Overview
Blue Cascades II is a collaborative initiative brought forth by the Pacific Northwest Economic Region (PNWER) in cooperation with the King County Office of Emergency Management (Region 6, Washington Homeland Security District), Federal Emergency Management Agency (FEMA region X), Public Safety and Emergency Preparedness Canada (PSEPC), and the Washington State Military Department, on September 8, 2004 in Seattle, Washington. This will be the follow-up to the first successful Blue Cascades (first of its kind multi-state and international critical infrastructure interdependencies tabletop exercise) held in Welches, Oregon in 2002.
Background
PNWER, chartered in 1991, brings together public and private sector interests with the aim of enhancing the economic development of its eight U.S. and Canadian member jurisdictions: Alaska, Alberta, British Columbia, Idaho, Oregon, Montana, Washington, and the Yukon Territory.
On November 30, 2001, just after 9/11, the Pacific NorthWest Economic Region (PNWER) organized a meeting of public and private stakeholders from the PNWER region and formed the Partnership for Regional Infrastructure Security. This meeting began a process with the goal of developing a cooperative preparedness strategy using a risk-based approach to enhance the security of critical systems region-wide. Blue Cascades I was the first exercise in a series of activities that are key elements of this unique initiative.
More than 150 representatives from 70 private and public sector organizations attended the first Blue Cascades. The exercise was conducted by PNWER and co-sponsored by the U.S. Navy, FEMA Region 10, and OCIPEP, now known as Public Safety and Emergency Preparedness Canada (PSEPC).
Blue Cascades I focused on the linkages between and among infrastructures that could make the Pacific Northwest vulnerable to cascading impacts, which could complicate a speedy recovery in the event of an attack or disruption. Critical infrastructure components represented in the exercise included energy (electric power, oil, and natural gas), telecommunications, transportation, water supply systems, banking and finance, emergency services, and government services. Federal, state/provincial, and local government agencies, including emergency management organizations took part as well.
Overall participants found the exercise particularly effective in illuminating what they know and do not know about regional interdependencies, and the preparedness gaps they need to address to create a disaster resistant/resilient region. Participants expressed the need for further such multi-jurisdiction, cross-national activities in the future.
Exercise Focus
Blue Cascades II is designed to build upon the key findings from Blue Cascades I by tracking improvements, and addressing new concerns. This tabletop exercise will help stakeholders continue to assess the current state of their understanding and preparedness, particularly from the perspective of infrastructure interdependencies and compare results to those of the previous exercise. One of the key findings from Blue Cascades I demonstrated the need for contingency plans in the event of the loss or damage to electronic systems. As a result, Blue Cascades II will focus on the overwhelming dependency of Information Technology (IT) related resources required to communicate, continue business operations and execute recovery plans. It will also examine specific cyber security vulnerabilities that could impact operational systems such as SCADA and other electronic processes. This will enable the public and private sectors to better understand IT shortfalls that could have potentially devastating consequences.
The overall exercise findings will help participants identify the needs, priorities, and resource requirements for incorporation into an Action Plan to assist the eight jurisdictions within PNWER to become a disaster-resistant/resilient region. This information, along with the key lessons learned, will help sensitize public and private sector decision makers to infrastructure security issues and provide the impetus to prioritize and implement activities that will ensure the reliability and security of critical infrastructure.
Purpose
The purpose of Blue Cascades II is to build upon the lessons learned from the first Blue Cascades and continue to build a strategy to develop a "disaster resistant" region. Blue Cascades II will serve as a platform for holding future interdependency exercises in other locations within the PNWER region by contributing to, and validating implementation of a comprehensive preparedness approach.
Objectives
· Raise awareness of infrastructure interdependency issues with a particular focus on cyber-security.
· Examine cyber security vulnerabilities that could impact operations, business practices, response and recovery.
· Identify ways to make infrastructure providers and organizations aware of the extent and duration of disruptions.
· Identify and focus attention on the most important vulnerabilities that result from infrastructure interdependencies and their impacts.
· Promote a mutual understanding of interdependent infrastructure service restoration priorities, challenge and time lines.
· Identify and highlight roles, responsibilities and authorities (local, county, state, federal) for responding to and recovering from infrastructure attacks and disruption.
· Determine ways to build upon private/public sector cooperation and information sharing in developing and implementing infrastructure protection, mitigation, response and recovery options.
· Looking beyond the greater Puget Sound Region at interdependencies of critical infrastructures, identify challenges and abilities to cooperatively prepare for and deal with attacks and disruptions.
· Identify interdependency shortfalls related shortfalls
· Produce an After Action Plan of activities to address these identified shortfalls.
· Examine how our regional response and recovery activities interface with the new national documents National Incident Management Systems (NIMS) and National Response Plan (NRP).
· Develop a mutual understanding of the roles, responsibilities and needs of the law enforcement, intelligence and first responder communities in relation to the needs of private sector and critical infrastructure providers.
· Lay foundation for a more focused exercise on critical infrastructures interdependencies intended to examine response and short-term recovery.
Intent
Blue Cascades II allows participants (players) to discuss the impacts of attacks and disruptions on each represented infrastructure. This setting allows participants to become familiar with other infrastructures and the potential for cascading effects as a result of interdependencies.
All participants are encouraged to think aloud and "outside the box". Doing so will maximize the opportunity to discuss issues freely in a no fault setting. The exercise will involve minimal interaction with the facilitators.
Scenario
Scenario development is the responsibility of a small group of stakeholder volunteers representing key infrastructure and government organizations. The scenario will reflect those threats that the exercise participants are most concerned about - both deliberate and "non-deliberate" (e.g., natural disasters, systems failure, and human error). Infrastructure operational information solicited from utilities and other critical infrastructure managers in the region will make the scenario as realistic as possible. The scenario will provide a framework for participants to discuss infrastructure interdependencies and infrastructure protection, mitigation, response, and recovery requirements across government agencies and the private sector. Participants will be asked a series of questions to explore how a complete disruption or a service curtailment in one infrastructure could cause cascading effects on other infrastructures. This is designed to better understand how infrastructure interdependencies could exacerbate or improve repair and restoration efforts. Participants will agree to a confidentiality statement prior to the exercise. This will help protect specific information of a propriety nature.
Exercise Structure and Dynamics
The tabletop exercise will take place from 10:00 a.m. to 5:00 p.m. and include a working lunch. To maximize the benefits of the exercise, all participants will be located in the same room. The number of participants and observers will be limited only by the allowed capacity of the room selected. Every attempt will be made to ensure the inclusion of stakeholders who would play a role in a regional emergency.
The principal participants will be organized into approximately 20 infrastructure-specific and functional areas. The scenario will focus on critical infrastructures in the greater Puget Sound area. Observers from other PNWER jurisdictions and relevant external public and private sector organizations will be invited to attend and provide input as needed. The facilitators will control the progression of the scenario, verbally and by using one or two large screens for displaying scenario progression and key issues for discussion. Maps and other visual information aids also will be displayed.
Blue Cascades II will be divided into three sections: (1) orientation, (2) exercise moves (scenario progression), and (3) a "hot wash" immediately following the end of the exercise. The purpose of the hot wash will be to capture feedback and lessons learned. A follow-on meeting will be held to discuss the feedback and lessons learned in greater detail and to plan next-step activities that will be part of an overall comprehensive preparedness plan for both the area that is the focus of the exercise and the collective eight PNWER jurisdictions.