This section provides information on the characteristics of RDD and IND attacks, major cities considered at high risk of terrorist act, core capabilities for all hazards preparedness, and response planning and associated federal guidance in the national preparedness system. A radiological attack is defined as an event or series of events leading to the deliberate release, or potential release into the environment, of radioactive materials in sufficient quantity to require consideration of protective actions. Such an act would probably be executed with no advance warning. The typical means of dispersing radioactive material in an RDD is through a conventional explosion. There is a wide range of possible consequences from an RDD incident depending on the type and size of the device and the extent of dispersal. According to FEMA officials, the most likely RDD attack would impact a small area and not result in acutely harmful radiation doses to exposed individuals but could result in latent effects increasing the risk of cancer to exposed individuals. In contrast, an IND attack would produce a nuclear explosion from fissile material, which releases extreme heat and powerful shock waves, and disperses radiation that would be lethal for a significant distance. It also produces radioactive fallout, which would deposit radioactive material over a large area. If the fission of the radioactive material is not achieved, the effects of the explosion may resemble the impacts of an RDD. A 2011 Congressional Research Service report states that the use of an RDD is more likely than an IND because the radioactive material to construct an RDD is more accessible, and it would be more difficult for a terrorist to make an IND. In both cases, early response within the first hours includes initial actions to protect public health and welfare. In 2003, DHS established an Urban Areas Security Initiative program to allocate homeland security grants to enhance and sustain the capacity to prevent, protect against, mitigate, respond to, and recover from acts of terrorism in high density urban areas, particularly the urban centers. The program identifies these high density urban areas by their major city. For example, the Chicago area includes 3 states, 14 counties, and 10 principal cities. Figure 1 shows the 31 major cities in the Urban Areas Security Initiative program in fiscal year 2012 within the 10 FEMA regions. In the National Preparedness Goal, DHS identified core capabilities needed for each of the five national preparedness mission areas. These core capabilities are considered necessary for an all hazards, capability- based approach to preparedness planning across all levels of government, although each level of government does not have to possess all capabilities. The five mission areas have in common three core capabilities—planning, public information and warning, and operational coordination—in addition to other capabilities specific to each mission area. For the response mission area, there are 11 additional core capabilities, for a total of 14. In compiling the list of core response capabilities, DHS based them on those capabilities that would be needed to respond to a large earthquake, major hurricane, and a weapon of mass destruction attack. Table 1 describes the activities for each of the 14 core capabilities in the response mission area that DHS considers necessary to save lives, protect property, and meet basic human needs after a catastrophic incident, such as an RDD or IND attack. Under the national preparedness system, FEMA has issued guidance to help planners at all levels of government develop and maintain viable, all hazards emergency operations plans. This guidance describes how to develop and maintain emergency operations plans and how to implement these plans. While the basic emergency operations plan is oriented around an all hazards approach, FEMA guidance states that special policies may be necessary to respond to catastrophic incidents, such as an RDD or IND attack. According to FEMA guidance, local governments have the discretion to address these attacks in specific plans that are annexed to a city’s emergency operations plan, and the inclusion of these annexes will vary based on a jurisdiction’s assessment of the risks it faces. DHS guidance establishing the national preparedness system recognizes that since local governments will focus their planning efforts on the more likely risks, federal planning must complement these planning efforts for low-probability, high-consequence risks, such as a terrorist attack using an RDD or IND. DHS issued preliminary guidance for RDD and IND response planning to federal, state, and local governments in 2008, through a Federal Register announcement, that was followed in 2010 with additional federal guidance on responding to an IND attack. Some professional organizations have also published guidance covering measures that state and local government should consider in responding to RDD and IND attacks. Figure 2 illustrates the conceptual response planning framework, including possible nuclear or radiological attack annexes as supplements to all hazards operational or emergency operations plans supporting national preparedness. Many major city emergency managers, although not all, responded to our questionnaire that their city had assessed the risks of RDD and IND attacks and had ranked the risk of these attacks as lower than the risk of other hazards their city faces. The results of our questionnaire also show that fewer than half of the major cities that responded had developed specific RDD and IND response plans. Most of the major cities that reported having RDD and IND response plans also reported having conducted exercises to validate those plans. Emergency managers of many of the major cities responding to our questionnaire reported that their city assessed the risk of RDD and IND attacks and ranked those risks as lower than other hazards their city faces. We asked emergency managers to refer to their city’s most recently completed Hazard Identification and Vulnerability Assessment, and report whether they assessed the risk of RDD or IND attacks and, if so, where those risks ranked relative to the other hazards assessed by their city, such as hurricanes, tornadoes, and flooding. All 27 cities responded to our question regarding their assessment of the risks of RDD and IND attacks. Three major cities reported that they had not completed a Hazard Identification and Vulnerability Assessment, or a similar assessment, and 6 cities reported that while they did have a recent assessment, they did not include either RDD or IND attacks in this assessment. Of the remaining 18 cities, 7 combined RDD and IND attacks into a single risk in their assessments, 9 assessed the risk of RDD and IND attacks separately, and 2 assessed the risk of an RDD attack but did not assess the risk of an IND attack. Of the 11 cities that assessed the risk of an RDD attack separately, 7 ranked the risk as lower than most or all other hazards their city faces. Of the 9 cities that separately assessed the risk of an IND attack, 7 ranked the risk as lower than most or all other hazards their city faces. In general, most cities that conducted a separate risk assessment for both RDD and IND reported that the risk of an RDD attack was higher than the risk of an IND attack. Table 2 shows the approach taken by the major cities responding to our questionnaire for assessing the risks of RDD and IND attacks, as well as the percentage of cities for each approach that ranked these risks lower than most or all other hazards they face. According to the responses to our questionnaire, fewer than half of the major cities have response plans that specifically address RDD and IND attacks, although some emergency managers indicated that their city had these plans in