Ep 22: Complex Coordinated Attack (CCA)

C3 Podcast: Active Shooter Incident Management

Episode 22: Complex Coordinated Attack (CCA)

A discussion of Complex Coordinated Attack (CCA), sometimes referred to as Complex Coordinated Terrorist Attack (CCTA).

Bill Godfrey:

Welcome back everybody to our next podcast. Today's subject, we are going to talk about Complex Coordinated Attack. Now, interestingly, the terminology means a little bit different depending on where you are or who you're talking to. Some people call it CCA, Complex Coordinated Attack. Sometimes it's referred to as CCTA, Complex Coordinated Terrorist Attack. For the purposes of our conversation here today, it's all the same. My name is Bill Godfrey, one of the instructors here at C3 Pathways. I've got with me, Bruce Scott, one of our other instructors. Bruce, say hello.

Bruce Scott:

Hello

Bill Godfrey:

And Tom Billington.

Tom Billington:

Hello, how you doing?

Bill Godfrey:

And Don Tuten.

Don Tuten:

Good afternoon.

Bill Godfrey:

All right, so we've got four of our instructors. Actually, this team that's with you today was part of the group that just did our new CCTA for EOC a class a few weeks ago. We've got another delivery coming up in a few weeks, but we wanted to talk a little bit about some of this. So let's start off by talking about our definition of a CCA which is more of a responder's definition, the necessarily like our research definition, and some of the challenges with that.

So I'll share this with you, the way we define a CCA is, it's three or more attackers, or two or more sites, or an act of terrorism that overwhelms the local jurisdiction. Now, that sounds pretty loosey goosey on the surface, and we don't disagree with that. But the point is, is that our definition is designed for use by responders. When you're listening to the radio, you're listening to the dispatch, you're listening to what's going on to be able to say, "Huh, that doesn't sound good. That sounds like that could be a CCA." So Don, why don't you talk a little bit about the importance of early recognition, and why that matters? Why we kind of steered away from the research grade definition and went to that instead?

Don Tuten:

Absolutely. So first and foremost is you're going to be competing for resources, that is the biggest thing, and knowing what type of incidents or incidents are out there, and who is performing these incidents, whether they're terrorists, whether there are foreign terrorists, whether they're homegrown terrorists. To us, the intel is a big piece of it, but ultimately, we have to really gather those resources to be able to manage and take care of each one of those scenes independently as well as collectively, because they may be tied together as you know, Bill. And they're working with our federal partners, working with our local jurisdictions, making sure everybody's on the same page to be prepared, training together, ensuring that we have MOUs with each other, especially, in smaller agencies and smaller jurisdictions, where we're all competing for the same resources and having some type of understanding of who we call, when we call, and how they'll get there in some of our staging areas, that's another piece that we really see is obviously, is where we're going to bring those resources into.

Bill Godfrey:

Tom, you've got a lot of background in emergency management as does as, well, actually, all of us do quite frankly. But what's your thoughts on the importance, especially on the fire-EMS side of recognizing pretty early on that this is not your usual call?

Tom Billington:

Well, first of, these events are going to happen at 1:00 in the morning during the week. They're not going to happen 9:00 a.m. on a Monday when everybody's in the office. So it's important that our line personnel, or shift commanders, battalion chiefs, lieutenants, law enforcement, supervisors have a good idea of what a CCA or CCTA is and when to declare that it is happening. So the sooner the better, because obviously, if you have three or four different incidents going on in your county, it's going to be the shift supervisor has to determine, are these things connected, or are they just three separate issues? So that's the main thing, putting the puzzle together. If I have a shooting in one area, a car blows up in another area, and suddenly, I hear about a shooting. Are these connected? Is this a complex attack, or are they just separate incidents? So it's going to be the ground supervisor, the line supervisor to find it out as soon as possible and put the puzzle together.

Bill Godfrey:

Bruce, what's your take?

Bruce Scott:

I think the key, Bill, is that early recognition, right? So the definitions that we provide kind of allow us to say, this is abnormal, this is way out of the ordinary, this is a trigger that some things need to happen. And those things may very well be that establish of that area command, that establishment of activation your EOC, the notification of your senior officials. So having those triggers already there and putting them in the back of your head and said, these are not, this is a huge abnormality, and we need to make these triggers happen. Because as Tom alluded to that it takes a long time to start putting these resources together, and so having those definitions early on and allow those triggers to make things happen.

