The Largest Security-Cleared Career Network for Defense and Intelligence Jobs - JOIN NOW


Center for Army Lesson Learned Logo

Catastrophic Disaster Response Staff Officer's Handbook

Handbook 06-08
May 2006

CALL Handbook No. 06-08: Catastrophic Disaster Response Staff Officer's Handbook Cover

National Response Plan: Terrorism Incident Law Enforcement and Investigation Annex

Appendix F

Coordinating Agencies: Cooperating Agencies:
Department of Justice/Federal Bureau of Investigation Department of Defense
Department of Energy
Department of Health and Human Services
Department of Homeland Security
Department of State Environmental Protection Agency



The purpose of this annex is to facilitate an effective Federal law enforcement and investigative response to all threats or acts of terrorism within the United States, regardless of whether they are deemed credible and/or whether they escalate to an Incident of National Significance. To accomplish this, the annex establishes a structure for a systematic, coordinated, unified, timely, and effective national law enforcement and investigative response to threats or acts of terrorism within the United States.


This annex is a strategic document that:

  • Provides planning guidance and outlines operational concepts for the Federal law enforcement and investigative response to a threatened or actual terrorist incident within the United States; and
  • Acknowledges and outlines the unique nature of each threat or incident, the capabilities and responsibilities of the local jurisdictions, and the law enforcement and investigative activities necessary to prevent or mitigate a specific threat or incident.


The United States regards terrorism as a potential threat to national security, as well as a violent criminal act, and applies all appropriate means to combat this danger. In doing so, the United States vigorously pursues efforts to deter and preempt these crimes and to apprehend and prosecute directly, or assist other governments in prosecuting, individuals who perpetrate or plan terrorist attacks.

To ensure the policies established in applicable Presidential directives are implemented in a coordinated manner, this annex provides overall guidance to Federal, State, local, and tribal agencies concerning the Federal Government’s law enforcement and investigative response to potential or actual terrorist threats or incidents that occur in the United States, particularly those involving weapons of mass destruction (WMD), or chemical, biological, radiological, nuclear, or high-explosive (CBRNE) material.

Federal Agencies

The law enforcement and investigative response to a terrorist threat or incident within the United States is a highly coordinated, interagency State, local, tribal, and Federal responsibility. In support of this mission, the following Federal agencies have primary responsibility for certain aspects of the overall law enforcement and investigative response:

  • Department of Defense (DOD)
  • Department of Energy (DOE)
  • Department of Health and Human Services (HHS)
  • Department of Homeland Security (DHS)
  • Department of Justice/Federal Bureau of Investigation (FBI)
  • Environmental Protection Agency (EPA)

According to HSPD-5, “The Attorney General has lead responsibility for criminal investigations of terrorist acts or terrorist threats by individuals or groups inside the United States, or directed at U.S. citizens or institutions abroad, where such acts are within the Federal criminal jurisdiction of the United States, as well as for related intelligence collection activities within the United States, subject to the National Security Act of 1947 and other applicable law, Executive Order 12333, and Attorney General-approved procedures pursuant to that Executive order. Generally acting through the Federal Bureau of Investigation, the Attorney General, in cooperation with other Federal departments and agencies engaged in activities to protect our national security, shall also coordinate the activities of the other members of the law enforcement community to detect, prevent, preempt, and disrupt terrorist attacks against the United States. Following a terrorist threat or an actual incident that falls within the criminal jurisdiction of the United States, the full capabilities of the United States shall be dedicated, consistent with U.S. law and with activities of other Federal departments and agencies to protect our national security, to assisting the Attorney General to identify the perpetrators and bring them to justice. The Attorney General and the Secretary shall establish appropriate relationships and mechanisms for cooperation and coordination between their two departments.”

Although not formally designated under this annex, other Federal departments and agencies may have authorities, resources, capabilities, or expertise required to support terrorism-related law enforcement and investigation operations. Agencies may be requested to participate in Federal planning and response operations, and may be requested to designate liaison officers and provide other support as required.

