Facilitated After-Action Review

1. Facilitated After-Action Review SEESIM 2010 LTC A Bali / Mr. D Schultz After-Action Review Manager 25 October 2010

2. Agenda • Introduction • Discussion by City / Organization • Selected Topics • Closing Remarks

3. Introduction • Rules • Regional Themes

4. Rules • This is your After-Action Review • Address operational issues • Open and honest discussion • Avoid exercise scenario discussion

5. SEESIM 10 Regional Themes • Regional Communications / Enhance Information Sharing / Information Management • Transnational Issues and Cyber Attacks • Border Security • Consequence Management • Counter-terrorism • Counter-proliferation • Internal Ministry / Agency Coordination • Coordinate with International and Non-governmental Organizations

6. Discussion by City / Organization • Summary of Incidents & Injects • A discussion of the training design and how well the Training Audience executed their standard operating procedures (SOP) • Sustain & Improve • Using the Observations made during SEESIM 10 execution to develop three Sustain and three Improve recommendations

7. Athens – 3 Incident/84 Injects • Foreign Officers Kidnapping • Indications and Warnings • Terrorists in Greece kidnap foreign officials. • Hostages are used as bargaining chips for the release of individuals in prison. Explosions take place in the Hellenic territory. • Threatening phone call about dirty bomb. • Media broadcast the events. • Expected Actions • Intelligence indicate the action of participators in Bulgaria. • The Crisis Management Council of the Hellenic Police is being activated and handles the incident.

8. Athens – 3 Incident/84 Injects • Foreign Officers Kidnapping (cont) • Actions Taken • The three levels of command are created (Tactical, Operational and Political-Strategic) according to the National Emergency Plan. • The Hellenic Police cooperate with other countries through INTERPOL and EUROPOL to exchange information. • The National Intelligence Service cooperates with other intelligence agencies to gather intelligence. • The Hellenic police investigate the incident and make the necessary actions to protect the public safety and security.

9. Athens – 3 Incident/84 Injects • Dam Collapse • Indications and Warnings • The Thisavros dam overflow in Greece causing collapse of Platanovrisis dam, flooding, infrastructure damage, casualties and displacement of the local population. • Expected Actions • Step by step activation of the local, region and national emergency plan and respective mobilization of the involved agencies. • Activation of EU MIC • Request and offer of international assistance • Management of the disaster consequences • Expected actions were taken

10. Athens – 3 Incident/84 Injects • Cyber Attack • Indications and Warnings • Hackers cyber attack the National Electricity Company (DEH) results to continuous power outages at the area of Thesalonica. • Hackers cyber attack the Aegean bank resulting to money loss and malfunction of web services • Distributed Denial of Service attack at a website of the Ministry of Citizen Protection in Greece • Expected Actions • The Hellenic National CERT cooperates with Police Cybercrime Department, Internet Providers and other National CERTs to defend cyber attacks • Expected actions were taken

11. Athens Sustain • The good cooperation between the EOCs • Team spirit between the participating countries. • The fact that we have clear SOPs that really help us to respond effectively in any critical situation • Successful flow of information with the major international organization

12. Athens Improve • Message types should be improved. • The differences between some types of messages were not clear. • This should have been predefined at the beginning of the exercise • the exact meaning of “offer of acceptance” was not clear what and in which case it should have been used.

13. Athens Improve (cont) • The injects that take place during the Mini Exercise should be predetermined and designed to facilitate the use of the above mentioned message types. • The main goals of mini exercise should be the familiarization of the trainees to the working environment, the exercise execution procedures, and the use of the equipment. • The main injects list should be not played during the Mini Exercise because the training objectives are not accomplished.

14. Belgrade – 4 Incident/61 Injects • Serious flooding throughout Serbia • - Heavy rains, collapsed dams and bridges, overflowing of Tamis, Tisa and Timok rivers; • - Alert to national authorities, evacuation of people, repair of dams and bridges; • - Inform local government, evacuation of people, organization of accommodation of • evacuated people, engagement of local health centers, engagement of fire units, • establishing check points with police officers, inform Ministry of Agriculture, Forestry and Water Management to take measures, Red Cross provides assistance; • Chemical accident in the area of Prahovo and Bor • Leaking chemicals, oil spot on the Danube river, overflowing of chemical substances into Crni Timok river, underground waters in the Factory for artificial fertilizers in Prahovo, water polluted in the village of Mosorin, leakage of oil into the Danube river, fire in warehouse in Prahovo; • Section for reacting in chemical accidents of the Ministry of Environment directed the operator to conduct urgent transfer of the chemical substances, fire rescue ship was also engaged, with the pump for collecting and storing hazardous substances into exterior tanks; • Engagement of boat for stretching floating dams, organization of water control, • firefighting pumps engagement, fire-rescue ship provided technical support;

