View as a webpage / Share

Volume 23 — Issue 26 | June 29, 2023

DOT proposes requirements for sharing real-time hazmat information with first responders at freight rail incidents

On the evening of February 3, 2023, an eastbound Norfolk Southern Railway freight train derailed 38 railcars in East Palestine, Ohio. The incident received national media attention due to public health concerns about the hazardous materials release. It also drew attention to the importance of getting real-time information to first responders about the hazards at the scene.

First responders need to quickly mount a specialized and coordinated response with appropriate personal protective equipment (PPE) at hazardous materials incidents. Knowing what chemicals are involved as quickly as possible is critical to making safe and effective response decisions.

According to testimony to the U.S. Senate about the incident, about 300 firefighters from 50 departments initially responded to the scene of the derailment in East Palestine on the night of February 3. Many of them were volunteers without hazardous materials training or specialized equipment. Their PPE may have been inadequate at protecting them from the hazardous materials exposures, which included vinyl chloride, a liquified compressed gas that is flammable, highly toxic, and a known carcinogen.

The National Transportation Safety Board (NTSB) is currently investigating the East Palestine incident. In last week’s hearing, the NTSB presented its findings so far, which included a video summarizing the hazardous materials release and an investigation summary with incident video footage. The investigation hearing discussed several communication issues between first responders and the railroad.

There was an initial 45-minute delay before responders were given the consist that listed the materials in each of the tank cars. Additionally, firefighters on scene didn’t have access to the AskRail app, which would have offered an alternate way to access this information. Placards identifying the hazardous materials on the tank cars had been damaged by the fires. The hardcopy of the train’s consist was not immediately available because the conductor had uncoupled the head-end locomotives and was in the process of moving them a mile away from the derailed railcars.

In response to these communication and preparedness challenges experienced by local first responders at East Palestine and at several past hazmat rail incidents, the Pipeline and Hazardous Materials Safety Administration (PHMSA) is currently requesting input on proposed reforms. PHMSA posted a Notice of Proposed Rulemaking in the Federal Register on June 27, which is open for public comment until August 28, 2023.

PHMSA is proposing amendments to its Hazardous Materials Regulations pertaining to the Fixing America's Surface Transportation (FAST) Act that will strengthen requirements to get real-time train consist information to first responders at hazardous materials rail incidents.

The proposed amendments would require railroads to:

• Maintain current train consists in both hardcopy and electronic formats. They are currently only required to maintain hardcopies.
• Actively push train consist information to authorized responders within a 10-mile radius as soon as the railroad is aware of an accident involving any hazardous materials. The current requirement only mandates that this information be made “available” to local responders, who must pull this information themselves.
• Share this information at all railways. Currently, only class 1 railroad carriers are required to provide train consists to responders, but the proposed amendment would require carriers of all classes to share this information.

To learn more and submit comments on these proposed reforms, see PHMSA’s Federal Register notice. Visit NTSB’s website to learn more and stay updated on NTSB’s ongoing investigation into the East Palestine, Ohio, incident.

(Sources: DOT, PHMSA, NTSB, CNN)

Highlights

DOT proposes requirements for sharing real-time hazmat information with first responders at freight rail incidents

Emergency services agencies as safe haven providers for infants

FEMA seeks input on how to designate community disaster resilience zones

2023 Northeast-Midwest Regional Prescribed Fire Science and Management Workshop, August 29-31

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

Emergency services agencies as safe haven providers for infants

In most states, on-duty fire department, emergency medical services (EMS), and law enforcement personnel are considered “safe haven providers.” This means that fire, EMS, and law enforcement agencies in many communities are required to take emergency protective custody of an infant that is relinquished to them and provide any immediate medical care that the infant may require.

Safe Haven laws, sometimes called “Baby Moses laws,” have been enacted in all 50 states to aid mothers in crisis and protect babies from abandonment in unsafe places. The laws also protect mothers from being charged with abandonment. Each state has its own variation of the law, but all states specify age cutoffs for the child and valid locations where an infant can be relinquished safely, anonymously, and legally into state custody.

Emergency services agencies should be familiar with their state’s safe haven law and periodically revisit any standard operating guidelines (SOGs) that define their responsibilities as safe haven providers. This includes knowing the permitted age limit for surrender of babies in your state. Some state laws only allow babies up to three days old to be surrendered; others allow babies up to 90 days old or even 1 year old, in the case of North Dakota.

