This section provides information on the characteristics of RDD and IND attacks, major cities considered at high risk of terrorist act, core capabilities for all hazards preparedness, and response planning and associated federal guidance in the national preparedness system. A radiological attack is defined as an event or series of events leading to the deliberate release, or potential release into the environment, of radioactive materials in sufficient quantity to require consideration of protective actions. Such an act would probably be executed with no advance warning. The typical means of dispersing radioactive material in an RDD is through a conventional explosion. There is a wide range of possible consequences from an RDD incident depending on the type and size of the device and the extent of dispersal. According to FEMA officials, the most likely RDD attack would impact a small area and not result in acutely harmful radiation doses to exposed individuals but could result in latent effects increasing the risk of cancer to exposed individuals. In contrast, an IND attack would produce a nuclear explosion from fissile material, which releases extreme heat and powerful shock waves, and disperses radiation that would be lethal for a significant distance. It also produces radioactive fallout, which would deposit radioactive material over a large area. If the fission of the radioactive material is not achieved, the effects of the explosion may resemble the impacts of an RDD. A 2011 Congressional Research Service report states that the use of an RDD is more likely than an IND because the radioactive material to construct an RDD is more accessible, and it would be more difficult for a terrorist to make an IND. In both cases, early response within the first hours includes initial actions to protect public health and welfare. In 2003, DHS established an Urban Areas Security Initiative program to allocate homeland security grants to enhance and sustain the capacity to prevent, protect against, mitigate, respond to, and recover from acts of terrorism in high density urban areas, particularly the urban centers. The program identifies these high density urban areas by their major city. For example, the Chicago area includes 3 states, 14 counties, and 10 principal cities. Figure 1 shows the 31 major cities in the Urban Areas Security Initiative program in fiscal year 2012 within the 10 FEMA regions. In the National Preparedness Goal, DHS identified core capabilities needed for each of the five national preparedness mission areas. These core capabilities are considered necessary for an all hazards, capability- based approach to preparedness planning across all levels of government, although each level of government does not have to possess all capabilities. The five mission areas have in common three core capabilities—planning, public information and warning, and operational coordination—in addition to other capabilities specific to each mission area. For the response mission area, there are 11 additional core capabilities, for a total of 14. In compiling the list of core response capabilities, DHS based them on those capabilities that would be needed to respond to a large earthquake, major hurricane, and a weapon of mass destruction attack. Table 1 describes the activities for each of the 14 core capabilities in the response mission area that DHS considers necessary to save lives, protect property, and meet basic human needs after a catastrophic incident, such as an RDD or IND attack. Under the national preparedness system, FEMA has issued guidance to help planners at all levels of government develop and maintain viable, all hazards emergency operations plans. This guidance describes how to develop and maintain emergency operations plans and how to implement these plans. While the basic emergency operations plan is oriented around an all hazards approach, FEMA guidance states that special policies may be necessary to respond to catastrophic incidents, such as an RDD or IND attack. According to FEMA guidance, local governments have the discretion to address these attacks in specific plans that are annexed to a city’s emergency operations plan, and the inclusion of these annexes will vary based on a jurisdiction’s assessment of the risks it faces. DHS guidance establishing the national preparedness system recognizes that since local governments will focus their planning efforts on the more likely risks, federal planning must complement these planning efforts for low-probability, high-consequence risks, such as a terrorist attack using an RDD or IND. DHS issued preliminary guidance for RDD and IND response planning to federal, state, and local governments in 2008, through a Federal Register announcement, that was followed in 2010 with additional federal guidance on responding to an IND attack. Some professional organizations have also published guidance covering measures that state and local government should consider in responding to RDD and IND attacks. Figure 2 illustrates the conceptual response planning framework, including possible nuclear or radiological attack annexes as supplements to all hazards operational or emergency operations plans supporting national preparedness. Many major city emergency managers, although not all, responded to our questionnaire that their city had assessed the risks of RDD and IND attacks and had ranked the risk of these attacks as lower than the risk of