15. Belgrade – 4 Incident/61 Injects • Criminal activities • Car theft, criminals tried to stole chemicals, bank robbery in Zajecar, illegal border crossing, escape of group of prisoners, hostage situation in bus; • Engagement of special police and police patrols, increased security of border crossing, engagement of fire units, taken police action to catch the prisoners; • Traffic police patrols closed the road entrance, Border PD increased the security of a part of state border, engagement of special counter - terrorist unit; • People trafficking, smuggling of drugs and dangerous substance • Locating emigrants, smuggling of narcotics; • Border police personnel inspect and control the region; • Increased control of people and vehicles on roads, increased security of the state border ;

16. Belgrade Maintain good cooperation at national and international level; Outstanding effort of people involved in the exercise; All reactions were conducted in accordance with the standing SOP and logic practical experience. Sustain

17. Belgrade It is necessary to synchronize SOP of different institutions with the new Law on Emergencies of the Republic of Serbia, but solution to inject is not disabled by the standing SOP; More attention on media events; Include representatives of UN and EU organizations. Improve

18. Bucharest – 4 Incidents/89 Injects • Terrorist attack in Bucharest - 29 injects • Indications and Warnings • RF operatives illegally entering national territory by sea; • Institutional cooperation to contain the terrorist threat • Expected Actions: • Cooperation within National System for Preventing and Countering Terrorism • Actions Taken: • Terrorist crisis management • Counter-terrorist intervention • Earthquake in Vrancea area - 18 injects • Indications and Warnings • Most affected region – Bucharest city • Buildings collapsed, people trapped in rubble • Hospitals overwhelmed, huge amount of casualties and injured people • Expected Actions • Notification on the disaster at international level • Search and rescue, evacuation of the people, provide shelter • Request for international assistance • Actions Taken • Information flow and cooperation between national and ministerial operational centers in case of disaster • Civil-military cooperation in National Committee for Emergency Situations

19. Bucharest – 4 Incidents/89 Injects • Collision of two tankers in Constanta-Agigea - 20 injects • Indications and Warnings: • M/V Horizon and M/V Neptune crash leads to oil spill in the harbor • Fire on board and the spill, toxic clouds • Expected Actions: • Weather conditions may determine cross border environmental disaster • Notification of all neighboring countries to the Black Sea • Activation of Marine De-pollution Centre • Actions Taken: • Rescue the crew members • Evacuation of people from affected seashore • Cooperation between EOC and local and national authorities

20. Bucharest – 4 Incidents/89 Injects • Accident at Chemical Plant Navodari - 22 injects • Indications and Warnings • Explosion at the Chem Plant, Fire is spreading nearby buildings • Panic through residents, 130 persons poisoned, toxic cloud • Expected Actions • Securing the affected area, evacuation of all inhabitants nearby • Cooperation within National Centre of Coordination and Management of Intervention and National Operational Centre for Emergency Situations • Actions Taken • Notification of neighboring countries • Interrupting of gas pipelines and electric power and evacuation • of the people • First emergency medical assistance

21. Bucharest Sustain • Information flow and cooperation between national EOC and international organizations in case of disaster and terrorist attack; • Civil-military cooperation in National Committee for Emergency Situations; • Develop existing national procedures regarding consequence management of disasters (intervention management and intervention of special structures).

22. Bucharest Improve • Planning regional exercises for improving national operations and bilateral cooperation in case of cross-border disasters; • Improve the existing legal framework in order to enhance cooperation between National Ministries, related agencies and national NGOs, in case of civil emergencies; • Enhance information sharing in case of a disaster.