Agencies should also know the difference between Safe Places, Safe Havens and Safe Stations. These are all individual designations that provide different resources to people seeking help, but for different reasons.

Another aspect of the legal landscape is the use of “baby boxes.” Most states require relinquishment of an infant directly to a person, but a growing number of states are allowing relinquishment of an infant into a baby box, which is a medical device that allows the infant to be left safely but completely anonymously at a designated safe haven site. Be familiar with what your state’s law says about the use of baby boxes and what would be required of your staff if a baby box were installed at your station.

The National Safe Haven Alliance provides a map with information on each state’s Safe Haven laws. The Department of Health and Human Services’ (HHS) Child Welfare Information Gateway provides an Infant Safe Haven Law Fact Sheet and a searchable database of state safe haven laws.

FireRescue1 provides essential components to be included in any public safety agency’s SOG as a safe haven provider.

A video interview with the Port Arthur, Texas, Fire Chief reviews his departments’ responsibilities as a safe haven provider and emphasizes the importance of thinking proactively to help us all be better prepared.

(Sources: National Safe Haven Alliance, HHS, 12NewsNow - Texas, FireRescue1)

FEMA seeks input on community disaster resilience zones

The Community Disaster Resilience Zones Act was signed into law on Dec. 20, 2022. The new law will build disaster resilience across the nation by creating and designating resilience zones which identifies disadvantaged communities most at-risk to natural hazards.

This new law amends the Robert T. Stafford Disaster Recovery and Emergency Act and applies FEMA’s National Risk Index to identify communities that are most vulnerable to natural hazards.

FEMA is responsible for designating community disaster resilience zones at the census tract level in each state based on the highest individual hazard risk ratings. FEMA will also be responsible for maintaining a geographic balance for the zones.

Once designated, community disaster resilience zones will hold the designation for five years. These zones will receive targeted support to access federal funding to plan for resilience projects that will help them reduce impacts caused by climate change and natural hazards. It will also enable communities to work across a range of federal and private sector partners to maximize funding and provide technical assistance, strengthening community resilience.

These zones are expected to be identified later in 2023, but FEMA has published a notice in the Federal Register seeking input from the public on how to implement this new legislation.

This Request for Information will help FEMA gain better understanding in key areas that will support an effective implementation of the Community Disaster Resilience Zone Act.  This includes learning how communities identify, use and apply risk assessment tools to reduce natural hazard effects and how to achieve equity and geographic balance when designating zones.

Learn more about FEMA’s role in designating community disaster resilience zones on FEMA’s website. To learn more about the specific input FEMA is seeking about how to implement this initiative and to submit comments, see FEMA’s Federal Register Notice. Comments must be submitted by July 25, 2023.

(Source: FEMA)

2023 Northeast-Midwest Regional Prescribed Fire Science and Management Workshop, August 29-31

The use of prescribed fire is an essential part of the 2014 National Cohesive Wildland Fire Management Strategy (Cohesive Strategy). The U.S. Forest Service’s 10-year strategy for confronting the wildfire crisis aims to dramatically increase forest health treatments over the next 10 years, in part through increased use of prescribed fire in targeted landscapes that pose the most immediate threats to communities. Additionally, an Addendum to the Cohesive Strategy released in May 2023 reiterates the need for increased use of prescribed fire and managed wildfire to reduce accumulated fuels, restore resiliency to landscapes and protect communities.

The Wildland Fire Leadership Council's Northeast Region is hosting a workshop on expanding use of prescribed fire across the 20 Northeast (NE) and Midwest (MW) states in Madison, Wisconsin on August 29-31, 2023.

The Northeast – Midwest Regional Prescribed Fire Science and Management Workshop is an opportunity for all wildland fire management partners across the 20 state NE-MW region to share region-wide, science-based, fire ecology information oriented toward expanding and maintaining the use of prescribed fire across all landscapes, jurisdictions, and fire-dependent ecosystems.

This is a great opportunity to meet and interact with regional partners across multiple agencies and organizations to advance this critical wildland fire management mission objective.

A Smoke TOOLS workshop will be held the day preceding the full workshop on August 28, from 10 a.m. to 4 p.m. Smoke management and smoke hazards are one of the most important things to plan for and manage when doing a prescribed burn, or to consider during any wildfire suppression. This day is an active participation “hands-on” workshop where with exercises using online smoke tools. It is designed for anybody with an interest in wildland fire and is offered at no additional cost.

Registration for the workshop is now open and the early bird registration rate is available until July 1, 2023.