Deployment/Employment Priorities

In addition to the priorities identified in the National Response Plan (NRP) Base Plan, the law enforcement and investigative response to terrorist threats or incidents is based on the following priorities:

  • Preserving life or minimizing risk to health; which constitutes the first priority of operations.
  • Preventing a threatened act from being carried out or an existing terrorist act from being expanded or aggravated.
  • Locating, accessing, rendering safe, controlling, containing, recovering, or disposing of a WMD that has not yet functioned, and disposing of CBRNE material in coordination with appropriate departments and agencies (e.g., DOD, DOE, EPA).
  • Apprehending and successfully prosecuting perpetrators of terrorist threats or incidents.

Planning Assumptions and Considerations

  • In addition to the planning assumptions and considerations identified in the NRP Base Plan, the law enforcement and investigative response to terrorist threats or incidents, particularly those involving WMD and CBRNE material, are based on the following assumptions and considerations:
  • A terrorist threat or incident may occur at any time of day with little or no warning, may involve single or multiple geographic areas, and may result in mass casualties.
  • The suspected or actual involvement of terrorists adds a complicating dimension to incident management.
  • The response to a threat or actual incident involves FBI law enforcement and investigative activity as an integrated element.
  • In the case of a threat, there may be no incident site, and no external consequences, and, therefore, there may be no need for establishment of traditional Incident Command System (ICS) elements such as an Incident Command Post (ICP) or a Joint Field Office (JFO).
  • An act of terrorism, particularly an act directed against a large population center within the United States involving nuclear, radiological, biological, or chemical materials, will have major consequences that can overwhelm the capabilities of many local, State, and/or tribal governments to respond and may seriously challenge existing Federal response capabilities.
  • In the case of a biological attack, the effect may be temporally and geographically dispersed, with no determined or defined “incident site.” Response operations may be conducted over a multijurisdictional, multistate region.
  • A biological attack employing a contagious agent may require quarantine by Federal, State, local, and tribal health officials to contain the disease outbreak.
  • If appropriate personal protective equipment and capabilities are not available and the area is contaminated with CBRNE or other hazardous materials, it is possible that response actions into a contaminated area may be delayed until the material has dissipated to a level that is safe for emergency response personnel to operate or until appropriate personal protective equipment and capabilities arrive, whichever is sooner.


The complexity, scope, and potential consequences of a terrorist threat or incident require that there be a rapid and decisive capability to resolve the situation. The resolution to an act of terrorism demands an extraordinary level of coordination of law enforcement, criminal investigation, protective activities, emergency management functions, and technical expertise across all levels of government. The incident may affect a single location or multiple locations, each of which may be an incident scene, a hazardous scene, and/or a crime scene simultaneously.

Concept of Operations

Command and Control

The FBI is the lead agency for criminal investigations of terrorist acts or terrorist threats and intelligence collection activities within the United States. Investigative and intelligence activities are managed by the FBI from an FBI command post or Joint Operations Center (JOC). The command post or JOC coordinates the necessary Federal law enforcement assets required to respond to and resolve the threat or incident with State, local, and tribal law enforcement agencies.

The FBI Special Agent in Charge (SAC) of the local Field Office establishes a command post to manage the threat based upon a graduated and flexible response. This command post structure generally consists of three functional groups: Command, Operations, and Operations Support, and is designed to accommodate participation of other agencies, as appropriate (see Figure 1).

When the threat or incident exceeds the capabilities and resources of the local FBI Field Office, the SAC can request additional assistance from regional and national assets to augment existing capabilities. In a terrorist threat or incident that may involve a WMD or CBRNE material, the traditional FBI command post will transition to a JOC, which may temporarily incorporate a fourth functional entity, the Consequence Management Group (see Figure 2), in the absence of an activated JFO.

When, in the determination of the Secretary of Homeland Security, in coordination with the Attorney General, the incident becomes an Incident of National Significance and a JFO is established, the JOC becomes a section of the JFO and the FBI SAC becomes the Senior Federal Law Enforcement Official (SFLEO) in the JFO Coordination Group. In this situation, the JOC Consequence Management Group is incorporated into the appropriate components of the JFO (see NRP Base Plan, Figure 4 and Figure 7).

Graphic depicting FBI command post
Figure AF-1. FBI command post

The JOC structure may also be used to coordinate law enforcement, investigative, and intelligence activities for the numerous threats or incidents that occur each year that do not escalate to Incidents of National Significance.

