DHS disaster practice makes perfect (kinda)

The Homeland Security Department is getting better at running drills that train a wide variety of government officials how to respond to terrorist attacks and that polish interoperable communications. But in other areas, it's still being criticized for inadequate preparations.As DHS carried out two major drills last month, the department got whipsawed by a coalition of corporate CEOs for poor cyberattack readiness and needled by an IT vendor over disaster relief IT preparations.The department carried out a three-day tabletop exercise that simulated attacks by terrorists using weapons of mass destruction on Washington and on a fictional West Coast port called LandPort. In a separate drill, called Grecian Firebolt, Army units tested communications links among military units and the Federal Emergency Management Agency.But the three-day drill, known as TopOfficials 4 Command Center Exercise, or TopOff 4 for short, apparently did not include a prominent cybercomponent, according to department officials and documents describing the simulation.'A large portion of this exercise was devoted to assuring that the government would be able to achieve continuity of operations [during a major terrorist attack],' DHS undersecretary for preparedness George Foresman said at the press conference concluding the exercise.On the same day as the DHS press conference, the Business Roundtable, an association of corporate chief executive officers whose companies collectively have $4.5 trillion in revenues and 10 million employees, denounced federal COOP plans for a cyberattack.'Our nation's Internet and cyberinfrastructure serve as a critical backbone for the exchange of information vital to our security and our economy, but our analysis has exposed a significant weakness that could paralyze the economy following a disaster,' according to a statement by Edward B. Rust Jr., chairman and CEO of State Farm Insurance Cos. and head of the roundtable's cybersecurity task force.'If there's a cyberdisaster, there is no emergency number to call and no one in place to respond, because our nation simply doesn't have the kind of coordinated plan in place that we need to restart and restore the Internet,' Rust said.The business organization pointed to three problems with national preparedness for a cyberattack:DHS did not have any immediate response to the Business Roundtable report.'If our nation is hit by a cyber-Katrina that wipes out large parts of the Internet, there is no coordinated plan in place to restart and restore the Internet,' said roundtable president John J. Castellani.The department has been working on cyberattack issues via acting NCSD director Andy Purdy since it lost its permanent chief more than a year ago.On another front, a major vendor of authentication technology said FEMA hasn't completed contract negotiations for a system to authenticate the identity of disaster benefits recipients.Foresman said his organization was reviewing all of its contracts. He expressed confidence that the department would be able to authenticate the identities of disaster aid applicants.Without a functioning authentication system, FEMA runs the risk of widespread benefits fraud of the kind that led to last year's outlandish and widely reported misuse of relief funds for hardcore entertainment rather than the hardcore unemployed.Foresman said TopOff 4 would generate an after-action report. 'This will not be a report that will sit on a shelf gathering dust,' Foresman said.But he said the drill had not led DHS to conclude that it needed to reallocate any grant money to respond to threats or preparedness needs that the simulation had uncovered. And his fellow press conference speaker, John Miller, the FBI's assistant director for public affairs, said the information gained in the exercise had not prompted the bureau to adjust the training or deployment of its special agents.DHS runs large-scale TopOff exercises in odd-numbered years. In 2006, an off year, DHS is running a smaller-scale CPX, or command post exercise.'Companies and trade associations participated in the simulated national emergency either as a tabletop exercise called a TTX or a Command Post Exercise known as a CPX,' according to a memo issued by the Real Estate Information Sharing and Analysis Council.Earlier TopOff exercises have brought dozens of agencies together to respond to simulated disease outbreaks and chemical gas attacks by terrorists.The separate communications interoperability exercise, Grecian Firebolt, involved FEMA personnell and Army Signal Corps units. It combined the efforts of the disaster agency with work by the Army's 311th Theater Signal Command in a drill that set up voice, data and video network services for Army units deployed in areas from Massachusetts to California, the Army said.Grecian Firebolt involved more than 500 military personnel at different times, according to command spokeswoman Jo Hoots.'In today's world, you often see the Army and federal emergency agencies working together,' said Maj. Gen. Donna Dacier, commander of the Signal Corps unit, in a statement. 'When a real disaster strikes, the lines of communication must open quickly and stay open.'Dacier added that the Grecian Firebolt exercise, centered at Fort Dix, N.J., provided an opportunity to test the interoperability of Army and FEMA radios, compare command and control practices, design systems infrastructure and strengthen agency coordination.Grecian Firebolt also supported four other military exercises spread across several states and involved several other Signal Corps units.One key Signal Corps unit in Grecian Firebolt was the Delaware National Guard's 261st Signal Brigade. Hoots noted that the Delaware unit specializes in setting up interoperable communications hubs for civilian and military networks at disaster sites.