development. Of the 27 major cities that responded to our questionnaire, 11 (41 percent) of the emergency managers reported that their city had completed RDD response plans, and 8 (30 percent) had completed IND response plans. Some emergency managers for cities that did not have specific RDD and IND response plans reported that they would rely on other plans in the event of such an attack, including their city’s emergency operations plan or hazard management plan. Table 3 identifies the extent to which major cities have hazard-specific RDD or IND response plans. The questionnaire results regarding the number of cities with specific response plans for RDD and IND attacks are generally consistent with prior analyses conducted by FEMA. In 2010, FEMA conducted a national review of the contents of state and urban area emergency operations plans. FEMA found that more than 80 percent of urban areas reported that their emergency operations plans were well-suited to meet the challenges presented during large-scale or catastrophic incidents; however, fewer than half expressed confidence that specific RDD and IND response plans annexed to their emergency operations plans were adequate to manage such attacks. Forty percent of the urban areas had confidence in their RDD response plans, with 10 percent providing no response. Thirty percent said they had confidence in their IND response plans, with 20 percent providing no response. Most emergency managers responding to our questionnaire who reported having specific RDD or IND response plans also reported having conducted exercises to validate those plans based on federal guidance. According to FEMA, a response plan should not be considered complete until exercises are conducted to validate it. Of the 11 cities that have specific RDD response plans, 9 of their emergency managers reported that their city had participated in RDD exercises from 2010 to 2012. Of the 8 cities that have specific IND response plans, 5 of their emergency managers reported that their city had participated in IND exercises over this same time period. These results are comparable to FEMA’s 2010 national review of emergency operations plans that found that plans were frequently exercised. Specifically, 95 percent of all states and urban areas (including the major cities in our questionnaire) had conducted exercises using their basic plans, an increase from the previous review in 2006, and the response planning annexes subject to the most exercises included those involving the response to the release of hazardous materials, which can include the dispersal of radioactivity from RDD and IND attacks. Major city emergency managers responding to our questionnaire varied widely in their perception of their cities’ abilities to respond within the first 24 hours (early response) to an RDD or IND attack. Limited DHS guidance exists that is applicable to major cities on the capabilities needed for early response to an RDD attack, but more such guidance exists for the early response to an IND attack. According to FEMA officials, the agency is considering developing additional guidance on nuclear and radiological incidents to be annexed to the forthcoming FIOPs for the response and recovery mission areas that may help guide the preparation of specific response plans to supplement the all hazards emergency operations plans of cities interested in doing so. Our analysis of the questionnaire responses from major city emergency managers showed a wide variation in their perceptions regarding their cities’ abilities to respond within the first 24 hours to the RDD or IND attack depicted in the National Planning Scenarios, but most perceived that their city has more ability to conduct the early response for an RDD attack than for an IND attack. To gather this information, we obtained the emergency managers’ self-assessments of their cities’ abilities for early response to the national planning scenarios for RDD and IND attacks, but we did not ask them to assess their level of ability for each of the 14 federal core response capabilities. We also asked them to consider mutual aid from other jurisdictions in estimating their early response abilities, but not to consider assistance from federal sources. Our analysis of emergency manager responses showed a wide variation in perceived early response abilities across the major cities. For example, 7 of 27 cities were perceived by their emergency managers as being able to conduct all of the activities needed for early response to an RDD attack without federal assistance—such as treating casualties—while 2 cities were perceived as being able to conduct all of the activities needed for an IND attack, without federal assistance. Moreover, all cities were perceived by their emergency managers as being able to conduct at least a few early response activities for an RDD attack, while 10 cities were perceived as not being able to conduct any early response activities for an IND attack. Overall, our analysis concluded that more emergency managers perceived that their city was able to conduct some, almost all, or all of the early response activities needed for an RDD attack (22 of 27 cities) compared with an IND attack (7 of 27 cities). Ten major cities reported not having any ability to conduct the early response after an IND attack, even considering assistance from the surrounding jurisdictions and their states, which would suggest a high expectation for federal assistance during early response. For RDD, emergency managers from 20 major cities reported perceiving that their city was not able to conduct all of the necessary early response activities, which may also suggest some expectation for federal assistance. Figure 3 shows the distribution of major cities among five categories of early response activities following an RDD or IND attack based on emergency manager perceptions of their city’s early response abilities including mutual aid from other jurisdiction but not federal assistance. The wide variation among emergency manager perceptions of their cities’ abilities to conduct the early response to RDD and IND attacks is not necessarily related to whether or not a city had specific response plans. Our analysis found that 10 of the 17 major cities perceived by their emergency managers as being able to conduct all or almost all the necessary response activities for an RDD attack did not have specific RDD response plans. For IND attacks, three of the four major city perceived by their emergency managers as able conduct all or almost all of the necessary response activities for an IND attack did not have specific IND response plans. Regarding the wide differences in emergency managers’ perceptions of their cities’ abilities to respond, FEMA officials told us that some cities will tend to overestimate the risks of an RDD attack due to their lack of understanding about dispersed radioactive material and underestimate their actual abilities to conduct responses across the federal core response capabilities. They told us that cities in states with nuclear power plants are likely to have a greater understanding of the possible effects of a radiological attack and thus might be able to assess the risks and their cities’ abilities to respond better than other cities. These cities would have access to state technical and resource assistance developed and exercised to respond to a radiological dispersal incident at a nuclear power plant, which would have some characteristics of the dispersal of radioactive material by an RDD. Moreover, FEMA officials told us that cities closer to federal offices and facilities tend to have more interaction with FEMA and NNSA subject matter experts and are likely to have a greater understanding of the nature of an RDD attack. In regard to IND attacks, FEMA officials told us that they would expect that emergency managers