23. Istanbul – 8 Incidents/75 Injects • Earthquake in Izmir (OCT 20-22) • 7.0 Richter scale; having corollary effects (death, injuries, LCG spilling, fire eruption in oil refinery) • EOC Turkey immediately responded to the incident • Developed regional communications about what happened in the region • EOC exchanged messages of requests and offers of assistance • Terror attack on natural gas station (OCT 21) • The explosion in natural gas station due to sabotage by RF terrorists; • Fire completely under control in IPSALA, lost people found, natural gas line to activate

24. Istanbul – 8 Incidents/75 Injects • Biological agents contamination in Istanbul • Decontamination completed • Infected people treated • Neighbors warned • Cyber Attack on a dam • Valves shut down, rescue teams sent, İnvestigation has been started to find responsibles. Warned other dams around the disaster area to be prepared to possible different cyber attacks

25. Theft of a dual-use item (botulinum toxin) from a University Coordination with the Italian government Human Trafficking/Illegal Immigrants Notified other nations, increased border security by land and sea, updating situational reports Ship Collision Istanbul – 8 Incidents/75 Injects

26. Istanbul Enhanced sharing of information and intelligence of any kind of terrorist threats within the government Effective coordination between civil and military institutions (civilian and military turf clearly delineated) At the national and local level, clear understanding of each other’s responsibilities well-articulated through SOP Sustain

27. Istanbul Citizens' involvement through media Inviting a representative of an NGO Raising and keeping situational awareness around the region; keeping informed the IOs and engaging more Improve

28. Kiev – 6 Incidents/106 Injects • Forest fires in Crimea • Fire situation occurred in the Crimea near ammunition warehouse. • Expected Actions: • - Local authorities and response teams have to be activated. • Actions Taken: • The disaster management headquarters was established by MoE. • Cooperation of local authorities and MoE achieved: MoE in conjunction with the MoD conducted extinguishing the fire and minimized the damage. • Local authorities have organized drinking water and food. • Terror attack on Dnepr Dam • Terror attack was conducted against energy system installation (hydro-electric power station). • Expected Actions: • Verification and investigation of the information about terrorist organization, perform actions on localization and liquidation of oil pollution of the Dnieper river. • Expected action occurred.

29. Kiev – 6 Incidents/106 Injects • Server of the MoD has been attacked, data stolen • Having received an e-mail from unknown sender with attached file, IT department reported about malfunctions of servers and workstations of the MoD. • Expected Actions: • Localize infected computers, restore operational state, and corrupted data. • Actions Taken: • Measures to localize infected computers, restore operational state as well as preventive actions were carried out. Security level of the system was increased. • Ship explodes while loading ammonia • Ship exploded in port of Odesa while loading ammonia, caused injuries, poisoning with ammonia and massive leakage. • Expected Actions: • Evacuation of personnel and population from port and affected area of Odessa, medical aid, decontamination and mitigation of the effects of ammonia leakage. • Actions Taken: • The interdepartmental disaster management headquarters was established. The evacuation of personnel and population from port and affected area of Odessa carried out, medical aid provided, decontamination teams were brought to the site.

30. Kiev Interesting scenario concerning important aspect connected to cyber attack or related incidents; Joint activities of the Central and Local authorities of Ukraine, interagency activities regarding consequence management of the disasters Use software as management and analysis tool. Sustain

31. Kiev Cooperation with international organizations concerning the flu epidemic incident; Use of mass media, press statements; Create scenario to increase intensity of use of simulation and modeling system. Improve

32. Rome – 1 Incidents/137 Injects • Disaster • Indications: • Radiological (gamma) released on the town of Ancona by a terrorist group; • Expected Actions: • First aid to the population of Ancona and adoption of the measures to reduce the consequences • Actions Taken: • EOC and Training Audience managed properly the situation in accordance with the national and international procedures.

33. Rome – 1 Incidents/137 Injects • Terrorism • Indications & Warnings: • EOC received and faced several warnings concerning possible terrorist attacks in Italy and, in particular, in the Regions overlooking the Adriatic sea. • Training audience managed a terrorist attack on a ferry boat moored in the port of Ancona, with safety, security and emergency consequences. • Expected Actions: • Activation of all foreseen international/national and regional plans and procedures in case of disasters and terrorist attacks. • Actions Taken: • While EOC and training audience faced properly the event, their emails didn’t always mirror the full development of the decision-making progress and the main Actors involved.

34. Rome – 1 Incidents/137 Injects • Consequence Management • Indications and Warnings: • Evacuation and sheltering of population affected, crowd and traffic control, dealing with media requests of information, ensuring public vital services in Ancona. • Expected Actions: • Local Authorities were expected to manage above mentioned consequences, in accordance of the procedures and the support of central Authorities and Agencies. • Actions Taken: • National procedures were fully respected, except some few cases.

