Responding to Incidents 

of National Consequence

Recommendations for America's Fire and 

Emergency Services Based on the Events of 

September 11, 2001, and Other Similar Incidents

FA-282-May 2004

RESPONDING TO INCIDENTS OF 

NATIONAL CONSEQUENCE 

Recommendations for America's Fire and Emergency 

Services Based on the Events of September 11, 2001, 

and Other Similar Incidents 

This report was produced for the United States Fire Administration, Federal Emergency Management 

Agency under contract #EME-98-CO-0202 T018. Any information, findings, conclusions, or

recommendations expressed in this report do not necessarily reflect the views of the Federal Emergency 

Management Agency or the United States Fire Administration.

1 
2
TABLE OF CONTENTS

Table of Contents................................................................................................3 

Executive Summary............................................................................................7 

Introduction.......................................................................................................15 

Introduction............................................................................................................17 

Purpose...................................................................................................................19 

 Methodology..........................................................................................................20 

Overview of Report Reviews.................................................................................21 

Recommendations............................................................................................23 

Awareness/Prevention/Preparedness .....................................................................25 

 Initial Response......................................................................................................37 

Stabilized Event/Ongoing Recovery......................................................................66 

Postevent/Long-Term Recovery ............................................................................71 

Conclusions and Summary....................................................................................... 79

Conclusions and Summary ....................................................................................81 

Awareness/Prevention/Preparedness .....................................................................83 

 Initial Response......................................................................................................84 

Stabilized Event/Ongoing Recovery......................................................................86 

Postevent/Long-Term Recovery ............................................................................86 

Appendix A: Issues-Recommendations Checklist.........................................87 

Appendix B: Homeland Security Presidential Directive-5.............................95 

Appendix C: NIMS Fact Sheet for Emergency Response Agencies...........105 

Appendix D: FBI Interface ..............................................................................111 

Appendix E: Acronyms ..................................................................................115 

3 
4 
"Today our way of life, our very freedom came under attack in a series of 

deliberate and deadly terrorist acts... Today our nation saw evil, the very 

worst of human nature, and we responded with the best of America, with 

the daring of our rescue workers, with the caring for strangers and 

neighbors who came to give blood and help in anyway they could." 

– President George W. Bush, September 11, 2001 

5
6
EXECUTIVE SUMMARY 

EXECUTIVE SUMMARY 

The terrorist events in the fall of 2001 were unparalleled in our Nation's history and 

tested the capabilities of the local, State, and Federal emergency response resources 

beyond any incident or series of incidents to that point. Unfortunately, it may not be the 

last time such capabilities will be tested. Local, State, and Federal response agencies 

must learn from the experiences of those who dealt with the tragic events in New York, 

Virginia, Pennsylvania, and Florida to ensure that they are as prepared as possible for any

type of major emergency or disaster. 

The purpose of this report is to provide guidance to fire departments and emergency 

services across America to prepare for, respond to, and recover from major

multijurisdictional local incidents that have national consequences and may involve 

national resources. The issues and recommendations in this report were identified in 

various after-action reports and interviews with the leaders of the organizations that 

responded to, participated in, and managed these events. 

The incidents that were reviewed had many similarities and many differences. For 

example, the plane crashes at the World Trade Center (WTC) and the Pentagon can be 

characterized as fire-managed incidents with a nondiscretionary time element. The plane 

crash in Shanksville, Pennsylvania, and the anthrax incident in Boca Raton, Florida, can 

be characterized as law enforcement-managed incidents with a discretionary time 

element. Although all of the incidents were crisis events, the discretionary time element 

allows decisions and actions to be developed and implemented without the urgency of an 

environment that is considered imminently dangerous to health and life. Not all issues

identified were present at all of the incidents. Similarly, not all of the recommendations 

in this report will apply to all departments, nor will the priority order for implementation

be the same for all departments. 

The issues and recommendations in this report, as shown below, are prioritized in four

categories: Awareness/Prevention/Preparedness, Initial Response, Stabilized

Event/Ongoing Recovery, and Postevent/Long-Term Recovery.

7 
EXECUTIVE SUMMARY

AWARENESS/PREVENTION/PREPAREDNESS 

Area/ 

Priority 

Issue 

(Current Situation) 

Recommendation 

(Action Items) 

1 

A community may not have adequate 

resources to sustain a reinforced 

response to a major incident. 

Develop a local and regional capability to 

augment and sustain a reinforced 

response. 

2 

The response to a major incident may 

deplete local resources, while the 

population continues to experience 

typical emergencies. 

Develop a plan for continued public 

safety protection and service provision in 

a jurisdiction affected by a major 

incident. 

3 

Personnel may need to be recalled to 

duty during the early stages of a major 

incident. 

Develop a formal, organized policy for 

the orderly recall of organizational 

personnel.

4 

Departments or organizations from nonaffected jurisdictions may self-dispatch to 

the scene, leaving their own 

communities at risk. 

Develop an organizational policy to 

define/guide the deployment of 

personnel to assist other agencies in

time of crisis. 

5 

The size, scope, or complexity of an 

incident may overwhelm local 

emergency service resources. 

Develop statewide mutual-aid 

agreements for resource acquisition and 

deployment.

6 

Complete knowledge and accurate 

structural and hazard information about 

the incident site may not be readily 

available.

Complete and document an assessment 

on all target hazards. 

7 

The integration of local, State, and 

Federal resources may not occur 

effectively during a multiagency 

response to a major incident. 

Develop regular interagency planning

and training to improve large-scale, 

multiagency response and incident 

management. 

8 

During a major incident, traffic arteries

will become congested rapidly, delaying 

responding resources. 

Develop a coordinated traffic 

management and regional evacuation 

plan. 

9 

Untrained local citizens and community 

groups will attempt to help in times of

crisis. 

Develop and train supplemental 

community resources to provide initial 

assessment and assistance to public 

safety organizations. 

8
EXECUTIVE SUMMARY

INITIAL RESPONSE

Area/ 

Priority 

Issue 

(Current Situation) 

Recommendation 

(Action Items) 

1 

During a major incident, unrequested

personnel and equipment arriving to offer 

unsolicited assistance will create 

confusion, congestion, uncoordinated

operations, difficulties in planning, and 

increased hazards to responders. 

Develop a policy to control requested 

and nonrequested resources and 

eliminate freelancing of public safety 

resources. 

2 

Interagency communication and 

coordination may not be effective during 

a multiagency incident. 

Establish a Unified Command function 

as soon as possible after the initial 

response. 

3 

Specific communication and coordination 

between the Unified Command Team 

and the Federal Bureau of Investigation 

(FBI) may not be effective during a 

terrorist event. 

Follow the established procedures for 

the FBI integration into a Unified 

Command structure to manage the 

consequences of a terrorist event. 

4 

Responders are considered targets in 

terrorist incidents. 

Develop the capability and policy for

scene security that includes perimeter 

control, force protection, and responder 

credentialing. 

5 

Operational boundaries may not be 

effective enough to ensure protection of 

both responders and civilians. 

Develop local response capability to 

implement control zones quickly. 

6 

Convergence of apparatus too close to 

the incident site may impede site access 

for needed apparatus and resources. 

Identify remote staging areas in the 

recall/response policy.

7 A major incident can result in a high 

number of injuries and casualties. 

Develop a multicasualty/multipatient 

incident capability. 

8 

Responders and the public may be 

exposed to multiple hazardous 

contaminants during a major incident. 

Develop risk-based capability to rapidly 

decontaminate responders and large 

numbers of civilians. 

9 

Major incident sites pose multiple health 

hazards to responders, civilian 

volunteers, and the general public.

Develop a continuous and 

comprehensive hazard monitoring 

capability for the incident site and the 

community, as indicated.

9
EXECUTIVE SUMMARY 

INITIAL RESPONSE (cont'd)

Area/ 

Priority 

Issue 

(Current Situation) 

Recommendation 

(Action Items) 

10 

Communication may be hampered 

during a major incident because 

decisionmakers are located in multiple 

areas. 

Use the highest-ranking official present 

to serve as a link among the decisionmaking entities. 

11 

The specific operational responsibilities 

of multiple agencies may not be 

coordinated effectively during a major 

incident. 

Develop an efficient and effective Unified 

Operations capability. 

12 

Normal methods of communicating 

between units or agencies may not exist 

during a major event. 

Develop a comprehensive 

communications plan to address initial 

cell phone overload and potential radio 

interoperability among responding 

mutual-aid organizations. 

13 

Major incidents are multifaceted and may 

require a significant amount and/or type 

of resources not routinely available for 

day-to-day operations. 

Develop a robust incident logistics 

capability. 

14 

Forecasting actions needed to 

coordinate activities and resources 

effectively may not be available during a 

major incident. 

Develop a robust incident planning 

capability. 

15 

Responders tend to focus only on 

immediate aspects of the incident, and 

may not be aware of related critical 

information. 

Develop a means to keep incident 

responders updated with credible 

information about additional threats and 

events outside the immediate scene.

10
EXECUTIVE SUMMARY 

STABILIZED EVENT/ONGOING RECOVERY 

Area/ 

Priority 

Issue 

(Current Situation) 

Recommendation 

(Action Items) 

1 

State and Federal agencies involved with 

the management of events may not have 

an understanding of the roles, 

responsibilities, and capabilities of those 

other agencies involved. 

Develop a plan to integrate State and 

Federal assets into an established

incident management system. 

2 

Horrific incidents can have a significant 

psychological impact on responders.

Develop and implement a plan to provide 

Critical Incident Stress Management 

(CISM) to responders early in the 

incident. 

3 

Outpouring of citizen contributions can 

overwhelm an already taxed response 

system. 

Develop and implement an effective 

management structure to receive, 

inventory, organize, distribute, and 

account for large-scale donations and 

manage civilian volunteers. 

4 

The local jurisdiction will be inundated

with requests from the public for 

information. 

Develop a plan to manage the volume of 

inquiries about the well-being of both 

responders and victims and to 

coordinate family notification of 

emergency worker fatalities. 

11
EXECUTIVE SUMMARY 

POSTEVENT/LONG-TERM RECOVERY 

Area/ 

Priority 

Issue 

(Current Situation) 

Recommendation 

(Action Items) 

1 

The responsibilities for managing 

different stages of major incidents will 

vary among agencies. 

Develop local doctrine to ensure the

proper transfer of command as dictated 

by incident needs. 

2 

Adequate and appropriate information 

about all aspects of incident response 

may be difficult to identify, document, 

and maintain. 

Develop a mechanism to maintain the 

most complete and accurate incident 

response information possible. 

3 

A major incident has the potential to 

have a significant long-term financial 

impact on a department and on the 

overall economy of the local area. 

Maintain a capability to rapidly hire and 

train replacement firefighters and EMS 

providers and obtain replacement 

apparatus and equipment in order to

continue providing adequate public 

protection, even during difficult economic 

times. 

4 

A major incident has the potential to 

have a significant long-term health 

impact on a department's members and 

on the citizens of the local area. 

Recognize the need to initiate medical 

evaluation and follow up for responders, 

as well as long-term health monitoring, 

following a major incident. 

12
EXECUTIVE SUMMARY 

A prioritized checklist showing the issue, the corresponding recommended action(s), and 

whether the action should be a short-, medium-, or long-term priority for the 

implementing agency or department can be found in Appendix A. 

While the after-action reports and interviews were completed primarily in 2002, this 

report was completed after the Department of Homeland Security (DHS) was created

formally, and after the release of both the Initial National Response Plan (INRP) and the 

National Incident Management System (NIMS) in 2003. The premise behind the INRP 

and the NIMS can be found in Homeland Security Presidential Directive-5, found in 

Appendix B. A fact sheet on the NIMS, as it relates to emergency response agencies, can 

be found in Appendix C. 

It is clear from the research that went into this report that the successful management of a

major multijurisdictional local incident that has national consequences and may involve 

national resources requires: 

• rapid implementation of the Incident Command System (ICS), transitioning into a 

Unified Command structure; 

• a Unified Operations Section that includes deputies to coordinate tactical

operations across all disciplines; 

• strong Planning and Logistics Sections for forecasting the need for and acquiring 

resources; and 

• close interagency coordination and cooperation before, during, and after an 

incident. 

These are all areas that are addressed in the NIMS. All Federal, State, and local agencies

must comply with the NIMS, specifically with the use of the ICS to manage major and/or 

complex incidents. The USFA has worked with the FBI to ensure that local fire and 

emergency service agencies understand how the FBI fits into the Unified Command 

structure during terrorist incidents. An ICS chart with this FBI interface is found in

Appendix D. 

13
EXECUTIVE SUMMARY 

A list of the acronyms used in this report can be found in Appendix E. 

Web sites listed in this report are subject to change without notice. The reader may need 

to contact the appropriate agency for current information. 

14
INTRODUCTION 

SECTION 1: 

INTRODUCTION

15 
INTRODUCTION 

 

16
INTRODUCTION 

INTRODUCTION 

On September 11, 2001, at 8:46 a.m. (EDT), hijacked American Airlines Flight 11 

crashed into the north tower of the World Trade Center complex (WTC 1) in New York 

City. The Fire Department of the City of New York's (FDNY) First Battalion Chief

witnessed the first crash. He established the Incident Command Post (ICP) in the lobby of 

WTC 1 at approximately 8:50 a.m. The ICP was moved out of the lobby when the Chief 

of the Department assumed the role of Incident Commander (IC). Initial efforts focused

on rescue and evacuation. Firefighters began ascending the tower to help those trapped. 

Chief officers considered a limited, localized building collapse possible, but no one 

thought the building would collapse entirely. At 9:03 a.m., hijacked United Airlines 

Flight 175 hit the south tower of the World Trade Center complex (WTC 2). WTC 2 

collapsed at 9:59 a.m., killing many civilians and responders and destroying the ICP. 

WTC 1 collapsed at 10:29 a.m., killing members of the Command Staff, including the 

Chief of the Department, temporarily leaving the incident without a clear command 

structure, and creating an incident of a magnitude and scope that had never been faced 

before. 

At 9:38 a.m., hijacked American Airlines Flight 77 hit the Pentagon. When this plane hit, 

it was obvious that the United States was under a terrorist attack. The crash was 

witnessed by the crew of Arlington County (Virginia) Fire Department (ACFD) Engine 

101 enroute to a training session. The engine Captain reported the crash to the Arlington 

County Emergency Communications Center (ECC) and advised them to notify the FBI. 

Firefighters from the Fort Myer Fire Department station located at the Pentagon close to 

the impact point reported the actual location of the crash and began helping victims out of 

the first floor windows. The first ACFD personnel arrived at the Pentagon within 2 

minutes of the attack. Command was established within 4 minutes. Within 5 minutes of

impact, the Metropolitan Washington Airports Authority (MWAA) Fire Department at

Ronald Reagan Washington National Airport had fire and medical units on scene and the 

first FBI contingent arrived. By 10 a.m., most of the ACFD duty shift was engaged at the 

Pentagon. 

17
INTRODUCTION 

As the country watched the events in New York City and the Pentagon unfold on 

television in awe and horror, United Airlines Flight 93 crashed in a field near 

Shanksville, Pennsylvania, at 10:06 a.m. Three departments were dispatched initially to 

the crash site. The first-arriving Shanksville Volunteer Fire Company (SVFC) was aware 

of the attacks that were being carried out nationally, and they actually heard the aircraft 

hit the ground. On arrival, the SVFC Assistant Chief, who was riding on the first 

apparatus to arrive, requested five additional fire companies and all available Emergency 

Medical Services (EMS) units from Somerset and Cambria counties. 

The initial focus was fire confinement activities and removal of occupants. Upon

surveying the area, the SVFC Assistant Chief determined there were no survivors and 

tried to abort the request for the EMS ambulances from Somerset and Cambria counties.

This attempt was unsuccessful. When the FBI arrived, they declared the incident a crime 

scene and assumed control of the incident, establishing the ICP in a vacant building in a 

nearby mining operation. 

On October 2, 2001, as Americans were still reeling from the events of the previous

month, an employee of American Media, Inc. (AMI) was admitted to a Boca Raton,

Florida, hospital near death. On October 4, 2001, he was diagnosed with inhalation 

anthrax. On October 5, 2001, he died. On October 6, spores were found on the dead 

man's computer. A second AMI worker was admitted to the hospital and diagnosed with 

inhalation anthrax on October 8. At that point, the FBI established command, sealed the 

AMI office, and began a formal investigation. With a third worker (the second from the 

AMI mailroom) testing positive on October 10, the first suspicions arose that the source 

was a letter received at the AMI building. By October 13, at least six workers had tested 

positive for anthrax and were on antibiotics. Additional letters began to appear in other 

parts of the country. Before the end of the month, tainted letters would appear in New 

York City and Washington, DC, and diagnosed cases would appear in Trenton, New

Jersey, New York City, and Washington, as well as Boca Raton. 

18
INTRODUCTION 

The Boca Raton Fire Rescue and the Palm Beach County Department of Health

supported the FBI investigation by collecting and analyzing samples. This incident 

developed slowly, allowing participating agencies discretionary time to assess risks, 

problem-solve, and formulate strategies for subsequent operations. 

The events in the fall of 2001 were unparalleled in our Nation's history and tested the 

capabilities of the Federal, State, and local response resources beyond any incident to that 

point. Although the fire service had faced the majority of the individual aspects of these 

events in other incidents, the size, scope, and combination of many of those aspects had 

never been managed previously (i.e., resource needs, accountability, etc.). Several fire

departments involved in these incidents faced issues and challenges they had never faced

before, including recall of entire departments, an unprecedented number of simultaneous

line-of-duty deaths, family support for the responders lost, and managing an 

overwhelming volunteer response from both responders and the public. Finally, there 

were aspects, such as securing the perimeter, responder health and safety, influx of 

support resources, and compromises to the infrastructure, which took on new and 

different dimensions and priority. 

PURPOSE 

Several after-action reports have been written on the individual incidents from different 

perspectives. These reports detail various aspects of the events, the response, the 

timeline, the challenges, and the recommendations. This report will not review what is 

already covered in existing after-action reports. It is based on a review of those reports 

and the input of the senior leaders who were involved in the management of the incidents. 

