Multiple terrorists attacks

1. Multiple terrorists attacks Wisconsin Regional SWAT Table Top Exercise Series 2011 Seminar/Table Top Exercise

2. Overall classification of this meeting is: UNCLASSIFIED // For Official Use Only (U//FOUO) Discuss and disseminate this information as you see fit in the course of official duties. No dissemination to general public or media. Building orientation Cell phones on vibrate or silent please Please introduce yourself: Name, position, department Instructor introductions Administrative ROE For Official Use Only

3. 8:30 – 9:00 Registration 9:00 – 9:15 Welcome and Opening Remarks 9:15 – 9:35 Interoperable Communications 9:35 – 9:50 Break 9:50 – 10:20 National Guard Assets 10:20 – 11:10 ALERT 11:10 – 12:00 Fusion Center Brief 12:00 – 12:30 Lunch Table Top 12:30 Module 1: Briefing, Caucus Discussion, Module 2: Briefing, Caucus Discussion, Module 3: Briefing, Caucus Discussion, 3:00- 3:30 TTX Hot Wash Agenda For Official Use Only

4. Purpose & Scope • Familiarize the area SWAT teams with policies and procedures in responding to a simultaneous multi-targeted terrorist attack using conventional weapons along with a WMD. • The exercise will encompass the decision-making process, communication and coordination involved with a response to a terrorist incident in a Wisconsin location. Participants are limited to law enforcement SWAT members who would respond to a terrorist attack.

5. Evaluate mutual aid procedures of SWAT to establish the management and coordination of the Public Safety and Security Response to a simultaneous multi-targeted attack using conventional weapons. Evaluate local and state response to a WMD incident. Assess the intelligence sharing environment in providing real-time situational awareness and analysis from the fusion center to the IC and surrounding jurisdictions. Assess the ability to identify, establish, and manage necessary communications logistics for a large-scale incident. Verify the establishment of Incident Command (IC) and collaboration of necessary unified incident management components to effectively communicate with all responding agencies. Objectives For Official Use Only

6. Potential Outcome • Improve situational awareness for law enforcement agencies • Identify gaps in preparedness, planning and execution of multi-target response plan. • Identify a framework of critical issues and effective response methods as a first step in the development of a Corrective Action Plan.

7. ALERT (Aligned Law Enforcement Response Team) 2011 Awareness and Partnering Overview oja.wi.gov/alert Tony Peterson Law Enforcement Program Manager (608) 266-9565 tony.peterson@wisconsin.gov

8. ALERT: Aligned Law Enforcement Response Team Law Enforcement Executive Committee SWAT Workgroup EOD Workgroup • Dane Co Sheriff • Douglas Co Sheriff / Superior PD • Eau Claire Co Sheriff • Green Bay PD / Brown Co Sheriff • La Crosse Co Sheriff / La Crosse PD • Milwaukee PD • Oneida Co Sheriff • Winnebago Co Sheriff • Brown Co Sheriff • Dane Co Sheriff • Kenosha Co Sheriff • Marathon Co /Oneida Co Sheriffs • Milwaukee Co Sheriff • Milwaukee PD Published: February 2010

9. Team Selection-Emergency Police Service Areas • Team selection occurred with a geographic emphasis • Representation of each EPS region facilitates effective dispersal of critical/specialized equipment and capability • Most effective statewide coverage • Minimal statewide response times

10. ALERT’s Missions • Primary: To deliver enhanced tactical capability through specialized/critical equipment, advanced tactics and a highly coordinated response plan when activated as a statewide asset. (Applicable once legislation is realized)

11. ALERT Activation(Applicable after legislation is realized) • In order for ALERT to be activated: • A local agency must contact their respective EPS Director requesting assistance. • EPS Director will assess incident and, using the ALERT Activation Matrix Criteria as a guideline, determine if an activation is appropriate. • The guideline provides consistency in the assessment of event circumstances. It is recognized that the Activation Matrix Criteria is only a guideline and that specific event circumstances will be included in the determination whether an ALERT activation may occur.

