat and the threat actor, interdependencies that  exist, the effect that cumulative preparatory consequence management actions can have  on the overall public visibility of the Response Mission’s operations, and the fact that  circumstances can evolve; and
7. After developing the plan, exercise it regularly and revise it as part of a continuous  improvement cycle, including based on lessons learned from exercises and responses to  real-world events.

Planning Across All Levels of Government 

The seven planning steps discussed above need to involve all levels of government to maximize  the chances for the success for both prevention and response missions, particularly for terrorist  threats involving chemical, biological, radiological, and nuclear (CBRN) materials, weapons, and/or dispersal devices. For example, the federal government has a new interagency coordination  mechanism for coordinating the federal government’s response to WMD terrorist threats,  namely, the Weapons of Mass Destruction Strategy Group (WMDSG).³⁴ The WMDSG is an FBI led interagency crisis action team supporting information exchange and the deconfliction of  consequence management and law enforcement operations.³⁵ The federal government co-locates  the Consequence Management Coordination Unit (staffed and managed by FEMA) directly in  the WMDSG. This allows “real-time” information sharing, strategic advice, and recommended  consequence management courses of action that can take into account ongoing law enforcement  and counterterrorism operations.³⁶ SLTT governments should mirror this approach and co-locate  and integrate law enforcement and consequence management operations.  

Indeed, as the federal government has pointed out, it cannot combat WMD terrorism alone.  As a result, the federal government’s response to a terrorist threat may need to be augmented  by assets and resources under the control of SLTT governments.³⁷ These may be tasked with  locating the terrorist and the weapon the terrorist intends to use to carry out the attack or  to assist in mitigating the potential consequences of the threat. For example, let us assume a  terrorist threatens to use a WMD. The National Guard has 57 WMD-civil support teams across  the country. These civil support teams can “identify chemical, biological, radiological and  nuclear agents and substances, assess current and projected consequences, advise on response  measures, and assist with requests for additional support.”³⁸ 

Similarly, SLTT public health resources may be needed to augment the distribution and  administration of medical countermeasures or to otherwise prepare for mass casualty events,  as illustrated by the federal government’s delivery of Covid-19 vaccines to “loading docks” that  needed states and localities to “take over from there.”³⁹ An act of terrorism involving CBRN  materials that may “overwhelm the capabilities of many local, state and/or tribal governments  to respond” may also “seriously challenge existing Federal response capabilities.”⁴⁰ As a result,  unity of effort will be required, which mandates the seamless integration of law enforcement and  consequence management operations. In the same way that unity of effort was improved through  the adoption of NIMS, the federal government and its SLTT partners should adopt the new  approach discussed above to develop a cohesive plan for integrating preparatory consequence  management and law enforcement operations during “left of boom” terrorist threats when the  public is not aware of the threat, particularly for those involving the threatened use of a WMD.  

Finally, while some preparatory consequence management actions can alert a terrorist and  adversely affect the prevention operations, response planners may nonetheless recommend  those actions to decision-makers to minimize the potential negative effect on the mission. While  these recommendations may raise difficult discussions and require difficult decisions, senior government officials must also consider the success of the response. 

Conclusion 

Since 2003, national policy has treated law enforcement crisis management operations and  consequence management as a single integrated function.⁴¹ However, responding to terrorist  threats can be more complicated than responding to natural disasters. Moreover, when a terrorist is threatening the use of a WMD, effective response can be even more complex  because of the unique challenges that exist in responding to threats involving CBRN materials,  dispersal devices, and weapons.⁴² If the public is not aware of the terrorist threat and the  government conducts highly visible preparatory consequence management operations, the  terrorist could be alerted, potentially jeopardizing the success of the prevention mission’s  efforts. At the same time, it is essential to consider interdependencies and other factors that  can affect the success of the response mission’s efforts.  

All levels of government must adopt a unified approach that cohesively integrates preparatory  consequence management and law enforcement operations during “left of boom” terrorist  threats. The successful resolution of imminent terrorist threats will require more than cohesive  and integrated planning and operations. Senior government officials may need to make tough  decisions involving competing risk and value trade-offs. To best support them, the federal  government’s and SLTT government’s approach to “left of boom” terrorist threats and the  coordination mechanisms should be similar and integrate seamlessly. This will ensure that  decision-makers across all levels of government have the same understanding of the threat and  that course of action options are developed with the risk-informed input from stakeholders in all  mission areas.