The purpose of this report is to provide guidance to fire departments and emergency 

services across America to prepare for, respond to, and recover from major multijurisdictional local incidents that have national consequences and may involve national 

resources. 

19
INTRODUCTION 

METHODOLOGY 

The first step in developing the recommendations in this report was to review the relevant

after-action reports to compare and contrast the findings and identify the challenges

common to the events. The following are some of the after-action reports that were 

reviewed. 

• McKinsey & Company, Increasing FDNY's Preparedness;

• Titan Systems Corporation, Arlington County After-Action Report;

• Rand, Protecting Emergency Responders: Lessons Learned from Terrorist 

Attacks; and

• Grant, N., Hoover, D., Scarisbrick-Hause, A., Muffet, S., Terrorism in

Shanksville: A Study in Preparedness and Response (Quick Response Research 

Report #157). 

The internal United States Fire Administration (USFA) reports that were reviewed are 

• Pre-Event Customized Training for Mass Gatherings and Multiple Incident 

Events--After-Action Report of Effects of Executive Analysis of Multi-Venue 

Operations and EMS Special Operations Training for 2002 Winter Olympics, 

February 8-25, 2002; and 

• United States Fire Administration's Role in Addressing the Issues Identified from

the September 11, 2001 Terrorist Attacks--Post-9/11 Briefing, May 31-June 1, 

2002.

In addition to reviewing written reports, interviews were conducted with senior leaders of 

the responding departments and agencies. The following are gratefully acknowledged for

their willingness to give of their time, honesty in answering questions, and providing 

their perspective, suggestions, and recommendations to assist other organizations in 

preparing to deal with an event of this magnitude: 

Arlington County Fire Department

Ed Plaugher, Fire Chief 

James Schwartz, Assistant Chief 

Boca Raton Fire Rescue

Jack McCartt, Deputy Chief 

20
INTRODUCTION 

Fire Department of the City of New York 

Frank Cruthers, Chief of Department 

Stephen Gregory, Assistant Fire Commissioner for Communications 

Peter Hayden, Assistant Chief of Operations 

Harold Meyers, Assistant Chief, Manhattan Borough Commander 

Joseph Pfeifer, Deputy Assistant Chief, Planning 

Robert Ingram, Battalion Chief, Hazardous Materials Operations 

John Norman, Battalion Chief, Special Operations 

Michael Canty, Battalion Chief

Shanksville Volunteer Fire Company 

Terry Shaffer, Fire Chief 

Rick King, Assistant Chief 

U. S. Forest Service Southwest Incident Management Team 

Dan Oltrogge, Incident Commander

Paul Summerfelt, Planning Section Chief 

 

OVERVIEW OF REPORT REVIEWS 

Each of the incidents was managed differently. The Assistant Chief initially managed the 

incident in Shanksville, and was succeeded by the Fire Chief, using a partial activation of 

the ICS structure. The FBI assumed control of the incident at approximately 1 p.m. The 

Pentagon crash in Arlington County was a locally managed event using Unified 

Command. The ACFD served as the spokesperson for the first 10-day fire-and-rescue 

phase of the incident. The FBI assumed control of the incident on September 21. The 

WTC events were coordinated through the existing New York City emergency 

management system by local agencies with the help of mutual aid and Federal agencies. 

 

Although each event involved unique circumstances, they shared many common 

challenges. Although not all-inclusive or prioritized, these challenges included 

• multiagency/multijurisdictional participation involving Federal, State, and local 

agencies; 

• expanded Incident Command; 

• traffic congestion and response routes; 

• overwhelming, unsolicited emergency worker response--self-dispatching and 

freelancing; 

21
INTRODUCTION 

• large-scale/multiagency personnel accountability; 

• short- and long-term health and safety issues for responders, including personal 

protective equipment (PPE), air monitoring, and stress management; 

• establishing and maintaining outer and inner perimeter control; 

• interagency interoperability, including "trust" factor; 

• equipment interoperability; 

• communication issues, including hardware, interpersonal, interagency, and system 

overload; 

• logistics, including obtaining, managing, and tracking resources, and long-term

logistical support; 

• integration of EMS into the ICS structure, including patient tracking; 

• managing civilian and business donations; 

• issues related to interaction with the Emergency Operations Center (EOC); 

• lack of familiarity with the Federal Response Plan (FRP); 

• compromised or impaired infrastructure; 

• national airspace closed to civilian aircraft; 

• lack of current information related to ongoing/potential new attacks; and 

• lack of intelligence sharing among agencies. 

The issues and recommendations that follow are based on these common challenges and 

insights provided by those interviewed for this report. The remainder of this report 

outlines these issues and recommendations prioritized in a chronological manner, using 

the following structure: 

• Awareness/Prevention/Preparedness; 

• Initial Response; 

• Stabilized Event/Ongoing Recovery; and 

• Postevent/Long-Term Recovery. 

Each recommendation includes some suggested approach(es), including what has been 

done by the agencies that responded to the September 11, 2001, incidents. 

22
RECOMMENDATIONS

SECTION 2: 

RECOMMENDATIONS

23 
RECOMMENDATIONS

24 
RECOMMENDATIONS

AWARENESS/PREVENTION/PREPAREDNESS 

ISSUE: A community may not have adequate resources to sustain a 

reinforced response to a major incident. 

The implications of the attacks of September 11, 2001, were not focused solely on the 

incident sites. As FDNY and ACFD escalated the response to the sites, the community 

continued to experience the usual background call load and the typical variety of requests 

for assistance that those jurisdictions handle on a daily basis. With so many of the 

regular response and supervisory resources assigned to the WTC and Pentagon sites, 

these two communities struggled on two fronts: the crisis response to the incident sites 

and replenishing resources to provide normal community services and protection. Both 

FDNY and ACFD relied on recall of personnel and mutual-aid departments for

equipment and personnel for the crisis response and the continuation of community 

services. 

Additional equipment, supplies, and personnel may be needed sooner than regional or 

State mutual aid can arrive on scene. Some Federal assets and support may not arrive on 

scene for up to 72 hours. This delay was particularly apparent in New York. With the air 

transportation system shut down, some Federal resources had to drive long distances to 

the site. The delay was less apparent at the Pentagon. Although in Arlington there was a 

delay in getting some resources and getting key department personnel back, many 

Federal resources, such as Urban Search and Rescue (US&R), were within a short driving 

distance of the incident and were incorporated early into the incident management. 

Members of the New York US&R Task Force were part of the fire department's initial

response to the incident and were among the casualties when the towers collapsed. Offduty US&R members later responded and worked together with the other Federal US&R 

Task Forces when they arrived. 

25 
RECOMMENDATIONS

RECOMMENDATION: Develop a local and regional capability to augment 

and sustain a reinforced response. 

Develop an immediate incident support capability to bridge the gap between the request 

and the arrival of mutual-aid resources. Following the response to the Pentagon, ACFD 

began working to develop what they term a regional Mobile Incident Support Team

(MIST). This team would provide (among other things) chief officers familiar with local 

operational policies, air supply, flashlights, and radios (with spare batteries) to provide a 

3- to 8-hour support package for incident operations, as well as supervision for backfilling community coverage. In other areas, this concept might involve building a local or 

regional cache of equipment that might be needed, but not immediately available for up 

to the first 24 to 72 hours of an incident. 

FDNY has logistical support units prepositioned throughout the city. During major 

incidents, the units provide necessary air supply, lighting, fuel, and other logistical needs. 

FDNY's command structure requires that senior chief officers be notified of escalating 

incidents; they then respond to the FDNY Operations Center. Availability of remaining 

resources and the service needs of the rest of the city are monitored from the Center.

Through a Memorandum of Understanding (MOU) with the United States Forest Service 

(USFS), the department received ICS training to form two, 28-person Incident 

Management Teams (IMT's) to improve their large incident management capability. 

ISSUE: The response to a major incident may deplete local resources,

while the population continues to experience typical emergencies. 

The emergencies experienced by the residents and visitors in a particular area will 

continue to occur during the response and recovery efforts associated with a major event. 

People still will experience vehicle crashes, medical problems, fires, and situations 

requiring law enforcement interventions. ACFD used mutual-aid resources both at the 

incident site and teamed with local personnel to cover the remainder of the county. 

26
RECOMMENDATIONS

FDNY implemented a similar plan and was able to maintain coverage with existing 

personnel and apparatus coupled with pairing of mutual-aid resources. 

A jurisdiction's ability to provide services may not be wholly dependent on acquiring

additional apparatus and personnel. It may require the repair or rebuilding of, or

adaptation to, a compromised infrastructure. For example, in New York City, the collapse 

of the WTC destroyed a major telephone switching station, compromising the 

communication infrastructure. 

RECOMMENDATION: Develop a plan for continued public safety protection 

and service provision in a jurisdiction affected by a major incident. 

Establishing mutual-aid agreements with all surrounding jurisdictions is one approach to 

assuring continued public safety protection. The regional support team approach being 

developed in the Arlington area is another approach. The mutual-aid agreements being 

developed by FDNY would team mutual-aid personnel with FDNY units and use them

primarily to fill fire stations. They will respond as a team under the direction of an FDNY 

officer. Jurisdictions also should develop plans to assure continued access to government

services, such as the phone system or utilities, during periods of infrastructure

compromise.

ISSUE: Personnel may need to be recalled to duty during the early stages 

of a major incident. 

Both ACFD and FDNY experienced problems with the recall of personnel. Recall lists 

were outdated. Many personnel responded independently. The official communication 

system used for the recall was overloaded. Many television and radio stations broadcast 

unauthorized requests for first responders. In addition, many personnel reported directly

to the incident, instead of to a mobilization point.

27
RECOMMENDATIONS

Without a formal recall policy, first responders may elect to self-dispatch to a local, nearby, or nationally prominent event. Organizations have a finite number of personnel. 

There must be a defined, orderly, and practiced policy for personnel use during a crisis 

event. 

RECOMMENDATION: Develop a formal, organized policy for the orderly 

recall of organizational personnel. 

As a result of their response to incidents on September 11, 2001, both ACFD and FDNY

have recognized the necessity for a formal and exercised recall policy. A recall system

should 

• provide for contact of off-duty employees using an accurate list of telephone 

and/or pager numbers; 

• include alternative options for officially notifying personnel, e.g., public service 

announcements with authorized information, including a specified reporting 

location; 

• provide for access to individual PPE; and 

• define a reporting location. 

To increase the effectiveness of personnel recall following the September 11, 2001, 

incident, FDNY implemented a resource capability matrix. Using the matrix, the specific 

numbers of firefighters and officers required to meet the department needs can be

identified and recalled. This results in more efficient resource use and improved 

command and control. Agreements with the media have been developed to assist the 

department in a coordinated notification process. 

28
RECOMMENDATIONS

ISSUE: Departments or organizations from nonaffected jurisdictions may

self-dispatch to the scene, leaving their own communities at risk. 

All three September 11, 2001, responses were faced with managing unrequested 

resources. Some organizations sent resources and personnel, disregarding local mutualaid agreements. Many others sent resources without a formal request for assistance. 

Individuals responded without being requested and, in many cases, without the 

permission of their employing organization. Sending independent and unanticipated 

resources overloads the receiving jurisdiction, creates a significant problem for personnel

accountability, increases liability, and has the potential to strip a jurisdiction of public 

safety resources that may be required at home during a follow-on incident. 

RECOMMENDATION: Develop an organizational policy to define/guide the 

deployment of personnel to assist other agencies in time of crisis. 

An organization is responsible both for protecting its own jurisdiction and for ensuring 

the safety of employees when they are sent to assist other agencies. A public safety 

organization exists to protect and serve its constituents. The safety of employees is a 

paramount responsibility of the employing organization. Organizations should be 

participants in mutual-aid agreements before sending resources and/or employees to

assist other agencies. The framework of a formal mutual-aid agreement provides 

guidelines for assisting other jurisdictions, ensuring continued services to constituents, 

and tracking deployed employee accountability. 

ISSUE: The size, scope, or complexity of an incident may overwhelm local 

emergency service resources. 

Mutual aid is a way of life in many rural areas. Somerset County, Pennsylvania, and the 

Somerset County Emergency Management Agency regularly schedule and conduct masscasualty exercises. Therefore, the local and State responders at the Shanksville crash 

29
RECOMMENDATIONS

were familiar with one another and respected the professional capabilities of their fellow 

responders. However, both the local and national responders failed to understand the

impact of their actions on the other's responsibilities until the incident had progressed. 

Once this occurred, the FBI offered support that the local jurisdiction would otherwise 

not have received. For example, the FBI helped local responders complete an MOU with

the U.S. Department of Health and Human Services (HHS), which enabled the 

deployment of the Disaster Morgue Team (DMORG) and the assumption of many of the 

expenditures associated with the recovery operation. This was extremely important, since 

Shanksville was never declared a disaster site and was not eligible for Federal disaster

relief monies. 

As a result of regular interagency training and exercises, ACFD was aware of the 

capabilities and resources of their mutual-aid organizations. This allowed them to tap

into neighboring Fairfax County Fire and Rescue Department's logistics expertise and use

that expertise to begin managing the logistics needs, train their own department

personnel, and assure appropriate documentation for Federal reimbursement. 

Although FDNY had mutual-aid agreements in place at the time of the incidents, they 

usually provided mutual aid to other departments. Thus, when they requested aid, it was 

nonspecific and they were not aware of the responding organizations' resources and 

capabilities. Since the incident, the department has initiated meetings to develop 

memoranda of agreement/understanding with adjoining counties. These agreements will 

describe the policies, procedures, response activation, reporting locations, accountability,

tactical ICS organization, communication procedures, and other requirements for safe, 

effective mutual-aid response. 

RECOMMENDATION: Develop statewide mutual-aid agreements for 

resource acquisition and deployment. 

The NIMS addresses the importance of mutual-aid agreements in creating a defined and 

organized process that will help quantify anticipated resources. This includes apparatus 

30
RECOMMENDATIONS

"typing" as well as qualification, certification, and credentialing of individuals. 

Formalized agreements should define 

• financial compensation for participating agencies; 

• the parameters for worker compensation and other insurance issues; and 

• the foundation for eliminating/controlling the self-dispatching of responders and

resources to an incident. 

One proven approach is the Florida Fire Chiefs' Association State Emergency Response 

Plan (SERP) developed after Hurricane Andrew in 1992. A statewide mutual-aid

agreement is a foundational part of this Plan. It has been incorporated into Florida's

terrorism response planning. This plan can serve as a template for regional and statewide 

resource deployment. The SERP can be accessed at: 

 http://ffca.org/forms/2002_SERP.pdf 

Florida's philosophy of terrorism response can be accessed at: 

 http://www.myflorida.com/myflorida/domestic_secruity/index.html

The Florida Department of Law Enforcement Web site contains additional information 

on Florida's response preparations. Publicly available information can be accessed at: 

http://www.fdle.state.fl.us/publications/anti-terrorism.pdf

ISSUE: Complete knowledge and accurate structural and hazard

information about the incident site may not be readily available. 

ACFD did not have detailed structural drawings of the Pentagon available or access to 

any building engineers. As a result, breaching the roof ahead of fire involved a great deal

of guesswork. 

The FDNY routinely uses construction blueprints, as well as onsite building management

personnel who serve as "technical specialists," in its response to emergencies in 

commercial and highrise structures. 

31
RECOMMENDATIONS

RECOMMENDATION: Complete and document an assessment of all target 

hazards. 

Departments should have building details with hazards preidentified and site drawings 

available at the incident to provide responders with critical and accurate information. The

need to understand building features and hazards has been well documented, and the fire 

service has used fire preplanning programs for many years. 

One of the challenges faced by civilian emergency workers responding to military

facilities is gaining knowledge of the portions of the structure(s) that contain classified 

(government or research) information. Civilian responders must accept that there may be 

instances when they are denied access and certain property may be sacrificed to protect 

national security. However, developing good professional relationships with appropriate

personnel in access-restricted facilities will provide local organizations with the best 

possible technical assistance if an incident should involve that facility. 

Since September 11, 2001, FDNY has enhanced risk assessment to include potential 

terrorist targets and now continuously assesses vulnerability at priority sites in the city. A 

building database includes information on commercial, highrise, and structures that have

been altered in any way that could affect safety and/or operations (e.g., mixed 

construction, special life hazards, and unusual avenues of fire spread). Dispatchers can 

access the information through the Critical Information Dispatch System (CIDS)

program. The information also can be accessed through mobile data terminals (MDT) and 

digitally. Staging locations, evacuation routes, means of transportation, and sheltering 

facilities throughout the city are analyzed based on new information. In addition, the 

department is developing Incident Action Plans (IAP) for special events and priority

sites. 

32
RECOMMENDATIONS

ISSUE: The integration of local, State, and Federal resources may not occur 

effectively during a multiagency response to a major incident. 

Regular multiagency exercises and preexisting professional relationships enabled ACFD 

to incorporate mutual-aid departments rapidly and implement a Unified Command 

function that integrated local, State, and Federal resources into a sustainable operational 

posture. The benefit of exercising existing plans also is noted in the Shanksville response. 

The local agencies' members were very familiar with each other and the resources

immediately available in the area. As State and Federal resources assembled on the site,

the relationships that were forged in previous responses served the local community well. 

The Office of Emergency Management is the city agency responsible for conducting 

large-scale interagency exercises. The exercises are designed to test the city emergency

response plan. The FDNY had not participated in any recent interagency drills prior to 

September 11, 2001, due to scheduling differences among the city agencies. 

RECOMMENDATION: Develop regular interagency planning and training to 

improve large-scale, multiagency response and incident management. 

When a large incident occurs, numerous outside resources will converge on the scene. 

Two critical components of managing outside resources are the effective integration of 

those resources into a successful response and the interrelational aspect of agencies and 

personnel responsible for incident management and scene actions. 

Regular exercises and preestablished relationships provide the foundation for a cohesive 

local response. Another way to express this is within the framework of trust. Exercising 

established plans should include representatives of local fire, EMS, and law enforcement

agencies, as well as State and Federal agencies likely to be involved in a major incident. 

In particular, the FBI should be invited and encouraged to attend and participate. 