would claim that such an attack would overwhelm their city response resources and that their city would need federal assistance across most federal core response capabilities. DHS has provided limited guidance on the early response capabilities needed by cities for a large RDD attack based on the planning assumptions contained in the National Planning Scenarios, but more such guidance exists for the IND attack substantially based on the planning assumptions contained in the National Planning Scenarios. DHS has identified the core capabilities needed to respond to any catastrophic incident but generally not the specific capabilities needed by cities for early response to these attacks. DHS guidance contained in an annex to the 2008 National Response Framework states that an RDD or IND attack directed at a major city can have consequences that overwhelm the capabilities of state and local governments and may also seriously challenge existing federal response capabilities. In regard to RDD response, this DHS guidance states that major cities should be able to respond to small radiological releases with only occasional federal assistance but does not address the large RDD attack depicted in the National Planning Scenarios. According to FEMA and NNSA officials, additional federal guidance may not be necessary because they expect major cities to have the abilities to respond to a more likely smaller scale RDD attack than the large RDD attack, as they would a hazardous materials spill. If needed, the federal response to a hazardous materials release is described in an emergency support function covering oil and hazardous materials releases that is annexed to the National Response Framework. DHS has also issued guidance on protective actions that should be taken at various phases of response, including early response to the dispersal of radioactive materials, such in an RDD attack. However, the only detailed planning assumptions in current federal guidance for an RDD attack are those in the National Planning Scenarios and this is for a large RDD attack. DHS has not provided guidance on the early response capabilities needed by major cities for such an attack. According to NNSA officials, cities are likely to reach out for federal support in the case of either a large or small-scale RDD attack due to the rarity of the event and the high profile of any radiological emergency. The federal government has issued more guidance pertaining to early response to an IND attack substantially based on the National Planning Scenario. In 2009, DHS issued an interim concept of operations plan for the federal response to the IND attack. This federal operations plan states that the federal priority in the first 24 hours is to assist in saving lives and reducing casualties, while providing advice to those in the incident area to shelter in the nearest structure and listen for instructions from authorities. This federal operations plan also directs the states and local governments to delineate control zones, coordinate evacuations, make shelter-in-place decisions, issue protective action recommendations, initiate decontamination procedures, and use the National Guard to assist with environmental monitoring, but it provides limited information on the capabilities needed to complete these actions. In 2010, a federal interagency task force issued planning guidance to all levels of government that expanded on the 2008 DHS planning guidance by addressing gaps in IND response, expanding the discussion of needed capabilities, and examining other IND scenarios beyond the one identified in the National Planning Scenario. This 2010 guidance presents general background information that builds a foundation for specific planning recommendations on response to an IND attack during the first 24 to 72 hours prior to the arrival of significant federal resources. This guidance states that other recommendations would be forthcoming, such as for establishing critical communications among first responders. This guidance recognizes that response planning must be done on a city- specific basis using city-specific impact assessments. However, this guidance also points out that response to an IND will largely be provided from neighboring jurisdictions, which would require advanced planning to establish mutual aid and response protocols. Notwithstanding the specific planning recommendations, the 2010 planning guidance does not detail the early response capabilities needed by major cities to an IND attack in relation to other sources of assistance. Without greater awareness of and additional federal guidance on the capabilities needed by cities for early response to both RDD and IND attacks, cities may not have the information they need to adequately prepare for and respond to them. Any gaps in response capabilities could lead to complications that result in greater loss of life and economic impacts. Figure 4 provides a simple illustration of the capability requirements for increasing levels of incident effects, with an IND attack likely to be the highest level of incident effect. FEMA is considering the need to develop a nuclear and radiological annex, as depicted in figure 2, to help guide federal response activities and possibly assist in the development of specific response plans for RDD and IND attacks as supplements to city emergency operations plans. This federal nuclear and radiological annex would be attached to the forthcoming FIOPs—currently under review for approval—for the all hazards planning framework for the response and recovery mission areas. FEMA officials told us that a nuclear and radiological annex may be needed to supplement these FIOPs because their all hazards orientation would not address several unique requirements and concepts of operations specifically tailored to the needs for nuclear and radiological incidents. The need for such an annex is also supported by a 2012 DHS report that found the response and recovery needs after a radiological attack differ from traditional all hazards incidents due to the need for decontamination activities, heightened public anxiety, long-term risk management, and substantial disruption to citizen’s lives and the economy. FEMA officials said that if they decide to develop a nuclear and radiological annex it could help guide adjustments to FEMA regional operational plans. They also told us that these adjustments to the regional operational plans may help encourage major cities in FEMA regions to develop annexes to their all hazards emergency operations plans covering specific RDD and IND response plans. FEMA has not determined what it might include in the nuclear and radiological annex or how to address RDD and IND response planning. FEMA officials told us that this annex is expected to address RDD and IND attacks, as well as a broader spectrum of radiological dispersal incidents, such as nuclear power plant accidents. According to FEMA guidance, separate hazards can be grouped under a more general category, such as terrorist acts, but FEMA recognizes that problems can arise that will affect subsequent analysis when grouping hazards with a wide range of consequences under a single category, such as might be the case with RDD and IND attacks. FEMA officials provided information to compare the characteristics of RDD and IND attacks, as shown in table 4. One of the characteristics is the magnitude of the RDD and IND attacks. FEMA officials told us that if they decided to develop the nuclear and radiological annex, they would also consider the need to clarify the planning assumptions for these incidents, particularly the RDD attack scenario. An additional FEMA consideration in developing the nuclear and radiological annex to the FIOPs is the information recently gained from the agency’s participation in a multigovernmental initiative to develop an IND regional