Bill Godfrey:

Yeah, it's interesting all of you have kind of mentioned now the idea of area command. Let's talk about that a little bit. First of all, let's explain what area command is, and then kind of dig into the dirt a little bit about why we felt like that was such a great tool for addressing CCAs. Bruce, you want to go into the basis of area command, that concept behind it?

Bruce Scott:

I sure would, because I think it's one of the most misunderstood things in the incident command system and the least trained on, right? So we touch about it. I'll touch a little on it. When we teach I3 or G300 or G400, we talk a little bit about area command, but we really don't practice it. People don't understand it. And the thing is, you can't plant a higher ICS flag and incident command flag in area command. So you put that flag in the ground and say, "You know what? We're in charge. We have jurisdictional authority." And now, we're going to begin coordinating all the efforts if it is multiple sites, if it is multiple shooters, it allows us to begin the coordinating effort at a high level of an incident.

Don Tuten:

And I tell you, I like to expand on that too, is because you've got to think outside of what our local responses are, you're going to get federal responses, and they need to come to one place, know where to go, especially when you have multiple sites, and then how are you going to divvy those resources out to those sites, and then give them tasks to work with those specific incident commanders at those different sites.

Bill Godfrey:

Absolutely. Tom, Bruce mentioned planting the flag and putting that in, but when you've got multiple jurisdictions involved which is easy to have happened and accomplish coordinate attack, what does that look like at area command? How do you make that work when your incidents or your attack across a bunch of jurisdictions?

Tom Billington:

This is something that has to be decided beforehand. We talk about that a lot, medium counterparts, having mutually agreements, having automatic aid agreements. Because if it's a complex coordinated attack, you're right, it could be going over county lines, even state lines in some areas. These are things we need to figure out ahead of time, and there needs to be a statement of jurisdiction, which is kind of hard to get several counties online, but it can be done, deciding ahead of time if it's hits two or three counties. Are we going to work together and do a unified area command? So again, pre-planning with your partners beforehand is important.

Bill Godfrey:

Yeah, I think the key element there was the idea of a unified area command, which it's not any easier than a regular unified command, which can be fun. You all can't see it but all three of the other instructors are laughing with me. We've always kind of seen that before. So the unified command concept is a great one. It's hard to do if you haven't practiced it or you got a bunch of people that are having to work together that don't know each other. It doesn't mean it can't work, but boy, it's a whole lot easier if you can meet your counterparts and leadership folks from the other agencies and other jurisdictions in training and things like that, just kind of getting that.

The other thing I want to touch on an area command before we kind of leave that is a concept and talking about why you want to use it, and I think this tangents into it is, one of the differences between a gathering a bunch of incidents and making them a complex under one incident in area command is that each of the incident commanders at the individual sites retains their incident command authority.

That site is their responsibility, and they're making the decisions at the call where area command is setting the priorities, setting the big picture objectives, setting the resources. In other words, Bruce, if you've got an incident, and you've got 10, 12 people that are injured and down, but there's nothing active going on right now, but you're calling for help. And Tom's got an incident going on, and he's got half a dozen or a dozen with a car through the crowd and a problem. But over at Don's place, it's just bad news.

There's three or four people with automatic weapons and the killing is ongoing. Well, the three incidents, you guys might not even know about each other's existence or that the incidents are going on but area command is, and they're the ones that have to make the decision to say, "Bruce, Tom, do the best you can with what you got. We'll get you some when we can. But in the meantime, I got to push resources over to Don" on this third incident, so that was one of the things I wanted you guys to talk about.

Don Tuten:

Well, in staging, an area staging is a big part of that also, is you have to, once again, lean forward thinking if this is going to be an area command is going to take over, managing these two, three, four different incident sites, you have to set up an area staging as soon as possible. Everybody has to be on board to push things out, and I think a good way to practice this, Bill, is on larger, special events that are taken over two or three locations. And even in some of these different communities can practice, each individual parking could be set up as a separate incident command for instance, inside a venue. And that's a smaller way to practice how this is going to work by setting up an area command.

