Recap of Day Two Event

How do you get involved in local hospitals with your plans? I have been in various places, and a common issue is we don't get a lot of information before the patient arrives, working blind at times. 

• Identify and partner with local hospitals in the area. If we have an event, we keep roadways clear to trauma centers and work with DC Fire to see who can take what type of injuries. Our officers are trained and prepared to control extreme bleeding and to get injured individuals to level-one trauma centers.

• Let hospitals know you're coming and what kind of patient you have so they're ready to intercept. Have a plan of action in place. Plan, be ready, be mentally prepared, and communicate.

Do you have two types of EMTs: one for military forces and one for public service? What criteria do you consider when providing tactical medical updates for civilian medical assistance? Do you have specific criteria, or do you identify someone as a civilian first and then determine their treatment?

• During large First Amendment events or special occasions, we have a team of Controlled EMTs and HHS personnel, known as tactical medics. Our top priority is to treat law enforcement officers. If there are no officers in need, we can also treat civilians. We work closely with partner agencies, including DC Fire, AMR, and GW Medical. They provide ambulances, Advanced Life Support (ALS), Basic Life Support (BLS), bike medics, and gaiters. Given the roadway blockages, the additional support from bike medics and gaiters is beneficial. Our tactical medicine team is deployed with a doctor and a paramedic to assist law enforcement. We also coordinate with local EMS and GW colleagues. Our capabilities include ALS support at these events. The primary mission of the tactical medicine team is to treat law enforcement officers. If there are no officers requiring assistance, the team will transition to address the needs of others present.

Context: During the BLM demonstrations in 2020, one observation I made was regarding the presence of demonstration leaders and local law enforcement at the event. Their involvement helped reduce unintentional interactions between vehicles and demonstrators. What percentage of public gatherings you have overseen have effective leadership that maintains the participants in their designated areas?

• Many larger events we organize have marshals. Most participants in demonstrations and special events hold permits and have marshals and legal representatives involved. However, these individuals do not always fulfill their commitments or follow through on their assigned roles. It is beneficial for permit holders and organizations to collaborate with law enforcement to establish a dedicated staging area. This space allows them to conduct their First Amendment activities effectively. We will provide a location that is visible to the main group while placing a barrier between them.

Could you share some unexpected aspects from events and how TTXs have evolved?

• One of the factors we always consider is the concept of an "event within an event." For instance, during the Fourth of July, we need to account for heat emergencies. In our tabletop exercises (TTXs), we strive to envision every possible scenario, including those that could be intentional. Recently, we have been discussing the potential for cyber attacks that might occur alongside a natural disaster.

You have all worked hard to address the needs of individuals with various disabilities—comprising 28% of the U.S. population—when it comes to notifications, evacuations, sheltering in place, and taking cover. Please discuss how you plan for and prioritize these essential needs.

• They focus on this population in their internal planning for future risks, threats, and emergencies. One of the biggest concerns for individuals with disabilities is missing persons, which requires innovative approaches to locate them. During the DC Health and Medical Coalition exercise, community members representing 'vulnerable populations' were included as patients at each facility, ranging in age from 1 to 91.

It has been suggested that high-security mass gatherings are less likely to be targeted. Do you think having visible, pre-staged rescue task forces—composed of law enforcement and paramedics—would be beneficial, or would it create problems and cause panic among event attendees, such as at a large county fair?

• Increasing security presence at events is beneficial, especially considering the trend of targeting healthcare facilities during these incidents. However, our logistical preparations may not always be fully developed, as seen in the fentanyl example. In such a case, having a truckload of NARCAN parked outside the stadium may still not be enough to save everyone. Therefore, counterterrorism measures are the most crucial aspect to address. We must plan for it effectively.

There is a notable risk associated with the use of drones, particularly in the context of the ongoing conflict in Ukraine. What lessons can we learn from the military casualties and forensics that can be applied to disaster response and mass gatherings? What insights have we gained, and how can we better prepare for similar situations?

• We are significantly behind in addressing the drone threat at mass gathering venues and similar locations. The technology has advanced rapidly, even faster than AI, as technology is incorporating AI into autonomous systems. Currently, physical security programs are not including the airspace domain in their planning. Many legacy programs fail to address this specific area. For example, an outdoor stadium may have the capability to detect drones in its vicinity, but it lacks effective measures to mitigate any potential threats. I have developed a program that assists security, safety, and emergency preparedness professionals in establishing a methodology to address these issues. Our focus is on gathering information and intelligence to prevent potential incidents before they occur. We also need to consider a public-private partnership to facilitate discussions around this issue. DHI, which holds the largest market share in the U.S., recently discontinued its software for drone management. It is essential that import control measures be taken into account, and there must be coordination among multiple agencies to effectively tackle this challenge.