Joint Operations Center

  • The JOC is an interagency command and control center for managing interagency preparation for, and the law enforcement and investigative response to, a credible terrorist threat or incident. Similar to the Area Command concept within the ICS, the JOC also may be established to coordinate and organize multiple agencies and jurisdictions during critical incidents or special events. Following the basic principles established in the National Incident Management System (NIMS), the JOC is modular and scalable and may be tailored to meet the specific operational requirements needed to manage the threat, incident, or special event.
  • A JOC may be established and staffed in a pre-incident, pre-emptive role in support of a significant special event. This “watch mode” allows for rapid expansion to full operations if a critical incident occurs during the special event. The JOC is a strategic management tool that effectively coordinates law enforcement investigative, intelligence, and operational activities at multiple sites from a single location. The JOC may be the only management structure related to a threat, critical incident, or special event, or it may integrate into other management structures in accordance with the NRP.
  • Law enforcement public safety functions, such as proactive patrol and traffic control, historically are managed through the Operations Section of the ICS. Criminal investigation and the collection, analysis, and dissemination of intelligence are sensitive law enforcement operations that require a secure environment and well-defined organizational management structure. The JOC is designed to coordinate this specialized law enforcement investigative and intelligence activity. It provides mechanisms for controlling access to and dissemination of sensitive or classified information. Management of crisis information and intelligence is recognized under the NIMS as a sixth functional area within ICS. The structure of the JOC supports this functional area and enhances the overall management of critical incidents and special events.
  • The NIMS provides the framework within which the ICS and JOC structures operate for a unified approach to domestic incident management.
  • The JOC is composed of four main groups: the Command Group, the Operations Group, the Operations Support Group, and the Consequence Management Group.

Graphic depicting Joint Operations Center
Figure AF-2: Joint Operations Center

* While the Operations Group and Operations Support Group remain components of the JOC when it is incorporated into the JFO, the JIC and Consequence Management Group will be merged into the appropriate JFO staff components, if established.

Command Group

  • The Command Group of the JOC provides recommendations and advice to the FBI SAC regarding the development and implementation of strategic decisions to resolve the situation. It is responsible for approving the deployment and employment of law enforcement investigative and intelligence resources. The Command Group maintains its advisory role to the FBI SAC when the JOC becomes a section of the JFO for an Incident of National Significance. When a JFO is established in this situation, the FBI SAC becomes the SFLEO in the JFO Coordination Group. The Assistant SAC or an alternate senior FBI official leads the JOC Command Group once the SAC has transitioned to the JFO.
  • The FBI representatives in the Command Group include the SAC, the Assistant SAC, and an executive-officer position known as the Crisis Management Coordinator (CMC). The SAC of the FBI Field Office in which the incident occurs is responsible for developing the overall strategy for managing Federal investigative law enforcement activities at the critical incident or special event and coordinating the implementation of that strategy with other agency decision makers and FBI Headquarters. The FBI SAC also is responsible for coordinating Federal law enforcement activities with other Federal incident management personnel during domestic critical incidents and special events. The CMC ensures that the strategy of the SAC is communicated to everyone in the JOC and that the JOC is staffed and equipped to effectively implement the strategy of the SAC. The CMC also ensures that information flows efficiently within the JOC and between the JOC and other command and control centers.
  • The JOC Command Group includes senior officials with decision making authority from local, State, and Federal agencies, as appropriate, based upon the circumstances of the threat or incident. Consistent with the Unified Command concept, law enforcement investigative and intelligence strategies, tactics, and priorities are determined jointly within the JOC Command Group. Federal law enforcement investigative, intelligence, and operational decisions are made cooperatively to the extent possible, but the authority to make these decisions rests ultimately with the FBI SAC.
  • Three specialized teams provide guidance and expertise directly to the Command Group. These teams are the Strategic Legal Team, the Joint Information Center Team, and the Domestic Emergency Support Team.
    • The Strategic Legal Team is composed of legal counsel from the FBI, U.S. Attorney’s Office, and the District or State’s Attorney’s Office. This team provides legal guidance to the Command Group concerning the strategies under consideration for resolution of the crisis.
    • The Joint Information Center (JIC) Team is integrated into the JFO when established. It is composed of the public affairs (media) officers from the participating local, State, and Federal public safety agencies. It manages information released to the public through a coordinated, unified approach. A separate media unit within the JOC Operations Support Group provides FBI-specific guidance and expertise to the FBI SAC and coordinates with the JIC to ensure the media strategy is consistent with the overall investigative strategy.
    • The Domestic Emergency Support Team (DEST) is a specialized interagency team composed of subject-matter experts from the FBI, the DHS/Emergency Preparedness and Response/Federal Emergency Management Agency (DHS/EPR/FEMA), DOD, DOE, HHS, and EPA. It provides guidance to the FBI SAC concerning WMD threats and actual incidents.

