View as a webpage / Share

Volume 22 — Issue 25 | June 23, 2022

Vehicle manufacturers improve response guidance for incidents involving electric vehicles and lithium-ion batteries

Traffic incidents involving electric vehicles are already commonplace. The number of electric vehicles on the roads is likely to increase significantly in the next few years.

Responder safety is always a concern during incidents involving electric vehicles with lithium-ion batteries. Responders face safety risks related to electric shock, thermal runaway, battery ignition and reignition, and stranded energy.

Electric vehicle makes and models vary significantly in how they are designed. Responders need practical and accurate emergency response guidance specific to the unique features of each electric vehicle. This information is essential for safe and effective vehicle extrication, rescue, and fire suppression.

The National Transportation Safety Board (NTSB) released a report in November 2020, Safety Risks to Emergency Responders from Lithium-Ion Battery Fires in Electric Vehicles. The report recommended, among other things, that vehicle manufacturers improve their ERGs.

Key to the NTSB’s recommended improvements to electric vehicle ERGs is compliance with the International Organization for Standardization’s (ISO’s) standard 17840: Road vehicles – Information for first and second responders.

This 4-part standard outlines display labels and colors to clearly identify a vehicle’s fuel and/or energy used for propulsion, to facilitate rapid identification of alternative fuel vehicles on the roads. It also outlines a standard format, with standardized symbols and graphics, for the information about a specific vehicle that a rescue team would need when extricating the occupants in an accident.

ERGs that comply with ISO 17840 are incredibly helpful to responders because they document the features and safety risks of individual vehicles in a standardized way, making this critical information much more complete, accurate, and accessible during training and response.

Since the NTSB made its recommendations in 2020, eight vehicle manufacturers have complied with the recommendations with updated ERGs for their electric vehicles: Honda, Hyundai, Mitsubishi, Porsche, Proterra, Van Hool, Volkswagen and Volvo.

Another 12 manufacturers are making progress toward compliance: BMW, BYD, Stellantis (formerly Fiat Chrysler Automobiles US), Ford, General Motors, Gillig, Kia, Mercedes-Benz, Nissan, Subaru, Tesla and Toyota.

Most vehicle manufacturers who have fully complied with the NTSB’s recommendations have posted their updated ERGs on their websites and submitted them to the National Fire Protection Association (NFPA) for inclusion in its Alternative Fuel Vehicle Safety Training program. The NFPA posts all of these ERGs in one convenient location.

The NTSB is tracking progress with each vehicle manufacturer. You can read the most current information about electric vehicle manufacturers’ compliance with the NTSB’s recommendations on the NTSB’s website.

(Source: NTSB)

Highlights

Vehicle manufacturers improve response guidance for incidents involving electric vehicles and lithium-ion batteries

FCC requests comments on wireless 911 call routing technologies by July 11

Extreme heat resilience planning resources, webinar June 29

IAFC launches online training, Whole Community Planning for Disaster

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

FCC requests comments on wireless 911 call routing technologies by July 11

On June 9, the Federal Communications Commission’s (FCC’s) Public Safety and Homeland Security Bureau (PSHSB) released a Public Notice, seeking to update its understanding of the state of technology capable of routing wireless 911 calls to the proper 911 call center.

Most of the time, wireless 911 calls are routed based on the location of cell towers, which can cover up to a 10-mile radius. This can cause delays in emergency response, especially when a call is made within public safety answering point (PSAP) border areas, where state, county or city boundaries overlap, requiring PSAPs to re-route calls.

Today, about 80% of 911 calls come from a mobile device, so the accuracy of wireless 911 call routing to the correct PSAP is critical.

In 2018, the FCC issued a Notice of Inquiry asking for comments on the feasibility of routing 911 calls based on caller location, not the location of the cell tower that handles the call. Since then, wireless carriers have begun rolling out “location-based routing” for wireless 911 calls.

In December 2020, T-Mobile announced the launch of its Location-Based Routing (LBR) in parts of Texas and Washington State, with plans to expand nationwide. T-Mobile’s LBR capability uses low-latency, device-based location technology, rather than cell tower location information to route calls. T-Mobile reported 40% fewer PSAP call transfers in some areas since its implementation.

Just last month, AT&T announced its version of location-based routing for wireless 911 calls, which it calls “Locate Before Route.” AT&T states that by using a hybrid of GPS and other location information, the location of the caller’s device can be pinpointed within 50 meters.

