View as a webpage / Share

Volume 22 — Issue 37 | September 15, 2022

IAFF and Metro Chiefs issue joint statement on health risks from chemicals in firefighter turnout gear

Firefighter turnout gear made national news last month, when the International Association of Firefighters (IAFF) and the Metropolitan Fire Chiefs Association (Metro Chiefs) released a joint statement warning firefighters that the synthetic chemicals in their protective gear are associated with various health risks, including an increased risk of liver and kidney cancer.

The chemicals responsible for these increased health risks are a group of fluorinated compounds called per- and polyfluoroalkyl substances, commonly referred to as PFAS. PFAS are used in firefighter turnout gear to increase its ability to repel oil and water.

The IAFF and Metro Chiefs’ joint statement advises firefighters to reduce their exposure to PFAS by donning protective gear only when necessary. However, the statement also emphasizes that wearing all personal protective equipment (PPE) and self-contained breathing apparatus (SCBA) during firefighting, overhaul, and while working in smoke is still the best first line of defense when it comes to limiting exposures to fireground contaminants.

The joint statement comes after a recent study by the International Agency for Research on Cancer (IARC) found that occupational exposure as a firefighter causes cancer. While the occupation of firefighting comes with many inherent risks, the IAFF and Metro Chiefs see exposure to PFAS via firefighting gear to be an “unnecessary exposure.” The agencies hope this joint statement will encourage the fire service to take steps to mitigate this exposure.

Over the past few years, the Environmental Protection Agency (EPA) has increased regulations limiting permissible uses of PFAS due to mounting evidence of the health and environmental risks.

Hopefully, more PFAS-free products will become available on the market soon, due to the recent actions of EPA, the fact that many states have already enacted legislation restricting the use of PFAS, and due to advocacy from agencies such as IAFF and Metro Chiefs. IAFF is the largest firefighter’s union in the United States and Metro Chiefs represents the highest level of leadership within fire departments across the country.

The IAFF and Metro Chiefs advise fire departments to replace current gear with equivalent PFAS-free gear when it becomes available.

For more information on PFAS in firefighter gear, see the IAFF’s website. To learn more about the IAFF and Metro Chiefs’ recommendations on how to mitigate the risks, see the joint statement, the IAFF’s news release, and the NBC news coverage of this issue.

(Sources: IAFF/Metro Chiefs, NBC News)

Highlights

IAFF and Metro Chiefs issue joint statement on health risks from chemicals in firefighter turnout gear

Leveraging computer-aided dispatch systems to enhance suspicious activity reporting

Transporting liquefied natural gas by rail: Emergency preparedness and response

FEMA offering exercise assistance through National Exercise Program

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

Leveraging computer-aided dispatch systems to enhance suspicious activity reporting

The Department of Justice (DOJ), Bureau of Justice Assistance (BJA) released a report last month, Best Practices Leveraging Computer-Aided Dispatch to Enhance Suspicious Activity Reporting.

This 21-page report was developed by experts in law enforcement and criminal intelligence. The report’s purpose is to provide law enforcement and fusion centers with promising practices and recommendations on how to develop or enhance the process of querying Computer-Aided Dispatch (CAD) data to derive or develop information based on tips and leads or suspicious activity.

Law enforcement and other public safety agencies such as fire and emergency medical services use CAD systems to facilitate incident response and communication in the field.

CAD systems allow public safety operations and communications to be augmented, assisted, or partially controlled by an automated system. Additionally, they are often the very first point of storage and transmittal of key information collected during law enforcement interactions with members of the public. These features give CAD systems the potential to play a critical role in the process of developing intelligence on emerging threats, such as threats of targeted violence or terrorism.

The recommendations explain how to utilize the tools and resources necessary to build this capability, and the report offers examples of how centers and agencies may work together to exchange such information. Topics discussed include:

• The kinds of relevant information that can be collected from a CAD system for the purpose of developing intelligence on emerging threats or criminal activity.
• Requirements for data collection in compliance with privacy, civil rights and civil liberties protections.
• Promising practices for how a CAD system can be integrated with intelligence data warehouses and how data can be responsibly and safely shared between these CAD systems and the intelligence community.
• Opportunities and challenges with these integration and data sharing efforts, including challenges with cross-jurisdictional data sharing, staffing needs, vendor selection and data ownership, and other requirements.

