View as a webpage / Share

Volume 24 — Issue 42 | October 17, 2024

NIOSH launches Center for Firefighter Safety, Health, and Wellbeing

On Oct. 7, the National Institute for Occupational Safety and Health (NIOSH), part of the U.S. Centers for Disease Control and Prevention (CDC), launched a new Center for Firefighter Safety, Health, and Well-being.

NIOSH supports the nation’s firefighters by conducting fatality investigations, health hazard evaluations, managing the National Firefighter Registry for Cancer, researching hazardous exposures to materials including per- and polyfluoroalkyl substances (PFAS), evaluating personal protective equipment, and studying the unique working conditions and hazards found in wildland firefighting environments.

The new Center provides a central point for partners to engage with NIOSH on the broad spectrum of firefighter-related research and services (e.g. fatality investigations, National Firefighter Registry for Cancer) at the Institute. The Center model will facilitate faster responses to new and emerging hazards through its coordinating teams and help refine the priority research and service activities where NIOSH should focus its resources.

Learn more in NIOSH’s Oct. 7 update release.

(Source: NIOSH)

Highlights

NIOSH launches Center for Firefighter Safety, Health, and Wellbeing

Position paper: Best practices for collaboration between EMS and law enforcement for acute behavioral emergencies

Election security in 2024: Resources for emergency planning and response

SERTC launches new course on response to incidents involving alternative fuels and flammable commodities

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

Position paper: Best practices for collaboration between EMS and law enforcement for acute behavioral emergencies

On Sept. 27, the National Association of EMS Physicians (NAEMSP), the International Association of Fire Chiefs (IAFC) and the International Association of Chiefs of Police (IACP) published a position paper in the journal Prehospital Emergency Care, Best Practices for Collaboration Between Law Enforcement and Emergency Medical Services During Acute Behavioral Emergencies.

Emergency Medical Services (EMS) and law enforcement (LE) frequently work as a team in encounters with individuals experiencing acute behavioral emergencies manifesting with severe agitation and aggression. A coordinated and unified response enhances the safety and effective management of potentially serious situations posed by individuals experiencing such acute behavioral emergencies.

IN 2023, NAEMSP, IAFC, and IACP brought together a group of representatives to discuss this issue. The group developed this position paper to provide guidance and direction in the shared responsibility of managing and caring for a person displaying behavioral instability with irrational, agitated, and/or violent behavior.

The paper discusses the roles of LE, 9-1-1 call centers (also called Emergency Call Centers or “ECCs”), EMS, and Fire. It provides a framework endorsed by the NAEMSP, IACP, and the IAFC that outlines a collaborative approach to acute behavioral emergencies. The paper is organized into sections that follow the steps of response, from the initial 911 call and dispatch to post-incident analysis:

• Processing of the call by Emergency Call Center (ECC); Crisis intervention teams and 9-8-8 Suicide and Crisis Lifeline.
• Scene threat assessment; De-escalation; Self-preservation.
• Livesaving is everyone’s duty; Duty to Act/Just culture; Subject or Patient?
• Medical Evaluation; Restraints and Patient Positioning.
• Transport; Transition of Care at Destination; Importance of Appropriate Documentation.
• Post Incident Analysis (PIA).

This 2024 position statement acknowledges the work of a 2021 position statement, Clinical Care and Restraint of the Agitated Patient by Emergency Medical Services Practitioners, which provided an important foundation for the broader discussion of the multidisciplinary collaboration that is already occurring between the emergency response disciplines for the preservation of life and safety. The 2021 position statement was developed by the NAEMSP, the National Association of State EMS Officials (NASEMSO), National EMS Management Association (NEMSMA), National Association of Emergency Medical Technicians (NAEMT), and the American Paramedic Association (APA).

The position paper, “Best Practices for Collaboration Between Law Enforcement and Emergency Medical Services During Acute Behavioral Emergencies,” is an open-access publication. Read the full text of the paper here: https://doi.org/10.1080/10903127.2024.2402530

(Source: Prehospital Emergency Care)

Election security in 2024: Resources for emergency planning and response

The 2024 election cycle is now underway, and the Nov. 5 Election Day is fast approaching.

U.S. elections remain an attractive target for both nation-states and cyber criminals. Election officials and private sector election infrastructure partners are the frontline defenders in securing the electoral process from the physical, cyber, and operational security threats they face.

The following are several resources that may assist emergency managers and emergency responders in their roles ensuring physical security, security of election workers and public officials, and planning and coordination for special security events or large gatherings related to elections.