The FCC’s latest Public Notice is seeking an update on what progress has been made in the last 4 years since its 2018 Notice of Inquiry. Many of the issues the FCC is concerned with pertain to the technical aspects of implementing these location-based routing technologies. However, a selection of the issues pertain to how these technologies are impacting public safety operations and the effectiveness of 911 responses. These issues include:

• The frequency of 911 call misrouting and its impact on public safety.
• The current state of location-based routing technologies and the capabilities of these technologies to support the requirement to successfully calculate a caller’s location within five seconds or less.
• The interdependencies of location-based routing technologies and NG911 to optimize emergency response.
• Any incentives or regulatory steps the FCC could implement to encourage the development and implementation of location-based routing for wireless 911 calls.
• Any security, reliability, and privacy considerations related to location-based routing approaches.

To learn more about this inquiry, read the FCC’s fact sheet, news release, and final Public Notice.

Comments are due by July 11, 2022. Those interested can submit comments via the FCC’s Electronic Comment Filing System, or by sending mail to the Office of the Secretary, Federal Communications Commission. Instructions for submittal and mailing addresses are provided in the Public Notice.

(Source: FCC)

Extreme heat resilience planning resources, webinar June 29

Earlier this month, about 60 million people in the United States were under an extreme heat warning, with high temperatures breaking daily records in multiple cities. Temperatures reached up to 108 degrees Fahrenheit in Kansas, killing thousands of cattle.

As of this writing, the National Weather Service’s Climate Prediction Center is forecasting excessive heat for much of the central and southeastern United States.

Heat waves are becoming more frequent, hotter and longer lasting than in previous decades. The fourth National Climate Assessment  in 2018 reported that the frequency of heat waves had jumped from an average of two per year in the 1960s to six per year by the 2010s.

Extreme heat kills more Americans than any other weather event, but heat-related illnesses are preventable.

The public often lack awareness about how dangerous extreme heat can be. Some populations, such as older adults and the very young, are much more vulnerable to extreme heat than others, but many don’t know their individual risks or have adequate resources to help themselves.

Effective mitigation of the risks of extreme heat requires a multi-disciplinary response, shared across multiple agencies. Here are some resources for emergency managers, planners, and public health officials that can help educate the public, locate at-risk populations, and inform public health actions:

• The Centers for Disease Control and Prevention (CDC) provides a heat guide and warning signs and symptoms of heat-related illness in a single convenient graphic with accessible plain text, to help increase public awareness about the health risks.
• The Occupational Safety and Health Administration (OSHA) just updated its Heat Illness Prevention page with educational materials for employers and workers.
• The CDC just updated its Heat & Health Tracker, which now includes daily heat illness data. Users can track and download daily cases of heat-related illness across the country. This information can help communities better prepare for and respond to extreme heat events.
• The National Oceanic and Atmospheric Administration (NOAA) is currently mapping heat inequities in 14 U.S. cities and counties. Cities with Urban Heat Islands mapped by NOAA in previous years are available on NOAA’s National Integrated Heat Health Information System (NIHHIS) website.
• Emergency managers, planners, and public health officials can join colleagues for a webinar hosted by the Federal Emergency Management Agency on Wednesday, June 29, 2022, from 1-2:30 p.m. EST, entitled June RNPN Ideation Hour: Extreme Heat Resilience. The webinar will discuss the relationship between extreme heat and housing, extreme heat as a threat multiplier and a public health hazard, and local planning and capital improvements related to extreme heat risks.

(Sources: Various)

IAFC launches online training, Whole Community Planning for Disaster

The IAFC, in partnership with the Department of Transportation, Pipeline and Hazardous Materials Safety Administration (PHMSA), recently launched a new online training course, Whole Community Planning for Disaster.

The purpose of the course is to explain why and how government, community organizations, faith-based and other groups can participate in an inclusive emergency planning process to improve the resilience of a community, and subsequently the nation.

Upon completion of the Whole Community Planning for Disaster course, participants will be able to:

• Define the Whole Community Approach and discuss its benefits.
• Combine the knowledge, resources, and networks of all stakeholders to support community preparedness for disaster.
• Address the needs of all community members during disaster response and recovery.
• Explore actions your community can take to be better prepared for disaster situations through the application of the Emergency Planning Principles and the steps of the Preparedness Cycle.
• Explore the use of the C-MIST framework to address the needs of all community members, including people with disabilities and others with access and functional needs.
• Identify characteristics of SMART goals and explore their relationship with Action Plans.