Operations Group

  • The Operations Group handles all investigative, intelligence, and operational functions related to the threat, critical incident, or special event.
  • Each unit within the Operations Group provides expertise in a specific functional area that is important in the overall resolution of the incident.
  • The units within the Operations Group are scalable and modular, and may be tailored to the specific threat, critical incident, or special event.
  • The Operations Group normally consists of the Information Intake unit (formerly referred to as the Control unit), the Intelligence unit, the Investigations unit, and Field Operations units.

Information Intake (or Control)

  • Information Intake is the central point for receiving all information that comes into the JOC. The purpose of Information Intake is to ensure that telephone calls, e-mail messages, fax reports, and other incoming information are assessed for relevance to the threat, critical incident, or special event. The information is checked to determine if it has been previously reported. It is prioritized and entered into the information management system. Through this filtering mechanism the Information Intake unit ensures that only current and relevant information is disseminated to the JOC.
  • The Information Intake Coordinator is responsible for providing guidance and direction to all personnel within the Information Intake unit and coordinating the activities of the unit with all other units within the JOC. Personnel within the Information Intake unit are responsible for receiving incoming information, processing new information, routing followup information appropriately, and implementing procedures for tracking evidentiary material that is introduced into the command post.


  • The Intelligence unit manages the collection, analysis, archiving, and dissemination of relevant and valid investigative and strategic intelligence. It fuses historical intelligence from a variety of sources with new intelligence specific to the threat, critical incident, or special event. The Intelligence unit also disseminates intelligence products and situation reports to all JOC units, FBI Headquarters Strategic Information and Operations Center (SIOC), and the JFO Coordination Group. This information is shared with the DHS Homeland Security Operations Center (HSOC), the National Counterterrorism Center (NCTC), and, as appropriate, other government agencies, consistent with operational security considerations.
  • The Intelligence unit usually is divided into teams based on functional responsibility. Teams manage intelligence related to the crisis site or target, build intelligence portfolios and databases on significant elements related to the investigation (subjects, vehicles, and organizations), analyze and identify trends in activities related to the investigation (predictive and strategic intelligence), conduct liaison with outside members of the Intelligence Community, and prepare periodic briefings and reports concerning the status of the crisis or investigation. The Intelligence unit is responsible for collecting and reviewing all intelligence related to the threat, crisis, or special event to enable the SAC to further develop and refine strategic objectives.


  • The Investigations unit provides oversight and direction to all investigative activity related to the threat, critical incident, or special event. The Investigations unit implements the strategy of the SAC by directing the collection and management of investigative information. It is composed of investigative personnel from the agencies with specific jurisdiction or authority for investigating crimes related to the threat, critical incident, or special event. The Investigations Unit Coordinator is usually an FBI Supervisor who has responsibility for investigating the most significant substantive law violation.
  • Teams within the Investigations unit review all incoming information to determine investigative value. The Investigations unit assigns, tracks, and reviews all investigative leads and documents the investigation in the appropriate case file(s). The case agents or primary investigators within the Investigations unit manage all evidence and information, and prepare it for court presentation, if appropriate. The case agents or primary investigators are assisted by analytical personnel to ensure that all investigative information is pursued to its logical conclusion. A Records Check Team within the Investigations unit reviews case files and databases to ensure that all items of investigative value are identified and evaluated. The Investigations unit is responsible for collecting and reviewing all reports of investigative activity to enable the SAC to further develop and refine strategic objectives.