Notes 

1. Scott J. Glick, Preparatory Consequence Management & Weapons of Mass Destruction, DomPrep Journal  (November 2020), https://www.domesticpreparedness.com/preparedness/preparatory-consequence management-weapons-of-mass-destruction/. 
2. Karen Roganov, FEMA, State, Military, Guard, CAP, Volunteers, Rehearse Whole-of-Government Crisis  Response, Joint Task Force Civil Support News (June 18, 2019), https://www.jtfcs.northcom.mil/MEDIA/ NEWS-ARTICLES/Article/1879772/fema-state-military-guard-cap-volunteers-rehearse-whole-of government-crisis-re/. 
3. E.g., “Severe T-Storms Prompt Tornado Watch in Parts of Tri-State Area,” WCBS NewsRadio 880 (August 27,  2020), https://www.audacy.com/wcbs880/articles/news/cuomo-ny-agencies-to-pre-deploy-emergency response-assets. 
4. FEMA Mission Areas and Core Capabilities, (Last updated July 20, 2020), https://www.fema.gov/emergency managers/national-preparedness/mission-core-capabilities. 
5. PDD-62, Protection Against Unconventional Threats to the Homeland and Americans Overseas, at 5-6  (May 22, 1998) (“When the Attorney General, acting on the advice of the Director, FBI, and in coordination  with the Director, FEMA, determines that the incident or threat of an incident has subsided, lead agency  responsibility may be transferred to FEMA.”), https://clinton.presidentiallibraries.us/items/show/16200. 
6. Presidential Decision Directive (PDD) 39, U.S. Counterterrorism Policy, 6, (June 21, 1995), (“Within the United  States, the Department of Justice, acting through the FBI, shall have lead responsibility for management of  terrorist incidents,” https://clinton.presidentiallibraries.us/items/show/12755. 
7. National Prevention Framework, 1, (2d Ed. 2016), https://www.fema.gov/sites/default/files/2020-04/ National_Prevention_Framework2nd-june2016.pdf. 
8. Scott J. Glick, Preparatory Consequence Management & Weapons of Mass Destruction, DomPrep Journal (November 2020), https://www.domesticpreparedness.com/preparedness/preparatory-consequence management-weapons-of-mass-destruction/. 
9. National Response Framework, 2, (4th Ed. 2019), https://www.fema.gov/sites/default/files/2020-04/NRF_ FINALApproved_2011028.pdf. 
10. Response FIOP, 5, (2d Ed. 2016), https://www.fema.gov/sites/default/files/documents/fema_response fiop.pdf . 
11. National Response Framework, 12, (4th Ed. 2019), https://www.fema.gov/sites/default/files/2020-04/NRF_ FINALApproved_2011028.pdf. 
12. Ibid. 
13. National Prevention Framework, 3, (2d Ed. June 2016), https://www.fema.gov/sites/default/files/2020-04/ National_Prevention_Framework2nd-june2016.pdf. 
14. Ibid., 3.  

15. DHS, Planning Considerations: Complex Coordinated Terrorist Attacks, 2, (July 2018), https://www.fema. gov/sites/default/files/2020-07/planning-considerations-complex-coordinated-terrorist-attacks.pdf.

16. Ibid.; See also U.S. Department of State, International Travel, Terrorism (Listing recommendations  for travelers to “avoid becoming a target of opportunity”), https://travel.state.gov/content/travel/en/ international-travel/emergencies/terrorism.html. 
17. FEMA, Leaning Forward: Go Big, Go Early, Go Fast, Go Smart, https://www.fema.gov/pdf/about/state_of_ fema/state_of_fema.pdf. 
18. Podcast: Spotlight on FEMA’s CBRN Office (November 29, 2019), https://cbrnecentral.com/the-fema podcast-spotlight-on-femas-cbrn-office/21038/ (FEMA official noting “We’re always trying to lean forward  in the CBRN realm as well.”). 
19. National Incident Management System (Third Ed. 2017), https://www.fema.gov/sites/default/ files/2020-07/fema_nims_doctrine-2017.pdf. For a historical chronology of FEMA and the management of  the consequences of terrorism from 1972 through 2009, see Baldwin, “FEMA’s Terrorism Consequences  Role as Assigned by Section 2-103 of E.O. 12148,” https://fas.org/irp/agency/dhs/fema/chron.pdf. 
20. National Incident Management System, Glossary, 70, (3rd Ed. 2017), https://www.fema.gov/sites/default/ files/2020-07/fema_nims_doctrine-2017.pdf. 
21. National Incident Management System, Glossary, 68, (3rd Ed. 2017), https://www.fema.gov/sites/default/ files/2020-07/fema_nims_doctrine-2017.pdf. 
22. Ibid., 4. 
23. Profit Management Solutions, “How Are You Managing Your Team Interdependence,” (August 3, 2020),  https://proffittmanagement.com/how-are-you-managing-your-team-interdependence/. 
24. Richard Sisk, “Shots in Arms Within 24 Hours: Army General’s Complex Vaccine Delivery Task Takes Shape,”  Military News (October 26, 2020), https://www.military.com/daily-news/2020/10/26/shots-arms-within-24- hours-army-generals-complex-vaccine-delivery-task-takes-shape.html (large scale distribution of vaccines  is complex from a “logistical standpoint). 
25. Centers for Disease Control and Prevention, Treatment of Anthrax Infection (Last reviewed November 20,  2020), https://www.cdc.gov/anthrax/treatment/index.html. 
26. Centers for Disease Control and Prevention, Antibiotics to Prevent Anthrax After Exposure, (Last reviewed  November 20, 2020), https://www.cdc.gov/anthrax/prevention/antibiotics/index.html. 
27. Ibid., 5. 
28. FEMA, Terrorism Incident Law Enforcement and Investigation Annex, 3, (December 2004), https://www. fema.gov/sites/default/files/2020-07/fema_incident-annex_terrorism-law-enforcement.pdf. 
29. Connor Simpson, “F.B.I. Released the Tsarnavev’s Photos Because of Reddit and the Post,” The Atlantic (April 21, 2013), https://www.theatlantic.com/national/archive/2013/04/fbi-released-tsarnaev-brothers photos-because-reddit-and-post/316075/. 
30. DHS, Planning Considerations: Complex Coordinated Terrorist Attacks, 2, (July 2018), https://www.fema. gov/sites/default/files/2020-07/planning-considerations-complex-coordinated-terrorist-attacks.pdf. 
31. Ibid.,3. 