Tom Billington:

And, Bill, if I can add, we just need to remember that an area command is not an EOC, an emergency operations center, totally two separate items, two separate very important items. At the emergency operation center, usually, I know most jurisdictions takes hours to get stood up. An area command handles the problems that are right now, right here, right now, let's handle it, but we do need to get that EOC set up or multiple EOC set up in various counties.

Bill Godfrey:

Yeah, absolutely. Bruce, you want to talk a little bit more about that?

Bruce Scott:

Well, first off, I'd like to say that as you alluded to, Bill, area command has to make those critical resource decisions, right? And the only way you can do that successfully is number one, have pre-established relationships and good communications with your incident commanders, right? You have to be able to explain to them what the overall situation is and understand, "Hey, you just can't. Tom, you're going to have to wait on your resources." So it has to be an understanding and trust that's been developed. And as Tom alluded to earlier, the only way you do that is plan together, train together, exercise together, and continue to do that. Emergency operation centers do take a long time to get set up, and they can help you with those critical resource decision, not necessarily where are you going to allocate those resources but the amount of resources that you can bring into the fight from both your mutual aid partners, your state partners, and your federal partners, and help coordinate that.

And one of the things I think that really emergency management brings to the table, if you would, Bill, if you order a hundred police officers, or a hundred fire trucks, and a hundred ambulances, where are they going to stay? Where are they going to eat? Where are they going to go to the restroom? How are they going to get fuel? An emergency management does a lot of that planning in the foreground and probably have logistical staging areas set up and an ability to support those resources as they come in. So I think emergency management and your merchant operation center play a key role in that.

Bill Godfrey:

Yeah, absolutely they do. They're complementary roles. And I think, Tom put it well. The reason for area command is we don't have time to wait. This is a right now-right now problem. As our friend, Jeff used to always say, "We got to get on it", and that's the role of area command. But the role of the EOC is to almost be shoulder to shoulder with area command and partnering on those resources. Because I think the other thing that people sometimes forget is no matter how good your comm center is, no matter how good that dispatch center is, no matter how well their staff, they are going to get overwhelmed and overloaded. And once you've stripped the resources that are available to them through the CAD system, or through the radio, now they got to go old school, and start picking up phones, and calling agencies, and calling other dispatch centers, and that's slow and tedious.

And when they're already overloaded, that's hard to do. But the EOC has mechanisms in place to be able to say it, Bruce, as you said, "I need a hundred cops, and I need them. I need a 500 cops. I need a hundred engines or a hundred ambulances", whatever the case may be. That's a big request order, but they can get that done. Now, as you pointed out rightfully so, there's a lot of responsibility that comes with ordering up that many folks. So that's really kind of interesting. So let's go back and talk a little bit more now that we kind of explained how those pieces fit together. Let's talk about some of the issues that area command needs to focus on versus the individual incident commander at a site.

So let's take my example that I just gave you guys. We've got three active sites that are working, and area command is having to split the decisions. Give me some examples of what the incident commander at a site has to worry about versus the area command team or the unified area command that's making the bigger picture resource decisions and things like that.

Bruce Scott:

Well, I'll tell you. As an on-scene incident commander, I'm only concerned about my incident, right? So if I'm thinking that there's nobody more important in the world than me at that particular incident some time, and I really think that it's the understanding of what the area command mechanism is put in place, that you have that understanding of there are other incidents going on, and then there may be those critical resource of decisions that are being made, they're being made for a good reason. I think that's the understanding of that that has to happen.

Don Tuten:

Yeah, and I think you put it well. As the incident commander, you're over that one incident, and you may not know, like you said, what the other incidents are until that area command comes in and explains to you, "Listen, you're one piece of the pie. There's three additional horrible and terrible incidents out there. And we have manage those resources coming in because we're all competing for the same thing." We all want it as an incident commander for a specific site, but we're given a hundred percent for that site, but we may not know what Tom's working, or what you're working at another place. In area command, gels all that together, understands what the priorities are, and then ultimately utilizes the resources and the individual strengths to handle the big picture, and what's going on as well as gathering the intel, because you may only have the intelligence of your one specific location and not know how it ties into the other locations.