12. ALERT’s Role When Activated(Applicable after legislation is realized) • Collaboration with the local Incident and/or Tactical Commanders in the mitigation of an event through the application of specialized/critical equipment, enhanced tactical capability and highly coordinated response.

13. ALERT’s Missions • Secondary: Make available specialized/critical equipment and/or advanced tactics through mutual aid requests for incidents that do not meet the activation threshold. (Already in effect)

14. Mutual Aid • Mutual Aid For Law Enforcement Partners (Per the Office of Justice Assistance) Equipment acquired through Homeland Security grant funding is available to regional law enforcement partners through mutual aid. ALERT agencies shall require memorandums of understanding with law enforcement partners who may request this equipment. ALERT agencies may choose to only allow their own personnel to operate specialized/critical equipment or may require law enforcement partner personnel to be trained on specialized/critical equipment prior to use.

15. ALERT Goal • Expand current tactical collaboration to EPS area and beyond • Using ALERT as the foundation, establish a venue for area-wide tactical team planning, training and coordination • Enhance area-wide tactical capability

16. Awareness • Law enforcement partners invited to meeting with area ALERT team • ALERT program overview • Mutual aid planning • Regional capability partnership

17. Partnering • Area LE partners invited to participate in the process of identifying future equipment and training priorities. • ALERT Team solicits input from regional tactical team partners on equipment and training considerations • ALERT work groups and subcommittees review, research and prioritize considerations • Acquired equipment is available to LE partners through mutual aid • Training acquisitions have “train-the-trainer/instructor” emphasis

18. Alert Network Pyramid

19. Questions? For more information please visit: http://oja.wi.gov/alert Tony.peterson@wisconsin.gov (608) 266-9565

20. Players Respond to the scenario as presented Facilitators Lead, focus, and moderate group discussions Evaluators Observe and record the discussion during the exercise, and also participate in the data analysis TABLE TOP EXERCISE Participants For Official Use Only

21. Exercise Guidelines • A TTX is not a test. • Varying viewpoints, even disagreements, are expected. • Respond based on your knowledge of current plans and capabilities. • Do not let your organization’s positions or policies limit you. • Make recommendations. • The situation manual (SITMAN) and briefing are the basis for discussion. For Official Use Only

22. The scenario is plausible, and events occur as presented. There is no “hidden agenda” and there are no trick questions. There are no wrong answers or single solutions. All participants receive the information at the same time. Players should assume that all jurisdictions are implementing their current plans, policies, and procedures. Assumptions and Artificialities For Official Use Only

23. For Official Use Only MODULE 1 – 15 April 2011 For Official Use Only

24. For Official Use Only SAR For Official Use Only

25. For Official Use Only MODULE 1 23 April 2011 (U//FOUO) National Intelligence Community (NIC) assesses that al-Qa‘ida and its affiliates pose a “credible, but non-specific” threat of executing synchronized attacks against the homeland; possibly employing small unit assault tactics. 28 April 2011 (U//FOUO) There have been at least four reported incidents of suspicious photography at malls and shopping centers in Arizona and Iowa; three in the past week and one in the first week of April. The three Arizona incidents occurred in the Phoenix area; and the Iowa Fusion Center reports a similar incident at a shopping mall in the Des Moines metro area. At this time there is no specific or credible information indicating these incidents are connected to any terrorist threat streams. In each of the incidents, the person or persons are unidentified males and females described as being of Middle Eastern decent. For Official Use Only

26. For Official Use Only Information Sharing 5 May 2011 (U//FOUO) Three Pakistani males questioned by Mall Security and Law Enforcement Officer at Fair Oaks Mall located in Fairfax, VA. Subjects walking quickly through mall without talking and taking photos and video of the mall. Subjects separated and questioned, stories did not match. No plausible explanation for the recording activity. For Official Use Only