33
RECOMMENDATIONS

Following September 11, 2001, FDNY developed an interagency training approach using 

tabletop and field exercises. The exercises have clear objectives and are monitored by 

outside observers. Both monitors and agency participants write after-action reports. Any

identified deficiencies are analyzed and corrected. Lessons learned are published and 

plans are revised as needed. 

ISSUE: During a major incident, traffic arteries will become congested 

rapidly, delaying responding resources.

ACFD experienced two significant challenges in traffic management when the roads

around the Pentagon were closed. The first challenge occurred when all the Federal 

departments closed. The mass exodus of employees from the District of Columbia that

resulted from the closing was not coordinated with the Virginia Department of 

Transportation (VDOT). Although no major problems arose, the lack of coordination 

could have resulted in one jurisdiction directing evacuating traffic into another 

jurisdiction's roadblocks. 

The second significant challenge arose as the incident extended over time. No one fully 

recognized the impact of isolating a Federal property that functioned as part of the VDOT 

network. Over the years, the Pentagon had become an unofficial "Slug Line" transfer 

point. A Slug Line is a designated location where motorists stop and pick up additional 

riders to transport to a designated drop off point in the District in the morning. The 

process is reversed in the evening. This civilian-initiated innovation to deal with traffic 

volume and lack of parking in the District has operated for many years and, literally, 

provides the means for thousands to commute efficiently throughout the area each 

business day. 

In New York, traffic congestion and gridlock impeded the response by FDNY, as well as 

mutual-aid and Federal resources responding into New York.

34
RECOMMENDATIONS

RECOMMENDATION: Develop a coordinated traffic management and 

regional evacuation plan. 

In all probability, a major incident will have an impact on the transportation infrastructure 

of a community. Without an evacuation/traffic plan, it is likely that one jurisdiction 

would unknowingly route traffic into another jurisdiction that was not anticipating the 

additional traffic. Traffic flow must be coordinated with neighboring jurisdictions as well 

as the State Department of Transportation. 

During preparation for the 1996 Atlanta Olympic Games, it was discovered that one

jurisdiction was planning on defining specific one-way streets that ended up in another 

jurisdiction that had designated the same artery as a one-way street in the opposite 

direction. This potential problem was resolved through a cooperative planning effort. 

Every jurisdiction's street maps were produced to the same scale and combined to form a 

composite road map that was distributed throughout the Olympic Theater. 

In planning for the 2002 Winter Olympics, the Utah Department of Transportation 

(UDOT) worked closely with the Utah Olympic Public Safety Command (UOPSC) to 

coordinate traffic throughout the Olympic Theater, including implementation of the 

Intelligent Transportation System and the Commuterlink dispatch center. 

ISSUE: Untrained local citizens and community groups will attempt to help 

in times of crisis. 

Community Emergency Response Teams (CERT's) made up of local civilian volunteers 

are an excellent source of help. CERT's can serve as an important supplement to police, 

fire, and EMS. 

California pioneered the CERT concept in the United States many years ago. The value 

of this community resource has been proved repeatedly during floods, earthquakes, and 

35
RECOMMENDATIONS

mudslides in that State. CERT's allow neighborhoods to initiate care of themselves. This 

could alleviate some of the urgency felt by public safety organizations in the hours and 

days immediately following a major event. 

RECOMMENDATION: Develop and train supplemental community

resources to provide initial assessment and assistance to public safety

organizations. 

Each CERT member completes at least 20 hours of training on disaster preparedness, 

basic disaster medical operations, fire safety, light search and rescue, and other essential 

topics. The training also includes a disaster simulation in which participants practice

skills they learned throughout the course. In the event of an emergency, CERT members 

can provide immediate assistance to victims, assist in organizing spontaneous volunteers 

at a disaster site, and provide critical support to first responders. More information on 

CERT teams is available online at: 

 http://www.fema.gov and http://www.citizencorps.com

36
RECOMMENDATIONS

INITIAL RESPONSE 

During the initial response phase, local agencies will need to initiate actions to save lives,

limit property loss, provide for scene security, and request/prepare for the arrival of 

regional, State, and Federal resources. 

ISSUE: During a major incident, unrequested personnel and equipment 

arriving to offer unsolicited assistance will create confusion, congestion, 

uncoordinated operations, difficulties in planning, and increased hazards 

to responders. 

Unanticipated equipment resources congest an incident scene, and unanticipated 

personnel negate the personnel accountability system and endanger the safety of all 

personnel involved in operations. 

Many units in New York (including fire, EMS, and private ambulances), as well as offduty responders in their private vehicles, self-dispatched to the incident. EMS could not

control the large number of ambulances that self-dispatched. Other units pushed dispatch 

to send them and, in some cases, dispatch relented. Finally, some units that were 

dispatched failed to report to staging, going directly to the incident instead. 

ACFD faced freelancing ambulances and fire apparatus, as well as freelancing at the 

Incident Command level. One jurisdiction operated entirely independent of the overall

ICS. 

In Shanksville, surrounding fire companies self-deployed. Uncontrolled arrivals resulted 

in severe congestion of the only access road to the downed aircraft. Adding to the

congestion problem was the response of department members in their private vehicles. 

Once the IC determined there were no survivors, he tried to abort the request for the EMS 

ambulances from two neighboring counties. This attempt was unsuccessful. 

37
RECOMMENDATIONS

RECOMMENDATION: Develop a policy to control requested and nonrequested resources and eliminate freelancing of public safety resources. 

As part of a comprehensive mutual-aid agreement(s), the communication center or 

dispatch function should be empowered to control the release, dispatch, and assignment 

of response resources verbally. 

In order to maximize both safety and effectiveness, FDNY has implemented the 

following policies since September 11, 2001: 

• Only on-duty members shall respond to alarms on the apparatus. 

• Persons other than members of FDNY are to be excluded from the response. This 

includes former members of the department, members of other fire departments, 

friends, and relatives. 

• Members who have arrived at incidents prior to responding companies, and those 

whose assistance has been accepted by authorized Fire Officers, are subject to the 

direction and control of the IC. It is the policy of the department that such 

members are relieved as soon as sufficient on-duty, properly equipped and 

protected resources have arrived. The IC's authority in this matter is absolute. 

• In response to recall, members shall report to their assigned quarters. They shall 

not respond directly to the incident. 

ISSUE: Interagency communication and coordination may not be effective 

during a multiagency incident. 

Both ACFD and Arlington County Police Department (ACPD) are familiar and trained in 

ICS, so the system was established within minutes of the attack on the Pentagon, and 

quickly transitioned to Unified Command. After the first 8 hours, an estimated 60 

38
RECOMMENDATIONS

agencies responded to the Pentagon scene. Of those agencies, representatives from 

ACFD, ACPD, the US&R Incident Support Team (IST), Federal Emergency 

Management Agency (FEMA), Department of Defense (DOD), and the FBI made up the 

Unified Command function. ACFD added the IST to Unified Command to keep US&R 

in the information loop. This group met every 4 hours and directed an IAP be produced 

for each 12-hour operational period. These representatives remained in constant contact 

with each other through cell phones and incident-issued radios. 

At the time of the incident in New York City, the Mayor's Office of Emergency 

Management (OEM), which included the city's EOC, was located at 7 WTC directly 

across the street from the WTC towers. The collapse of the towers caused collateral 

damage to 7 WTC, including numerous fires and eventual structural collapse. The FBI

issued an order to evacuate and relocate the EOC. After moving several times, the

OEM/EOC ultimately operated from Pier 92. Time lost in reestablishing the EOC 

severely hampered interagency coordination. In addition, New York City's Emergency

Response Plan did not have a formalized ICS in place for all city agencies and lacked a

Unified Command concept. 

The USFA typically does not respond to major disasters under activation of the FRP. 

However, historically, USFA personnel have been deployed to major events such as the 

Oklahoma City bombing and the Columbine school shootings to gather information and 

document aspects of the incident. USFA's overall mission related to these incident types 

is to prepare specific training to affect future behavior of emergency personnel and 

improve response. 

After the collapse of the towers on September 11, 2001, FDNY and City officials met

with the Director of FEMA. As a result of that meeting, on September 12, 2001, USFA 

was directed to assemble a 5-person team to report to New York City to function strictly

in a support role. They were directed to assist the FDNY leadership in reestablishing the 

Incident Command structure, work with the U.S. Army Corps of Engineers to locate and 

provide necessary resources, and support the efforts of the National Fallen Firefighters 

39
RECOMMENDATIONS

Foundation as they coordinated Critical Incident Stress Management (CISM), chaplain 

support services, and survivor support services. In many instances, USFA helped bridge 

communication between Federal and local officials and assisted in the integration of the

U.S. Forest Service IMT to support FDNY in the planning function. 

The IAP is a written document prepared by the Planning Section of the ICS for a given 

operational period. It provides a clear statement of objectives and actions and serves as 

the basis for measuring work and cost effectiveness, work progress, and for providing 

accountability. FDNY had not used the standard ICS planning process for developing an 

IAP using ICS forms. This, coupled with the collapse of the towers, personnel deaths, and 

loss of Command Staff, initially resulted in confusion in Command and General Staff 

functional areas. 

An IMT is part of the Federal resources activated under the FRP. The team typically 

consists of experts in fiscal, logistical, operational, information, safety, and planning 

issues. The function of the IMT during a deployment under the FRP is to assist the local 

jurisdiction to develop and manage the incident response framework. The Southwest 

IMT, activated by FEMA, supported the FDNY in their planning process and developing 

IAP's. FDNY conducted briefings for all local, State, Federal, and private response 

agencies at the ICP twice a day. Since the incident, FDNY recognizes the need for all 

agencies to use the ICS citywide. The experience of September 11, 2001, also illustrated 

the need for long-term incident management capability to meet threats and potential acts 

of terrorism. 

Based on pre-existing personal relationships, the ACFD IC and the FBI representative 

collaborated and cooperated from the beginning of the incident. In addition, the Major 

General in charge at the Pentagon placed his resources in support of the ACFD from the

onset of the incident and the FBI (when they assumed control on September 21) until 

control was returned to the DOD on September 28. Initially the FBI representative 

worked side-by-side with ACFD and the military in planning and conducting operations

in the ICP. Subsequently the FBI liaison was removed from the ICP and placed in the 

40
RECOMMENDATIONS

Joint Operations Center (JOC). There was a noticeable deterioration in the operations, as

seen in the unnecessary evacuation orders that resulted from rumored incoming aircraft. 

This clearly indicates that having ongoing agency representation in the ICP results in a 

smoother unified operation and better interagency communications. The FBI

representative was returned to the ICP on September 13. 

ICS was initially attempted in Shanksville. Command was transferred from the Assistant 

Chief to the Fire Chief approximately 30 minutes into the incident. When the incident 

was determined to be a recovery operation, Command was transferred to the FBI, who 

implemented a Unified Command structure. The FBI assumed the Operations Section 

Chief function responsibility while the Shanksville Fire Department assumed a deputy 

operations position under the Operations Section. The FBI held periodic briefings with all 

agencies that remained on the scene. The Shanksville Fire Department maintained a 

presence in the Unified Command structure until the incident was terminated. 

Unified Command was established in response to the anthrax situation at the AMI 

building in Palm Beach County, Florida. The fire and public health departments

supported this Unified Command, which was led by the FBI. Although there was an 

urgency to work through the particulars and specifics of this situation, Command and 

Operations were not established or performed in the chaos that is often prevalent in the 

initial stages of other emergency scenes. 

RECOMMENDATION: Establish a Unified Command function as soon as 

possible after the initial response. 

According to Ed Plaugher, the Fire Chief of ACFD, "The ICS audience is broader than 

ever before and must cross multiple agencies." The scene of a terrorist incident presents 

a very complex environment with a significant number of responding agencies. The interrelationships of decisions among these agencies become all-powerful in terms of the 

impact on the community and incident responders. Unified Command concepts are 

41
RECOMMENDATIONS

explained in the NIMS. In addition, the ICS forms used to develop the IAP 

accommodate the expression of the Unified Command. 

The FDNY is establishing multiple levels of ICS training within the Department. The

training level will be based on the function and positions within the ICS, and training on

the concepts of Incident Command will be ongoing. As described earlier in this report, 

they also received incident management training from the U.S. Department of 

Agriculture's Forest Service. 

One method for areas with smaller departments to prepare for implementing Unified 

Command rapidly at a significant event is forming a regional multiagency IMT. The

USFA delivered two customized training courses, Executive Analysis of Multi-Venue 

Operations (EAMVO) and Emergency Medical Services: Special Operations (EMS:SO) 

for the UOPSC in June 2001 and November 2001 to prepare emergency services and law 

enforcement personnel for the 2002 Winter Olympics. Of the 26 jurisdictions involved in 

the Olympics, 17 sent students to the EAMVO course and 11 sent students to the 

EMS:SO course. Both courses included students from fire departments, police 

departments, and EMS. As a result of this training, the area formed a regional IMT for

the Olympics and maintained that concept as part of standard operations. 

USFA has developed a "training roadmap" to guide departments or groups of local 

departments toward the development of multiagency IMT's. Members trained for these 

teams will learn to function in appropriate ICS Command and General Staff positions

during local incidents using Unified Command structure, and to transition to a higher 

level, more robust team if necessary after the first operational period to assist in managing 

major incidents. Information about USFA's IMT training initiative is available online at:

http://www.usfa.fema.gov/fire-service/incident/imt-roadmap.shtm.

42
RECOMMENDATIONS

ISSUE: Specific communication and coordination between the Unified 

Command Team and the FBI may not be effective during a terrorist event. 

During the early stages of the Pentagon event, the first-responding FBI Special Agent 

(SA) quickly established a physical presence with the ACFD Incident Commander. In 

accordance with the preestablished FBI ICS procedures for a WMD event, the FBI SA 

and ACFD Incident Commander established a Unified Command structure. This occurred

at approximately 9:49 a.m., shortly after their arrival. 

Developing and establishing a Unified Command structure was a relatively simple 

process at this incident. This can be attributed to the fact that the ACFD Incident 

Commander and FBI SA had attended joint terrorism training sessions together and had 

developed a professional relationship that was built on trust and confidence. This 

relationship permitted the Unified Command structure to be established smoothly,

allowing for a remarkable collaborative effort during the early stages of the event. It also 

allowed for other responding agencies to easily assimilate into an already established 

Unified Command structure. 

As events unfolded, at 10:15 a.m., FBI intelligence informed the SA at the ICP of valid 

threat information. This information was relayed quickly to all agency representatives 

within the Unified Command team, and an immediate evacuation order was issued for all 

emergency responders in anticipation of a second aircraft crashing into the structure. 

Although this second hijacked aircraft never reached its reported destination, this critical 

and valid threat information received from FBI intelligence was circulated quickly among 

the Unified Command team, and immediate and preventive action was taken successfully 

throughout the incident scene. An assumption could be made that if there had not been 

an FBI presence at the ICP, that vital piece of valid threat intelligence may not have 

reached the Unified Command team in a timely manner to issue the emergency

evacuation order. If the aircraft had reached its purported destination and emergency 

43
RECOMMENDATIONS

responders had not been forewarned to evacuate, it is quite possible that a large loss of 

responder lives may have occurred. 

Initially at the incident, ACFD established the ICP at the back of a Battalion Chief 

vehicle (a Chevrolet Suburban) parked in very close proximity to the Pentagon building. 

However, based on the threat information about the supposedly incoming aircraft, a 

decision was made to relocate the ICP to a more remote area. The chosen site was under a 

highway overpass that was deemed to be a safe distance from the Pentagon, but still in 

the general proximity and within sight of the building. 

The relocation of the ICP actually provided beneficial spacing and distancing from the 

ongoing operational activities taking place around the Pentagon. Oftentimes, close 

proximity of an ICP can be distracting to command processes and decisionmaking. 

Defining proper spacing between ongoing operations and the ICP is recommended 

whenever possible to reduce these potential distractions. 

At about noon on September 11, the SA presence within the Unified Command team was 

interrupted. The SA was directed to detach from the ICP and assist the FBI in preparing

to activate the Joint Operations Center (JOC) at nearby Fort Myer. This action had a 

significant operational downside, even though it was temporary measure. 

During the time that the SA presence was detached from the Unified Command Team, 

two additional full building evacuations were ordered. These evacuations were based on 

invalid threat information; they were actually a result of friendly aircraft, escorted by 

fighter aircraft, approaching the area. This critical information gap occurred during the 

period when there was no physical FBI presence at the ICP. The false evacuations 

interrupted the fire attack and changed on-site medical treatment of injured civilians 

during the crucial early stages. False evacuations also can extract a serious toll in terms 

of physical and psychological well-being of responders. 

44
RECOMMENDATIONS

Moreover, these critical lessons learned clearly identify that face-to-face communication

links between the FBI and Unified Command team should be firmly established early in 

the event and maintained continuously without interruption. Even though radio 

communication was never severed completely between the Unified Command team and 

the FBI, the ability to validate critical information face-to-face was lost. 

At approximately midnight on September 12, a decision was made to again relocate the 

ICP. This time it was relocated to Fort Myer, where the JOC had been established.

However, this second relocation proved to be somewhat cumbersome, causing some

functioning difficulties for both the Unified Command team and JOC group. Most likely

this occurred because of the contrasting missions of the JOC group (policy and Federal 

interagency coordination) and the Unified Command team (operational command). 

At approximately, 8 a.m., it was determined that both groups could best function as 

distinct entities, separate and apart from one another but with strong communication 

links. The ICP was then relocated back to the overpass site and the JOC remained at Fort

Myer. Upon the ICP being relocated back to the overpass site, an FBI SA accompanied 

the Unified Command team. The physical separation of the ICP and JOC enabled both 

groups to function effectively throughout the duration of the event without interfering 

with one another while retaining interrelated agency communications. The inclusion of 

the SA assured that critical, face-to-face communication links were maintained

continuously until the Unified Command structure was deactivated. 

Maintaining the flow of external information, particularly to the media, also is vitally 

important during a terrorist event. Early in the Pentagon incident, the media obtained 

information from any available source. As a result, the media reported erroneous

"eyewitness" accounts of various aircraft crashing into the Pentagon, and overestimates 

of fatalities based on potential occupancy of the impact area (despite the fact the 

renovation work left a significant part of the impact area uninhabited). The first official 

press conference at the Pentagon was not convened until 11 p.m. on September 11, more 

than 13 hours after the event began. 