operations plan for Chicago, which is intended to guide development of other regionally based IND operations plans. For example, FEMA found that the development of this IND regional operations plan provided information on needed early response capabilities, coordination of stakeholder groups, the type and timing of federal assistance, and the level of effort to complete the plan. The IND planning team determined that the most feasible course of action to save the greatest number of lives during early response involved concentrating on a limited number of activities around public information and warning, operational coordination and communications, on-scene security and protection, situational assessment, and shelter-in-place and evacuation. These activities are covered by 7 of the 14 federal core response capabilities in the national preparedness goal. In addition, IND planning team members told us that the planning effort gave them a greater appreciation of the communication and coordination activities needed across stakeholder groups to respond to an IND attack. The planning effort involved more than 300 local, state, and federal emergency management offices and private entities. Moreover, the IND planning team was able to develop a detailed spreadsheet containing the type and timing of assistance that might be available and needed—at the three response phases—for an IND attack on Chicago. The development of the plan has taken time and substantial funding. The IND planning process has been under way since 2010, costing about $7.6 million, as of 2012, when the plan was completed. This cost includes the project work of the city, the state of Illinois, neighboring states, and federal agencies that contributed to the development of the overall plan. As a result of the IND planning effort in Chicago, FEMA officials told us that they plan to use the information gained to assist other major cities seeking to develop similar operations plans with regional partners. FEMA officials told us that they also plan to undertake this planning initiative in Boston, the District of Columbia, and Houston during fiscal year 2013, with planning initiatives in Los Angeles, New York and Philadelphia to follow. In addition, FEMA officials told us that they plan to look for geographic and infrastructure similarities, such as common building structures and transportation systems in each region in order to expedite the planning process and reduce planning costs for other cities in a region. FEMA’s Response Planning Division has allocated about $3.8 million for IND planning activities for fiscal year 2013. FEMA officials also told us that they thought that an IND response plan would be sufficient to address most of the response needs after an RDD attack as well. Emergency managers of major cities responding to our questionnaire reported varying levels of need for federal support in early response to RDD and IND attacks in the form of technical and resource assistance, procedures and information for early response activities, and preparedness funding. Emergency managers identified a number of areas for federal technical and resource assistance, but we found limitations in the federal guidance applicable to major cities on the type and timing of this assistance. Emergency managers of major cities also reported the need for federal government research that could improve procedures and information for their early response to RDD and IND attacks. DHS has supported working groups of subject matter experts to help mitigate shortcomings in response capabilities for IND attacks, which may have applications for improving RDD response capabilities. In addition, emergency managers reported that a decrease in federal funding would affect their abilities to conduct early response to RDD and IND attacks. Most emergency managers from major cities responding to our questionnaire reported that they need federal technical and resource assistance to support their early response to RDD and IND attacks, but federal guidance on the type and timing of this assistance is not found in a single document and may not be well understood by emergency managers. Nineteen of 27 emergency managers perceive a need for federal technical and resource assistance for early response to an RDD attack, and 21 of them perceive a need for this assistance in early response to an IND attack. Our analysis of questionnaire responses determined that of the 14 core response capabilities, emergency managers indicated that the capability most needing federal technical and resource assistance for both RDD and IND attacks (11 of 27 cities each) was situational assessment. Situational assessment provides decision makers with technical information such as the nature and extent of the hazard, its cascading effects, and the status of the response. For RDD attacks, after situational assessment, the emergency managers’ next most frequently cited federal assistance needs were the following: public health and medical services (8 of 27 cities), operational coordination (5 of 27 cities), and on-scene security and protection (5 of 27 cities). For IND attacks, after situational assessment, the emergency managers’ next most frequently cited federal assistance needs were as follows: on-scene security and protection (5 of 27 cities), and public health and medical services (5 of 27 cities). We also obtained several responses from emergency managers regarding actions, such as planning, that the federal government should take to help sustain and improve early response capabilities. For example, one emergency manager commented that integrated RDD and IND plans of local, state, and federal government roles and responsibilities are nonexistent. Another emergency manager stated that that the federal government should provide a model RDD and IND response plan and templates to assist local jurisdictions’ efforts. The type and timing of federal assistance to major cities during the early response to an RDD or IND attack may not be well understood by all major city emergency managers, even though some guidance is available but in different documents. For example, in 2008, DHS issued guidance on federal agency responsibilities for responding to incidents involving the release of nuclear, radiological, and hazardous materials in the National Response Framework, and introduced the concept of phases of response in planning guidance for RDD and IND attacks. However, these and other guidance documents do not contain complete information on the type and timing of federal technical and resource assistance by response phases. For RDD attacks, DHS has not provided specific operational guidance on the type and timing of federal assistance that might be made available to cities for early response, although some information is available in an emergency support function annex to the National Response Framework. For IND attacks, DHS identified the technical and resource activities that federal agencies could provide to respond to an IND attack in a 2009 federal interim concept of operations plan and more recently in the 2012 IND regional operations plan for Chicago. In addition, federal agencies have provided various descriptions of the type and timing of the federal assistance that might be available on their websites. However, FEMA officials told us that the type and timing of the federal response would depend on the proximity of the city to federal offices. Confusion over the type and timing of assistance, such as federal assistance in the case of an IND attack, could produce a disjointed and untimely early response to the attack that might increase its consequences. Based on information from a variety of sources, some of which may not be readily available to major cities, we developed an illustration of the federal agencies most likely to assist these cities during early response