View as a webpage / Share

Volume 23 — Issue 3 | January 19, 2023

FBI releases data on 2022 law enforcement line-of-duty deaths

The Federal Bureau of Investigation (FBI) released its preliminary 2022 data on law enforcement officer line-of-duty deaths. The FBI’s reporting breaks down the statistics on the circumstances surrounding felonious and accidental officer deaths. It also provides a breakdown of number of deaths due to various medical conditions.

The FBI will use this line-of-duty death data to update its Officer Safety Awareness Training (OSAT) program so that this training effectively targets the most pressing safety issues for law enforcement officers.

There were 60 felonious deaths, 58 accidental deaths, and 81 deaths due to medical conditions, totaling 199 law enforcement officer line-of-duty deaths in 2022. Notable findings from the FBI’s preliminary 2022 statistics include:

• The 60 felonious deaths represent a 17.8% decrease from the 73 officers feloniously killed in 2021.
• Among the 60 felonious deaths, the circumstance associated with the largest number of deaths (12) was ambushes against officers involving entrapment and premeditation. The FBI defines this circumstance as one where an unsuspecting officer is deliberately targeted or lured into danger. These 12 deaths represent a 50% increase over the number of deaths due to ambush attacks in 2021 (8).
• The circumstance associated with the biggest decrease in felonious deaths when compared with 2021 data was unprovoked attacks. In 2021, 24 deaths were associated with unprovoked attacks. This circumstance significantly outpaced all other felonious deaths in 2021 and was the highest number of deaths attributed to unprovoked attacks in 30 years of reporting. In 2022, this number declined 75% to only 6 deaths due to unprovoked attacks.
• Firearms were used in 81.7% of felonious deaths in 2022.
• 48 of the 58 accidental deaths involved circumstances related to motor vehicles, where either a pedestrian officer was struck by a vehicle, or the officer was involved in a motor vehicle crash.
• 52 of 81 deaths attributed to medical conditions were due to illness related to COVID-19. While these COVID-19-related deaths represent the majority (61%‍) of all deaths due to medical conditions in 2022, this is a drastic decrease from the 257 officers who died from COVID-19-related illnesses in 2021.

To learn more about the FBI’s 2022 statistics on law enforcement line-of-duty deaths, see the FBI’s Jan. 12 news release. You can download this report and related data from the FBI’s Crime Data Explorer (CDE), under the LEOKA section of the CDE. Learn more about how the FBI collects and uses this data through its Law Enforcement Officers Killed and Assaulted (LEOKA) program.

(Source: FBI)

Highlights

FBI releases data on 2022 law enforcement line-of-duty deaths

January is National OPSEC Awareness Month

FEMA releases final canine team-related resource typing documents

Online training: Addressing the Needs of Older Adults in Disasters

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

January is National OPSEC Awareness Month

The term OPSEC stands for Operations Security, a systematic process to identify, control and protect critical information about a mission, operation, or activity. The purpose is to deny or mitigate an adversary’s ability to compromise that information.

Each year in January, the National Counterterrorism and Security Center (NCSC) observes National OPSEC Awareness Month and encourages all organizations to assess and protect their public and private data that could expose vulnerabilities.

Although OPSEC activities have traditionally been linked with military and intelligence agencies, National Security Presidential Memorandum (NSPM)-28, signed in January 2021, directed all United States executive branch departments and agencies to implement OPSEC programs. This presidential directive means federal executive branch organizations are mandated to take steps to increase their operations security. But all government agencies, public and private-sector entities, and individuals can benefit from OPSEC.

As part of the nation’s critical infrastructure, the Emergency Services Sector can certainly benefit from implementing OPSEC principles and tactics. For example, any emergency services agency that could be a target of terrorist activity should guard against exposing standard operating procedures, facility diagrams, personnel specifics, and exercise or training details publicly, since terrorists could use any of this information to exploit their vulnerabilities.

During National OPSEC Awareness Month, NCSC encourages all organizations to take the opportunity to learn more about OPSEC, understand its role in securing your organization and how that understanding can benefit you personally.

The NCSC is part of the Office of the Director of National Intelligence and is responsible for executing the roles and responsibilities of the National Operations Security Program. Visit NCSC’s Operations Security page to find all of NCSC’s guidance, training and awareness materials on OPSEC, including its January 2023 National OPSEC Awareness Bulletin series. Use hashtag #ThinkOPSEC on social media to share and discuss OPSEC awareness this month and throughout the year.

(Source: NCSC)

FEMA releases final canine team-related resource typing documents

The Federal Emergency Management Agency (FEMA) recently published the “Canine Detection Team – Explosives” resource typing document and “Canine Handler – Explosives” job title/position qualification document. These National Incident Management System (NIMS) Resource Typing Definitions provide explosive detection support for law enforcement operations.

The “Canine Detection Team – Explosives” is responsible for conducting screening and searches to detect explosives and explosives-related substances and assist in bomb crime scene investigations. The “Canine Handler – Explosives” job title/position qualification document ensures those qualified have successfully completed canine handling in the explosives detection discipline and is part of a canine explosive-detection team.

To review the documents and for more information, including the full scope of Search and Rescue resource typing definitions, visit FEMA’s Resource Typing Library Tool (RTLT).

Resource typing is a key component of NIMS and enables organizations from across the country to work together during incidents of all types and sizes. Implementing NIMS resource management principles across the nation is a fundamental part of building our national preparedness.