45
RECOMMENDATIONS

Establishing effective media information dissemination took longer than it might 

otherwise have for a number of reasons. The unfilled ACFD Information Officer position 

was a contributing factor to the media interface problem. Additionally, when the JOC 

opened, the FBI chose not to activate a Joint Information Center (JIC) to serve as a focal 

point for coordinating all interagency media interface. The failure to establish a JIC 

proved to be an impediment to the presentation of coordinated, factual, and timely public 

information. There was not a central point of interface between the media and the

agencies involved in the response. Each agency dealt separately with the media. 

During a terrorist event, it is imperative that the Information Officer at the ICP take the 

necessary precautions to insure that all pertinent event information is coordinated with 

the JIC before disseminating public information. 

RECOMMENDATION: Follow the established procedures for FBI 

integration into a Unified Command structure to manage the consequences 

of a terrorist event. 

Senior management personnel from all agencies that may respond to a major incident--

fire, law enforcement, EMS, and FBI (in the event of a terrorist incident)--should meet 

and train together to ensure that a good relationship exists prior to an incident. If 

possible, they should develop a local or regional IMT. Whether or not they are part of a 

formal IMT, these individuals likely will make up the Unified Command team at a major

incident. 

An FBI representative should be a part of the Unified Command team at a terrorist

incident. (A graphic display of the FBI Interface into the Unified Command structure at a 

terrorist incident can be found in Appendix D.) At such an incident, the Unified 

Command team also will have to coordinate closely with the JOC and the JIC. The FBI 

has provided ICS training for their personnel, and has established the following 

procedures for integrating into the Unified Command structure at a terrorist incident, and 

for establishing and activating a JOC and a JIC. 

46
RECOMMENDATIONS

FBI Procedures for Integrating into an ICS Unified Command Structure following a 

Weapons of Mass Destruction (WMD) event 

1. The first component of this procedure is to deploy a Joint Terrorism Task Force 

(JTTF) to the event site immediately. 

• Included in this JTTF deployment will be an assigned FBI SA. 

• Upon arrival of the first FBI SA at the event site, this SA will assume the 

role as the initial FBI representative to the Unified Command team. The 

SA will be responsible for overall Federal law enforcement coordination at 

the incident, as well as directing any FBI-specific operations. 

2. The second component of this procedure is to deploy a WMD coordinator to the 

event site immediately. 

• The WMD coordinator will assume the role of a Deputy Planning Section 

Chief functioning under the ICS Planning Section Chief. 

3. The third component of this procedure is to deploy the Special Agent in Charge 

(SAC) and Assistant Special Agent in Charge (ASAC) to the event site 

immediately. 

• The SAC will assume the role of the FBI unified commander initially

filled by the first-arriving SA, and will be responsible for overall Federal 

law enforcement coordination at the incident. The ASAC will direct any 

FBI-specific operations necessary as a result of the incident.

• Upon the SAC replacing the SA as the FBI unified commander, the SA 

will then assume the role of a Deputy Operations Chief functioning under 

the ICS Operations Section Chief. 

47
RECOMMENDATIONS

FBI Procedures for Activating a JOC 

• The SAC will ensure that a JOC is established and activated within 

reasonable proximity to the event site. (Under the Initial National 

Response Plan (INRP), the JOC will be co-located with, and operate under

the auspices of, the Joint Field Office (JFO). 

• Assigned staff members will assemble at the identified JOC. 

• The JOC should be capable of permitting senior representatives from

several Federal agencies with relevant responsibilities to convene and 

exchange information and coordinate interagency law enforcement-related 

activities. 

FBI Procedures for Activating a Joint Information Center (JIC) 

• The appropriate FBI staff will ensure that a JIC is established and 

activated within the JOC. (Under the NIMS and the INRP, the JIC will be

established and activated within the JFO.) 

• The JIC is established to manage the flow and release of all pertinent 

event information and is the focal point for coordinating interagency 

media interface. 

• The JIC is designated as the clearinghouse for all public information 

relevant to the event. 

48
RECOMMENDATIONS

ISSUE: Responders are considered targets in terrorist incidents. 

Although police controlled entrances from major roads during the first 2 days at the 

Pentagon, those claiming involvement were granted liberal access, based on the 

assumption that some appropriate authority had cleared them. By the third day, everyone 

entering the fireground needed a new color-coded identification badge. Gaining control 

of the perimeter in New York City took several days and accountability remained a 

problem well into the incident. It was not until the arrival of the National Guard, 

equipped with weapons to support the NYPD, that effective control was established. 

Some responders remained on site at the WTC for long periods of time with no system of

credentialing or tracking. The extensive involvement of private sector workers involved 

in debris removal during the recovery phase of the incident added to the credentialing

problem. Because the number of these workers was so great, a separate credentialing 

process was established for the private sector workers. 

Personnel safety is the paramount command consideration on an incident scene. An 

intentionally caused incident has several added dimensions. For example, in an effort to 

create the safest operational environment possible, responders should be considered 

secondary targets of the terrorists. 

RECOMMENDATION: Develop the capability and policy for scene security

that includes perimeter control, force protection, and responder

credentialing. 

One of the first actions should be to implement law enforcement managed perimeters

around the incident. Law enforcement agencies are familiar with "inner" and "outer" 

perimeters, which are routinely established at hostage or barricade situations. Definitions 

of these perimeters specific to a haz mat or terrorist situation may coincide with the warm 

zone (inner perimeter) and the outside of the cold zone (outer perimeter); or new

49
RECOMMENDATIONS

definitions may emerge as this tactic is developed, implemented, and refined in future 

exercises and incident management methodologies. 

The perimeter can be reinforced later by installing chain-link fence, as was done in

Oklahoma City, Arlington County, and New York City. Arrangements for rapid 

procurement of large quantities of fencing materials should be in place. In Shanksville 

and Palm Beach County, law enforcement personnel maintained control of the outer 

perimeter. 

Force protection is defined as actions taken by law enforcement or the military to ensure 

the safety of those working on the incident site. Force protection may consist of any of

the following: 

1. Armed personnel posted around the operating perimeter. 

Law enforcement personnel were used at the Pentagon. The National Guard 

assured perimeter control in New York City. 

2. Base and staging areas. 

There should be a separate marshalling area at the incident base for unrequested 

and/or unverified resources. This "corral" concept was used in Oklahoma City. 

For added security, law enforcement should manage the perimeter of these areas. 

3. A badging or credentialing process. 

This approach was used in Oklahoma City, New York City, Arlington County, 

and Shanksville. Establish criteria to determine who is eligible for incident 

credentials. Use a method such as color-coded bands or badges to ensure people 

do not remain on site for more than their scheduled time. If other than public 

safety agencies are going to credential people for access to the site, it must be 

approved by those responsible for site security. 

50
RECOMMENDATIONS

ISSUE: Operational boundaries may not be effective enough to ensure

protection of both responders and civilians. 

Rapidly establishing control zones around an incident site will minimize injuries and 

contamination, as well as identify operational boundaries for response personnel. During 

the first 2 days at the Pentagon, police controlled entrances from major roads. Chief 

Plaugher ordered 2,000 feet of chain-link fence early on September 11 to construct the 

outer perimeter boundary. Fencing also was used successfully to control access to the 

Murrah Building in Oklahoma City. Fencing around an incident site is important in 

gaining absolute perimeter control. Fencing also improves accountability for persons

working inside the fence and enables better scene control for the IC. The identification of 

ingress and egress points must be determined before the hard perimeter is established.

RECOMMENDATION: Develop local response capability to implement 

control zones quickly.

The first step in scene control should begin with the first-arriving responders. The

Hazardous Materials First Responder Awareness competencies of recognition,

identification, protection, and notification set the foundation for subsequent arriving 

responders. It must be recognized that large incidents will require a broad interagency 

involvement to establish effective scene control. 

Identifying local sources for fencing needs, such as home improvement stores, etc., and 

developing preincident agreements and contacts for after hours also can eliminate a 

lengthy wait, if the time comes that the resource is needed. 

ISSUE: Convergence of apparatus too close to the incident site may 

impede site access for needed apparatus and resources. 

51
RECOMMENDATIONS

Although not a significant problem at the Pentagon, locating staging areas close to the 

incident created a problem in New York City. FDNY dedicated two 5th-alarm 

assignments to the WTC and had an additional 5th-alarm assignment staged in Brooklyn, 

ready to come to Manhattan. Senior chiefs had designated staging areas near the WTC. 

However, as units approached the area, many failed to report to the staging areas and 

proceeded directly to the tower lobbies and other parts of the incident instead. Traffic 

congestion at the incident site also prevented some apparatus arriving from outlying areas 

from reaching the designated staging area. Personnel proceeded on foot even though they 

were unfamiliar with the local street area and the building identification. In after-action 

discussions, FDNY indicated that this convergence of apparatus could create an 

additional target of opportunity and that a policy should be written to ease the travel of

apparatus and reduce the possibility of creating additional targets. 

A particular incident site may not be able to accommodate all of the responding 

apparatus. An agency may have to develop alternate methods to get personnel to the 

scene. In addition, the intentional or inadvertent concentration of both regular and 

specialty response resources creates an opportunistic target for terrorists. Identifying 

multiple remote staging areas creates a defensive posture and should be part of a 

deliberate and comprehensive force protection policy. 

RECOMMENDATION: Identify remote staging areas in the recall/response 

policy.

The remote staging definition should be a component of a comprehensive organizational 

recall policy. Potential sites should be assessed to determine their suitability to meet the

following: 

• prevent both agency and mutual-aid personnel from responding directly to the 

incident site without supervision; 

• establish accountability for the recalled and mutual-aid personnel; 

• control the amount of resources reporting to the site and ensure citywide/ 

jurisdictional area coverage in the ensuing days; and 

52
RECOMMENDATIONS

• diversify resources in the event of a secondary incident. 

A base could be established as a marshalling area and check-in point for responding

resources. This also could be used to isolate and hold unrequested and/or unverified 

resources until they can be screened, verified, and either assigned or released. 

ISSUE: A major incident can result in a high number of injuries and 

casualties. 

Localities must develop a plan to address the intentional overwhelming of their local 

health care system. In both New York and at the Pentagon, patient accountability was

deficient. Several factors contributed to this situation. Triage tags were not used at either 

incident. Ambulances did not go through staging. Civilians flagged them down and crews 

initiated treatment and transport without reporting their actions through the ICS. At the 

Pentagon, mutual-aid responders were unfamiliar with locations of staging areas and 

there was no central hospital designated to coordinate communication and dissemination 

of patient dispositions. 

RECOMMENDATION: Develop a multicasualty/multipatient incident 

capability.

An effective Multiple Casualty Incident/Multiple Patient Incident (MCI/MPI) plan should 

include all of the health and medical resources within a local area/region. Significant 

components of an MCI plan include EMS, private ambulance providers, fire department, 

law enforcement, hospitals, medical education facilities, and public health capabilities.

Freestanding minor emergency treatment centers/clinics should be included in the plan as 

well. 

53
RECOMMENDATIONS

The MCI/MPI plan must account for and track each patient from the time the patient is

located and enters the system through treatment and final release from a definitive care

facility. At the site of the incident, the Medical or EMS Branch in the Operations Section

will include the Triage, Treatment, and Transport Units. The use of triage tags is an 

accepted method for tracking patients as they go through this process and provides the 

field documentation needed to ensure patient accountability. 

The appropriate distribution of injured persons among capable treatment facilities must 

be coordinated to prevent overloading any one facility. The MCI plan must identify a

method to assess bed capacity and treatment capability of all area hospitals and then 

systematically direct the transportation of injured persons to the appropriate facility for 

treatment. The specific treatment capability available locally may be extremely limited 

for certain types of incidents (e.g., collapse, fire, chemical, etc.). For example, if the 

incident results in a high number of burn injury patients, the local burn bed capacity will 

be overwhelmed quickly and additional specialized care facilities must be identified to 

receive the injured. 

A number of persons will seek medical attention outside of the organized MCI/MPI 

structure. Many will self-refer to medical facilities in the area of the incident. Visitors

present at the time the incident occurs may return home and then follow up for treatment

at a doctor's office or hospital in their home location. Although the EMS system 

documented treatment of only about 100 patients at the 1993 bombing of the WTC, 

estimates indicate that upwards of 5,000 persons sought medical treatment. A large 

portion of those fled the 1993 bombing scene, then sought medical attention in a hospital 

or doctor's office after returning to their home State or country. At this point, it is 

unknown how many people did this as a result of the WTC collapses. The same actions 

can be anticipated in almost any major incident. 

54
RECOMMENDATIONS

ISSUE: Responders and the public may be exposed to multiple hazardous 

contaminants during a major incident. 

A decontamination capability must be developed quickly for responders and for persons 

who are initially exposed to potentially hazardous or toxic substances. Limiting the

spread and effect of possible contaminants is one of the most important considerations in

any incident. Although first-arriving fire personnel may be overwhelmed with the

consequences of the event, it is extremely important to establish an emergency 

decontamination capability as early as possible and to recognize there is a real likelihood 

that multiple locations will need to be identified. This process must be a priority for the

IC (or Unified Command). 

RECOMMENDATION: Develop a risk-based capability to decontaminate 

responders and large numbers of civilians rapidly.

All fire departments must plan and train for the establishment of emergency 

decontamination by initial responders. This is one of the first steps in developing 

effective strategies to control an incident involving large numbers of potentially 

contaminated civilians or responders. Firefighters trained to the Haz-Mat Operational 

Level should be able to set up an effective emergency decontamination corridor using 

firefighting hoses, nozzles, ladder pipes, salvage covers, and the apparatus itself. Proper 

positioning of the apparatus can create a funnel to direct contaminated persons through a

water "shower" to remove a large percentage of a contaminant. 

As additional resources are assembled, a more definitive decontamination process can be 

defined and implemented as necessary. This secondary, or technical, decontamination 

may include tents or trailers designed for large numbers of persons (mass 

decontamination) and use specific cleaning solutions. Attention must be given to 

environmental conditions that affect the decontamination process in the field, such as 

cold weather. Jurisdictions should be familiar with the best type of decontamination 

process for use in their geographic location. 

55
RECOMMENDATIONS

Important considerations in the decontamination process include modesty and 

hyper/hypothermia. The decontamination strategy should include methods to assure

availability of and provide re-dress garments for persons exiting the decontamination 

corridor. Depending on the time of the year, blankets, some type of protective barrier, or 

heated shelters may be needed for persons completing the decontamination process. 

ISSUE: Major incident sites pose multiple health hazards to responders, 

civilian volunteers, and the general public. 

Hazard monitoring may pose unexpected problems. For example, chemical agent 

monitors did not work at the WTC because of the smoke and dust that caused a large 

number of false readings. However, they did work at Pentagon, where smoke was less 

intense. It also may be difficult to gather or compile data if the disaster site is large, as 

was the case in New York. 

One of the issues at the Pentagon and the WTC was lack of interagency coordination and 

consistency in protocols for both hazard identification and PPE selection. Both the 

Environmental Protection Agency (EPA) and the Occupational Health and Safety

Administration (OSHA) were present at the incidents. In New York City, while Federal,

State, and local environmental agencies were conducting air monitoring and sampling, 

the construction industry brought in its own air monitoring capability along with 

appropriate respiratory equipment for the construction personnel operating on the site. 

At the Pentagon, the IC took all hazard evaluation information into consideration and 

made the decision about what PPE would be used by all responders on that site. In 

addition to needing appropriate credentials, no personnel were allowed on the worksite 

without the required PPE. 

RECOMMENDATION: Develop a continuous and comprehensive hazard 

monitoring capability for the incident site and the community, as indicated. 

56
RECOMMENDATIONS

Local responders need the capability to conduct a site assessment and develop a Site 

Safety Plan for operations. This implies that equipment designed for the detection and 

monitoring for hazards (chemical, biological, radiological, etc.) should be in the hands of 

local responders. If no local or regional hazardous material response team is available, 

the National Guard Civil Support Team (CST) may be the first arriving asset with 

definitive detection and monitoring capability. The EPA or State environmental 

protection agency also may be able to provide excellent air sampling and monitoring 

functions. 

Resolving interagency inconsistencies must occur on a level higher than the local one, but 

local agencies should provide input and continue to keep the issue alive through 

communication with the appropriate State agencies and with Federal agencies such as 

EPA and OSHA. 

ISSUE: Communication may be hampered during a major incident because 

decisionmakers are located in multiple areas. 

During the response to the Pentagon, the Fire Chief of ACFD determined that he could be 

of the greatest benefit to both the incident and the community by assuming the role he

termed "Senior Advisor." His primary responsibility was to ensure linkage between the 

ICP, the local EOC, and the JOC. This position was not used at any of the other incidents. 

The Unified Command team must have close coordination with the local EOC during a 

major incident or disaster. While the Unified Command team deals with the strategic and 

tactical aspects of the incident, the EOC will be dealing with local policy and planning 

issues related to the continued protection of the community, as well as resource 

acquisition for dealing with the response to and recovery from the incident. Should State 

resources be required for the incident, or should a local state of emergency be issued, the

local EOC is the communications link to the State EOC. The State EOC is the point-ofcontact for the various agencies within the State, including the Governor's office. 

57
RECOMMENDATIONS

RECOMMENDATION: Use the highest-ranking official present to serve as a 

link among the decisionmaking entities. 

The responsibilities of local organizations to participate in a JOC or a Joint Field Office 

(JFO) under the new NRP have not been defined fully. The JFO is established by FEMA 

on its arrival, and provides the operating environment for Federal agencies and 

organizations who have responsibility in the incident (e.g., DHS, FBI, Federal Aviation 

Administration (FAA), etc.). The JOC is established within the JFO. The NIMS further 

defines the multiagency coordination systems that may be used at major and/or complex 

incidents for interaction between the local Unified Command team and the JFO. 