with activities associated with the core capabilities they claim they can support after an IND attack. While other federal agencies are involved through their emergency support functions under the National Response Framework, a senior FEMA official told us that the four federal agencies we identified in figure 5 would be the most involved during the first 24 hours after an IND attack. Figure 5 provides an illustration of the federal technical and resource support for the core capabilities necessary for major city early response to an IND attack. Most emergency managers responding to our questionnaire indicated that their cities perceive a need for federal government research that could improve procedures or information for their early response to RDD and IND attacks. Using DHS guidance, we developed a list of 10 topic areas for federal government research initiatives that could improve procedures or information used by cities during the first 24 hours after the detonation of an RDD or IND. We asked emergency managers for their opinions on how much impact, if any, each topic area might have on improving their city’s capability for early response to an RDD or IND attack. For example, emergency managers from two-thirds of the major cities (18 of 27 cities) identified communicating a sheltering-in-place strategy to the public and communicating potential impacts of radiation exposure to the public as the topic areas having the highest impact. Figure 6 shows emergency managers’ responses identifying the topic areas their city considers important for improving procedures or information necessary for early response to RDD and IND attacks. We compared the emergency managers’ responses on the impact that improved procedures and information might have on their city’s early response to RDD and IND attacks with the research initiatives being considered by six FEMA IND focus working groups to determine if they align. FEMA has established these working groups of subject matter experts to mitigate shortcomings in response capabilities for an IND attack, such as clarifying responsibilities and coordinating efforts among government levels and federal agencies. We found that the areas addressed by the working groups through their initiatives are generally the same as those topic areas emergency managers reported as having a high impact on procedures and information needed for early response to an RDD and IND attack. FEMA does not have current plans to identify or attempt to fill potential gaps in capabilities for early response specifically to an RDD attack. However, IND focus area working group experts and a senior FEMA official told us that their efforts to fill gaps in IND capabilities and all hazards plans would have application for other catastrophic hazards, including RDD attacks. For example, they told us that RDD and IND attacks share some common attributes, such as (1) the release of radiological materials, (2) the need for decontamination and radiation treatment, and (3) prioritization of response resources and personnel based on ethical, philosophical, legal, and practical decision tools. In addition, both types of attacks also require communication of consistent information about radiation effects on general health outcomes and protective measures. Further, NNSA officials told us they also have several programs that might apply to RDD, as well as IND planning and capability enhancements. Most emergency managers responding to our questionnaire indicated that their cities need federal funding to maintain current early response capabilities to an RDD or IND attack. Almost all emergency managers (24 of 27 cities for RDD and 23 of 27 cities for IND) indicated that their city needs federal funding to maintain current early response capabilities. According to the 2008 National Response Framework, response capabilities are developed within the national preparedness system through effective planning, coordinating, training, equipping, and exercising activities. These activities are essential elements of an integrated, capability-based approach to preparedness. Emergency managers reported that a decrease in federal funding would affect the degree to which each of these activities builds the capabilities needed for early response to an RDD or IND attack. Our analysis of questionnaire results indicated that about a third of 27 cities identified equipment, training, and planning activities important to the capabilities that would be most affected by a decrease in federal preparedness funding, with fewer cities indicating that coordination and exercising would be affected. Federal funding to support preparedness against terrorist attacks and other catastrophic incidents such as RDD and IND attacks currently comes from seven DHS grant programs. In fiscal year 2013, DHS allocated more than $1.5 billion for these seven grant programs, but officials in charge of these programs were unable to determine how much of the funding was used by major cities to improve early RDD and IND response capabilities. Two of the DHS grant programs that have been most relevant to response preparation for an RDD or IND attack are the Homeland Security Grant Program and the temporary (fiscal years 2008 to 2011) Regional Catastrophic Planning Grant Program. In fiscal year 2013, DHS allocated more than $968 million to the Homeland Security Grant Program, and more than half (roughly $560 million) was allocated to Urban Areas Security Initiative grants, a portion of which goes to law enforcement terrorism prevention activities. The Regional Catastrophic Planning Grant Program awarded $14 million in grants in fiscal year 2011, the last year it made awards, to support regional planning efforts to address catastrophic incidents. For example, these funds were used by New York and New Jersey to develop RDD and IND response plans and were also combined with other federal funding to support development of the IND regional operations plan for Chicago. According to members of the IND planning team for Chicago, the Regional Catastrophic Planning Grant Program provided the funding to bring together the many stakeholder groups that would be involved in responding to an IND attack and, without continued funding, it would be difficult to maintain the same level of collaboration. Appendix III provides a detailed breakdown of the seven federal grant programs for fiscal year 2013. DHS has recognized that the early response to catastrophic incidents such as an RDD or IND attack on a major city is critical and has to come first from the city and surrounding jurisdictions. While cities are assumed to be preferred targets for an RDD or IND attack, in response to our questionnaire, many emergency managers indicated that their cities ranked the risk of these attacks as lower than other hazards their cities face, and fewer than half of the cities have specific response plans for such attacks. City emergency managers rely on federal guidance to prepare all hazards emergency operations plans and also specific response plans for hazards of concern that can be annexed to these emergency operations plans at the discretion of the city. However, we found limitations in the federal planning guidance applicable to the early response capabilities needed by cities for an RDD attack of the size depicted in the National Planning Scenarios. More federal planning guidance applicable to major cities has been developed for IND response, primarily based on the event depicted in the National Planning Scenarios, but this guidance does not detail the early response capabilities needed by major cities in relation to other sources of assistance. Perceptions of emergency managers varied widely on their cities’ abilities to conduct the activities needed for early response to the type of RDD attacks described in the National Planning Scenarios—with assistance