The Cybersecurity and Infrastructure Security Agency (CISA) released a Cross-Sector Checklist to Support Elections on Sept. 30. The administration of elections relies on infrastructure owned and operated by other critical infrastructure sectors. Scheduled or unexpected outages in other critical infrastructure sectors could have significant cascading effects on the administration of an election. This resource is a checklist that provides a series of questions to help critical infrastructure owners identify actions they can take to support elections. It also gives a basic overview of election administration and highlights how other sectors play a critical role in election operations.

CISA launched an Election Security Resource Library as part of its #Protect2024 campaign. This collection has several additional planning checklists for physical security of election offices, facilities, ballot boxes, polling locations, as well as resources on mitigating insider threats and swatting attacks.

The Federal Emergency Management Agency (FEMA) released an Election Security Resource Guide last month. This resource outlines the activities eligible for grant funding under the Homeland Security Grant Program that enhance election security and the protection of soft targets and crowded places. It lists several additional guidance documents from CISA and the National Institute of Standards and Technology (NIST) related to election security for state and local officials, emergency managers, and critical infrastructure owners and operators.

The Congressional Research Service (CRS) released an Insight last month, Election Worker Safety and Privacy. Concerns about election workers’ safety and privacy have been reported in surveys, news articles, and congressional hearings from the 2020 elections through the current election cycle. This Insight provides a brief overview of recent federal activity on election worker safety and privacy.

(Sources: CISA, FEMA, CRS)

SERTC launches new course on response to incidents involving alternative fuels and flammable commodities

This fall, the Security and Emergency Response Training Center (SERTC) will launch a new course, PER-327 Alternative Fuels and Flammable Incident Response and Management (AFFIRM).

Alternative fuels are rapidly becoming much more than just a buzz word. Electrified vehicles are becoming a major part of not only highway transportation but rail and personal mobility as well. High-pressure gas and cryogenic liquid fueled vehicles are permeating the mass transit and service vehicle market. Hydrogen, ammonia, ether, and many other emerging alternative fuels are popping up in all transportation sectors.

AFFIRM (PER-327) is an intense five-day, resident course that prepares responders for all types of flammable commodity emergencies from crude to batteries. It is offered at SERTC’s campus in Pueblo, Colorado, where SERTC recently broke ground on a new training area that expanded its capabilities to conduct hands-on training for flammable liquids, alternative fuels, and electric vehicle (EV) emergency response.

The AFFIRM course was created in partnership with Hazard3 and Engineering, Procurement & Construction, Inc. (EPC). It was approved by FEMA’s National Training and Education Division (NTED) and is funded by DHS grant funding. This means the course is free to responders and their organizations; participants’ travel, transportation, lodging, meals, and course costs are all covered.

Pilot classes of this course are schedule for the weeks of November 18 and December 16, 2024, with regular offerings starting in 2025. See SERTC’s PER-327 (AFFIRM) course page to learn more about the course and how to apply.

(Source: SERTC, FirstResponderTraining.gov)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

CISA, FBI, NSA, and international partners release advisory on Iranian cyber actors targeting critical infrastructure organizations using brute force

On Oct. 16, CISA—with the Federal Bureau of Investigation (FBI), the National Security Agency (NSA), and international partners—released joint Cybersecurity Advisory Iranian Cyber Actors Brute Force and Credential Access Activity Compromises Critical Infrastructure. This advisory provides known indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) used by Iranian actors to impact organizations across multiple critical infrastructure sectors.

Since October 2023, Iranian actors have used brute force and password spraying to compromise user accounts and obtain access to organizations in the healthcare and public health (HPH), government, information technology, engineering, and energy sectors.

CISA and partners recommend critical infrastructure organizations follow the provided guidance, as well as ensure all accounts use strong passwords and register a second form of authentication.

(Source: CISA)

Russian-backed attackers hit UK ambulance service

Russian-based attackers targeted a supplier to the Ambulance Radio Programme (ARP) as part of a wider cyber campaign against British emergency services.

According to media reports, the attack was aimed at key suppliers to UK Ambulance Services over the last 12 months and is believed to form part of a new Russian cyberwarfare campaign dubbed by UK intelligence sources “Cyber Wagner”, in reference to the hardline Russian mercenary group run by the late Yevgeny Prigozhin.

The warnings come as UK and US agencies issue guidance about the latest tactics being used to collect foreign intelligence for future cyber operations, including in support of Russia’s ongoing invasion of Ukraine.  