27. For Official Use Only West High School 6 May, 2011 (U//FOUO) West High School reports the information below to the school district administration. Date Observed: 2011-05-06 09:51AM EDT Incident Summary: On 5/6/2011, John A. Gonzalez, telephone number (920) 854-9876, email: JSAG96@gmail.com, reported that his wife (Vanessa), who works for West High School, encountered two men with heavy Middle Eastern Accents asking about the student population, the size of the town and the police force. Mr. Gonzalez stated he was calling the administration to report this activity because his wife was not comfortable creating a record of this type. For Official Use Only

28. For Official Use Only BOLO 7 May 2011 (U//FOUO) Washington DC Fusion Center issues BOLO: Request assistance identifying subjects pictured above. Once aboard train they videotaped how patrons oriented themselves within the metro rail car. The subjects were attempting to videotape inconspicuously, by holding the camera at their side, between their chest and waist. For Official Use Only

29. For Official Use Only Module 1 Discussion For Official Use Only For Official Use Only

30. Discussion Points • Intelligence Support • Discuss how the intelligence community supports the law enforcement agency: • What is your definition of intelligence? • How does the intelligence community support you? • Who or what is the point of contact? • What documents are regularly received? • How are they transmitted? • How does information from the intelligence community flow within your organization? • How long does it take for the information to reach a point where it is accessible to patrol officers? • Suspicious Activity Reporting (SAR) and Follow-up • Describe how the law enforcement agency reports suspicious activity: • What types of information do you send? • Where is the information sent? • How is it sent? • How do you confirm receipt of sent information? • Do you receive SAR information from state or federal entities?

31. For Official Use Only Discussion Continued • Collaboration (Non-SAR communications) • Describe how the law enforcement agency communicates non-SAR information with state and federal entities: • What types of information do you receive from state and federal agencies? • What types of information do you send to state and federal agencies? • How is information exchanged? • What individuals or agencies do you regularly communicate with and are distribution lists used? • Are there any special steps you need to take before contacting a state or federal agency? • Questions • Collaboration with Non-Law Enforcement Partners • Discuss how the private sector, public, and other non-LE local government agencies communicate with the law enforcement agency. List each category/entity and for each indicate: • Who or what the point of contact(s) are? • How the information flows once its received? • Describe the information do you typically receive? • How long does it take for the information to reach a point where it is accessible to command staff or analysts? For Official Use Only

32. For Official Use Only Module 2 For Official Use Only

33. Calls come into 911 center indicating that a vehicle at the Shell Station on Main Street had caught on fire, the manager indicated that an explosion was heard prior to the vehicle fire No injuries reported For Official Use Only May 10th , 9:20 am Shell Station,1698 Main Street For Official Use Only

34. For Official Use Only West High - Bursts of gunfire begins at local high school. Gunmen work their way into the building, tossing pipe bombs and using assault rifles to shoot at any targets within the building. - School Liaison Officer wounded , first responding officers wounded by IED and gunfire -SWAT commander is the next arriving officer - Numerous cell calls from students flood 911 For Official Use Only

35. At Kroll’s Restaurant 1990 S. Ridge Road, multiple patrons call 911 to report “choking odor and burning eyes;” device “spewing white smoke” discovered under a table. For Official Use Only Kroll’s Restaurant For Official Use Only

36. ICD Video For Official Use Only Kroll’s Restaurant For Official Use Only

37. For Official Use Only Court House Attack For Official Use Only

38. For Official Use Only Court House • 13 min. since the H.S. Attack. • 4 Gunmen enter court house, kill deputies with small IED. • Work their way to top floor with military precision. • Employees that escaped report many dead and injured For Official Use Only

39. For Official Use Only Attack at Bay Park Square Mall For Official Use Only

40. Within minutes of the Court house attack Several gunmen enter the mall and open fire with a rifles and shotguns two men quickly leave the area on foot, other gunmen remain in the mall. Suspects set fires as they make their way through the mall setting fires as they go. 911 center receives several calls that a drive by shooting has occurred at a corner bus stop two blocks east of the high school. For Official Use Only Mall For Official Use Only