The course takes up to two hours to complete and includes interactive features such as knowledge checks and learning activities. This course is available at no cost to the participant and offers a certificate of course completion.

The course is accessible via the IAFC’s training portal, IAFC Academy, which uses the Helix public safety cloud. If you are a registered member of the IAFC’s Hazmat Fusion Center training programs, you already have a Helix account and you only need to sign in. If you do not have an IAFC Helix account, you can create one for free by visiting the IAFC Academy website. Once logged into the IAFC Academy, visit the course page for Whole Community Planning for Disaster to enroll.

(Source: IAFC)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

CISA releases security advisories related to OT:ICEFALL (Insecure by Design) report

The Cybersecurity and Infrastructure Security Agency (CISA) is aware that Forescout researchers have released OT:ICEFALL, a report on 56 vulnerabilities caused by insecure-by-design practices in operational technology across multiple vendors. The vulnerabilities are divided into four main categories: insecure engineering protocols, weak cryptography or broken authentication schemes, insecure firmware updates and remote code execution via native functionality.

CISA has released five corresponding Industrial Controls Systems Advisories (ICSAs) to provide notice of the reported vulnerabilities and identify baseline mitigations for reducing risks to these and other cybersecurity attacks. Read CISA’s news release for the full list of ICSAs.

(Source: CISA)

Biden signs a pair of cybersecurity bills into law

The bipartisan State and Local Government Cybersecurity Act will allow CISA to offer state and local actors access to upgrade digital security tools and procedures. It also boosts the Multi-State Information Sharing and Analysis Center to help prevent and respond to future digital incidents.

The president also signed off on the bipartisan Federal Rotational Cyber Workforce Program Act, which establishes a rotational cyber workforce development program across several government agencies in an effort to compete with the usually more lucrative private sector.

(Source: The Record)

Top 10 Malware - May 2022

In May 2022, with the exception of Jupyter returning to the Top 10, the lineup remained consistent with the previous month’s malware. Jupyter, aka SolarMarker, is a highly evasive and adaptive .NET infostealer that is downloaded by leveraging SEO-poisoning. This creates watering hole sites for the purpose of deceiving unsuspecting users who visit the website and download a malicious document, often a zip or PDF file embedded with a malicious executable. The Top 10 Malware variants comprise 63% of the total malware activity in May 2022, decreasing 6% from April 2022.

Read this month’s full Top 10 Malware report from the Multi-State Information Sharing and Analysis Center (MS-ISAC).

(Source: MS-ISAC)

Russian botnet disrupted in international cyber operation

The Department of Justice (DOJ), together with law enforcement partners in Germany, the Netherlands and the United Kingdom, have dismantled the infrastructure of a Russian botnet known as RSOCKS which hacked millions of computers and other electronic devices around the world.

The RSOCKS botnet initially targeted Internet of Things (IoT) devices. IoT devices include a broad range of devices—including industrial control systems, time clocks, routers, audio/video streaming devices, and smart garage door openers, which are connected to, and can communicate over, the internet, and therefore, are assigned IP addresses. The RSOCKS botnet expanded into compromising additional types of devices, including Android devices and conventional computers.

(Source: DOJ)

Keeping PowerShell: Measures to Use and Embrace

Cybersecurity authorities from the United States, New Zealand, and the United Kingdom have released a joint Cybersecurity Information Sheet (CIS) on PowerShell. The CIS provides recommendations for proper configuration and monitoring of PowerShell, as opposed to removing or disabling it entirely due to its use by malicious actors after gaining access into victim networks. These recommendations will help defenders detect and prevent abuse by malicious cyber actors, while enabling legitimate use by administrators and defenders.

CISA urges organizations to review Keeping PowerShell: Measures to Use and Embrace and take actions to strengthen their defenses against malicious cyber activity.

(Source: CISA)

Phishing – avoid getting hooked

According to CISA, most phishing attempts come by email, while other attacks—including text messages (SMS)—are also on the rise. Awareness of the different types of phishing attacks are key for implementing comprehensive mobile device security.

The National Institute of Standards and Technology’s (NIST’s) National Cybersecurity Center of Excellence (NCCoE) has developed guidance to help protect mobile devices from phishing threats. We provide example solution architectures that organizations can use to help improve their information security and privacy. To learn more about how to protect your mobile device from phishing attacks, view our latest short form paper on phishing protection.

(Source: NCCoE)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites or the information, products or services contained therein. Reference to any specific commercial products, process or service by trade name, trademark, manufacturer or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the EMR-ISAC or the U.S. government.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.