## 2 Overview of Cyber Threats in EM  
During an emergency, human mistakes are naturally common. Time pressure and the lack of familiarisation of EM practitioners with concepts of cyber security [18] would make it relatively easy  
Figure 1: Example of technologies involved in the Response phase. for cyber attackers to exploit human mistakes, possibly through social engineering. The insider threat or Man-at-the-end attack, as suggested in [19], may also be significant. For example, in 1992, a failure of Chevron's computerised emergency alert system delayed the authorities from notifying the public of a chemical release accident. The failure was caused by a disgruntled former employee who had disabled the emergency alert function [20]. While the human element is certainly critical in the EM context, our emphasis here is on the vulnerabilities of the technologies involved (Tables 1-3). \begin{table}
\begin{tabular}{l l l l} \hline \hline \begin{table}
\begin{tabular}{l l l l} \hline
**Technology** & **Security threat** & **Impact** & **Countermeasures** \\ \hline \multirow{8}{*}{Satellite-based Sensing} & GPS Spoofing [50] & Misleading GPS coordinates used for positioning calculations & Signal analysis [51, 52, 53] \\ \cline{2-3}  & On-board computer reconfiguration [54] & Covert activity & No known solutions \\ \cline{2-3}  & Jamming & Loss of signal & Multiplexing, Spread-Spectrum, EHF frequencies, directional antenna beams, signal processing _etc._[55] \\ \hline \multirow{8}{*}{Sensor Networks} & Compromised node [56, 57] & Battery exhaustion, spoofed/altered/replay messages & Detection based on both network and sensor measurements [58], collaborative sensor detection \\ \cline{2-3}  & Sybil attack [59] & Multiple fake identities used to collaboratively overcome cryptographic techniques & Collaborative detection [60] \\ \cline{2-3}  & Rogue nodes in EM medical body sensor network [61] & Unauthorised use & Light-weight cryptography [62] \\ \cline{2-3}  & Denial of service in EM medical body sensor network & Loss of availability & Body sensor network IDS [63] \\ \cline{2-3}  & & & \\ \end{tabular}
\end{table} 
Table 2: Sensing security threats and proposed EM countermeasures. \begin{table}
\begin{tabular}{l l l l} \hline
**Technology** & **Security threat** & **Impact** & **Countermeasures** \\ \hline \multirow{8}{*}{Social Media} & Account hijacking/relay attack [47] & Rogue messages transmitted on behalf of emergency services & Social media management applications \\ \cline{2-3}  & Intentionally false information provided to emergency services [47] & EM influenced by misleading information & No known technical solutions. Discussion provided in [48] \\ \cline{2-3}  & Bot-generated messages & Spam or misleading information sent to EM & Random Forest Classifier for bot detection [49] \\ \cline{2-3}  & & Social media account & \\ \hline \end{tabular}
\end{table} 
Table 1: _Cont._Likewise, the protection of EM against cyber threats can be enhanced through strengthening the technology, the processes or the awareness of people involved. Each EM-supporting system may need to be updated and patched regularly to avoid attacks on known vulnerabilities, as well as to keep appropriate logs for detecting and investigating cyber events. Process practices and guidelines would bring the level of security of Emergency Management Information Systems (EMIS) up to date with industrial standards and would assist auditing. Human mistakes and susceptibility to social engineering could be reduced through training programs for EM personnel, as well as through the introduction of strong cyber security policies on user privileges. Such procedural improvements to information security have been discussed in [18] and a prime example is the Red Cross, whose engineers maintain ghost master system images with operating systems and software needed in disaster zones.