Bruce Scott:

Right, and I think that's what Bill is actually alluding to. The intelligence that we're gathering at our incident merge with the intelligence that you're gathering from your incident, be able to put those pieces, big picture together are we see some commonalities.

Don Tuten:

Absolutely.

Bruce Scott:

And again, I'm sorry, I didn't mean to interrupt you, if we can start predicting, and get out of a reactive state, and move into a proactive state, and maybe prevent that third or fourth incident from happening because we're doing a good job of gathering intelligence and sharing of information.

Bill Godfrey:

That's a perfect segue was where I was going to go. Tom, imagine you're the area commander, or you're part of the unified area command team. We've got three incidents. One's at a train station. One's at a plane, an airport, and one's at a bus terminal. What are you thinking is the area command? Each of the incident commanders were up to the weeds. We're in the weeds up to our necks, trying to deal with our individual incidents. What are you starting to think as the area commander? What are the thoughts running through your head? What are some of the community action steps that you might be taking that we would never even think of as incident commanders?

Tom Billington:

This is where the big hat comes in and being every command. You don't only have to know what's going on now, what's coming next, and do I have resources what's coming next? If I have transportation hubs that are being attacked, do I have another railroad station, another airport they have to consider? Do I want to make sure I pre-positioned resources elsewhere where attacks may happen? What is my intelligence telling me? I need a good area intelligence, as Bruce said, to give of the other three incidents that are going on, to see what commonalities are. So these are the things that Eric Mann has to think about. Yes, I need to support my three incidents that are ongoing. But what is getting ready to happen, when it happens, how am I going to respond to it?

Don Tuten:

And nationally, I mean, transportation is one of those things that as an area commander, you have to, once again, think about, yeah, not only is the transportation sector in my area where these three events are, but this could be an ongoing national event, and that area commanders starts pushing up to their state and federal resources. We may be one of three or three or four sites of a national attack that's coordinated that we may not know about. So important for that area commander to work well with those federal and state partners and push that information up just like an incident commander would.

Bruce Scott:

And I think it's also important to note that if local jurisdictions fear that they may be next, your normal way of getting those resources and that help that you thought they're going to hold onto that help. So again, that early recognition, that early cry for help, potentially, we'll get your assistance quicker, because typically, local communities will hold onto their resources and not send them to help anybody else if they think it may happen there.

Bill Godfrey:

Yeah, exactly. For example, you know, if we have the situation we just described as pretty clearly attack on transportation sector, as the area commander, I might be thinking, okay, what other transportation hubs do we have? Do I need to preemptively, you know, if we've got a commuter rail system, do I need to preemptively put a law enforcement assets at each rail station? Do we need to shut the rail station down? Do we need to shut the bus lines down? Assuming the airport has been closed, how many passengers have I just stranded? And boy, that's going to keep EOC busy, trying to figure out how to house 5,000 people, 2000 of which left their ID, wallets, and cell phones in their purses, and carry on’s, and drop luggage that they ran away from. So there's all of these community... I've never really figured out what the right phrase is. I want to call them like these community reaction phrases.

But there's a lot of stuff that the EOC does, but at some point, as Tom said, somebody with the big hats got to make the big, hard decision that is going to involve, shutting down services, tying up a lot of resources. I mean, even if you don't shut down your rail system, let's say you've got a commuter rail system, if you've got a station that's been attacked, at the very least your rail traffic's not running through that station, so now you've got to do a bypass for your hundreds or thousands or you know.

Don Tuten:

You're affecting the communities where they left from where they're going to next. And everybody in ancillary all the way around, this is going to have to stop a hundred miles, 50 miles short of there, as well as those flights that may be in the air that when this happened, they're now having to be diverted that you're going to have to work with your federal partners, especially when it comes to transportation.

Bill Godfrey:

So just to kind of recap this, the idea and where we're kind of focused on the training is, again, from the field responders and EOC perspective of not just one incident or though, or it could be a very complex singular incident, again, if it's three or more attackers, or two or more sites, or an act of terrorism that overwhelms a local jurisdiction, we're recommending that you establish an area command. And in some cases, in fact, some of the scenarios that we run in training, we've got the one that's one of my favorite, it's the three attackers at an outdoor mall. And so it's a single site, except it's not because as soon as you start chasing the intel, you realize that there are witnesses telling you that there are potential suspects, at least persons of interest that have fled the area. They fled to the airport, the license plate reader gets a hit on that.