The highest-ranking fire official available at the time of the incident should fill the 

"senior advisor" position. The IC will continue to focus on the completion of incident

priorities, the strategic and tactical plan, and the other components of the incident. The 

senior advisor's focus is on the entire incident, its impact from a broader perspective, and 

providing direction and overall guidance. The senior advisor should circulate between the 

ICP, the EOC, and the JFO on a regular basis to work with the IC, the jurisdiction 

administrator, and other key local, State, and Federal officials. This will ensure that all 

the centers have a common understanding of the incident size, complexity, nature, and 

resource needs so appropriate municipal and incident policy decisions can be made. 

ISSUE: The specific operational responsibilities of multiple agencies may

not be coordinated effectively during a major incident. 

Effective unified operations were difficult to achieve in New York. The loss of senior

FDNY leadership and the EOC facility were major contributing factors, as was 

unfamiliarity with some of the capabilities of Federal resources that were available at the 

incident. When the Pentagon attack occurred, it was clear that it was a terrorist action. It 

was quickly determined that fire, EMS, and law enforcement would have to operate 

under a single Operations Section of the ICS for a coordinated effort. 

58
RECOMMENDATIONS

RECOMMENDATION: Develop an efficient and effective Unified Operations 

capability.

The concept of unified incident management should be woven throughout the ICS 

structure, not just the Command function. Such is the main purpose for the 

implementation of the NIMS. There should be a single Operations Section Chief with 

deputies assigned from appropriate disciplines. These deputies should ensure coordinated 

tactical operations. For example, search and rescue, patient care, and evidence collection 

need to be coordinated closely during a terrorist event. The Operations Section Chief, 

through the deputies, is responsible for this coordination. This approach to unified 

operations was used during the response to the Alfred P. Murrah Federal Building 

bombing. Law enforcement personnel, trained in PPE competencies, accompanied search 

and rescue personnel for the purpose of evidence preservation and collection. Appendix 

D contains a graphic organizational chart showing FBI interface with Unified Command 

and unified operations. 

ISSUE: Normal methods of communicating between units or agencies may

not exist during a major event. 

In both the New York and Pentagon incidents cell phones were of little value in the first 

few hours. Cell towers were down, there was no cellular priority access, and the lines 

were overloaded. Radio channels were congested and over-saturated. The FDNY

experienced poor communication with the EMS contingent. Fire and EMS dispatchers 

were overwhelmed and unable to synthesize or disseminate all critical information. 

There was minimal radio communication between fire department and police department

resources operating at the WTC incident. 

RECOMMENDATION: Develop a comprehensive communications plan to 

address initial cell phone overload and potential radio interoperability

among responding mutual-aid organizations. 

59
RECOMMENDATIONS

To some degree, the communication mechanism(s) of a typical response entity are 

probably a combination of a commercial infrastructure and a government-owned radio 

system. 

This configuration presents several challenges: 

• Commercial components, such as cell phones, may be overwhelmed by entities 

other than emergency responders. During the incidents of September 11, 2001, 

family members were trying to contact other family members; the news media 

tied up lines; and a far greater number than normal public safety agency personnel 

were all trying to access lines. This severely limited the number of cell sites

available. 

• Another problem is the sheer number of cell phone users converging on an area. 

Working with cellular providers to develop a plan and agreement to bring in

portable cellular sites on short notice will decrease the amount of time an agency 

must deal with an inadequate communication capability. Portable Cellular sites

On Wheels (COW's) were used successfully during the WTC incident and the 

2002 Olympic Winter Games in Utah to augment existing cellular service, as well 

as providing increased capability for the public service agencies. 

• The new analog and digital 800 and 900 mHz radio systems used by public safety 

agencies are proprietary systems. This means that only radios built by the specific

manufacturer will work on the system. One way to alleviate part of this problem

is to require a certain number of analog mutual-aid talk-groups during the system 

design phase. Some system manufacturers are willing to bring additional digital 

equipment to the site. However, organizations must be aware that the system is 

still vulnerable if more digital users are loaded into the system than it was 

designed to handle. 

• COW's can disrupt or disable existing cell networks. If the use of COW's and/or 

additional digital equipment is anticipated during an emergency, the components

should be set up and tested prior to the actual need. Exercise of a supplemental 

60
RECOMMENDATIONS

communication system can avoid unintentional compromise of the 

communication infrastructure. 

The FDNY designed a new system for the department to address field communications. It 

includes handie-talkies (portable radios), the Command Post radio, repeaters, VHF 

repeater handie-talkies, and the VHF mobile apparatus radios. The system takes a highpowered mobile (vehicle) radio and makes it usable at the freestanding command posts 

used by FDNY. The system is designed for use in a large indoor or outdoor structure 

(such as a stadium or arena), a ship, or a highrise. The department also is testing a 

modular interface/interconnect system to improve interoperability. This system can be 

configured to meet almost any interface application involving telephones and radios of 

any sort. 

Regardless of the communication system employed, organizations should not rule out the 

use of foot messengers during the initial stages, until the enhancements and expansion of

cellular/radio system can be implemented. Foot messengers were used successfully by

ACFD in the initial hours at the Pentagon. Use of foot messengers may be limited by the 

geographic scope of the incident, or may require the use of bicycles, golf carts, or other 

conveyances. 

ISSUE: Major incidents are multifaceted and may require a significant

amount and/or type of resources not routinely available for day-to-day

operations. 

Neither ACFD nor FDNY had a dedicated logistics function. ACFD used the logistics 

person from neighboring Fairfax County Fire and Rescue Department to develop the 

incident logistics function and train ACFD personnel as the incident progressed. In the 

days immediately following the attack, the FDNY assigned a chief officer to coordinate 

both planning and logistics with the support of the Southwest IMT and the Army Corps 

of Engineers. 

61
RECOMMENDATIONS

RECOMMENDATION: Develop a robust incident logistics capability.

The ability to support the needs of personnel and operational actions on an incident is 

critical for a successful incident response system. Events like those of September 11, 

2001, quickly deplete organizational and mutual-aid supplies and present the incident 

managers with equipment and supply needs that are difficult, if not almost impossible, to 

preplan. 

FIRESCOPE (FIrefighting RESources of California Organized for Potential

Emergencies) involves all agencies with firefighting responsibilities in California in a 

cooperative effort to create and implement new applications in fire service management, 

technology, and coordination. The group places an emphasis on Incident Command and 

multiagency coordination. FIRESCOPE and the National Wildfire Coordinating Group 

(NWCG) provide resources for local entities to assist in establishing the logistics function 

within an incident management system. Localities should develop their own logistics 

capability and should make accommodation to incorporate an IMT into the scene 

management structure. More information about FIRESCOPE can be found at 

http://firescope.oes.ca.gov/ More information about NWCG can be found at 

http://www.nwcg.gov 

ISSUE: Forecasting actions needed to coordinate activities and resources 

effectively may not be available during a major incident. 

 

The ability to forecast actions and needs is a critical function of a successful incident 

response system. Events of the magnitude witnessed in the fall of 2001 present 

responders with multiday, multiweek, and multimonth operational durations, as well as 

hundreds to thousands of persons working on the incident. 

ACFD reached out to a neighboring fire department and requested a specific individual 

with incident planning experience to establish the incident planning function. New York 

62
RECOMMENDATIONS

City incorporated the planning capability of the USFA staff and the Southwest IMT into 

its scene management methodology. 

RECOMMENDATION: Develop a robust incident planning capability.

FIRESCOPE and the NWCG provide resources for local entities to assist in establishing 

the planning function within an incident management system. Localities may elect to 

develop their own planning capability or make accommodation to incorporate a metro, 

regional, or national IMT into the scene management structure. During a terrorist 

incident, an FBI representative should be in the Planning Section as shown in 

Appendix D. This is outlined in the NIMS, along with an explanation of the information

and intelligence function within the ICS at a major and/or complex incident. 

Federal Homeland Security Presidential Directive-5 (HSPD-5) directs the Department of 

Homeland Security (DHS) to replace the FRP with the new National Response Plan 

(NRP). The new NRP will "integrate Federal Government domestic prevention, 

preparedness, response, and recovery plans into one all-discipline, all-hazards plan" 

under the authority of the Secretary of Homeland Security. It will establish a single base 

plan to address all hazards and contingencies, cover all disciplines, ensure coordination at 

all levels, and mandate that the Federal resources being tasked and deployed under the 

new NRP use the NIMS. The complete text of the Directive can be found in Appendix B. 

Until the NRP is developed, Federal agencies generally will follow existing policies and

plans as outlined in the INRP during a major disaster. The INRP establishes a process 

and structure for the systematic, coordinated, and effective delivery of Federal assistance 

to address the consequences of any major disaster or emergency declared under the 

Robert T. Stafford Disaster Relief and Emergency Assistance Act. The Plan combines the 

various response plans used by the Federal government and organizes the types of 

Federal response assistance under 12 Emergency Support Functions (ESF's), each of 

which has a designated primary agency. The INRP can be found at 

http://www.dhs.gov/interweb/assetlibrary/Initial_NRP_100903.pdf 

63
RECOMMENDATIONS

ISSUE: Responders tend to focus only on immediate aspects of the 

incident and may not be aware of related critical information. 

Incident personnel are removed from their regular work areas. They are focused on 

incident activities and do not have access to their usual news sources. This occurred in

both New York and the Pentagon. The FDNY after-action report revealed that personnel

operating within the towers not only were unaware of what was occurring outside the 

towers; they also were unaware of what was occurring in the other tower. The FDNY was

unable to access credible information on additional threats and received false notification

of a third inbound plane. 

The Pentagon received three additional warnings of incoming threatening aircraft. The

first threat of an incoming plane (United Airlines Flight 93) was credible, since the FBI 

liaison was in the ICP and talking directly with the FAA. As a result of this information,

an evacuation order was issued and remained in place until word was received that the 

plane had crashed in Shanksville. The other two threats were rumors. Because the FBI 

liaison had been moved from the ICP, these rumors resulted in unnecessary evacuation

orders that interrupted fire suppression and rescue operations. The FBI liaison was

returned to ICP on September 13, 2001. 

RECOMMENDATION: Develop a means to keep incident responders 

updated with credible information about additional threats and events 

outside the immediate scene. 

In a terrorist event, a senior-level FBI agent should be considered an essential member of

the Unified Command team and be present at the ICP at all times. This person has the

ability and authority to communicate with other appropriate agencies to determine the 

credibility of additional threats. 

64
RECOMMENDATIONS

A Situation Unit is part of the Planning Section of the ICS. The primary responsibility of 

the Situation Unit is to document and communicate current incident status. The Situation 

Unit also is responsible for keeping incident personnel updated on situations and 

circumstances outside of the immediate incident. This can be augmented by assuring that 

an FBI representative is assigned to the Planning Section. Another method is posting 

news articles on bulletin boards in specific places on the incident site. This practice can

be expanded to include updates of current local, State, national, or world situations for 

Command, and posting this information for all incident personnel on a regular or asneeded basis.

The Arlington County EOC developed information updates that were transmitted as voice 

mail messages to all County employees. For employees not directly associated with the 

site, these messages were well received. It is unknown if those personnel functioning at 

the scene accessed their voice mail when they were not working. This approach should be 

implemented early, and messages broadcast on a regular and frequent basis to provide the 

most current information possible. 

 

65
RECOMMENDATIONS

STABILIZED EVENT/ONGOING RECOVERY 

Once the event has stabilized, local jurisdictions will be interacting with State and 

Federal agencies to plan for long-term operations. The definition of long-term changed

on September 11, 2001, when long-term fire operations went from a matter of hours to a 

matter of weeks and months. These operations require coordination of multiple physical

resources and personnel. 

ISSUE: State and Federal agencies involved with the management of 

events may not have an understanding of the roles, responsibilities, and 

capabilities of those other agencies involved. 

It was evident in reviewing the after-action reports and through the interviews that both 

local and Federal agencies lacked a complete understanding of the FRP. Not only were 

local agencies unaware of many of the capabilities of various Federal agencies, Federal 

agencies were unaware of the roles and responsibilities of other Federal agencies. ACFD 

was unaware of the arrival of the California IMT (which they did not request) for almost

2 days and also was unaware of the documentation required for reimbursement. Different 

Federal agencies duplicated resource acquisition and distribution in New York City. 

On the positive side, the Southwest IMT took the time to explain what they could provide 

and tailored their normal procedures to meet the needs of FDNY. The FDNY Chief of

Department, Frank Cruthers stated, "The greatest asset provided by the Federal 

government to FDNY was the support of the Southwest IMT." Both the FDNY and the 

members of the IMT gained positive new perspectives of the other's capabilities from the

experience. 

66
RECOMMENDATIONS

RECOMMENDATION: Develop a plan to integrate State and Federal assets 

into an established incident management system.

HSPD-5, published on February 28, 2003, directs DHS to replace the existing FRP with a 

new NRP. It moves consequence and crisis management into one integrated action, with 

DHS serving as the lead for designating the role of each agency and when each agency

will become involved. It also requires Federal, State, and local agencies to use NIMS. In 

order to use Federal assets in the most prudent manner, local jurisdictions must 

understand the resources and capabilities that State and Federal agencies bring to support 

the local incident management and the role of each agency as they are integrated into the 

incident management. State and Federal agencies also must understand their place in the

local response and their roles and responsibilities, as well as the roles and responsibilities 

of other State and Federal agencies. 

Agencies on all levels (Federal, State, and local) must comply with the new NIMS; 

Federal agencies also must follow the Initial NRP. All agencies should understand the 

roles and responsibilities of the IMT, multiagency coordination systems, joint 

information systems, and the JFO. The magnitude of the incidents of September 11, 

2001, requires the local agency to think "outside the box," be flexible, and be open to 

what various Federal agencies can do to help. 

ISSUE: Horrific incidents can have a significant psychological impact on 

responders. 

Responders to large-scale, horrific incidents experience an extraordinary amount of stress 

and should receive support as soon as possible and on an extended basis. A mandatory 

debriefing after each operational period is a standard part of US&R operations. This

practice was deemed beneficial and was implemented in Oklahoma City. 

67
RECOMMENDATIONS

The Arlington County EOC, Employee Support Task Group placed initial emphasis on

providing CISM support to first responders. Arlington County school system employees 

are the staff of the County's Employee Assistance Program (EAP). Members were at the 

incident site within 3 hours of the attack. EAP support included contracted chiropractic 

services, seated therapeutic massages, individual counseling, assistance in contacting 

family members, and help managing personal affairs. As time progressed, support was

extended to other County employee groups and family members. 

CISM also was available on site in New York City. However, some personnel were 

hesitant to use the service because of the "Mental Health" identification on the hats of the 

debriefers and its location, which allowed many to view who was using the service. 

RECOMMENDATION: Develop and implement a plan to provide CISM to 

responders early in the incident. 

Careful consideration must be given to implementing this process at the incident scene. 

Personnel qualified to manage debriefing should be identified and brought to the scene 

early on. A process for identifying responders in need of debriefing should be developed. 

Not all personnel will recognize the need for or seek out assistance. Make attempts to 

locate the debriefing area away from heavily traveled pedestrian routes. Refrain from

using terms that suggest it is a mental health service. A plan also should be in place to 

follow up and to allow responders to access help for stress management after the incident 

is concluded. This already may be a part of a department's health and wellness program, 

but should be reviewed to assure adequate personnel to deal with a large number of 

responders. 

ISSUE: Outpouring of citizen contributions can overwhelm an already taxed 

response system. 

68
RECOMMENDATIONS

Neither New York City nor Arlington County was prepared for the outpouring of support 

from around the country and the generosity of citizens. For example, the Arlington 

County EOC had no plan to handle the hundreds of calls received on their information

phone line. In addition, many people channeled their desire to support public safety by 

preparing homemade meals and treats, which they delivered to the nearest public safety 

facility or the incident site. This resulted in a dilemma, since homemade food donations 

can neither be refused nor should they be consumed. After the first 48 hours of the event, 

the Arlington County EOC coordinated the invitation of citizens to local recreation 

centers to discuss experiences and prepare expressions of support. 

In New York, donations began almost immediately after the collapses of the WTC 

towers. Private companies contacted fire department headquarters offering and sending 

donations to assist the department. Numerous warehouses were required for storage and 

inventory. Both department and voluntarily offered private warehouses were used. 

In the days that followed the event, FDNY headquarters was overwhelmed with mail. 

Trailers were placed in the open area outside of headquarters for storage. Bags of mail 

were stored at headquarters and alternate sites. When it was discovered that Anthrax had

been sent to NBC headquarters offices, all the unopened mail received by FDNY was 

later irradiated by the Post Office. 

RECOMMENDATION: Develop and implement an effective management 

structure to receive, inventory, organize, distribute, and account for largescale donations and manage civilian volunteers. 

Citizens of this country want to contribute and help an affected community in any way 

possible. Departments should work with local agencies that are experienced in managing 

donations, such as the American Red Cross, Salvation Army, and other Voluntary 

Organizations Active in Disasters (VOAD), to develop a Standard Operating Procedure 

(SOP) for directing and controlling civilian volunteers, educating the public on 

acceptable donations and points of drop off, and coordination and support of victims'

69
RECOMMENDATIONS

families. It is also important to assess the region for potential storage facilities for largescale donations of supplies and equipment. 

ISSUE: The local jurisdiction will be inundated with requests from the 

public for information. 

The FDNY was significantly challenged in dealing with the large number of member 

fatalities. They were faced with handling a large volume of inquiries, coordinating family 

notification, and meeting the needs of the families. These tasks were further complicated

by the loss of critical personnel. This condition was unique to New York, since the other 

terrorist incidents did not result in responder fatalities. 

Notifying families in incidents with a large numbers of fatalities can overtax a local 

system. Families will begin calling immediately to try to obtain information, and that 

alone can overwhelm a system. If there are multiple responder fatalities, there is

additional stress and grief resulting from the loss of one of their own, making it even 

more difficult to meet the needs of the family members. 

RECOMMENDATION: Develop a plan to manage the volume of inquiries 

about the well-being of both responders and victims and to coordinate 

family notification of emergency worker fatalities. 

Activating a preidentified, qualified, independent resource, not involved with personnel 

at the incident, would be beneficial in assisting a department. Once such organization, 

Kenyon International, was used by FDNY later in the incident. Representatives from the

outside resource should be assigned to personnel from the involved departments rather

than function independently. This allows department personnel to advise how best to deal 

with individual cases. The airline industry, guided by the Families in Disaster Act, uses 

this type of resource for mass casualty incidents. 