(Source: FEMA)

Online training: Addressing the Needs of Older Adults in Disasters

The Administration for Strategic Preparedness and Response (ASPR) is currently featuring a free online course supporting its At-Risk Individuals program: HHS/ASPR Addressing the Needs of Older Adults in Disasters.

The older adult population is growing. The U.S. Census Bureau projects that by the year 2035, there will be more Americans who are 65 and older than there will be children under the age of 18.

Older adults are a very diverse group, with varying life experiences and capabilities. In many cases, older adults demonstrate greater resilience in the face of disasters than younger populations. However, many disasters and emergencies disproportionately impact the older adult population, especially older adults ages 85 and older. It is important to understand how to identify and address the specific needs of older adults during a disaster or emergency.

This course is targeted to public health and medical responders and is designed to improve their capabilities to address the access and functional needs of community-dwelling older adults in disasters. The course provides information, resources, tools, and strategies to help responders address the needs of older adults during natural disasters, infectious disease outbreaks, and other common disaster situations.

The course is estimated to take about 1 hour to complete. It is self-paced and can be paused and resumed at any time.

The course is hosted on the TRAIN Learning Network, a national learning network powered by the Public Health Foundation (PHF), a non-profit dedicated to improving public health and population health practice to support healthier communities.

ASPR leads the nation's medical and public health preparedness for, response to, and recovery from disasters and public health emergencies. ASPR collaborates with hospitals, healthcare coalitions, biotech firms, community members, state, local, tribal, and territorial governments, and other partners across the country to improve readiness and response capabilities.

To take this course, first create a free account with the TRAIN Learning Network. Then, see the course page for instructions on how to launch the course. You can also share this learning opportunity using the downloadable course flyer.

(Source: ASPR)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

CISA updates best practices for mapping to MITRE ATT&CK®

On Jan. 17, the Cybersecurity and Infrastructure Security Agency (CISA) updated Best Practices for MITRE ATT&CK® Mapping. The MITRE ATT&CK® framework is a lens through which network defenders can analyze adversary behavior and, as CISA Executive Assistant Director Eric Goldstein noted in his June 2021 blog post on the framework, it directly supports “robust, contextual bi-directional sharing of information to help strengthen the security of our systems, networks, and data.” CISA highly encourages the cybersecurity community to use the framework because it provides a common language for threat actor analysis.

CISA coordinated this update of the best practices with the Homeland Security Systems Engineering and Development Institute™ (HSSEDI), a DHS-owned R&D center operated by MITRE. The update covers changes that the MITRE ATT&CK team made to the framework since CISA initially published the best practices in June 2021. The update also covers common analytical biases, mapping mistakes, and specific ATT&CK mapping guidance for industrial control systems (ICS).

(Source: CISA)

HC3 Threat Brief: Royal and BlackCat Ransomware: The Threat to the Health Sector

The U.S. health sector continues to be aggressively targeted by ransomware operators, and Royal and BlackCat are two of the more recent sophisticated ransomware threats.

This Threat Brief from the Department of Health and Human Services (HHS) Health Sector Cybersecurity Coordination Center (HC3) provides an overview of Royal and BlackCat ransomware groups. This brief provides non-technical information for strategic decision makers as well as in-depth technical information for systems administrators.

The brief’s overview includes background, tactics and techniques used to target victims, technical analysis of how the ransomware is set up on a victim’s system, and how the encryption process works for each ransomware. The brief then provides defense and mitigation recommendations and references.

(Source: HHS HC3)

Initial access brokers - how they are changing cybercrime

Cybercriminals are becoming faster and more effective at stealing your money. And they're doing it by using highly specialized workers in a new business model that rivals any legitimate tech company you might see today. As an example, the Conti Ransomware-as-a-Service (RaaS) gang hired "Coders," "Testers," "Penetration Testers," and other personnel to fulfill various aspects of the "business." Conti's handlers even gave each of these departments its own budget to use as necessary.

Such specialization is also evident in many criminal organizations' use of Initial Access Brokers (IABs). In this blog post, we examine these actors in more detail. We break down what IABs do and how their activities are changing the cybercriminal ecosystem. We also provide tips that you can use to defend yourself against IABs.

Read the full article in the Center for Internet Security’s Cyber Threat Intelligence blog.

(Source: Center for Internet Security)

FAA preliminary investigation traces NOTAM outage to damaged database file

An initial investigation into the outage that hit the Federal Aviation Administration’s Notice to Air Missions (NOTAM) system has found that the error may have been caused by a damaged database file.

NOTAM is a communication system that alerts pilots to immediate hazards that could pose a threat to flight safety such as construction works on runways or flocks of birds. It operates separately from the FAA’s air traffic control services operation, which governs airspace across the country.

In a statement issued at 6:30 p.m. EST on Wednesday, Jan. 11, the agency said it was continuing a “thorough review to determine the root cause of the Notice to Air Missions system outage.”

The Federal Aviation Administration took the decision to ground aircraft between 7:30 a.m. and 9:00 a.m. EST Wednesday after an attempted reboot of the notification system was unable to rectify a system error.

If the diagnosis is correct, NOTAM will be the latest example of a major federal IT system outage caused by a damaged database file. In August, a major outage of the Department of Veterans Affairs’ critical Cerner Millennium electronic health record system was caused by a corrupted patient database.

(Source: FedScoop)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.