Now, we've got to chase these, question mark, are they suspect persons of interest down? There's an airport involved, we've got the crime scene. We're going to start working the ID of these attackers. Now, we're going to have potentially multiple crime scenes. All of that has to get coordinated somewhere. An area command is a great tool. If you get a manhunt, you could have a really, what's a fairly straightforward attack. I can't believe I just said it that way, but you can have an attack that on the surface doesn't ride to a complex coordinated attack. But because you have people that fled the scene or are in the wind, and now you've got a manhunt, that's a great example of when area command can be very helpful, is you managed to coordinate that.

So that's why we're kind of suggesting that now. Given that we've been talking about complex coordinated attack in this conversation, we want to wrap it up by talking a little bit about civil unrest, and how those incidents can actually be managed with this same process, the same layered approach of the incident sites. Don, how about you tee this one up for us and kind of talk us through it and we'll take it from there.

Don Tuten:

Obviously, if anybody's been watching the news for the past 12 months, civil unrest has been a challenge for all agencies, all communities. It's the unfortunate part of our history of America right now. But the biggest thing for law enforcement, for our emergency responders is, as soon as possible, getting that intelligence out. The sooner you get the intelligence on the amount of people, the locations fostered with your pre-planning, that hopefully every community is doing now on what resources they have to combat this along with training, that's the biggest piece of it. I mean, there's so many different facets to civil unrest versus working in the community with the different community groups and trying to tort this versus the radicals that come in that just want to cause havoc in your community. But I think civil unrest unfolds the same as it does for CCA or CCTA.

You have to have those established relationships ahead of time. You have to have plans. You have to know who is going to be, who is going to run that area command position. What the communications are? Which liaisons, with all the different agencies that are going to work together? And then obviously, have the common goal of sorting this no matter where it goes. Because as you know, civil unrest, when some of these groups, they're doing the same thing. they're going to two or three different places and locations at one time trying to overrun our emergency services.

Bill Godfrey:

Yeah, and the scary part is, is that you may think you know what the plan is but sometimes you don't.

Don Tuten:

Absolutely.

Bill Godfrey:

Sometimes you don't know where they're headed. You get a protest, you get a fixed protest that isn't supposed to move and then does, or you get a second one that pops up, or you move in to disband the first protest, cleared an un...

Don Tuten:

Unlawful assembly.

Bill Godfrey:

... unlawful assembly. Thank you. You declared an unlawful assembly and you break that one up, but in the process, they all just moved to a new location.

Don Tuten:

Yeah, it so hard for law enforcement because while we want to protect their civil rights, at the same time, these same people unfortunately want to cause havoc for everybody else. So it's such a hard subject for law enforcement. And I know my brothers and sisters in firefighting and emergency management go through the same thing because they're all being taxed. They're all going through the same pains that we all are so.

Bruce Scott:

Yeah, just real quick, we talk about, if you know these things, don't plan on what you think is going to happen. You need to be planning and thinking what might happen, right? And it allows us to hopefully, put those resources in place. At least the ability to mobilize those resources earlier and faster. A question for you, Bill, if you don't mind me throwing one to you, why do you think that... What's your opinion on the resistance to this whole area command concept? And again, I kind of like you to speak to it from a political or appointed leadership position. Why do you think some, as a first responder be say, "I want to set up area command, and I want to order 500 resources", in anticipation of something that might happen.

Bill Godfrey:

You know, I think it's a couple things. I think it's two fold. One is the question mark in your mind as the leader as the area commander, who says, "Man, 500 law enforcement officers, can I actually make that decision? Do I have the authority? Am I putting my city or county or region on the hook for half a million dollars? How does this get paid for?" Those can be pretty scary and intimidating things. And so if you don't really know where you stand or you can't just say, "Okay, I'm not necessarily sure what the downstream consequences are going to be, but this is what needs to be done right now, and I'm going to make the best decision I can, and if there's hell to pay afterwards, then there's hell to pay afterwards."

So I think part of it is that, it's a little scary for leaders to pull the trigger on some of that, and to say, "We need this much help", or "I think we might need this much help." Because in the mind of a leader, "Okay, I need 500 officers." And they end up in staging, and don't do anything, and we never deploy them because we didn't need them.