from surrounding jurisdictions but not the federal government—from being able to conduct all activities for early response to being able to conduct few early response activities. Less variation was evident for perceived early response abilities to an IND attack—considering this same source of assistance—with many cities indicating that such an attack would overwhelm their response abilities. Most cities indicated the need for federal technical and resource assistance—among other areas of federal support—for early response to RDD and IND attacks, but we found that complete guidance on the type and timing of this assistance is not readily available in a single document and is not well understood by all major city emergency managers. Any confusion over the type and timing of federal assistance could produce a disjointed and untimely early response to an attack that might increase its consequences. Without greater awareness of existing federal guidance and continued actions to close gaps in the guidance applicable to cities’ early response to RDD and IND attacks, some cities may not have the information they need to adequately prepare for and respond to them. Lack of adequate response planning could lead to complications that result in greater loss of life and economic impacts. To provide assistance to major cities in planning for early response to RDD and IND attacks, we recommend that the Secretary of Homeland Security direct the Administrator for the Federal Emergency Management Agency to promote greater awareness of existing federal guidance and develop additional guidance where appropriate to clarify the capabilities needed by cities for these attacks, including the planning assumptions for an RDD attack and the type and timing of federal assistance for early response. We provided a draft of this report to DHS and to DOE through NNSA for review and comment. DHS did not concur with our recommendation and provided written comments, which are reproduced in appendix IV. In addition, in an e-mail received August 27, 2013, the Director, Audit Coordination and Internal Affairs Office of Management and Budget (NA- MB-1.1) for NNSA stated that as the recommendations in the report are directed to DHS and FEMA, NNSA would not be preparing a formal response. DHS and NNSA provided technical comments, which we incorporated as appropriate. In the comment letter, DHS states that FEMA program officials and subject matter experts are concerned that our survey may have resulted in the receipt of skewed data and information that affected our analysis and conclusions. For example, the letter stated that some respondents may have believed that an IND/RDD event would or could be fully handled at the local level and therefore provided inputs partial toward taking on an inordinate level of responsibility. They also stated that our recommendation runs contrary to the survey results which illustrate a trend of grouping RDD and IND attacks for analysis and planning. We disagree. Our questionnaire explicitly asked city emergency managers to consider response assistance from surrounding jurisdictions in their assessment of response abilities, and only exclude federal assistance. In this way, we were able to isolate the perceived need for federal support, which we found for technical and resource assistance, improved procedures and information, and funding. Further, emergency managers did not provide trend information through their questionnaire responses on assessing RDD and IND risks, and cities more often separated the assessment of RDD and IND risks than combined them as DHS indicated in its comment letter. In addition, we took a number of steps to develop the questionnaire and to identify the best source for a response. For example, we conducted extensive pretesting and obtained comments on a draft questionnaire from officials at FEMA’s National Preparedness Assessment Division. We also determined that city emergency managers were in the best position to provide a city-wide perspective on this issue, but we allowed them to seek advice from other city officials as necessary. In its comment letter, DHS stated that neither the department nor FEMA believes that our recommendation that FEMA develop additional guidance in a single document to clarify the capabilities needed by cities for these attacks, including the planning assumptions for an RDD attack and addressing the type and timing of federal assistance for early response takes into sufficient account advances made to the preparedness system. In addition, the comment letter states that FEMA program officials and subject matter experts believe the recommendation does not align with our survey results or all-hazard risk management for worst case catastrophic scenarios. It also states that FEMA has concerns with the report’s characterization of the nation’s ability to respond to a nuclear and/or radiological attack. Furthermore, the letter states that additional RDD response guidance in a single document would be counterproductive to the existing planning and guidance structure for IND and all hazards incidents. As we note in the report, FEMA is already considering development of a nuclear and radiological incident annex to the FIOPs for the response and recovery mission areas based on the recognition that the all hazards approach may be insufficient to cover the unique response needs for nuclear and radiological incidents. While our recommendation did not specify how FEMA should provide this additional guidance, we have added language to the recommendation to clarify that that we are not recommending a single guidance document to cover only RDD response. In addition, to address the DHS/FEMA concern that city emergency managers may not be fully informed about available guidance, we added language to the recommendation for FEMA to promote greater awareness of existing federal guidance. More generally, DHS’ comment letter states that FEMA officials do not believe we provided adequate context for the National Preparedness System as defined by Presidential Policy Directive 8, which may cause confusion for cold readers not familiar with how the directive has been implemented. In addition, the comment letter states that the operational frameworks, structures, and ongoing efforts that have been developed in support of the directive’s comprehensive approach to national response are not fully outlined in the report; specifically, the letter states that the Nuclear and Radiological Incident Annex to the National Response Framework and Emergency Support Functions as the nation’s coordinating structures are not accurately portrayed and cites figure 5 as an inaccurate and misleading depiction of the federal response for an IND/RDD event. While the purpose of this report was not to conduct a detailed assessment of federal guidance or implementation of the directive, we added additional information about FEMA’s leadership role in coordinating the federal response to nuclear and radiological incidents within the context of the National Response Framework and its efforts to develop IND response planning guidance. We also added that the illustration in figure 5 of federal agency support for core response capabilities that might be available to cities during the first 24 hours after an IND attack does not include all federal agencies’ activities but only those four agencies confirmed by a senior FEMA official as being most present during this time period. We are sending copies of this report to the Secretary of Homeland Security and the Secretary of Energy, the appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202)512-3841 or trimbled@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made contributions to this report are listed in appendix V. In our review, we examined major cities’ (1) assessment of the risks of RDD and IND attacks and the extent