Growing Foreign Threats to National Security, Part 2: Emergency Management Approaches and Choices

Part 1 of “Growing Foreign Threats to National Security” addressed challenges and highlighted four nation-state threat actors and their relevance to the emergency management practice. The next step is to prepare for and mitigate these threats at the state and local levels in partnership with federal agencies and private entities. External and internal factors influence the decision-making abilities and calculations of emergency management leaders. Given these threats and their potential implications, an initial emergency management approach could use the following methodology:

1. Increase understanding and awareness,
2. Evaluate urgency and criticality,
3. Maintain flexibility, and
4. Create a decision framework.

With the evolving and complex nature of this threat landscape and the constant changes within the broader context of emergency management, these steps may occur concurrently while continuously considering new, incoming information.

Increase Understanding and Awareness

There is an uneven awareness of nation-state threats and their impact on emergency response and preparedness among emergency management leaders and personnel. Unlike a natural disaster, which can more easily be dissected and researched, data for nation-state threats are simultaneously partially classified, owned by multiple entities, and reliant on national security perspectives and global political interests. Each emergency management organization across the U.S. has different levels of access and permissions to information about nation-state threats. However, much of the intelligence and relevant analysis necessary to address these threats is openly available, and the profession should not wait for either a massive personnel security clearance process or for the nation to solve the longstanding challenge of sharing information across multiple sectors, agencies, and professional disciplines.

While some form of nationwide effort to inform and educate the emergency management profession is necessary, each organization should find ways to inform their personnel as much as possible, as they would for any new potential hazard or threat to their communities. Skepticism about the threat’s relevance and a resistance to change are natural as the potential to redirect resources from current priorities becomes a compelling, but not necessarily optimum, option. Uninformed reactions to these threats and their implications impede effective preparedness and may unintentionally increase risks and vulnerabilities.

Evaluate Urgency and Criticality

The analysis of effects and implications of nation-state threats listed in Part 1 of this article should be customized to each jurisdiction. Once a better understanding of the threats and their implications are known for a specific jurisdiction, some methodology to include that information within the context of all that a jurisdiction prepares for is necessary. Realistically, initial decisions will be experience-based intuitive calls by the emergency management leader to determine if this is a “stop the presses” moment or if the data fall short of a crisis-level re-direction of resources and people. What should then follow are a deliberate analysis and thoughtful decision-making as to where the nation-state threat fits within the larger contexts of a community’s risk profile.

Existing tools and practices may assist in determining criticality and urgency in more deliberate ways. Agencies can consider inserting nation-state threat information into existing risk assessment tools, such as the Threat and Hazard Identification and Risk Assessment (THIRA) process; predictive analysis tools used by fusion centers; the Criticality, Accessibility, Recoverability, Vulnerability, Effect, and Recognizability (CARVER) model; and war-gaming or red-teaming exercises.

Another critical factor for emergency management decision makers to consider is the source of demands for action in response to nation-state threats. For example:

• Is the “boss” calling for this threat to be taken more seriously than others? Or less? (The perspectives of the governor, mayor, commissioner, chief, etc., might not align with their emergency manager’s assessment of where nation-state threats fit in the spectrum of resource and effort dedication, potentially creating friction between them.)
• Is action being called for by entities and agencies that, while influential, do not have direct authority over the emergency management organization? (For example, while a state’s military department, National Guard leaders, or law enforcement officials may call for the emergency management agency to pivot toward these threats, they may not have command and control over the agency, nor, in many cases, should they, just because of these threats.)
• Is the call for action coming from those who fund the emergency management organization? (If not, who has authority to redirect funding toward preparation for and mitigation against nation-state threats? Who is responsible for notifying the appropriators or funders of emergency management programs that an agency is shifting its resources?)
• Is grant guidance requiring it?
• Is grant guidance allowing it?

The quickness to act and the priority level of the threat, in some way, is driven by a combination of expert intuition, deliberate analysis, and external influencers. Each individual emergency management organization may evaluate these factors and respond differently from each other.

Maintain Flexibility

Complex problems require adaptable courses of action. A higher prioritization of resources to face immediate nation-state effects is obvious, such as a cyberattack on a dispatch center or misinformation disrupting an effective emergency response. Acting in the moment and making decisions during crises are traits of the emergency management profession. However, prioritizing resources to prepare for nation-state threats is more challenging, as it often involves re-directing an agency’s resources and focus in varying degrees, depending on the specific context of each threat to the jurisdiction and its ability to adapt.

The more difficult aspect of prioritizing in the face of nation-state threats is that the probabilities and severities of such incidents vary in type (vector and magnitude), space (location), and time (imminent or remote). So, while one jurisdiction might see the need for a complete pivot toward these threats in the near and long-term (e.g., Guam under missile threats), other jurisdictions might foresee little exposure or minimal community-wide impacts that would require any significant change in operations and organization. Therefore, federal and other “upper echelon” guidance should consider that, while there may be some baseline requirements for all jurisdictions, the actions necessary for each are context-dependent. Additionally, the fluid nature of nation-state threats requires that jurisdictions frequently re-evaluate their relative risk and emergency management priorities while maintaining their flexibility and adaptability.

Create a Decision Framework

Practical decision frameworks for complex situations do not need to be created from scratch. The Cynefin Framework and its area of research are particularly useful for the nation-state adversarial environment. It is a “sense-making” model that can help categorize potential decision paths yet be flexible as information and situations change. Following is an example of how this framework could be applied to the nation-state challenge.