Field Operations

  • The Field Operations units are based upon the specific needs of the threat, critical incident, or special event. The personnel staffing these units are subject-matter experts in a number of specialized skill areas. Field Operations unit coordinators are responsible for ensuring the activity of the specialized units is consistent with and in support of the strategy of the SAC.
  • Field Operations units may include representatives of tactical, negotiations, WMD/CBRNE, evidence response, surveillance, technical, or any other specialized unit deployed to the crisis site(s) or staged in readiness. The mission of these units is to provide the SAC with current information and specialized assistance in dealing with the threat, critical incident, or special event. Information is communicated between the JOC and the crisis site(s) through the Field Operations unit representatives in the JOC. This ensures that decision makers both in the JOC and in the forward areas maintain full situational awareness. The Field Operations units coordinate their activities within the JOC to ensure each is aware of the impact of their activities on the other field units.
  • Local, State, and Federal law enforcement specialty units assigned to assist with field operations during the threat, incident, or special event coordinate their activities with the appropriate FBI Field Operations units through the JOC. Federal Government mission-specific units are designated to help the FBI maintain their respective chains of command and coordinate their activities through representation in the JOC. The JOC manages the activities of the specialized units at a strategic level. Activities at the individual or “tactical” level are managed at the crisis site(s) through forward command structures such as the Tactical Operations Center, Negotiations Operations Center, and Evidence Response Team Operations Center.

Operations Support Group

  • The Operations Support Group units designated within the JOC are based upon the specific needs of the threat, critical incident, or special event. The personnel who staff these units are subject-matter experts in a number of specialized areas. Operations Support Group unit coordinators are responsible for ensuring the activity of their units is consistent with and in support of the strategy of the SAC.
  • Operations Support Group units can include administrative, logistics, legal, media, liaison, communications, and information management. The mission of these units is to support the investigative, intelligence, and operational functions of the JOC.
  • The Administrative and Logistics units have responsibilities that are similar to the Finance and Logistics Sections in ICS. However, they are tasked with managing only the activities related to the law enforcement investigative, intelligence, and operational functions; they do not manage the administrative and logistics functions associated with the overall incident.
  • The Legal and Media units support the investigative and intelligence operations of the JOC through the preparation of specific legal processes and management of media affairs. These units focus on specific objectives related to the investigation such as search warrants and press releases, and not the strategic overall objectives handled by the Strategic Legal Team and JIC that are attached to the Command Group.
  • The Liaison unit is composed of representatives from outside agencies who assist the FBI with resolution of the threat, critical incident, or special event. The Liaison unit may include agencies without clear authority or jurisdiction over the threat, critical incident, or special event if they have a potential investigative interest. For example, law enforcement agencies that border affected jurisdictions may be represented in the JOC to maintain situational awareness of potential threats. Additional Liaison unit representatives may include fire department personnel, utility company workers, or engineering specialists.
  • The Communications unit handles radio and telephone communications to support JOC operations. The Communications unit establishes communications networks within the JOC. It also establishes networks to facilitate timely and reliable information-sharing between the JOC and other command and control centers.
  • The Information Technology unit is responsible for the JOC computer system operation within each unit and between units. Information technology specialists and facilitators assigned to this unit are responsible for ensuring the uninterrupted operation of the information management system used during JOC operations.

Consequence Management Group

  • The JOC Consequence Management Group consists of representatives of agencies that provide consequence-focused expertise in support of law enforcement activities. The JOC does not manage consequence functions; rather, it ensures that law enforcement activities with emergency management implications are communicated and coordinated to appropriate personnel in a complete and timely manner.
  • A DHS representative coordinates the actions of the JOC Consequence Management Group, and expedites activation of a Federal incident management response should it become necessary. FBI and DHS representatives screen threat/incident intelligence for the Consequence Management Group. Representatives of the JOC Consequence Management Group monitor the law enforcement criminal investigation and may provide advice regarding decisions that impact the general public or critical infrastructure. This integration provides continuity should a Federal incident management response become necessary.
  • Agencies comprising the Consequence Management Group may also have personnel assigned to other units within the JOC structure. Depending on the nature of the incident and required assets, additional teams assigned to support the FBI may be included under Other Specialized Units.
  • Should the threat of a terrorist incident become imminent, the JOC Consequence Management Group may forward recommendations to the RRCC Director to initiate limited pre-deployment of assets under the Stafford Act.
  • Requests for DOD assistance for law enforcement and criminal investigation during the incident come from the Attorney General to the Secretary of Defense through the DOD Executive Secretary. Once the Secretary approves the request, the order is transmitted either directly to the unit involved or through the Chairman of the Joint Chiefs of Staff. The FBI SAC informs the Principal Federal Official (PFO), if one has been designated, when requesting this additional assistance.
  • The Consequence Management Group is established when a JOC is necessary but a JFO has not yet been activated, or the event has not reached the level of being considered an Incident of National Significance.
  • Representatives in this group may move to appropriate positions in other sections of the JFO when one is established.