Visit the Northeast Regional Strategy Committee’s (NE RSC’s) website to learn more about the workshop objectives, program schedule, venue, exhibits and sponsors, and to access the online registration form. Please contact the workshop organizer, Mikel Robinson, at mikelrobinson@live.com with any questions.

(Source: NE RSC)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

CISA releases cloud services guidance and resources

On June 27, the Cybersecurity and Infrastructure Security Agency (CISA) released the first series of final security guidance resources under our Secure Cloud Business Applications (SCuBA) project: the Extensible Visibility Reference Framework (eVRF) Guidebook and a Technical Reference Architecture (TRA) document. With input from public comment period in 2022, the final guidance documents help public and private entities implement necessary security and resilience best-practices for their cloud services.        

The SCuBA project provides guidance and capabilities to secure cloud business application environments and protect information created, accessed, shared, and stored in those environments. The eVRF Guidebook and TRA document further the project’s goal of developing consistent, effective, modern, and manageable security configurations to help organizations adopt necessary cloud-focused security and resilience practices. 

To download the eVRF Guidebook and TRA document, visit Secure Cloud Business Applications (SCuBA).

(Source: CISA)

Someone is sending mysterious smartwatches to US military personnel

The U.S. Army’s Criminal Investigation Division reported that service members across the military received smartwatches unsolicited in the mail. Upon using these smartwatches, the devices automatically connected to Wi-Fi and began connecting to cell phones unprompted, gaining access to a huge quantity of user data.

The military investigation division also reported that the smartwatches may also contain malware that could be used to spy on the soldiers and steal sensitive data.

(Source: Security Affairs)

CISA and NSA release joint guidance on Defending Continuous Integration/Continuous Delivery (CI/CD) Environments

As evidenced by increasing compromises over time, software supply chains and CI/CD environments are attractive targets for malicious cyber actors (MCAs)

On June 28, CISA, together with the National Security Agency (NSA), released a Cybersecurity Information Sheet (CSI) to provide recommendations and best practices for organizations to strengthen the security of their CI/CD pipelines against the threat of malicious cyber actors.

This CSI explains how to integrate security best practices into typical software development and operations (DevOps) CI/CD environments, without regard for the specific tools being adapted, and leverages several forms of government guidance to collect and present proper security and privacy controls to harden CI/CD cloud deployments.

(Source: CISA)

NSA releases guide to mitigate BlackLotus threat

Malicious cyber actors could take advantage of a known vulnerability in the Microsoft Windows secure startup process to bypass Secure Boot protection and execute BlackLotus malware.

To guide system administrators and network defenders on how to mitigate this threat, the National Security Agency (NSA) is publicly releasing the BlackLotus Mitigation Guide Cybersecurity Information Sheet (CSI). The guide provides an overview of recommended actions to detect and prevent malicious activities associated with BlackLotus.

(Source: NSA)

HC3 Analyst Note: SEO Poisoning

Search engine optimization (SEO) poisoning, considered a type of malvertising (malicious advertising), is a technique used by threat actors to increase the prominence of their malicious websites, making them look more authentic to consumers. SEO poisoning tricks the human mind, which naturally assumes the top hits are the most credible and is very effective when people fail to look closely at their search results. This can lead to credential theft, malware infections, and financial losses. As more organizations utilize search engines and healthcare continues to digitally transform, SEO poisoning is becoming a larger security threat.

The Department of Health and Human Services (HHS) Health Sector Cybersecurity Coordination Center (HC3) has observed this attack method being used recently and frequently against the U.S. Healthcare and Public Health (HPH) sector.

(Source: HHS HC3)

Casualties keep growing in this month’s mass exploitation of MOVEit 0-day

The dramatic fallout continues in the mass exploitation of a critical vulnerability in a widely used file-transfer program, with at least three new victims coming to light in the past few days. They include the New York City Department of Education and energy companies Schneider Electric and Siemens Electric.

To date, the hacking spree appears to have breached 122 organizations and obtained the data of roughly 15 million people, based on posts the crime group has published or victim disclosures

The first signs of the exploitation spree occurred on May 27.

Among the first confirmed victims were payroll service Zellis and the Canadian province of Nova Scotia. Zellis customers British Airways, the BBC, Aer Lingus, Ireland's HSE, and UK retailer Boots were all known to have had data stolen through the breach of the payroll service. Other victims soon came to light, including two Department of Energy entities, the US states of Missouri and Illinois, the American Board of Education Extreme Networks, and Ofcam.

(Source: Ars Technica)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.