Simple or Obvious

Some actions and techniques may be used in other areas that are also easily applied or modified for the nation-state context. Identifying simple and/or obvious efforts often reveals the easier and more cost-effective actions to prepare for, prevent, and mitigate consequences. Most of these decisions are in operational and tactical areas but not solely. Decisions about what is simple or obvious might include training and exercise adjustments with unique-scenario attributes of a nation-state attack, such as dealing with misinformation. Other simple or obvious areas might include reassessing the relationships that emergency management offices need to work with on these unique contingencies. For example, increased interactions with fusion centers and military authorities may be necessary. Conducting agency- or system-wide briefings on nation-state threats and implications can be easily developed to increase general awareness. Best practices usually exist within this sense-making stage that can aid in quick implementation. Efforts might include the following:

• Updating public information training modules to reflect current examples of nation-state influence operations and information interference to teach best, or smart, practices in responding to them.
• Updating and presenting threat and hazard briefings to the emergency management organization’s personnel, its partner agencies, and its stakeholders, including nation-state threat information and potential consequences.
• Including nation-state interference assessments as a required component of traditional situational awareness elements and briefings.

Complicated

Some activities and decisions require expertise or analysis not currently in place or not readily applied to the context of a nation-state threat. Tools and processes can be used or modified to better understand the potential implications and consequences of nation-state influences and attacks. Mapping or diagraming the vulnerabilities of essential supply chains or the cascading impacts of cyberattacks takes time and resources. Many processes already exist, but where this expertise lies may have to be discovered and employed. There are complicated but achievable actions that might include these examples:

• Requesting assistance from national laboratories to dissect and map out dependencies of critical infrastructures that might be targeted in nation-state attacks, such as is done by the Idaho National Laboratories All Hazards Analysis
• Determining which new essential elements of information regarding nation-state threats should be added to multi-hazard and intelligence fusion centers.
• Deciding what and when to include nation-state injects into traditional and scheduled exercises as well as when (and how) to resource and conduct nation-state specific scenario exercises.

Complex

Decision-making and difficult choices are often more time-consuming and resource-intensive when decisions involve interacting variables where uncertainty and evolution are constant. The players and actors in this domain may be new or have different roles than other traditional emergency management-related efforts in the context of nation-state threats. However, because the nation-state impacts and choices for the emergency management community might be considered “wicked problems,” the techniques used in complex decision-making would be appropriate. Complex choices would include discussions of doctrine and strategy:

• Are authorities “right-sized” and “right-applied” for nation-state threats?
• What level of wholesale organizational changes are necessary, if at all?
• What national systemic changes are necessary to prevent, mitigate, respond to, and recover from attacks?

Identifying complex challenges and issues helps guide the effort and investment required to improve, if not solve, them. Complex problem-solving takes more time, involves negotiation, anticipates uncertainty, requires trial-and-error processes, and demands adaptability and flexibility. Some examples of complex problems to address include the following:

• Deciding on the appropriate messages and public information campaigns for a community, given nation-state threats, uncertainties, and levels of information security.
• Figuring out and designating the “center of gravity” for preparing the U.S. and its communities for a nation-state threat environment at all levels of government. A closely related challenge of deciding who will be “in charge” at each jurisdictional level in events that cross disaster response, criminal investigation, and national security divides must also be considered.
• Postulating and assessing the cascading effects from a complex incident involving nation-state attacks and the potential vectors that an enemy could employ.

Chaotic

This area of the Cynefin Framework is where decisions and choices are made to stabilize a crisis in progress. Emergency management leaders may employ resources or dedicate agency focus without significant deliberation or input. “Do something” is a mantra for situations where lives might be jeopardized and no clear answers or past practices are evident. In this area, the application of authorities, such as imminent life-safety responses from military forces, may be required, which shortens the timeframe for the more deliberate request for a“Defense Support to Civilian Authorities” process. Examples include the following:

• Provide life-saving search and rescue after a kinetic attack on a population or soft target.
• Respond to critical and urgent shortages of medical or life sustenance supplies.
• Restore power to critical infrastructures such as trauma centers and first response facilities.

Disorder

When emergency management professionals are unsure of what type of nation-state threat they are dealing with (e.g., simple or complex), they may require more information, input, and deliberation. For example, does the response to election interference from a foreign actor have simple and obvious tactics, or are there complicated and complex areas as well? Disagreement and discussions among participants in this process about which domain an issue may best be placed in are actually very beneficial. Arguments encourage diverse views and opinions that often reveal new information and insights as well as create potentially innovative and novel approaches.

Regardless of the domain from which decisions and actions may come, it is also important not to solely rely on “worst-case scenario” planning, as this type of preparedness methodology may miss important nuances and consequences that fall short of a catastrophic threshold.

A final emphasis of the Cynefin sense-making model is the caution to not prefer or bias decisions in search of simple and obvious answers. Many of the issues that emergency managers deal with in the nation-state dynamic are not solved with existing practices or “silver bullet” ideas. Any one entity trying to force what they believe to be the “right” answer onto others can create more confusion and animosity, rather than beneficial solutions.

Making Choices

This discussion should help inform whether the profession or individual jurisdictions should take the path of gradual absorption of these threats into current efforts or demand a full pivot to different priorities, focus, and expenditures – or something in between these options. Identifying low-hanging fruit often found in the simple or obvious may be the most pragmatic and cost-effective initial path. At the same time, more complicated and complex choices demand greater collaboration and interaction with entities within and new to the traditional ecosystem of the emergency management profession.

The approach and frameworks presented in this article are intended to be a starting place for emergency management professionals and organizations. As such, further iteration and progress toward greater resilience and security against nation-state threats to our communities will need to follow.