(Source: SC Media UK)

UMC Health restores EHR after ransomware attack

UMC Health System in Lubbock, Texas, has confirmed that significant progress has been made in recovering from its September ransomware attack. The ransomware attack affected multiple systems, including systems shared by the affiliated Texas Tech University Health Sciences Center and Texas Tech Physicians.

While care continued to be provided to patients and clinics remained open, its electronic medical record (EHR) system and other key systems were taken offline to contain the incident. Without access to critical systems, emergency and non-emergency patients were diverted to other facilities.

On October 11, 2024, almost three weeks after the attack, UMC Health confirmed that it had restored its EHR system across all locations, its MyCareTeam patient portal has been brought back online, as has the Find-a-Physician page on its website. Texas Tech University Health Sciences Center and Texas Tech Physicians are still experiencing outages due to the attack.

(Source: The HIPAA Journal)

The U.S. is investigating a China-backed hack of telecom companies. Here's what to know.

Federal authorities are investigating a cyberattack linked to China-backed hackers that targeted major U.S. telecommunications companies and systems used for key government intelligence collection capabilities, a U.S. official familiar with the matter confirmed to CBS News.

The hack was first reported by the Wall Street Journal. The FBI and other federal agencies, including CISA, are currently investigating the cyber breach. The FBI, the Justice Department and CISA did not comment.

According to the official, the Chinese hackers breached systems used by U.S. intelligence to conduct wiretaps, and both government agencies and the affected private companies are trying to ascertain what information, if any, the malign actors were able to collect.

The hacking group known as "Salt Typhoon" hit numerous companies including Verizon, AT&T and Lumen Technologies.

(Source: CBS News)

Microsoft reveals ransomware attacks against its customers nearly tripled last year

Microsoft customers confronted nearly triple the amount of ransomware attacks during the one-year period ending in June, the company said Tuesday in its Digital Defense Report.

Microsoft observed a 275% year-over-year increase in human-operated ransomware attacks between July 2023 and June 2024. This increase in ransomware attacks was partially offset by a sustained decrease in cyberattacks reaching the encryption stage, the report found.

“The percentage of attacks reaching actual encryption phase has decreased over the past two years by threefold,” Microsoft said in the report. “Automatic attack disruption contributed to this positive trend in decreasing successful attacks.”

(Source: Cybersecurity Dive)

DOJ: Readout of the Criminal Division’s Symposium on Artificial Intelligence in the Justice Department

The Department of Justice (DOJ), Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS) co-hosted the Artificial Intelligence in the Department of Justice Symposium in Washington, D.C., at the Center for Strategic and International Studies (CSIS) on Oct. 2.

The Principal Deputy Assistant Attorney General (PDAAG) and head of the Criminal Division kicked off the symposium by announcing a new Strategic Approach to Countering Cybercrime that is part of the division’s plan to combat cybercrime and other offenses enabled by emerging technology like AI. As part of the Strategic Approach’s focus on promoting cybersecurity, the division will engage with external stakeholders to update CCIPS’s Vulnerability Disclosure Framework to foster the responsible use of vulnerability testing and reporting and to account for the need for good-faith security research into AI systems.

A newly released Fact Sheet illustrates the recent enforcement actions that CCIPS has taken in furtherance of its Strategic Approach.

Read more in the DOJ’s Oct. 3 press release. A recording of the livestream of the symposium is now available on the symposium webpage

(Source: DOJ)

Army Cyber’s new unit focused on information threats to commanders, troops across the globe

Army Cyber Command’s newly established Theater Information Advantage Detachment will be primarily focused on global threats that U.S. forces are facing in the information space.

The unit is one of three such organizations in the service. Officials recently approved growth for the TIADs, which are 65-person teams focused on synchronizing information capabilities at the theater level. While the U.S. Army Pacific and the U.S. Army Europe and Africa TIADs will be focused on their respective regions, Army Cyber’s will be trans-regional.

These organizations will be present in the day-to-day competition with adversaries, providing commanders opportunities to create information effects while protecting against opponents’ information warfare effects. Then, if scenarios escalate, they can serve as a springboard to help plan and conduct operations or effects for commanders with their own resident capabilities, or attach specialized units such as Army Cyber’s expeditionary cyber teams, which are scalable formations that are designed to augment units upon request with the ability to maneuver with forces and provide offensive cyber capabilities, EW and information advantage functions.

Last year, the Army enshrined information advantage as official doctrine, meaning all commanders must take its tenets — enable, protect, inform, influence and attack — into consideration. The next step, officials believe, is making information a part of maneuver, much like the Marine Corps has done.

(Source: DefenseScoop)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.