The Response

  • Receipt of a terrorist threat may be through any source or medium and may be articulated or developed through intelligence sources. It is the responsibility of all local, State, and Federal agencies and departments to notify the FBI when such a threat is received. As explained below, the FBI evaluates the credibility of the terrorist threat and notifies the HSOC, NCTC, and other departments and agencies, as appropriate.
  • Upon receipt of a threat of terrorism within the United States, the FBI conducts a formal threat credibility assessment in support of operations with assistance from select interagency experts. For a WMD or CBRNE threat, this assessment includes three perspectives:
  • Technical Feasibility: An assessment of the capacity of the threatening individual or organization to obtain or produce the material at issue;
  • Operational Practicability: An assessment of the feasibility of delivering or employing the material in the manner threatened; and
  • Behavioral Resolve: A psychological assessment of the likelihood that the subject(s) will carry out the threat, including a review of any written or verbal statement by the subject(s).
  • A threat assessment is conducted to determine whether the potential threat is credible, and confirm whether WMD or CBRNE materials are involved in the developing terrorist incident. Intelligence varies with each threat and impacts the level of the Federal response. If the threat is credible, the situation requires the tailoring of response actions to use Federal resources needed to anticipate, prevent, and/or resolve the situation. The Federal response focuses on law enforcement/investigative actions taken in the interest of public safety and welfare, and is predominantly concerned with preventing and resolving the threat. In addition, contingency planning focuses on the response to potential consequences and the pre-positioning of tailored resources, as required. The threat increases in significance when the presence of a CBRNE device or WMD capable of causing a significant destructive event, prior to actual injury or loss, is confirmed or when intelligence and circumstances indicate a high probability that a device exists. In this case, the threat has developed into a WMD or CBRNE terrorist situation requiring an immediate process to identify, acquire, and plan the use of Federal resources to augment State, local, and tribal authorities in lessening or averting the potential consequence of terrorist use or employment of WMD or CBRNE material. It should be noted that a threat assessment would also be conducted if an incident occurs without warning. In this case, the assessment is focused on criminal intent, the extent of the threat, and the likelihood of secondary devices or locations.
  • The FBI manages a Terrorist Threat Warning System to ensure that vital information regarding terrorism reaches those in the U.S. counterterrorism and law enforcement community responsible for countering terrorist threats. This information is coordinated with DHS and the NCTC, and is transmitted via secure teletype. Each message transmitted under this system is an alert, an advisory, or an assessment—an alert if the terrorist threat is credible and specific, an advisory if the threat is credible but general in both timing and target, or an assessment to impart facts and/or threat analysis concerning terrorism.
  • Upon determination of a credible threat, FBI Headquarters activates its SIOC to coordinate and manage the national-level support to a terrorism incident. At this level, the SIOC generally mirrors the JOC structure operating in the field. The SIOC is staffed by liaison officers from other Federal agencies who coordinate with and provide assistance to the FBI. The SIOC serves as the focal point for law enforcement operations and maintains direct connectivity with the HSOC. The HSOC is notified immediately by the SIOC once a threat has been determined to be credible. In turn, this notification may result in activation of NRP components in coordination with the FBI.
  • The FBI leads the criminal investigation related to the incident, and the SIOC is the focal point for all intelligence related to the investigative law enforcement response to the incident. Consistent with the NRP, affected Federal agencies operate headquarters-level emergency operations centers, as necessary. FBI Headquarters initiates appropriate liaison with other Federal agencies to activate their operations centers and provide liaison officers to the SIOC. In addition, FBI Headquarters initiates communications with the SAC of the responsible Field Office, apprising him/her of possible courses of action and discussing deployment of the DEST. The FBI SAC establishes initial operational priorities based upon the specific circumstances of the threat or incident. This information is then forwarded to FBI Headquarters to coordinate identification and deployment of appropriate resources.