to which they have developed plans for responding to them, (2) perceptions of their abilities to respond to RDD and IND attacks in the first 24 hours (early response), and (3) perceptions of their need for federal support in the early response to RDD and IND attacks. To address these questions we sent a questionnaire to major city emergency managers, and we conducted interviews with outside experts and federal, state, and local officials. To gather information from major U.S. cities relevant to all three of our objectives, we developed a questionnaire for the directors of emergency management for each of the 31 major cities that were in the Urban Areas Security Initiative (UASI) program in fiscal year 2012. We chose the major cities within each UASI region because in our document review, as well as in interviews with the Federal Emergency Management Agency (FEMA), UASI regions were identified as higher risk jurisdictions for terrorist acts, including those using RDDs or INDs. As FEMA guidance states that local jurisdictions should plan and develop capabilities to respond to incidents based on risk, these jurisdictions are in need of developing plans and preparing for the response to RDD and IND attacks. Each of the 31 UASI locations covers a large metropolitan area that includes many local governments. For example, the Chicago UASI includes 3 states, 14 counties, and 10 principal cities. It did not serve our purpose to send the questionnaire directly through the UASI structure itself as the number of jurisdictions involved could introduce issues of reliability in the answers, as well as consistency in terms of the process used by each UASI to fill out our questionnaire. FEMA officials told us that the largest metropolitan area within each UASI constitutes the area at the highest risk for attack in each jurisdiction. In addition, we selected city emergency managers to receive the questionnaire because they were in the best position to provide a city-wide perspective on the level of preparedness to respond to RDD and IND attacks. Therefore, we chose to send questionnaires to only the emergency managers of these large metropolitan areas. The emergency management offices in Atlanta and Newark did not respond to our contact attempts, so we sent out questionnaires to the 29 cities that did reply. In developing our questionnaire, we developed questions that addressed all three of the report objectives and had these reviewed both internally, as well as by staff of FEMA’s National Preparedness Assessment Division. We conducted seven cognitive pretests with emergency management officials and first responders from major cities selected for their geographic location and population size in order to minimize errors that might occur from respondents who interpreted our questions differently than we intended. During these pretests, we also interviewed these emergency management officials and first responders to gain additional context regarding their city’s preparedness for responding to either an RDD or IND attack. The questionnaire was implemented as a self-administered Microsoft Word form e-mailed to respondents. We sent e-mail notifications to emergency managers beginning on December 11, 2012. We then sent the questionnaire and a cover e-mail to officials on December 12, 2012, and asked them to fill in the questionnaire form and e-mail it back to us within 3 weeks. To encourage emergency managers to complete the questionnaire, we sent e-mail reminders and a replacement questionnaire to nonrespondents approximately 1 week after, and again 3 weeks after, the initial questionnaire was distributed. We also made follow-up phone calls to nonrespondents from January 24, 2013, to February 8, 2013. We closed the questionnaire on February 20, 2013. We received 27 completed questionnaires for an overall response rate of 87 percent— Phoenix and San Antonio did not return the questionnaire. Because we attempted to collect data from each of the UASI major cities rather than a sample of major cities, there was no sampling error. However, the practical difficulties of conducting any questionnaire may introduce errors, commonly referred to as nonsampling errors. For example, differences in how a particular question is interpreted, the sources of information available to respondents, how the responses were processed and analyzed, or the types of people who do not respond can influence the accuracy of the questionnaire results. We took steps in the development of the questionnaire, the data collection, and the data analysis to minimize these nonsampling errors and help ensure the accuracy of the answers that were obtained. For example, a GAO social science questionnaire specialist designed the questionnaire, in collaboration with GAO staff with subject matter expertise. The draft questionnaire was pretested to ensure that questions were relevant, clearly stated, and easy to comprehend. The questionnaire was also reviewed by external experts and a second GAO questionnaire specialist. Data were electronically extracted from the Microsoft Word form questionnaires into a comma- delimited file that was then imported into a statistical program for analyses. No manual data entry was performed, thereby removing an additional potential source of error. We examined the questionnaire results and performed computer analyses to identify inconsistencies and other indications of error and addressed such issues as were necessary. Additionally, we contacted respondents to clarify ambiguous responses when necessary. Quantitative data analyses and the compilation of open- ended responses were conducted by the first GAO questionnaire specialist using statistical software and working directly with GAO staff with subject matter expertise. An independent GAO data analyst checked the statistical computer programs for accuracy. Responses to closed-ended (e.g., Yes/No) questions were summarized as standard descriptive statistics. Responses to open-ended (i.e., narrative) questions were analyzed through content analysis. In conducting the content analysis, one GAO analyst reviewed each open- ended response from each emergency manager to identify recurring themes. Using the identified themes, the analyst then developed categories for coding the responses. A second GAO analyst reviewed the responses from each emergency manager and reviewed the first analyst’s themes and categories to reach concurrence on the themes and categories. Each of the two GAO analysts then independently reviewed the answers to all open-ended questions and placed them into one or more of the categories. The analysts then compared their coding to identify any disagreements and reached agreement on all items through discussion. For the analysis of the open-ended responses on the city’s ability to respond to either an RDD or IND, we developed six categories based on the number of early response activities a city stated it could provide. Specifically, we reviewed the responses looking for whether the city would be overwhelmed, the number of specific activities the city stated it would conduct, and significant challenges it would face after the attack. To provide important context regarding current federal activities that relate to our second and third objectives on RDD and IND response planning and federal response capabilities, we traveled to Chicago to meet with federal, regional, state, and city planners who had participated in the interagency IND regional planning effort. In addition, we met with Department of Homeland Security and FEMA officials to learn how they may use insights gained from the interagency IND regional planning effort in Chicago for use in other major cities and for developing a potential nuclear and radiological annex to the draft federal interagency operational plans for the response and recovery mission areas. To obtain