32. FEMA, Developing and Maintaining Emergency Operations Plans: Comprehensive Preparedness Guide  (CPG) 101, 43, (Ver. 3 2021), https://www.fema.gov/sites/default/files/documents/fema_cpg-101-v3- developing-maintaining-eops.pdf.

33. Intelligence Community Directive (ICD) 203 (January 2, 2015) highlights the importance of expressing  likelihood or using the same terminology (i.e., not mixing words with percentages). By thinking about  each phase of each potential preparatory consequence management action and placing that action in a  default category of its likelihood to alert the threat actor, Response and Prevention Mission planners can  collectively, using the same terminology, effectively understand the degree to which each potential action  could adversely affect the success of the Prevention Mission. 
34. U.S. Department of Homeland Security, Protection Federal Interagency Operational Plan (FIOP), First  Edition, C-3-12, (January 2016), https://www.fema.gov/sites/default/files/documents/fema_protection fiop.pdf; See also U.S. Department of Homeland Security, FIOP Response and Recovery, Oil/Chemical  Incident Annex, 4-8, (June 2016), https://www.fema.gov/sites/default/files/2020-07/fema_incident-annex_ oil-chemical.pdf. 
35. Ibid. 
36. FEMA, Protection Federal Interagency Operational Plan, Appendix C to Annex C, C.3-12, (1st ed. January  2016), https://www.fema.gov/sites/default/files/documents/fema_protection-fiop.pdf. 
37. National Strategy for Countering Weapons of Mass Destruction Terrorism, 11, (December 1, 2018),  https://www.hsdl.org/?view&did=819382 (WMD terrorism cannot be “combatted exclusively by Federal  authorities” and many others, including first responders, and health care professionals play a key role in  protecting the nation against WMD threats). 
38. National Guard, Weapons of Mass Destruction (WMD) Civil Support Team (CST) (Current as of December  2017), https://www.nationalguard.mil/Portals/31/Resources/Fact%20Sheets/Weapons%20of%20Mass%20 Destruction%20Civil%20Support%20Team%20Fact%20Sheet%20(Dec.%202017).pdf . 
39. Karen Weintraub and Elizabeth Weise, Analysis: What Went Wrong with COVID-19 Vaccine Distribution and  How It Has Tarnished The ‘Miracle,’” USA Today (January 31, 2021), https://www.usatoday.com/story/news/ health/2021/01/31/covid-vaccine-what-went-wrong-distribution-whats-being-changed/4275954001/. 
40. FEMA, Terrorism Incident Law Enforcement and Investigation Annex, 3, (December 2004), https://www. fema.gov/sites/default/files/2020-07/fema_incident-annex_terrorism-law-enforcement.pdf. 
41. Homeland Security Presidential Directive 5, para. 3, Management of Domestic Incidents (February 23, 2003).
42. FEMA, Federal Interagency Operational Plans, (Last updated April 30, 2021), https://www.fema.gov/ emergency-managers/national-preparedness/frameworks/federal-interagency-operational-plans.