Those interested in making CAD system information available for the purpose of developing intelligence on emerging threat information, potentially in near-real time, would benefit from the considerations and recommendations provided in this report. The report also provides valuable background information for anyone with a role in interfacing between emergency response and the intelligence community.

Access the report on BJA’s website.

(Source: BJA)

Transporting liquefied natural gas by rail: Emergency preparedness and response

The Transportation Research Board (TRB), part of the National Academies of Sciences, Engineering and Medicine (NASEM), has just released a pre-publication draft of a report, Preparing for LNG by Rail Tank Car: A Readiness Review.

Shipping liquefied natural gas (LNG) by rail tank car is a viable mode in U.S. regions where the natural gas pipeline network is limited.

In 2020, the Department of Transportation’s (DOT’s) Pipeline and Hazardous Materials Safety Administration (PHMSA) finalized a rule to allow bulk transportation of LNG by an existing type of tank car used for cryogenic liquids, the DOT-113. The rule contained several safety requirements, including enhancements to the steel used in the outer tank of the DOT-113, remote monitoring of the pressure and location of the tank car, and risk assessments to evaluate safety and security.

Before the first bulk shipment of LNG by rail tank car, the TRB was tasked with a study to examine the safety of transporting LNG by rail. This report reflects the outcome of the second part of this study, which conducted a broad review of the hazard characteristics of LNG and the safety record of LNG shipments when transported by other modes. The goal of this phase was to identify areas where additional investigation, analysis, and monitoring may be warranted so that industry and regulators can better assess LNG’s risks in rail transportation and make choices about how best to manage those risks.

The report focuses on safe train operations when transporting LNG, support for emergency responders, and design features of the new cryogenic tank car, including pressure relief devices, insulation, and the type of outer tank steel.

Moving LNG by tank car presents challenges for the agencies responsible for responding to hazardous materials incidents. Because only limited quantities of LNG and other flammable cryogens are transported in the United States, few first responders have been trained in LNG emergency response and even fewer have been trained in responding to incidents involving LNG transported by rail. Firefighters are not as familiar with LNG and its related containers as they are with other Class 2.1 gases, such as propane, butane, and propylene, and with Class 3 flammable liquids, such as crude oil and ethanol.

Chapter 6 of the report, “Emergency Preparedness and Response,” outlines the likely challenges that moving LNG by tank car would pose for emergency responders, followed by brief descriptions of the current emergency planning, preparedness, and response activities for hazardous materials incidents conducted by government and industry. The chapter also includes an overview of currently available emergency response training for response to LNG incidents.

Download the full report on NASEM’s website.

(Source: NASEM)

FEMA offering exercise assistance through National Exercise Program

The Federal Emergency Management Agency (FEMA), National Exercise Division is now accepting Fall 2022 requests for exercise support to the National Exercise Program (NEP). Fall round submissions are due by Nov. 1, and decisions will be sent by Dec. 21.

The program offers no-cost assistance to state, local, tribal and territorial jurisdictions for exercise design, development, execution and evaluation to validate capabilities across all mission areas. The program will hold additional exercise support rounds in Spring and Fall 2023. Instructions for how to submit a request for support are on the NEP website.

FEMA is hosting webinars for jurisdictions and other community partners to discuss the exercise support process.

Please visit the NEP webinar page to register. All webinars will cover the same content. The webinar dates are:

• 3 p.m. EDT on Sept. 20.
• 2 p.m. EDT on Sept. 22.
• 3 p.m. EDT on Sept. 27.
• 2 p.m. EDT on Sept. 29.
• 3 p.m. EDT on Oct. 4.

For questions, send an email to the National Exercise Division.