70
RECOMMENDATIONS

POSTEVENT/LONG-TERM RECOVERY 

ISSUE: The responsibilities for managing different stages of major 

incidents will vary among agencies. 

As an incident progresses, it will be necessary to transfer overall incident responsibility 

within and among agencies. The local jurisdiction should have written guidelines that 

define who is in charge during the different phases of any given incident. The transfer of 

command must occur within a defined framework. ACFD was in control of the incident

site at the Pentagon until all rescue and fire suppression activity was complete. They 

relinquished control of the incident site to the FBI on September 21. In addition, the 

military leadership deferred to the ACFD IC, and the Commanding General of the 

Military District of Washington (MDW) served as the point of contact between the IC 

and Pentagon leadership. He ensured the military leaders were fully aware of the status of 

the fire and rescue activities. This averted their consideration of interceding. 

In New York City, FDNY was the Incident Commander from the start of the incident.

After 18 days operations made a transition from rescue to recovery mode. In late October 

a Unified Command was established with the FDNY in charge of search, recovery,

extinguishment, site safety, and fire prevention issues. The NYC department of Design 

and Construction was in charge of demolition and debris removal. 

RECOMMENDATION: Develop local doctrine to ensure the proper transfer 

of command as dictated by incident needs. 

The need for preparedness planning is addressed in the NIMS. An incident begins as the

total responsibility of local government and usually will end as the total responsibility of 

local government. Assisting agencies arrive as requested or as their organizational 

policies dictate in accordance with a mutual-aid agreement, and depart after completing 

their responsibilities under defined scope, jurisdiction, and authority statements. A 

locality can use the Emergency Operations Plan (EOP) as a mechanism to determine, in

advance, who should be responsible for certain situations and certain phases of an 

71 
RECOMMENDATIONS

incident. Regular interagency training and exercises among the area departments and 

agencies also will help define the responsibilities of agency heads, contributing to the 

effective management of command transfers throughout the incident. 

ISSUE: Adequate and appropriate information about all aspects of incident 

response may be difficult to identify, document, and maintain. 

Both FDNY and ACFD lacked experience with the documentation required for 

reimbursement from FEMA. Knowing Fairfax County Fire and Rescue Department

logistics staff had extensive experience in long-term operations in support of its US&R

team, ACFD requested their assistance. The Logistics Officer from Fairfax and his team 

taught the ACFD how to organize, staff up, and manage long-haul logistics functions, 

including recording all transactions and preparing the necessary paperwork for FEMA

reimbursement. In addition, ACFD assigned one of their firefighters to the EOC to assure 

the personnel ordering resources understood exactly what they were requesting. 

A certain portion of the community and organization's cost of the response activity may 

be reimbursable after the incident. Complete documentation is required for any 

reimbursement. This documentation combined with objective postincident analysis

activities, also will help identify areas of adequate preparation and areas needing 

improvement. 

RECOMMENDATION: Develop a mechanism to maintain the most complete 

and accurate incident response information possible. 

One of the most successful mechanisms for documenting incident response and actions is

the use of ICS forms during the response. In addition to the IAP that is produced for 

every operational period, each section of the ICS uses forms specific to its activities. 

When compiled at the conclusion of an event, these forms provide a comprehensive 

accounting of decisions, actions, contracts, assignments, and costs associated with the 

72
RECOMMENDATIONS

incident. The ICS forms provide documentation of the incident and can be used to justify 

claims for reimbursement from State and Federal agencies. These forms also can become

the basis for defense in the legal arena. These forms are referenced in the NIMS, and are 

available for download from many Internet sites, including www.firescope.org 

A robust Planning capability using the ICS forms provides the basis for comprehensive 

incident documentation. In both California and Florida, the structure of the ICS and the 

use of the forms associated with the activation of the functions and positions within the 

ICS have proven beneficial in cost recovery for natural disasters. 

Additional information on required documentation for reimbursement is available from 

State emergency management agencies. 

ISSUE: A major incident has the potential to have a significant long-term 

financial impact on a department and on the overall economy of the local 

area. 

The economic impact of the WTC attack on FDNY was as staggering as the personal 

impact: 

• 343 pensions with death benefits; 

• 661 retirees during 2002 (approximately 2.5 times the annual average); 

• tremendous overtime costs to cover for deceased or injured firefighters, and to 

work at the WTC site; 

• replacement personnel for deceased and retired firefighters; 

• replacement of 98 pieces of apparatus; and 

• replacement of damaged/destroyed equipment carried by firefighters and EMS 

providers, and on apparatus that was damaged or destroyed. 

73
RECOMMENDATIONS

As stated earlier in this report, the New York Office of Emergency Management lost its 

entire EOC. The replacement cost to the city for this facility alone is in the millions of 

dollars. 

An even larger issue is the impact on both the local and national economies. As an

example: 

• Jobs lost in New York owing to the attacks: 146,000. 

• Days the New York Stock Exchange was closed: 6. 

• Stock market volatility that wiped out $1.2 trillion of equity portfolio values in the 

first week after trading resumed. 

• $13 billion of destroyed private and government equity. 

This shows the vulnerability of our economy and of individual fire departments to 

terrorist attacks. While each attack may not be as effective at disrupting our economy, 

fire and emergency services remain in the situation where they may be faced with

catastrophic losses, perhaps planned by terrorists or resulting from an act of nature. 

RECOMMENDATION: Maintain the capability to rapidly hire and train 

replacement firefighters and EMS providers and obtain replacement 

apparatus and equipment in order to continue providing adequate public

protection, even during difficult economic times. 

Replacing the number of lost personnel from both fatalities and retirement on the scope 

of FDNY is the extreme. FDNY strength is about 11,000 persons. The loss of 343 

members is approximately 3.1 percent. According to data found on the Web, FDNY also 

experienced a retirement rate in 2002 that was 2.5 times greater (3.5 percent of the 

department complement) than the same period in 2001 (661:274). This is above the 

normal retirement number, but may not be above a realistic turnover rate for some

74
RECOMMENDATIONS

organizations. How many other departments would face such a retirement rate following

an incident? For example, Omaha, Nebraska, is a 500-member department. Even if they 

lost 5 percent of their personnel on an incident, that would require replacing 25 members, 

which is less than the normal recruit class number of 35 to 40. There may be a need to 

hold an unscheduled recruit class or hire (temporarily or permanently) already-trained 

firefighters and EMS personnel to fill the vacancies and maintain an appropriate level of 

service. 

A second aspect of the economic impact is apparatus replacement. FDNY had 98 

vehicles destroyed. What would be the "critical loss" (e.g., 3 engines, 10 engines, etc.) 

for other departments? That would have to be determined individually by each 

department, based upon the absolute minimum level of fire and EMS protection the 

department would be willing to maintain, as well as the availability of loaner apparatus

(from other departments, dealers, and manufacturers) and mutual-aid availability and 

response times. 

Other aspects that should be considered include revenue generation methods used by the 

jurisdictions to replace apparatus, the economic downturn in every State since September

11, 2001, and how those factors would affect replacement strategies. Public Assistance

Grants provided $28.3 million for destroyed vehicles and related equipment due to the 

WTC attack; this is approximately $288,775/vehicle. Will this type of funding be 

available in the future? Will the new NRP or other policy changes at the Federal level 

replace any requirements for Federal reimbursement or add any new methods for

recovering this type of loss? Much of this information is yet unknown. 

ISSUE: A major incident has the potential to have a significant long-term 

health impact on a department's members and on the citizens of the local 

area. 

75
RECOMMENDATIONS

This is a huge area and ties in with the economic impact to the individual department and 

the locality. The total number of people (civilians as well as responders) whose health 

has been affected by the WTC attacks is unknown. For departments whose emergency 

responders have been diagnosed with WTC Cough, the ultimate cost of short- and longterm medical treatment, work time lost, disability retirement benefits, etc., may be

incalculable.

According to Newsday.com on September 30, 2002: 

"Physicians in the city [NY] have made it clear: The malady now officially called

World Trade Center cough is like nothing they've ever seen, and hundreds--

perhaps thousands--of people are experiencing it. The extent of this lung disease 

is not known, and for a combination of bureaucratic reasons, the extent of the

human health impact may be understated. Moreover, cleanup efforts may be

inappropriately focused on a single element of the debris: asbestos." 

There are several Federally-sponsored health screening, monitoring, and research projects 

related to the WTC incident. Some of these include 

Data Snapshot--Understanding the Health Impact of 9/11 

(http://www.nyc.gov/html/doh/pdf/wtc/wtc-report200310.pdf) 

Environmental Health Effects of WTC (NIEHS/NIH research, Rutgers University) 

(http://www.eohsi.rutgers.edu/wtc/ehnetwork/university.shtml) 

Injuries and Illnesses Among New York City Fire Department Rescue Workers After 

Responding to the World Trade Center Attacks 

(http://www.cdc.gov/mmwr/preview/mmwrhtml/mm51SPa1.htm) 

World Trade Center Worker and Volunteer Medical Screening Program

(http://www.cdc.gov/niosh/inquiry/WTCmeetMay2/pdfs/volunteer.pdf) 

Another health issue is chronic stress-related problems in responders. While there has 

not been much information on this topic specifically related to the terrorist attacks, it is

just as important as the WTC Cough in terms of addressing health issues. The two health 

issues are important and complex enough to warrant their own report. 

76
RECOMMENDATIONS

RECOMMENDATION: Recognize the need to initiate medical evaluation

and followup for responders, as well as long-term health monitoring, 

following a major incident. 

The fire and emergency services are well versed in providing short-term medical care to 

responders who are injured at incidents. Long-term medical care and health monitoring 

aren't as commonplace. Capabilities for these services are available from many research

and teaching hospitals, and often through arrangements with Local or State heath 

departments. 

A medical evaluation, followup and health monitoring process was implemented by 

Fairfax County, Virginia, Fire and Rescue Department in 1988 following a response to a 

ruptured gasoline pipeline. Dozens of responders were exposed to gasoline fumes for 

several hours as they worked to evacuate residents and contain a flowing spill of 270,000 

gallons of unleaded fuel. Approximately 2 weeks after the incident, initial medical 

evaluations were done on the responders most significantly exposed. A joint team of 

physicians and nurses from the Fairfax County Health Department, Fairfax Hospital, and 

George Washington University Medical Center (GWUMC) conducted the evaluations. 

Thirteen responders required long-term medical followup and health monitoring; this was

done by the GWUMC Occupational Medicine Department. Only 3 of the 13 had any 

time lost from work due to the exposure. 

In the event of a major incident with potential long-term health effects for responders 

and/or citizens, consideration should be given to conducting a study of those potentially 

exposed. Such studies can be initiated by the local medical community, often through the 

local or the State public health agency. Federal agencies that may sponsor, conduct, or 

assist with such studies include the Centers for Disease Control and Prevention (CDC) 

entities: Agency for Toxic Substances and Disease Registry (ATSDR), National 

Institutes for Environmental Health Sciences (NIEHS), the National Institutes of Health 

(NIH), and the National Institute for Occupational Safety and Health (NIOSH). 

77
RECOMMENDATIONS

The long-term health impact on responders from a major incident will be minimized by 

implementing other recommendations in this report, such as "Develop a continuous and 

comprehensive hazard monitoring capability for the incident site and the community" and 

"Develop and implement a plan to provide Critical Incident Stress Management to 

responders early in the incident." 

78
CONCLUSIONS AND SUMMARY 

SECTION 3: 

CONCLUSIONS AND SUMMARY

79 
CONCLUSIONS AND SUMMARY 

 

80
CONCLUSIONS AND SUMMARY 

CONCLUSIONS AND SUMMARY 

Numerous after-action reports related to the role of the fire and emergency services in 

multijurisdictional, long-term operations were reviewed. This review, in conjunction with 

the openness of those involved in the September 11, 2001, and the Anthrax responses, led 

to many recommendations and approaches. These recommendations should assist fire and 

emergency service organizations to develop their own plan to deal with a large-scale 

incident. The review also raised unanswered questions. 

FDNY experienced an unprecedented loss of personnel and apparatus as a result of the 

WTC collapses. Hopefully, this will never happen again. However, it may be an 

indication of the type of terrorist-intended consequence. Much has been published on 

emergency workers being the target for secondary attacks. If the destruction of response 

infrastructure is anticipated in the future, should our Nation prepare a replacement 

philosophy to resupply and restaff an affected locality? 

Who will/should bear the cost of replacing apparatus? In the weeks that followed the

events of September 11, 2001, the citizens of our Nation responded in an equally 

unprecedented manner. New fire apparatus from volunteer fire companies and other 

organizations were donated to FDNY to replace certain pieces of apparatus that were 

destroyed by the collapses. Can, or should, this type of generosity be expected the next 

time one of our communities experiences the loss of response infrastructure? Following 

the attacks:

• The New York Stock Exchange was closed for 6 days. 

• The stock market volatility wiped out $1.2 trillion of equity portfolio values in the 

first week after trading resumed. 

• There was $13 billion in destroyed private and government equity. 

• There were 146,100 jobs lost in New York attributed to the attacks. 

81
CONCLUSIONS AND SUMMARY 

The entire country has suffered an economic impact as a result of these events. 

Would/Could this generosity be repeated in the current economic downturn? 

As time passes, more and more cases of "World Trade Center Cough" continue to 

surface. What will the overall impact be on the health of those exposed to the hazardous

materials? What will the final physical effects be on those who have already developed 

symptoms? How many others will present symptoms in the future--not only responders, 

but also civilians who worked at the site, visitors who were exposed during the collapse, 

and residents who lived in the path of the "cloud"? How many cases will surface in other 

parts of the country or internationally as the visitors seek medical attention at home? 

How many responders are dealing with chronic, posttraumatic stress related problems? 

Very little has been published related to this. What is the financial impact in terms of

direct medical costs, time lost, early retirement, etc.? The economic and health-related 

questions posed are outside the scope of this report. It will take time and further

definitive research to determine those answers; but the answers need to be found. 

The National Incident Management System (NIMS) was released on March 1, 2004. The

NIMS is a consistent, nationwide approach for Federal, State, tribal, and local 

governments to work effectively and efficiently together to prepare for, prevent, respond 

to, and recover from any type of incident, regardless of cause, size, location, or 

complexity. It is a core set of concepts, principles, and terminology, and is applicable for 

all incidents and across all levels of government. The NIMS is based on six key 

components, which address many of the issues identified in this report: 

1. Command and Management, including the use of ICS/Unified Command, 

multiagency coordination systems, and public information systems. 

2. Preparedness, including preparedness planning, training and exercises, personnel 

qualification and certification, and mutual-aid agreements. 

3. Resource Management, including resource typing, mobilizing and tracking 

resources, and reimbursement. 

4. Communications and Information Management, including interoperable 

communications and information databases. 

82
CONCLUSIONS AND SUMMARY 

5. Supporting Technologies, including scientific support and research. 

6. Ongoing Management and Maintenance, using a multiagency, multidiscipline 

approach based on lessons learned and best practices. 

The DHS also has released the Initial NRP (INRP). During a disaster, Federal assets and

resources generally will be requested and deployed consistent with the procedures 

identified in the FRP, the U.S. Government Domestic Counterterrorism Concept of 

Operations Plan, and other related plans. The Initial NRP establishes that a Principal 

Federal Official will oversee the coordination of the deployment and the application of 

Federal assets and resources in support of the onscene Incident Commander, and in 

collaboration with other Federal officials identified in existing plans. A JFO will be 

established, operating under an ICS-type structure, where the various Federal entities 

supporting State and local operations at the incident will be collocated. The final NRP is 

scheduled to be released in June 2004. 

While many questions remain unanswered, much has been learned that will assist the fire 

and emergency services in preparing for and improving the response to these types of 

events. This report discussed various recommendations related to responses with national 

consequences. These recommendations are based on the findings of a variety of afteraction reports and interviews with chief officers involved in managing the events of

September 11, 2001. Although all of the information in this report is pertinent, the 

recommendations are summarized in this section for quick reference for departments as 

they develop policies and procedures to improve their own preparedness. 

AWARENESS/PREVENTION/PREPAREDNESS 

• Develop a local and regional capability to augment and sustain a reinforced

response. 

• Develop a plan for continued public safety protection and service provision in a 

jurisdiction affected by a major incident. 

83
CONCLUSIONS AND SUMMARY 

• Develop a formal, organized policy for the orderly recall of organizational 

personnel. 

• Develop an organizational policy to define/guide the deployment of personnel to 

assist other agencies in time of crisis. 

• Develop statewide mutual-aid agreements for resource acquisition and 

deployment. 

• Complete and document an assessment on all target hazards. 

• Develop regular interagency planning and training to improve large-scale, multiagency response and incident management. 

• Develop a coordinated traffic management and regional evacuation plan. 

• Develop and train supplemental community resources to provide initial 

assessment and assistance. 

INITIAL RESPONSE 

• Develop a policy to control requested and non-requested resources and eliminate 

freelancing of public safety resources. 

• Establish a Unified Command function as soon as possible. 

• Follow established procedures for FBI integration into a Unified Command 

structure. 

• Develop the capability and policy for scene security that includes perimeter 

control, force protection, and responder credentialing. 

84
CONCLUSIONS AND SUMMARY 

• Develop local response capability to implement control zones quickly. 

• Identify remote staging areas in the recall/response policy. 

• Develop a multicasualty/multipatient incident capability. 

• Develop a risk-based capability to decontaminate responders and large numbers 

of civilians rapidly. 

• Develop a continuous and comprehensive hazard monitoring capability for the 

incident site and the community. 

• Use the highest-ranking official present to serve as a link among the decisionmaking entities. 

• Develop an efficient and effective Unified Operations capability. 

• Develop a comprehensive communications plan to address cell phone overload 

and radio interoperability among responding mutual-aid organizations. 

• Develop a robust incident logistics capability. 

• Develop a robust incident planning capability. 

• Develop a means to keep incident responders updated with credible information 

about additional threats and events outside the immediate scene. 

85
CONCLUSIONS AND SUMMARY 

STABILIZED EVENT/ONGOING RECOVERY 

• Develop a plan to integrate State and Federal assets into an established incident 

management system. 