41. The 911 center receives several calls that a drive by shooting has occurred at a corner bus stop two blocks east of the high school. No injuries reported. For Official Use Only Drive-by Shooting Reported For Official Use Only

42. Module 2 Discussion For Official Use Only

43. Discussion Questions • How would communications be facilitated in your region for a multi-target event involving rapid response tactics by multiple jurisdictions? • Does your tactical team have a system in place that can manage or track tactical team resources (personnel and equipment) as they deploy to a multi-target or other rapid response event? • Related to a multi-target event involving rapid response tactics by multiple jurisdictions, and the assumption that off duty and/or plain clothes personnel may be included in the initial response; does your agency have an established protocol/policy regarding how these personnel can be clearly identified? • Does your agency have ready access to building diagrams, area maps, etc? • Identify agency/regional equipment and training gaps related to a multi-target event.

44. Discussion Continued • Does your agency have a system for the timely notification and recall of off-duty personnel? Approximately, how many on-duty personnel may be available within your agency and within your region to respond? Approximately how many off-duty personnel may be available within the first hour? • Will first responders have access to respiratory protection or other PPE? • What first aid training and supplies are available to first responders and tactical team personnel? • Are the Fire/EMT agencies in your region prepared to respond to and deliver service in a tactical environment? • What considerations should first responders and/or supervisors use to guide them in determining if the immediate response will be effective or have a reasonable chance to succeed? • What would be the level of devastation that would result from a Mumbai-style attack on your city? • Are you street officers trained and fully equipped for a Mumbai-style attack? • Do you have contacts within the utility companies along with telecom?

45. MODULE 3EXTENDED RESPONSE

46. Situational Update • Law Enforcement, EMS and Fire resources at all ICPs. • Communication challenges continue • Reports that suspects are in community. • Wounded have not been attended to • Fires continue to burn in mall • Numerous reports coming in to 911 center from victims. • Chemical device casualties • CST on location

47. Situation Update Continued • SWAT commanders assigned as Operations Branch Directors with Fire and EMS at the scene waiting for stabilization. First responders are requesting deployment direction. • Wisconsin Emergency Management (WEM) in Madison has been notified and they have fully activated the State Emergency Operation Center. Governor Walker has been briefed and has declared a State of Emergency. • The initial officers and responders who arrived to aid the wounded at the court house are engaged by four gunmen within the building. Explosions are heard within the building, followed by fire and thick smoke pouring from windows throughout the upper floor of the building. • Units at court house see more smoke issuing from the building. Periodic gunfire and explosions can be heard throughout the building. 911 contacts Incident Command claiming to have cell phone access to men claiming to be the terrorists within the building. They claim to have demands and wish to negotiate the release of hostages. • As the incident progressed, further reports of possible hostages and locations of the shooters continued, often conflicting with other reports also being received. The differing reports, combined with the time necessary to safely evacuate students and staff from locked and barricaded areas, slowed the search of the school.

48. Module 3 DiscussionGreen Bay Under Siege For Official Use Only

49. Discussion Questions • At this point, what are your immediate priorities/actions; intermediate priorities/actions; and long term priorities/actions? • How would your agency prepare for the potential of another attack? • Would your agency need additional resources? • How would you continue to gain intelligence? • At what point would investigative responsibility be assumed by Federal authorities? • What measures of accountability for on-scene law enforcement officers would be put into place (long term)?

50. Discussion Continued • Would there be additional safety precautions in place for the law enforcement personnel? • How would multiple crime scenes be established? • How would you gain intelligence from the suspects? • Would you implement plans for initiating protective measures, including the hardening of potential targets/critical infrastructure? • What process insures information flows across disciplines (among fire departments, EMS units, public works, the private sector, and so forth) at all levels and across jurisdictions in a timely and efficient manner?