A lot of technologies are stockpiled. Are there trends regarding conversions, AI with drones, etc.? How much information sharing is taking place to exchange capabilities?

• I don't believe any rapid advancements are occurring. We're beginning to explore different capabilities of these platforms, particularly in the realm of agricultural drones and their potential for CBRNE (Chemical, Biological, Radiological, Nuclear, and Explosives) applications, which could significantly enhance medical response efforts. However, we are still operating with a mindset rooted in 2018 when it comes to this technology.

Have we made any constitutional efforts to identify individuals without revealing their methods or means?

• When it comes to individuals, we must operate within our restrictions and constitutional guidelines. However, the foreign public serves as our first line of defense. Typically, someone in the community will notice something concerning that prompts them to reach out to law enforcement. The key mechanism is when a community member raises a concern that we can investigate. Ultimately, it requires someone to speak up about issues in their community. We've observed that premeditated and well-planned events occur less frequently these days. Instead, we are seeing more amateur attempts, which can be challenging to intercept. However, we have had success in making planning more difficult for potential threats and in extending the planning cycle. Preemption must occur at the local level. 

Colonel Edwards, could you discuss the use of a counter-UAS framework, including aerial countermeasures and counter-drone deployment, as well as broader swarm protection measures for soft outdoor targets?

• Swarming hasn't fully met technological expectations yet, but we have seen widespread distribution abroad. The ability to centrally command and control swarms is a significant advantage. If there are just a lot of drones in the air, it can be considered a flock. Once you are part of a program that understands drone capabilities and assessments, you'll reach a point where you can develop a technology strategy and subsequently build a mitigation strategy—current capabilities are maintained at the DOJ and DHS.

How important do you think capability training is? Should it take an all-hazard approach or focus on certain areas instead, using a generic approach?

• Yes, we're aware. And we can likely expect access to resources through regional response.

How important do you think capability training should be? Should it adopt an all-hazard approach or focus on specific areas?

• Efforts to date have been largely reactive. In the U.S., we accept a significant amount of risk for a relatively small reward. In terms of force preparedness, we are willing to take certain risks. However, the core issue remains reactive; we tend to focus on past incidents to prevent them from happening again.

• The military has the capabilities to prepare for all types of attacks, which are often greater than those available in the civilian sector. It's crucial to prioritize the training of responders to ensure they can safely handle each type of threat, particularly regarding personal protective equipment (PPE). 

• There is potential for improved military-civilian coordination in threat response; currently, the Reserves play a role in this effort. In a follow-up response, the National Center for Disaster Medicine and Public Health (NCDMPH) has been working on improving patient decontamination efforts and determining the most effective locations for decontamination procedures. A significant challenge arises from the fact that people may leave a scene before realizing they need decontamination. There are many factors to consider in these situations, and we must evaluate all associated risks.

In the United States, we have not yet seen a dirty bomb. Is that also true in other developed regions such as Europe, Australia, and Japan?

• We do not believe that this situation is the result of intentional actions by malicious individuals. However, we suspect that similar incidents could occur in the future. There is a significant fear of radiation during such events. For instance, during the Three Mile Island incident, no one was exposed to dangerous levels of radiation, highlighting that fear plays an important role in how we respond to nuclear threats.

How do you view the military operation and response in the context of persistent biological and radiological threats in the environment?

• In biological contexts, we often overlook the persistence of environmental threats. We also need to consider the roles of military and civilian entities in these scenarios. The coordination and timeline for responses will largely depend on the nature of the event and the level of risk we are willing to accept.

• Exercises would take place within NORTHCOM, coordinating with local law enforcement; however, we do not take the lead during peacetime. 

• Additionally, we must consider the persistence of biological threats within the population and the potential for biological agents to spread between individuals. The capabilities required to address these scenarios are generally viewed as an all-of-government response, as the threats do not solely affect either military or civilian sectors.

Have you noticed any ways in which AI has altered the risk landscape in your work with radiology and nuclear medicine?

• Radiology and nuclear threats are largely state-centric, making them less accessible. As a result, we have not seen AI disrupt the radiology and nuclear space significantly. Our primary concern lies with state-coordinated events.

Lower resource equipment can be expanded upon. While it decreases resource requirements, how significantly has it impacted the actual threat risk for true novel agents? What is necessary in terms of resources?

• From a resource standpoint it's not difficult to make a wide variety of chemical threats from basic chemistry lab supplies. However, we have not really seen many people doing this.