• Develop and implement a plan to provide Critical Incident Stress Management to 

responders. 

• Develop and implement an effective management structure to receive, inventory, 

organize, distribute, and account for large-scale donations and manage civilian 

volunteers. 

• Develop a plan to manage inquiries about the well-being of both responders and 

victims and coordinate family notification of emergency worker fatalities. 

POSTEVENT/LONG-TERM RECOVERY 

• Develop local doctrine to ensure the proper transfer of command as dictated by

incident needs. 

• Develop a mechanism to maintain the most complete and accurate incident

response information possible. 

• Maintain the capability to rapidly hire and train replacement firefighters and EMS 

providers and obtain replacement apparatus and equipment. 

• Recognize the need to initiate medical evaluation, followup, and long-term health 

monitoring following a major incident. 

86
APPENDIX A: ISSUES-RECOMMENDATIONS CHECKLIST

APPENDIX A: 

ISSUES-RECOMMENDATIONS 

CHECKLIST 

87 
APPENDIX A: ISSUES-RECOMMENDATIONS CHECKLIST

88 
APPENDIX A: ISSUES-RECOMMENDATIONS CHECKLIST

Area/ 

Priority

Issue 

(Current Situation) 

Recommendation 

(Action Items)

Short 

Term

(0-6 mos.) 

Medium

Term

(6-18 mos.) 

Long 

Term

(18-36 mos.)

AWARENESS/PREVENTION/PREPAREDNESS 

1 

A community may not have 

adequate resources to sustain 

a reinforced response to a 

major incident. 

Develop a local and regional 

capability to augment and 

sustain a reinforced response. X 

2 

The response to a major 

incident may deplete local 

resources, while the population 

continues to experience typical 

emergencies.

Develop a plan for continued 

public safety protection and 

service provision in a jurisdiction 

affected by a major incident. X 

3 

Personnel may need to be

recalled to duty during the 

early stages of a major 

incident. 

Develop a formal, organized 

policy for the orderly recall of 

organizational personnel. X 

4 

Departments or organizations 

from nonaffected jurisdictions 

may self-dispatch to the scene, 

leaving their own communities 

at risk. 

Develop an organizational policy 

to define/guide the deployment of 

personnel to assist other 

agencies in time of crisis. X 

5 

The size, scope, or complexity 

of an incident may overwhelm 

local emergency service 

resources.

Develop statewide mutual-aid 

agreements for resource 

acquisition and deployment. X 

6 

Complete knowledge and 

accurate structural and hazard 

information about the incident 

site may not be readily 

available. 

Complete and document an

assessment on all target 

hazards. X 

7 

The integration of local, State, 

and Federal resources may not 

occur effectively during a multiagency response to a major 

incident. 

Develop regular interagency 

planning and training to improve 

large-scale, multiagency 

response and incident 

management. 

X 

8 

During a major incident, traffic 

arteries will become congested 

rapidly, delaying responding

resources.

Develop a coordinated traffic 

management and regional 

evacuation plan. X 

9 

Untrained local citizens and

community groups will attempt 

to help in times of crisis. 

Develop and train supplemental 

community resources to provide 

initial assessment and 

assistance to public safety 

organizations. 

X 

89 
APPENDIX A: ISSUES-RECOMMENDATIONS CHECKLIST

Area/ 

Priority

Issue 

(Current Situation) 

Recommendation 

(Action Items)

Short 

Term

(0-6 mos.) 

Medium

Term

(6-18 mos.) 

Long 

Term

(18-36 mos.)

INITIAL RESPONSE

1 

During a major incident, 

unrequested personnel and 

equipment arriving to offer 

unsolicited assistance will 

create confusion, congestion, 

uncoordinated operations, 

difficulties in planning, and

increased hazards to 

responders. 

Develop a policy to control 

requested and nonrequested 

resources and eliminate 

freelancing of public safety 

resources. X 

2 

Interagency communication

and coordination may not be 

effective during a multiagency 

incident. 

Establish a Unified Command 

function as soon as possible 

after the initial response. X 

3 

Specific communication and 

coordination between the 

Unified Command Team and 

the FBI may not be effective 

during a terrorist event. 

Follow the established 

procedures for FBI integration 

into a Unified Command 

structure to mange the 

consequences of a terrorist 

event. 

X 

4 

Responders are considered

targets in terrorist incidents. 

Develop the capability and policy 

for scene security that includes 

perimeter control, force 

protection, and responder 

credentialing.

X 

5 

Operational boundaries may 

not be effective enough to 

ensure protection of both 

responders and civilians. 

Develop local response 

capability to implement control 

zones quickly. X 

6 

Convergence of apparatus too 

close to the incident site may 

impede site access for needed 

apparatus and resources. 

Identify remote staging areas in 

the recall/response policy. 

X 

7 

A major incident can result in a 

high number of injuries and 

casualties. 

Develop a multicasualty/multipatient incident capability. X 

8 

Responders and the public

may be exposed to multiple

hazardous contaminants 

during a major incident. 

Develop risk-based capability to 

decontaminate responders and 

large numbers of civilians rapidly. X 

90 
APPENDIX A: ISSUES-RECOMMENDATIONS CHECKLIST

Area/ 

Priority

Issue 

(Current Situation) 

Recommendation 

(Action Items)

Short 

Term

(0-6 mos.) 

Medium

Term

(6-18 mos.) 

Long 

Term

(18-36 mos.)

INITIAL RESPONSE (cont'd)

9 

Major incident sites pose 

multiple health hazards to 

responders, civilian volunteers, 

and the general public. 

Develop a continuous and 

comprehensive hazard 

monitoring capability for the 

incident site and the community, 

as indicated. 

X

10 

Communication may be 

hampered during a major 

incident because decisionmakers are located in multiple 

areas. 

Use the highest-ranking official 

present to serve as a link among 

the decisionmaking entities. X

11 

The specific operational 

responsibilities of multiple 

agencies may not be 

coordinated effectively during a 

major incident. 

Develop an efficient and effective 

Unified Operations capability. 

X

12 

Normal methods of 

communicating among units or 

agencies may not exist during 

a major event. 

Develop a comprehensive 

communications plan to address 

initial cell phone overload and 

potential radio interoperability 

among responding mutual-aid 

organizations. 

X

13 

Major incidents are multifaceted and may require a

significant amount and/or type 

of resources not routinely 

available for day-to-day 

operations. 

Develop a robust incident 

logistics capability. 

X

14 

Forecasting actions needed to 

coordinate activities and 

resources effectively may not 

be available during a major 

incident. 

Develop a robust incident 

planning capability. 

X

15 

Responders tend to focus only 

on immediate aspects of the 

incident, and may not be aware 

of related critical information. 

Develop a means to keep

incident responders updated with 

credible information about 

additional threats and events 

outside the immediate scene. 

X

91 
APPENDIX A: ISSUES-RECOMMENDATIONS CHECKLIST

Area/ 

Priority

Issue 

(Current Situation) 

Recommendation 

(Action Items)

Short 

Term

(0-6 mos.) 

Medium

Term

(6-18 mos.) 

Long 

Term

(18-36 mos.)

STABILIZED EVENT/ONGOING RECOVERY 

1 

State and Federal agencies

involved with the management 

of events may not have an 

understanding of the roles,

responsibilities, and 

capabilities of those other 

agencies involved. 

Develop a plan to integrate State 

and Federal assets into an

established incident 

management system. X

2 

Horrific incidents can have a 

significant psychological 

impact on responders. 

Develop and implement a plan to 

provide Critical Incident Stress 

Management to responders early 

in the incident. 

X

3 

Outpouring of citizen 

contributions can overwhelm 

an already taxed response

system.

Develop and implement an 

effective management structure 

to receive, inventory, organize, 

distribute, and account for largescale donations and manage 

civilian volunteers. 

X 

4 

The local jurisdiction will be 

inundated with requests from

the public for information. 

Develop a plan to manage the 

volume of inquiries about the 

well-being of both responders 

and victims and to coordinate 

family notification of emergency 

worker fatalities.

X 

92 
APPENDIX A: ISSUES-RECOMMENDATIONS CHECKLIST

Area/ 

Priority

Issue 

(Current Situation) 

Recommendation 

(Action Items)

Short 

Term

(0-6 mos.) 

Medium

Term

(6-18 mos.) 

Long 

Term

(18-36 mos.)

POSTEVENT/LONG-TERM RECOVERY 

1 

The responsibilities for 

managing different stages of 

major incidents will vary among 

agencies. 

Develop local doctrine to ensure 

the proper transfer of command 

as dictated by incident needs. X 

2 

Adequate and appropriate

information about all aspects of 

incident response may be 

difficult to identify, document, 

and maintain. 

Develop a mechanism to 

maintain the most complete and 

accurate incident response 

information possible. X

3 

A major incident has the 

potential to have a significant 

long-term financial impact on a 

department and on the overall 

economy of the local area. 

Maintain the capability to rapidly 

hire and train replacement 

firefighters and EMS providers 

and obtain replacement 

apparatus and equipment in 

order to continue providing

adequate public protection, even 

during difficult economic times. 

X

4 

A major incident has the 

potential to have a significant 

long-term health impact on a 

department's members and on 

the citizens of the local area. 

Recognize the need to initiate 

medical evaluation and followup

for responders, as well as longterm health monitoring, following

a major incident. 

X

93 
APPENDIX A: ISSUES-RECOMMENDATIONS CHECKLIST

94 
APPENDIX B: HOMELAND SECURITY PRESIDENTIAL DIRECTIVE-5 

APPENDIX B: 

HOMELAND SECURITY 

PRESIDENTIAL DIRECTIVE-5 

 

95 
APPENDIX B: HOMELAND SECURITY PRESIDENTIAL DIRECTIVE-5 

96
APPENDIX B: HOMELAND SECURITY PRESIDENTIAL DIRECTIVE-5 

Subject: Management of Domestic Incidents 

Purpose 

(1) To enhance the ability of the United States to manage domestic incidents by 

establishing a single, comprehensive national incident management system. 

Definitions 

(2) In this directive: 

(a) The term "Secretary" means the Secretary of Homeland Security. 

(b) The term "Federal departments and agencies" means those executive departments

enumerated in 5 U.S.C. 101, together with the Department of Homeland Security; 

independent establishments as defined by 5 U.S.C. 104(1); government corporations as 

defined by 5 U.S.C. 103(1); and the United States Postal Service. 

(c) The terms "State," "local," and the "United States" when it is used in a geographical 

sense, have the same meanings as used in the Homeland Security Act of 2002, Public 

Law 107-296. 

Policy 

(3) To prevent, prepare for, respond to, and recover from terrorist attacks, major disasters, 

and other emergencies, the United States Government shall establish a single,

comprehensive approach to domestic incident management. The objective of the United 

States Government is to ensure that all levels of government across the Nation have the 

capability to work efficiently and effectively together, using a national approach to

domestic incident management. In these efforts, with regard to domestic incidents, the

United States Government treats crisis management and consequence management as a 

single, integrated function, rather than as two separate functions. 

(4) The Secretary of Homeland Security is the principal Federal official for domestic

incident management. Pursuant to the Homeland Security Act of 2002, the Secretary is 

responsible for coordinating Federal operations within the United States to prepare for, 

respond to, and recover from terrorist attacks, major disasters, and other emergencies. 

The Secretary shall coordinate the Federal Government's resources utilized in response to 

or recovery from terrorist attacks, major disasters, or other emergencies if and when any 

one of the following four conditions applies: (1) a Federal department or agency acting

under its own authority has requested the assistance of the Secretary; (2) the resources of 

State and local authorities are overwhelmed and Federal assistance has been requested by 

the appropriate State and local authorities; (3) more than one Federal department or 

agency has become substantially involved in responding to the incident; or (4) the 

Secretary has been directed to assume responsibility for managing the domestic incident 

by the President. 

97 
APPENDIX B: HOMELAND SECURITY PRESIDENTIAL DIRECTIVE-5 

(5) Nothing in this directive alters, or impedes the ability to carry out, the authorities of

Federal departments and agencies to perform their responsibilities under law. All Federal 

departments and agencies shall cooperate with the Secretary in the Secretary's domestic

incident management role. 

(6) The Federal Government recognizes the roles and responsibilities of State and local 

authorities in domestic incident management. Initial responsibility for managing domestic 

incidents generally falls on State and local authorities. The Federal Government will 

assist State and local authorities when their resources are overwhelmed, or when Federal 

interests are involved. The Secretary will coordinate with State and local governments to

ensure adequate planning, equipment, training, and exercise activities. The Secretary will 

also provide assistance to State and local governments to develop all-hazards plans and 

capabilities, including those of greatest importance to the security of the United States,

and will ensure that State, local, and Federal plans are compatible. 

(7) The Federal Government recognizes the role that the private and nongovernmental 

sectors play in preventing, preparing for, responding to, and recovering from terrorist 

attacks, major disasters, and other emergencies. The Secretary will coordinate with the

private and nongovernmental sectors to ensure adequate planning, equipment, training, 

and exercise activities and to promote partnerships to address incident management

capabilities. 

(8) The Attorney General has lead responsibility for criminal investigations of terrorist 

acts or terrorist threats by individuals or groups inside the United States, or directed at 

United States citizens or institutions abroad, where such acts are within the Federal 

criminal jurisdiction of the United States, as well as for related intelligence collection

activities within the United States, subject to the National Security Act of 1947 and other 

applicable law, Executive Order 12333, and Attorney General-approved procedures 

pursuant to that Executive Order. Generally acting through the Federal Bureau of 

Investigation, the Attorney General, in cooperation with other Federal departments and 

agencies engaged in activities to protect our national security, shall also coordinate the 

activities of the other members of the law enforcement community to detect, prevent, 

preempt, and disrupt terrorist attacks against the United States. Following a terrorist 

threat or an actual incident that falls within the criminal jurisdiction of the United States,

the full capabilities of the United States shall be dedicated, consistent with United States 

law and with activities of other Federal departments and agencies to protect our national 

security, to assisting the Attorney General to identify the perpetrators and bring them to 

justice. The Attorney General and the Secretary shall establish appropriate relationships

and mechanisms for cooperation and coordination between their two departments. 

(9) Nothing in this directive impairs or otherwise affects the authority of the Secretary of

Defense over the Department of Defense, including the chain of command for military

forces from the President as Commander in Chief, to the Secretary of Defense, to the

commander of military forces, or military command and control procedures. The

Secretary of Defense shall provide military support to civil authorities for domestic 

incidents as directed by the President or when consistent with military readiness and 

98
APPENDIX B: HOMELAND SECURITY PRESIDENTIAL DIRECTIVE-5 

appropriate under the circumstances and the law. The Secretary of Defense shall retain 

command of military forces providing civil support. The Secretary of Defense and the 

Secretary shall establish appropriate relationships and mechanisms for cooperation and 

coordination between their two departments. 

(10) The Secretary of State has the responsibility, consistent with other United States 

Government activities to protect our national security, to coordinate international

activities related to the prevention, preparation, response, and recovery from a domestic 

incident, and for the protection of United States citizens and United States interests 

overseas. The Secretary of State and the Secretary shall establish appropriate 

relationships and mechanisms for cooperation and coordination between their two 

departments. 

(11) The Assistant to the President for Homeland Security and the Assistant to the 

President for National Security Affairs shall be responsible for interagency policy

coordination on domestic and international incident management, respectively, as 

directed by the President. The Assistant to the President for Homeland Security and the 

Assistant to the President for National Security Affairs shall work together to ensure that 

the United States domestic and international incident management efforts are seamlessly 

united. 

(12) The Secretary shall ensure that, as appropriate, information related to domestic 

incidents is gathered and provided to the public, the private sector, State and local 

authorities, Federal departments and agencies, and, generally through the Assistant to the 

President for Homeland Security, to the President. The Secretary shall provide 

standardized, quantitative reports to the Assistant to the President for Homeland Security

on the readiness and preparedness of the Nation -- at all levels of government -- to 

prevent, prepare for, respond to, and recover from domestic incidents. 

(13) Nothing in this directive shall be construed to grant to any Assistant to the President 

any authority to issue orders to Federal departments and agencies, their officers, or their 

employees. 

Tasking 

(14) The heads of all Federal departments and agencies are directed to provide their full 

and prompt cooperation, resources, and support, as appropriate and consistent with their 

own responsibilities for protecting our national security, to the Secretary, the Attorney 

General, the Secretary of Defense, and the Secretary of State in the exercise of the 

individual leadership responsibilities and missions assigned in paragraphs (4), (8), (9), 

and (10), respectively, above. 

(15) The Secretary shall develop, submit for review to the Homeland Security Council, 

and administer a National Incident Management System (NIMS). This system will 

provide a consistent nationwide approach for Federal, State, and local governments to 

work effectively and efficiently together to prepare for, respond to, and recover from

99
APPENDIX B: HOMELAND SECURITY PRESIDENTIAL DIRECTIVE-5 

domestic incidents, regardless of cause, size, or complexity. To provide for 

interoperability and compatibility among Federal, State, and local capabilities, the NIMS 

will include a core set of concepts, principles, terminology, and technologies covering the 

incident command system; multi-agency coordination systems; unified command; 

training; identification and management of resources (including systems for classifying 

types of resources); qualifications and certification; and the collection, tracking, and 

reporting of incident information and incident resources. 

(16) The Secretary shall develop, submit for review to the Homeland Security Council, 

and administer a National Response Plan (NRP). The Secretary shall consult with

appropriate Assistants to the President (including the Assistant to the President for 

Economic Policy) and the Director of the Office of Science and Technology Policy, and 

other such Federal officials as may be appropriate, in developing and implementing the 

NRP. This plan shall integrate Federal Government domestic prevention, preparedness, 

response, and recovery plans into one all-discipline, all-hazards plan. The NRP shall be 

unclassified. If certain operational aspects require classification, they shall be included in 

classified annexes to the NRP. 

(a) The NRP, using the NIMS, shall, with regard to response to domestic incidents, 

provide the structure and mechanisms for national level policy and operational direction 

for Federal support to State and local incident managers and for exercising direct Federal 

authorities and responsibilities, as appropriate. 