other hazards their city faces. The results of our questionnaire also show that fewer than half of the major cities that responded had developed specific RDD and IND response plans. Most of the major cities that reported having RDD and IND response plans also reported having conducted exercises to validate those plans. Emergency managers of many of the major cities responding to our questionnaire reported that their city assessed the risk of RDD and IND attacks and ranked those risks as lower than other hazards their city faces. We asked emergency managers to refer to their city’s most recently completed Hazard Identification and Vulnerability Assessment, and report whether they assessed the risk of RDD or IND attacks and, if so, where those risks ranked relative to the other hazards assessed by their city, such as hurricanes, tornadoes, and flooding. All 27 cities responded to our question regarding their assessment of the risks of RDD and IND attacks. Three major cities reported that they had not completed a Hazard Identification and Vulnerability Assessment, or a similar assessment, and 6 cities reported that while they did have a recent assessment, they did not include either RDD or IND attacks in this assessment. Of the remaining 18 cities, 7 combined RDD and IND attacks into a single risk in their assessments, 9 assessed the risk of RDD and IND attacks separately, and 2 assessed the risk of an RDD attack but did not assess the risk of an IND attack. Of the 11 cities that assessed the risk of an RDD attack separately, 7 ranked the risk as lower than most or all other hazards their city faces. Of the 9 cities that separately assessed the risk of an IND attack, 7 ranked the risk as lower than most or all other hazards their city faces. In general, most cities that conducted a separate risk assessment for both RDD and IND reported that the risk of an RDD attack was higher than the risk of an IND attack. Table 2 shows the approach taken by the major cities responding to our questionnaire for assessing the risks of RDD and IND attacks, as well as the percentage of cities for each approach that ranked these risks lower than most or all other hazards they face. According to the responses to our questionnaire, fewer than half of the major cities have response plans that specifically address RDD and IND attacks, although some emergency managers indicated that their city had these plans in development. Of the 27 major cities that responded to our questionnaire, 11 (41 percent) of the emergency managers reported that their city had completed RDD response plans, and 8 (30 percent) had completed IND response plans. Some emergency managers for cities that did not have specific RDD and IND response plans reported that they would rely on other plans in the event of such an attack, including their city’s emergency operations plan or hazard management plan. Table 3 identifies the extent to which major cities have hazard-specific RDD or IND response plans. The questionnaire results regarding the number of cities with specific response plans for RDD and IND attacks are generally consistent with prior analyses conducted by FEMA. In 2010, FEMA conducted a national review of the contents of state and urban area emergency operations plans. FEMA found that more than 80 percent of urban areas reported that their emergency operations plans were well-suited to meet the challenges presented during large-scale or catastrophic incidents; however, fewer than half expressed confidence that specific RDD and IND response plans annexed to their emergency operations plans were adequate to manage such attacks. Forty percent of the urban areas had confidence in their RDD response plans, with 10 percent providing no response. Thirty percent said they had confidence in their IND response plans, with 20 percent providing no response. Most emergency managers responding to our questionnaire who reported having specific RDD or IND response plans also reported having conducted exercises to validate those plans based on federal guidance. According to FEMA, a response plan should not be considered complete until exercises are conducted to validate it. Of the 11 cities that have specific RDD response plans, 9 of their emergency managers reported that their city had participated in RDD exercises from 2010 to 2012. Of the 8 cities that have specific IND response plans, 5 of their emergency managers reported that their city had participated in IND exercises over this same time period. These results are comparable to FEMA’s 2010 national review of emergency operations plans that found that plans were frequently exercised. Specifically, 95 percent of all states and urban areas (including the major cities in our questionnaire) had conducted exercises using their basic plans, an increase from the previous review in 2006, and the response planning annexes subject to the most exercises included those involving the response to the release of hazardous materials, which can include the dispersal of radioactivity from RDD and IND attacks. Major city emergency managers responding to our questionnaire varied widely in their perception of their cities’ abilities to respond within the first 24 hours (early response) to an RDD or IND attack. Limited DHS guidance exists that is applicable to major cities on the capabilities needed for early response to an RDD attack, but more such guidance exists for the early response to an IND attack.