35. Rome Sustain • The escalation of the first 2 days (before the event) was very useful in order to facilitate the decision-making process and make the game realistic; • We appreciated the wide spectrum scenarios (security, safety and emergency) that has distinguished the exercise 2010 and gave us the chance to closely coordinate plans and procedures of the different actors both at international, national and local level; • Interoperability and cooperation with EOC and International organizations gave an added value on the scenario, generating unforeseen situation.

36. Rome Improve • It is important to remind to all EOCs the importance of the interaction among each other and not only with the EXCON; • Implement the presence of international organization to fully play some scenarios (e.g. decision-making process to close the borders of EU in case of natural events or terrorist attack in compliance with national decisions); • At the beginning of the game, we noted that Italian EOC was not officially aware of the events occurred in other Countries (e.g. Greece) that could influence its decision-making process. Despite Italian AAR and Site Manager have been informed that some information shared during the VTC’s could be pushed out to Italian EOC, we would find very useful if other countries’ events are officially spread to everyone (e.g. through media);

37. Rome Improve • Concerning Exonaut: as already pointed out, Exonaut’s evaluation window doesn’t list the injects by date of injection, compelling the user to do a long search by name. Furthermore, we suggest to increase size’s font in the inject box. • Timeline to send AAR daily report should be postponed to 2 pm in order to better prepare it.

38. Sarajevo – 5 Incidents/72 Injects • Flooding and landslides-20. OCT 2010. • Storm in area of Konjic town, landslides, road destruction, homes, buildings and farm fields flooded, dam damaged; • Hydro meteorological monitoring, standby of all responsible CP staffs, undertaking of all P&R measures horizontally and vertically, declaring the state of natural or other disaster, BH Armed Forces support, request/offer and coordination of international assistance; • Internal coordination, rescue operations, declared state of emergency, request for international assistance, following of internal SOP-s, coordination with BH Armed forces, regional coordination and cooperation. • Bomb attack-21. OCT 2010. • Explosion in shopping mall, terrorist attack by Revolutionary Front (RF), hostage situation; • Internal and external coordination with intelligence agencies, exchange of available data, reaction of special forces, coordination among police and intelligence agencies. • Exchanging data, international cooperation, investigation, cooperation internal and external, negotiations. • Oil spill in Neretva river-22. OCT 2010. • Truck and bus went off the road, oil spilled in Neretva river, injured people, cross border incident-affects Croatia; • Securing location, request for engagement of specialist services, rescue operation-MEDEVAC, warning to local population and Croatia, exchanging data, remove and eliminate oil from river; • Engagement of rescue services, engagement of BiH Armed Forces resources, coordination with Croatia.

39. Sarajevo – 5 Incidents/72 Injects • Fire in furniture company-23. OCT 2010. • Fire in furniture factory, fire spread on wider area, material damage, hazardous smoke cloud, injuries by smoke intoxication, storage roof collapsed; • Gathering information, engagement of specialist services, evacuation and securing area, medical care, information of people; • Reaction of firefighters, engaging medical units, coordination with meteorological agency, rescue operation on evacuation trapped firefighters, coordination among different firefighter units. • Cyber attack in Banja Luka-24. OCT 2010. • Power blackout of Banja Luka airport and vicinity, plane lost connection with flight control, plane crashed, cyber attack on computer network of electric distribution company; • Identify priority users of el power to ensure power supply, request for BH Armed Forces assistance, redirecting flight control, securing area of accident, gathering incident information, evacuation of injured, engagement of specialist forces for combating crime;

40. Sarajevo Sustain • Good cooperation among countries of region-faster response; • High level of coordination with BH Armed Forces-civil military cooperation; • Effort of people involved in all stages of resolving disasters.

41. Sarajevo Improve • Emergency communications (both, communication management and information management); • Emergency management structure; • Definition of jurisdictions-avoid overlapping of jurisdictions; • SOPs to improve interoperability among agencies.