You mentioned specifically about surveillance before the boom or earlier. Will this include suspicious activity reporting and suspicious injury patterns, or is the approach more focused on whether practitioners should have greater awareness and an open-minded perspective when seeing patients with symptoms?

• I was referring more to identifying signals at a population level. From the healthcare professional side, it's hard to distinguish certain threats from the flu, for example, without diagnostics or detection.

Diseases often appear similar, which can make it challenging to assess changing threats and rising risks. As we consider the importance of strengthening our systems and relying on personal protective equipment (PPE) while engaging in various activities with different levels of risk in patient care, I wonder where we stand on implementing technology to enhance disinfection processes. How optimistic are you about our progress in this area?

• There are programs and research initiatives focused on aerosols and improving healthcare environments. This may involve detecting or eliminating threats in air ventilation systems or designing buildings to reduce the circulation of biological agents. Achieving these goals will require investments in healthcare infrastructure from the private sector. In terms of research, we should concentrate on developing personal protective equipment (PPE) and exploring the appropriate applications for various types of PPE.

Are there integrated systems or wastewater surveillance that provides real-time information to local health authorities in case of an incident? What might be occurring?

• This situation is not ideal, but such instances do occur. Systems are in place to detect threats, and these systems are used to identify patterns we have observed in the past. While there have been advancements in wearable technology, we are not yet at a stage where these can be effectively used for detection. However, they could potentially be combined with other data to enhance surveillance efforts.

Do any of our panelists or experts have information about the physical properties of aerosolized fentanyl?

• Not particularly, but check out: https://www.iarpa.gov/

Could you provide more details about the Maui fires that were discussed earlier?

• After the fires in Maui, the Microsoft Threat Analysis Center discovered AI-generated imagery that perpetuated a conspiracy theory linking the event to a U.S. weather weapon.

Could you discuss cognitive warfare and the concept of cognitive superiority?

• I’m not intimately familiar with these topics, but adversaries do not differentiate between the cyber domain and the misinformation domain. As a government, we have unnecessarily siloed ourselves in this regard. Cyber campaigns and social engineering are ultimately the same: both aim to influence someone to do or believe something. Furthermore, hospitals likely do not view these as separate domains.

I'm wondering if you would agree with the following statement: the way information is conveyed by the media has become increasingly rapid, less fact-based, and, in my view, less trustworthy. Additionally, from what I've heard from my colleague, it seems that there is a lack of clarity regarding which facts are actual facts. People are more inclined to believe what they see. Am I correct in this?

• Not everything reported by the media is trustworthy. In the case of a mass casualty event, strategic communications and the lack of information in uncertain situations are crucial and can be exploited by our adversaries. People who have information need a reliable way to share it quickly. It’s important to understand the most effective means of communication before taking action. Which media sources are trustworthy, and which ones will reach the appropriate audience? Trustworthiness is a complex issue, but it doesn’t mean individuals should refrain from speaking out; this is protected by our First Amendment rights.

• Communicating early and often, without speculation, is the best approach we can take.

When misinformation or disinformation spreads during an event, what should you do if this information is already circulating and people are starting to believe it?

• If misinformation arises, address and correct it promptly. While it may seem like you're drawing attention to false information, the priority should be to disseminate accurate information as soon as it becomes available.

Earlier today, we discussed upcoming events in the NCR, including large-scale events and several hospitals identified as facilities that would be used. How well prepared are they for a ransomware attack?

• The National Capital Region (NCR) consistently has various events taking place, and most of these events are very well organized. Hospitals in the area work closely with the federal government and D.C. emergency management to prepare for potential emergencies. Most hospitals have established plans in the event of an attack, with mutual aid arrangements in place to determine what actions can be taken during such incidents. This region conducts many tabletop exercises and training sessions, ensuring that personnel are familiar with their roles and know the appropriate contacts in emergencies. Additionally, the FBI is located nearby, which adds to the area's preparedness. However, our adversaries remain persistent, and while I believe we are well-prepared, we must acknowledge that anything can happen.

• A couple of years ago, there was a ransomware attack affecting hospitals in D.C. while we were hosting an important government event. Although this was likely coincidental, it's not far-fetched to imagine a scenario where such an attack could be intentional. Much of our infrastructure is vulnerable, and it doesn’t take a mastermind to coordinate an assault on critical facilities. It's concerning how exposed we are, and there is much information that the general public does not hear about.

• Most ransomware attacks are the result of coordinated efforts by organizations. While we have yet to see these kinds of coordinated attacks on healthcare systems, it’s important to note that no hospital in the U.S. could withstand a concentrated assault from a state actor. 

• In discussions about potential targets, it's worth mentioning that hospitals are not the primary concern; rather, the critical infrastructure located around them poses a greater risk.