additional information for our third objective on the need and availability of federal early response support, we interviewed officials involved with federal research initiatives to close gaps in response capabilities, as well as those who oversaw planning funds and federal technical and resource assistance activities for RDD and IND attacks. Specifically, we interviewed FEMA emergency management interagency working groups, response planning, and grants officials; National Nuclear Security Administration emergency management response operations officials; Department of Energy national laboratory officials; and subject matter experts. We also reviewed relevant federal guidance documents. We conducted this performance audit from June 2012 to September 2013 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix III: Fiscal Year 2013 DHS Preparedness Grant Programs Funding Awarded Grant programs purpose For states and urban areas to prevent, protect against, mitigate, respond to, and recover from acts of terrorism and other threats. FY 2013 funding awarded Over $968 million (HSGP) Over $354 million (SHSP) Over $558 million (UASI) $55 million (OPSG) Over $968 million (HSGP) To support the implementation of state homeland security strategies to build and strengthen preparedness capabilities at all levels. To enhance regional preparedness and capabilities in 31 high-threat, high-density areas. To enhance cooperation and coordination among federal, state, territorial, tribal and local law enforcement agencies to jointly enhance security along the United States land and water borders. To assist state and local governments in enhancing and sustaining all hazards emergency management capabilities. Tribal Homeland Security Grant Program To implement preparedness initiatives to help strengthen the nation against risk associated with hazards including terrorist attacks. To support physical security enhancements for nonprofit organizations determined to be at high risk of a terrorist attack and located within one of the FY 2012 UASI-eligible urban areas. Intercity Passenger Rail (Amtrak) Program To protect critical surface transportation infrastructure and the traveling public from terrorism and increase Amtrak rail system resilience. To protect critical port infrastructure from terrorism, enhance maritime domain awareness, and strengthen risk management capabilities to protect against improvised explosive devices and other nonconventional weapons. To protect critical surface transportation and the traveling public from acts of terrorism and to increase the resilience of transit infrastructure. In addition to the individual named above, Ned Woodward, Assistant Director; Cheryl Arvidson; Thomas Laetz; Eli Lewine; David Lysy; Mike Silver; Kathy Smith; and Kiki Theodoropoulos made key contributions to this report.

Summary: A terrorist attack in a major city using an RDD or an IND could result not only in the loss of life but also have enormous psychological and economic impacts. Major cities are assumed to be preferred targets of such attacks, and local governments, along with their states, have primary responsibilities for early response (within the first 24 hours), with assistance from federal sources, as necessary, coming later. A disjointed or untimely response could increase the impact and undermine public confidence in federal, state and local governments' ability to respond to an attack. GAO was asked to review issues related to response preparedness for RDD and IND attacks. This report examines major cities' (1) assessment of RDD and IND risks and development of response plans, (2) perceptions of their abilities to respond within the first 24 hours, and (3) perceptions of the need for federal support in early response to these attacks. GAO primarily relied on questionnaire responses from emergency managers of 27 of the 31 major cities that the Department of Homeland Security considers to be at high risk for terrorist attack, the review of pertinent federal guidance, and interviews with FEMA officials and others. Many emergency managers from the 27 major cities responding to GAO's questionnaire, although not all, reported that their city had assessed the risks of a terrorist attack using a radiological dispersal device (RDD) or improvised nuclear device (IND) and had ranked the risk of these attacks as lower than the risk of other hazards they face. Also, 11 of the 27 reported that they had completed RDD response plans, and 8 of the 27 reported that they had completed IND response plans. Some emergency managers for cities without specific RDD and IND response plans reported that they would rely on their city's all hazards emergency operations plan or hazard management plan if attacked. Most cities that had RDD and IND response plans reported conducting exercises to validate the plans based on federal guidance. Major cities varied widely in perceptions of their abilities to respond within the first 24 hours of RDD and IND attacks (early response). For example, all 27 cities were perceived by their emergency managers as being able to conduct at least a few of the early response activities after an RDD attack, such as treating casualties, with assistance from other jurisdictions but not federal assistance. Ten of those cities were perceived as not being able to conduct any of the response activities for an IND attack without federal assistance. GAO analysis found that these perceptions were not necessarily related to a city having RDD and IND response plans but rather related to their understanding of nuclear and radiological incidents and the capabilities needed for response according to information obtained from Federal Emergency Management Agency (FEMA) officials. GAO found limited federal planning guidance related to the early response capabilities needed by cities for the large RDD attack depicted in the national planning scenarios. Federal guidance may not be needed, according to FEMA officials, because they expect cities to address a more likely but smaller RDD attack--as they would a hazardous materials spill--with limited federal assistance. More federal planning guidance applicable to cities has been developed for IND response, but this guidance does not detail the early response capabilities needed by cities in relation to other sources of assistance. Without greater awareness of and additional federal guidance on the capabilities needed by cities for early response to these attacks, cities may not have the information they need to adequately prepare for and respond to them. This could lead to complications that result in greater loss of life and economic impacts. Most emergency managers reported perceived needs for federal technical and resource assistance to support their cities' early response to RDD (19 of 27 cities) and IND (21 of 27 cities) attacks. However, GAO found that federal guidance on the type and timing of such assistance is not readily available or understood by all emergency managers. This condition could lead to a disjointed and untimely response that might increase the consequences of either kind of attack. Emergency managers also reported a need for improved procedures and more information that FEMA is addressing. In addition, most emergency managers reported their city needed federal funding to maintain current capabilities to respond to RDD and IND attacks. According to DHS guidance, response capabilities are developed through planning, training, equipping, and exercising, which are essential elements of an integrated, capability-based approach to preparedness. GAO recommends that FEMA develop guidance to clarify the early response capabilities needed by cities for RDD and IND attacks. FEMA did not concur with this recommendation. GAO believes that gaps in early response abilities warrant federal attention and has clarified its recommendation.