Don Tuten:

It's expensive insurance policy.

Bill Godfrey:

It sure is. And you know what? You really can be criticized, but I would also say, Don, you mentioned it, if you've been listening to news the last 12 months, you might've heard of these things called field hospitals that have been set up and torn down and set up and torn down all across the country over this last year as we've battled COVID. Not very many of these field hospitals ever saw patient one, and the ones that did see him didn't see very many, and those were very expensive insurance policies.

But at the time there were leaders in place that said, "I think this is what we need to do, and we need to move forward and make it happen." So I think part of it is that reluctance to just put it on the line and say, "We're going to do this." The second part, which I don't really think is directly related, but maybe tangentially related is the political implications of it. And I got to admit when I was active duty in the fire service, I was just as bad. I was the poster child of territorialism and this is our district in our zone, in our area, and it was terrible. I cringe when I think back to the way I handled some of those things. And then you get a perspective, of course, after you've retired, left active duty that goes. Well, maybe it wasn't such a good idea to act like jackass, but I think that's a piece of it too.

We in the industry, in the first response industry, police, fire, EMS, all of them, there's a competitive spirit, and to a degree, that competitive spirit is healthy and good. But at some point, you got to get over that. You've got to be able to work together. And sometimes the problem is in the field, but my experience has been, that's pretty rare. Most of the time, the problem is in leadership. It's higher up, and sometimes it's not even in the fire department or the police department, it's at the city government level or the county government level. They just don't like each other or can't get along. The best way I've seen to fix that is just training. You do joint training and bring everybody together.

Bruce Scott:

And relationship building.

Bill Godfrey:

Absolutely.

Don Tuten:

That's number one, relationships.

Bill Godfrey:

Absolutely. So yeah, thanks for putting me on the hot seat, Bruce. I appreciate that. Tom, you got anything you want to throw in here?

Tom Billington:

I just realize that leadership positions, you're not always going to get the pat on the back. There's going to be times when you go for it on fourth down and you don't make it and you're not going to be very popular. So you have to realize there's going to be good times, bad times. That's why you have to know who you're reporting to, that will they trust your decision tomorrow? What would the Monday morning quarterback issues be? So it's not easy, but you have to do it. Somebody has to step up and lead.

Bill Godfrey:

You know, I think Tom, you just made me think of something that I didn't say that I think probably needs to be said. As a leader, as a fire chief, or a police chief, or an EMS chief, or even the emergency manager, I think the most important thing that you can do is have a joint sit down with your city manager, county manager, whoever the top bosses you report to, especially if it's a civilian, and sit them down and say, "Look, these are our procedures. These are our processes. This is how this works. This is how this unfolds. These are the things that we're going to do, and this is why."

Because if you tell them ahead of time, it's a lot easier. They know what you're doing. They know what to expect. When a reporter shoves a microphone in their face, they know how to answer the question, and give you a little bit of breathing room, and give you the benefit of the doubt. All right. I wonder what comments we're going to get from this podcast.

Bruce Scott:

That'll be interesting.

Bill Godfrey:

Yeah, yeah, to say the least. Well gentlemen, any parting words before we wrap up?

Tom Billington:

No, not at all.

Don Tuten:

No. Thanks for bringing the, you know, to the forefront that obviously, area command is a big part of all of these things that we talked about and I hope people take it to word, and train for it, and do their best to try to implement it whenever possible.

Bruce Scott:

And practice it.

Tom Billington:

And build your relationships with your partners, and your superiors, and make sure everybody knows what you're going to do, so it's not a surprise.

Bill Godfrey:

Absolutely, and Bruce, I'll echo on to the practice. If somebody tells you that you can't practice this anyways, other than a tabletop bologna, pick up the phone and give us a call, We'll tell you how we do it. It's not a big secret. We're happy to share, and we're happy to help you. If you need help doing it. You can practice live, functional, and even full-scale scenarios for the command and control element of a CCA. We do it every week in the training classes that we provide. Well, ladies and gentlemen, thank you for taking the time with us today. We hope you enjoyed it. If you have any questions or comments, please feel free to email them to us. If you haven't already subscribed to the podcast, please do that until next time stay safe.