(b) The NRP will include protocols for operating under different threats or threat levels; 

incorporation of existing Federal emergency and incident management plans (with 

appropriate modifications and revisions) as either integrated components of the NRP or 

as supporting operational plans; and additional operational plans or annexes, as 

appropriate, including public affairs and intergovernmental communications. 

(c) The NRP will include a consistent approach to reporting incidents, providing 

assessments, and making recommendations to the President, the Secretary, and the 

Homeland Security Council. 

(d) The NRP will include rigorous requirements for continuous improvements from 

testing, exercising, experience with incidents, and new information and technologies. 

(17) The Secretary shall: 

(a) By April 1, 2003, (1) develop and publish an initial version of the NRP, in 

consultation with other Federal departments and agencies; and (2) provide the Assistant 

to the President for Homeland Security with a plan for full development and 

implementation of the NRP. 

(b) By June 1, 2003, (1) in consultation with Federal departments and agencies and with 

State and local governments, develop a national system of standards, guidelines, and 

protocols to implement the NIMS; and (2) establish a mechanism for ensuring ongoing 

100
APPENDIX B: HOMELAND SECURITY PRESIDENTIAL DIRECTIVE-5 

management and maintenance of the NIMS, including regular consultation with other 

Federal departments and agencies and with State and local governments. 

(c) By September 1, 2003, in consultation with Federal departments and agencies and the 

Assistant to the President for Homeland Security, review existing authorities and 

regulations and prepare recommendations for the President on revisions necessary to 

implement fully the NRP. 

(18) The heads of Federal departments and agencies shall adopt the NIMS within their 

departments and agencies and shall provide support and assistance to the Secretary in the 

development and maintenance of the NIMS. All Federal departments and agencies will 

use the NIMS in their domestic incident management and emergency prevention, 

preparedness, response, recovery, and mitigation activities, as well as those actions taken 

in support of State or local entities. The heads of Federal departments and agencies shall 

participate in the NRP, shall assist and support the Secretary in the development and 

maintenance of the NRP, and shall participate in and use domestic incident reporting 

systems and protocols established by the Secretary. 

(19) The head of each Federal department and agency shall: 

(a) By June 1, 2003, make initial revisions to existing plans in accordance with the initial 

version of the NRP. 

(b) By August 1, 2003, submit a plan to adopt and implement the NIMS to the Secretary 

and the Assistant to the President for Homeland Security. The Assistant to the President 

for Homeland Security shall advise the President on whether such plans effectively 

implement the NIMS. 

(20) Beginning in Fiscal Year 2005, Federal departments and agencies shall make

adoption of the NIMS a requirement, to the extent permitted by law, for providing 

Federal preparedness assistance through grants, contracts, or other activities. The 

Secretary shall develop standards and guidelines for determining whether a State or local 

entity has adopted the NIMS. 

Technical and Conforming Amendments to National Security Presidential Directive-1 

(NSPD-1) 

(21) NSPD-1 ("Organization of the National Security Council System") is amended by 

replacing the fifth sentence of the third paragraph on the first page with the following: 

"The Attorney General, the Secretary of Homeland Security, and the Director of the

Office of Management and Budget shall be invited to attend meetings pertaining to their 

responsibilities." 

Technical and Conforming Amendments to National Security Presidential Directive-8 

(NSPD-8) 

101
APPENDIX B: HOMELAND SECURITY PRESIDENTIAL DIRECTIVE-5 

(22) NSPD-8 ("National Director and Deputy National Security Advisor for Combating

Terrorism") is amended by striking "and the Office of Homeland Security," on page 4, 

and inserting "the Department of Homeland Security, and the Homeland Security 

Council" in lieu thereof. 

Technical and Conforming Amendments to Homeland Security Presidential Directive-2 

(HSPD-2) 

(23) HSPD-2 ("Combating Terrorism Through Immigration Policies") is amended as 

follows: 

(a) striking "the Commissioner of the Immigration and Naturalization Service (INS)" in 

the second sentence of the second paragraph in section 1, and inserting "the Secretary of 

Homeland Security" in lieu thereof; 

(b) striking "the INS," in the third paragraph in section 1, and inserting "the Department

of Homeland Security" in lieu thereof; 

(c) inserting ", the Secretary of Homeland Security," after "The Attorney General" in the

fourth paragraph in section 1; 

(d) inserting ", the Secretary of Homeland Security," after "the Attorney General" in the 

fifth paragraph in section 1; 

(e) striking "the INS and the Customs Service" in the first sentence of the first paragraph

of section 2, and inserting "the Department of Homeland Security" in lieu thereof; 

(f) striking "Customs and INS" in the first sentence of the second paragraph of section 2, 

and inserting "the Department of Homeland Security" in lieu thereof; 

(g) striking "the two agencies" in the second sentence of the second paragraph of section 

2, and inserting "the Department of Homeland Security" in lieu thereof; 

(h) striking "the Secretary of the Treasury" wherever it appears in section 2, and inserting

"the Secretary of Homeland Security" in lieu thereof; 

(i) inserting ", the Secretary of Homeland Security," after "The Secretary of State" 

wherever the latter appears in section 3; 

(j) inserting ", the Department of Homeland Security," after "the Department of State," in 

the second sentence in the third paragraph in section 3; 

(k) inserting "the Secretary of Homeland Security," after "the Secretary of State," in the 

first sentence of the fifth paragraph of section 3; 

102
APPENDIX B: HOMELAND SECURITY PRESIDENTIAL DIRECTIVE-5 

(l) striking "INS" in the first sentence of the sixth paragraph of section 3, and inserting 

"Department of Homeland Security" in lieu thereof; 

(m) striking "the Treasury" wherever it appears in section 4 and inserting "Homeland 

Security" in lieu thereof; 

(n) inserting ", the Secretary of Homeland Security," after "the Attorney General" in the 

first sentence in section 5; and 

(o) inserting ", Homeland Security" after "State" in the first sentence of section 6. 

Technical and Conforming Amendments to Homeland Security Presidential Directive-3 

(HSPD-3) 

(24) The Homeland Security Act of 2002 assigned the responsibility for administering the 

Homeland Security Advisory System to the Secretary of Homeland Security. 

Accordingly, HSPD-3 of March 11, 2002 ("Homeland Security Advisory System") is 

amended as follows: 

(a) replacing the third sentence of the second paragraph entitled "Homeland Security 

Advisory System" with "Except in exigent circumstances, the Secretary of Homeland

Security shall seek the views of the Attorney General, and any other Federal agency 

heads the Secretary deems appropriate, including other members of the Homeland 

Security Council, on the Threat Condition to be assigned." 

(b) inserting "At the request of the Secretary of Homeland Security, the Department of 

Justice shall permit and facilitate the use of delivery systems administered or managed by 

the Department of Justice for the purposes of delivering threat information pursuant to 

the Homeland Security Advisory System." as a new paragraph after the fifth paragraph of 

the section entitled "Homeland Security Advisory System." 

(c) inserting ", the Secretary of Homeland Security" after "The Director of Central

Intelligence" in the first sentence of the seventh paragraph of the section entitled

"Homeland Security Advisory System". 

(d) striking "Attorney General" wherever it appears (except in the sentences referred to in

subsections (a) and (c) above), and inserting "the Secretary of Homeland Security" in lieu 

thereof; and 

(e) striking the section entitled "Comment and Review Periods." 

GEORGE W. BUSH 

103
APPENDIX B: HOMELAND SECURITY PRESIDENTIAL DIRECTIVE-5 

104
APPENDIX C: NIMS FACT SHEET FOR EMERGENCY RESPONSE AGENCIES

APPENDIX C: 

NIMS FACT SHEET FOR 

EMERGENCY RESPONSE AGENCIES 

105 
APPENDIX C: NIMS FACT SHEET FOR EMERGENCY RESPONSE AGENCIES

106 
APPENDIX C: NIMS FACT SHEET FOR EMERGENCY RESPONSE AGENCIES

The National Incident Management System 

Fact Sheet for Emergency Response Agencies 

Homeland Security Presidential Directive 5 

To prevent, prepare for, respond to, and recover from terrorist attacks, major disasters, 

and other emergencies, the United States Government shall establish a single, 

comprehensive approach to domestic incident management. The objective of the United 

States Government is to ensure that all levels of government across the Nation have the 

capability to work efficiently and effectively together, using a national approach to 

domestic incident management. 

What is the National Incident Management System, or NIMS? 

The NIMS is... 

– Core set of 

• Doctrine 

• Concepts 

• Principles 

• Terminology 

• Organizational processes 

– Applicable to all hazards 

The NIMS is not... 

– An operational incident management plan 

– A resource allocation plan 

– A terrorism / WMD-specific plan 

– Designed to address international events 

The NIMS has Six Components 

1. Command and Management 

2. Preparedness 

3. Resource Management 

4. Communications and Information Management 

5. Supporting Technologies 

6. Ongoing Management and Maintenance 

1. Command and Management 

The NIMS standardizes incident management for all hazards and across all levels of 

government. The NIMS-standard incident command structures are based on three key 

constructs: 

Incident Command System

Multiagency Coordination Systems 

Public Information Systems 

107 
APPENDIX C: NIMS FACT SHEET FOR EMERGENCY RESPONSE AGENCIES

2. Preparedness 

The NIMS establishes specific measures and capabilities that jurisdictions and agencies 

should develop and incorporate into an overall system to enhance operational 

preparedness for incident management on a steady-state basis in an all-hazards context. 

The operational preparedness of our nation’s incident management capabilities is distinct 

from the preparedness of the individual citizens and private industry. 

3. Resource Management 

The NIMS defines standardized mechanisms to describe, inventory, track, and dispatch 

resources before, during, and after an incident; it also defines standard procedures to 

recover equipment once it is no longer needed for an incident. 

4. Communications & Information Management 

Effective communications, information management, and information and intelligence 

sharing are critical aspects of domestic incident management. The NIMS 

communications and information systems enable the essential functions needed to 

provide a common operating picture and interoperability for incident management at all 

levels. 

5. Supporting Technologies 

The NIMS promotes national standards and interoperability for supporting technologies 

to successfully implement the NIMS, as well as standard technologies for specific 

professional disciplines or incident types. It provides an architecture for science and 

technology support to incident management. 

6. Ongoing Management & Maintenance 

The DHS will establish a multi-jurisdictional, multi-disciplinary NIMS Integration 

Center. This Center will provide strategic direction for, and oversight of, the NIMS, 

supporting both routine maintenance and the continuous improvement of the system over 

the long term. 

The NIMS Integration Center will facilitate the development and promulgation of the 

standards addressing the components of the NIMS. 

All users and stakeholders--including various levels of government, functional 

disciplines, and private entities--will be given the opportunity to participate in the NIMS 

Integration Center activities. 

NIMS Timelines and Compliance Requirements 

March 1, 2004--Secretary Ridge announced the NIMS. 

108
APPENDIX C: NIMS FACT SHEET FOR EMERGENCY RESPONSE AGENCIES

October 1, 2004--State and local organizations must adopt the NIMS to receive Federal 

preparedness assistance (through grants, contracts, and other activities). 

Short-term compliance for local, State, and Federal entities is possible by adopting the 

Incident Command System as articulated in the NIMS document dated March 1, 2004. 

By October 1, 2004--the NIMS Integration Center will begin publishing additional 

standards, guidelines, and compliance protocols. 

Other components require additional development and refinement to enable future 

compliance (e.g., data and communications systems interoperability) 

Impact of the NIMS on Local Agencies 

The NIMS recognizes the National Wildfire Coordinating Group (NWCG) ICS training 

as a model for course curricula and materials applicable to the NIMS: 

ICS-100, Introduction to ICS 

ICS-200, Basic ICS 

ICS-300, Intermediate ICS 

ICS-400 Advanced ICS 

The USFA’s National Fire Academy and Emergency Management Institute both follow 

this model in their ICS training curricula. At the local level, agencies may contact the 

fire department for information and training on ICS. 

There are two minor differences between the NIMS ICS and the FIRESCOPE ICS or 

NFA Model ICS: 

Under NIMS, the intelligence and information function may be organized in one 

of the following ways: 

• Officer within the Command Staff

• Unit within the Planning Section 

• Branch within the Operations Section 

• Separate General Staff section 

Under NIMS, the Command Staff position previously known as "Information 

Officer" will be known as "Public Information Officer." 

Emergency response personnel and others involved in incident management will be 

required to comply with national qualification standards. The NIMS Integration Center 

will facilitate the development of these national qualification and certification standards. 

Personnel that are certified for employment in support of an incident that transcends 

interstate jurisdictions will be required to meet national qualification and certification 

standards. 

109
APPENDIX C: NIMS FACT SHEET FOR EMERGENCY RESPONSE AGENCIES

Mutual aid agreements provide the means for one jurisdiction to provide resources, 

facilities, services, and other required support to another jurisdiction during an incident. 

Each jurisdiction should be party to a mutual aid agreement with all neighboring or 

nearby jurisdictions, as well as relevant private sector and non-governmental 

organizations. The NIMS will facilitate the development of State and local mutual aid 

agreements. 

The full NIMS document is available for download from . . .

http://www.dhs.gov/interweb/assetlibrary/NIMS-90-web.pdf 

Additional information on the NIMS 

www.dhs.gov 

www.fema.gov 

www.usfa.fema.gov 

State fire training agencies 

State emergency management agencies 

110
APPENDIX D: FBI INTERFACE 

APPENDIX D: 

FBI INTERFACE 

111 
APPENDIX D: FBI INTERFACE 

112 
APPENDIX D: FBI INT

ERFACE 

JOINT OPERATIONS CENTER

(JOC)

FBI

UNIFIED COMMAND 

FIRE-LAW ENFORCEMENT

EMS-PUBLIC HEALTH

FBI (Ass't special agent in charge)

EMERGENCY OPERATIONS CENTER

STATE OR LOCAL 

EOC

JOINT INFORMATION CENTER (JIC)

FBI

SAFETY

LIAISON

INFORMATION

PLANNING

SECTION

DEPUTY (FBI WMD Coordinator)

OPERATIONS SECTION 

Fire

DEPUTIES

FBI (SA or JTTF)-Fire-LE-PH-EMS

LOGISTICS

SECTION

FINANCE/

ADMINISTRATION

SECTION

BRANCH

MEDICAL

BRANCH

Health

BRANCH

Law

BRANCH

Fire

BRANCH

FBI

Operations Section Chief will change as the incident goesfrom rescue to recovery and a crime scene investigation.

JOINT OPERATIONS CENTER

(JOC)

FBI

UNIFIED COMMAND 

FIRE-LAW ENFORCEMENT

EMS-PUBLIC HEALTH

FBI (Ass't special agent in charge)

EMERGENCY OPERATIONS CENTER

STATE OR LOCAL 

EOC

JOINT INFORMATION CENTER (JIC)

FBI

SAFETY

LIAISON

INFORMATION

PLANNING

SECTION

DEPUTY (FBI WMD Coordinator)

OPERATIONS SECTION 

Fire

DEPUTIES

FBI (SA or JTTF)-Fire-LE-PH-EMS

LOGISTICS

SECTION

FINANCE/

ADMINISTRATION

SECTION

BRANCH

MEDICAL

BRANCH

Health

BRANCH

Law

BRANCH

Fire

BRANCH

FBI

Operations Section Chief will change as the incident goesfrom rescue to recovery and a crime scene investigation.

FBI Interface 

113 
APPENDIX D: FBI INTERFACE 

114
APPENDIX E: ACRONYMS 

APPENDIX E: 

ACRONYMS 

115
APPENDIX E: ACRONYMS 

116
APPENDIX E: ACRONYMS 

ACFD.............................................................................Arlington County Fire Department 

ACPD......................................................................... Arlington County Police Department 

CERT ................................................................... Community Emergency Response Team

CIDS ......................................................................... Critical Information Dispatch System 

CISM...........................................................................Critical Incident Stress Management 

DHS................................................................................ Department of Homeland Security 

DOD................................................................................................. Department of Defense 

DOJ.................................................................................................... Department of Justice 

EAMVO...................................................... Executive Analysis of Multi-Venue Operations 

EAP...................................................................................... Employee Assistance Program

ECC...............................................................................Emergency Communication Center 

EMS ........................................................................................Emergency Medical Services 

EMSSO ................................................... Emergency Medical Services Special Operations 

EOC.......................................................................................Emergency Operations Center 

EPA.................................................................................Environmental Protection Agency 

ESF......................................................................................... Emergency Support Function 

FAA................................................................................... Federal Aviation Administration 

FBI ......................................................................................Federal Bureau of Investigation 

FDNY..................................................................Fire Department of the City of New York 

FEMA .................................................................Federal Emergency Management Agency 

FRP ...................................................................................................Federal Response Plan 

HHS...........................................................................................Health and Human Services 

HSPD ..................................................................Homeland Security Presidential Directive 

IAP....................................................................................................... Incident Action Plan 

IC..........................................................................................................Incident Commander 

ICP ..................................................................................................Incident Command Post 

ICS .............................................................................................Incident Command System

IMT .......................................................................................... Incident Management Team

INRP .....................................................................................Initial National Response Plan 

IST.....................................................................................................Incident Support Team

JFO............................................................................................................ Joint Field Office 

117
APPENDIX E: ACRONYMS 

JOC ..................................................................................................Joint Operations Center 

MCI................................................................................................. Multi-Casualty Incident 

MDT...................................................................................................Mobile Data Terminal 

MOU ..................................................................................Memorandum of Understanding 

MPI ....................................................................................................Multi-Patient Incident 

MWAA ......................................................... Metropolitan Washington Airports Authority 

NIMS.......................................................................National Incident Management System 

NRP................................................................................................. National Response Plan 

NWCG .....................................................................National Wildfire Coordinating Group 

OEM...............................................................................Office of Emergency Management 

PPE.......................................................................................Personal Protective Equipment 

SOP ....................................................................................... Standard Operating Procedure 

SVFC..........................................................................Shanksville Volunteer Fire Company 

UOPSC....................................................................Utah Olympic Public Safety Command 

US&R........................................................................................... Urban Search and Rescue 

VDOT ..................................................................... Virginia Department of Transportation 

WTC...................................................................................................... World Trade Center 

118