  • The JOC is established by the FBI under the operational control of the FBI SAC, and acts as the focal point for the field coordination of criminal investigation, law enforcement, and intelligence activities related to the threat or incident. When a PFO is designated for a terrorism incident, the FBI SAC provides full and prompt cooperation, resources, and support to the PFO, as appropriate and consistent with applicable authorities. The PFO (or an initial PFO designated by the Secretary of Homeland Security) may elect to use the JOC as an initial operating facility for strategic management and identification of State, local, and tribal requirements and priorities, and coordination of the Federal response. The FBI SAC coordinates with the PFO, including providing incident information to the PFO as requested, coordinating the public communications strategy with the PFO, and approving Federal interagency communications for release to the public through the PFO. It is recognized, however, that in some cases it may be necessary for the FBI SAC to respond directly to media/public inquiries on investigative operations and matters affecting law enforcement operations, particularly during the early stages of the emergency response.
  • The local FBI Field Office activates a Crisis Management Team to establish the JOC in the affected area, possibly collocated with an existing emergency operations facility. In locating the JOC, consideration is given to the possibility that the facility may have to accommodate other Federal incident management field activities including the JFO, the JIC, and other supporting teams. Additionally, the JOC is augmented by outside agencies, including representatives from the DEST (if deployed), who provide interagency technical expertise as well as interagency continuity during the transition from an FBI command post structure to the JOC structure.
  • Based upon a credible threat assessment and a request by the SAC, the FBI Director and DHS Under Secretary for Emergency Preparedness and Response, in consultation with the Attorney General and Secretary of Homeland Security, may request authorization through the National Security Council to deploy the DEST to assist the SAC in mitigating the crisis situation. The DEST is a rapidly deployable, interagency team responsible for providing expert advice and support concerning the Federal Government’s capabilities in resolving the terrorist threat or incident. This includes law enforcement, criminal investigation, and emergency management assistance, technical and scientific advice, and contingency planning guidance tailored to situations involving chemical, biological, or nuclear/radiological weapons.
  • Upon arrival at the FBI command post or JOC, the DEST may act as a stand-alone advisory team to the SAC providing recommended courses of action. Although it would be unusual, the DEST may be tasked to deploy before a JOC is established. The DEST may handle some of the specialized interagency functions of the JOC until the JOC is fully staffed. The DEST emergency management component merges into the Consequence Management Group in the JOC structure.
  • Prior to an actual WMD or CBRNE incident, law enforcement, intelligence, and investigative activities generally have priority. When an incident results in the use of WMD or CBRNE material, rescue and life-safety activities generally have priority. Activities may overlap and/or run concurrently during the incident management, and are dependent on the threat and/or the strategies for responding to the incident.
  • Upon determination that applicable law enforcement/intelligence goals and objectives are met and no further immediate threat exists, the FBI SAC may deactivate the JOC and order a return to routine law enforcement/investigative operations in accordance with pre-event protocols.
  • When an incident occurs and an ICP is established on-scene, FBI personnel integrate into the ICP to enhance the ability of the FBI to carry out its mandated mission (see Figure 3). Three specific positions within an ICP are provided. The first FBI Special Agent (SA) or Joint Terrorism Task Force (JTTF) member responding receives an initial briefing from the Incident Commander or his/her designee and works closely with the Incident Commander as a member of the Unified Command. The FBI representative then informs the local Field Office of the current situation and, if necessary, requests additional assets. When a more senior FBI SA arrives on the scene, he/she assumes the role of the FBI representative in the Unified Command.
  • The first arriving SA or JTTF member moves to the Operations Section as the Deputy Chief of Operations. This position is responsible for managing the deployment and coordination of Federal law enforcement and investigative assets in support of the Incident Action Plan. Additionally, an FBI SA assumes the position of Deputy Chief of Planning within the ICP. This position permits the FBI SA to remain updated on the situation and serve as a conduit for requests for additional law enforcement and investigative assets. The Agent also inputs Federal objectives into the developing incident action plan and performs other duties as appropriate. Also, FBI assets form a unit in the

Operations Section. Throughout the incident, the actions and activities of the Unified Command at the incident scene and the Command Group of the JOC (and the JFO Coordination Group if established) are continuously and completely coordinated throughout the incident.

Graphic depicting on-scene coordination
Figure AF-3: On-scene coordination

Note: Operational control of assets Unified at the scene is retained by the Command designated officials representing the agency (local, State, or Federal) (Police, Fire, EMS, FBI) providing the assets.

Join the mailing list

One Billion Americans: The Case for Thinking Bigger - by Matthew Yglesias