42. Skopje – 5 Incidents/77 Injects • Disaster • Indications and Warnings • Water floods of Damn “Spilje”, pollution of water in Debar (as a results of floods), dead fish in Prespa lake, stomach sickness in Debar. • Expected Actions • Solving the consequence from damaged dam. • Actions Taken • Activating all institution and NGO`s their SOP`s, book of rules and sub laws and cooperation with all neighbors affected countries • Terrorism • Indications and Warnings • Terrorist attack on damn “Spilje”, terrorist attack on soldiers in Kabul in peacekeeping mission, • gun fight on check point, pollution of water supply with anthrax, hostage situations. • Expected Actions • Activating all mechanism of national Crisis Management system and making decision of • execution of special task force actions taken. • Actions Taken • Solving the situation using the counter intelligence information, using the special task force of police, using the special method of tapping and monitoring of communication.

43. Skopje – 5 Incidents/77 Injects Cyber Attack • Indications and Warnings Hacker attack on the system of Integrated border management for checking the passengers and vehicles on the border check points. • Expected Actions solving the situation with crowded border crossing and fixing the system. • Actions Taken Using the alternative way or manual system for checking the passengers and vehicle. Consequence Management • Indications and Warnings Anti governmental demonstration, crowded border crossing, infected people, foreign citizens hostages, power system dawn, water supply pollution. • Expected Actions Taking measures of all institutions and dealing with consequence of crises. • Actions Taken Activating the land team of Directorate of Protection and Rescue, Army, and all other institution of Crises management system.

44. Skopje Sustain • Engagement of all necessary institutions within the EOC • Good information sharing with other EOC • Information management system during the exercise was supported by using real digital and paper maps

45. Skopje Improve • Role of media in crisis situation • Include representatives of EUROPOL and INTERPOL within IRC • English language skills of the EOC

46. Sofia – 3 Incidents/70 Injects • Earthquake at Nova Zagora • Indications and Warnings: • None! National Geophisical Institute reports an earthquake near Nova Zagora (magnitude 6.5 on Richter). • Expected Actions: • Organizing of the Integrated Rescue System Forces; SAR activities; • Investigation of the extent of the damages; First needs supplies delivery. • Actions Taken: • National Emergency Operational Center (EOC) was summoned; • Sumarizing and analizing the information recieved by the regional administrations of Civil Protection; • Rescue teamsfrom the Integrated Rescue System carry out SAR; • Organizing first needs supplies delivery.

47. Sofia – 3 Incidents/70 Injects • Terror Attack on Jovkovtzi dam • Indications and Warnings: • Sources in Sofia and other intelligence sources indicate for possible RF activities. Some incidents occurred in different parts of the country confirmed this information (found a cashe of RF extremist literature; stolen car by suspected members of terrorist group; inspection of the Jovkovtzi dam by suspects, etc.) • Expected Actions: • Bulgarian Security Services to conduct search operations. Processing the information to be started and the partner organiztions to be informed. • Actions Taken: • After the Terror attack at Yovkovtzi dam for protection of population have been taken following measures: • evacuation of population by the endangered places; • separate endangered from flooding zones; • organizing and leading SAR; • logistical support of evacuated population.

48. Sofia – 3 Incidents/70 Injects • Explosion in the port of Burgas • Indications and Warnings: • Sources in Sofia indicate that RF cell is attemping to obtain explosives; Guards at the gate of the port reported for videotaping the port; A false bomb threat called into the port facility; A large quantity of TNT is stolen from an ore-mining company; RF members escaped from a jail. • Expected Actions: • Security and Public Order Services to conduct operative works, search operations and counterterrorist activities; After the incident with the oil tanker and oil spill the emergency plans for carring out of rescue and urgent emergency recovery activities and for acting of sea emergency rescue team (SERT) to be put into action. Emergency Rescue Activity Group from the Regional Administration of Civil Protection and SERT to organise bonn enclosures, collecting of oil and cleaning of polluted sea shore line.

49. Sofia – 3 Incidents/70 Injects • Explosion in the port of Burgas(cont) • Actions Taken: • Security and Public Order Services conduct operative works , search operations and counterterrorist activities to verify the data; After the false bomb threat was called Emergency Services responded and cleared the port for continued operations; After the incident with the oil tanker HQ for Coordination of Rescue and Urgent Emergency Recovery Activities is summoned. Executive Agency "Maritaime administration" – Burgas is Informed. Teams from Ministry of Interior conduct investigation activities on site. Restricted measures are taken.

50. Sofia Good communication and coordination between national EOC and other EOCs; Relevance and timelines of planned actions; Abilities to lead subordinate forces in accordance with the senior level instructions, information from the interacting organizations, and reports from the subordinates. Sustain