(Source: FEMA)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

CISA, FBI, NSA, Treasury, Cyber Command, and international partners release advisory on malicious cyber actors affiliated with Iranian government agency

This Cybersecurity Advisory (CSA), titled, “Iranian Islamic Revolutionary Guard Corps-Affiliated Cyber Actors Exploiting Vulnerabilities for Data Extortion and Disk Encryption for Ransom Operations,” provides actionable information regarding IRGC exploitation of VMware Horizon® Log4j vulnerabilities for initial access and ongoing use of known Fortinet® and Microsoft Exchange® vulnerabilities. After gaining access to a network, these actors likely determine a course of action based on their perceived value of the data, including data encryption or exfiltration for ransom operations.

This CSA identifies additional malicious and legitimate tools that are likely being used by these actors as well as tactics, techniques, and procedures, and additional indicators of compromise (IOCs) observed as recently as March 2022 that can be used to detect this latest malicious activity. Also, it is an update to the 2021 joint CSA on Iranian government-sponsored APT actors exploiting Microsoft Exchange and Fortinet vulnerabilities and now assesses this APT group to be affiliated with the IRGC, an Iranian Government agency tasked with defending the Iranian Regime from perceived internal and external threats. For more information on state-sponsored Iranian malicious cyber activity, see CISA’s Iran Cyber Threat Overview and Advisories webpage.

(Source: CISA)

Cyber criminals targeting healthcare payment processors, costing victims millions in losses

The Federal Bureau of Investigation (FBI) has received multiple reports of cyber criminals increasingly targeting healthcare payment processors to redirect victim payments. In each of these reports, unknown cyber criminals used employees’ publicly available Personally Identifiable Information (PII) and social engineering techniques to impersonate victims and obtain access to files, healthcare portals, payment information, and websites. In one case, the attacker changed victims’ direct deposit information to a bank account controlled by the attacker, redirecting $3.1 million from victims’ payments.

Read the full Private Industry Notification shared by the FBI’s Internet Crime Complain Center (IC3).

(Source: FBI)

Cyber Incident Reporting for Critical Infrastructure Act Of 2022 (CIRCIA)

In March 2022, President Biden signed into law the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA).  Enactment of CIRCIA marks an important milestone in improving America’s cybersecurity by, among other things, requiring CISA to develop and implement regulations requiring covered entities to report covered cyber incidents and ransomware payments to CISA. These reports will allow CISA to rapidly deploy resources and render assistance to victims suffering attacks, analyze incoming reporting across sectors to spot trends, and quickly share that information with network defenders to warn other potential victims.

These new authorities are regulatory in nature and require CISA to complete mandatory rulemaking activities before the reporting requirements go into effect.  CIRCIA requires CISA to develop and publish a Notice of Proposed Rulemaking (NPRM), which will be open for public comment, and a Final Rule.

CISA has released a Request for Information (RFI) through which it is soliciting public input for 60 days, starting September 12, 2022, on potential aspects of the proposed regulation prior to publication of the NPRM. CISA will be hosting eleven in person listening sessions – one in each of CISA’s ten regions and an additional one in Washington, D.C.  

(Source: CISA)

LockBit 3.0 RaaS Gang incorporates BlackMatter capabilities

The LockBit 3.0 Ransomware as a Service (RaaS) gang has incorporated BlackMatter capabilities into its operations. Researchers at Trend Micro detected several similarities between LockBit 3.0 and BlackMatter.

It is important to look back to what happened in November 2021. At that time, Bleeping Computer reported that BlackMatter's handlers were ceasing operations under increasing pressure from law enforcement. As part of the shutdown, some affiliates from BlackMatter received decryptors for negotiations with existing victims. They then moved those victims over to LockBit's negotiation site and began providing victims with links to LockBit Tor sites.

It is this transition from BlackMatter to LockBit that adds useful context not only for the similarities discussed above but also for LockBit's other activities observed this year.

(Source: Center for Internet Security)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites or the information, products or services contained therein. Reference to any specific commercial products, process or service by trade name, trademark, manufacturer or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the EMR-ISAC or the U.S. government.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.