11 January 2003. Thanks to O.
Source:
http://terrorism.spjc.edu/CEIH.pdf.pdf
Department of Justice
Federal Bureau of Investigation
Department of Justice Programs
__________________________________________
The authors are particularly grateful to the U. S. Army
Soldier and Biological Chemical Command for lending
their support and extensive expertise in the development
of this handbook.
__________________________________________
Purpose
Potential Barriers
Responding to a Biological Attack
Public Health Investigation Goals
Public Health Epidemiological Investigations
Law Enforcement Investigation Goals
Law Enforcement Criminal Investigations
Joint Investigative Information
Effective Information Exchange
Sharing Sensitive Information
Appendix A — Decision Trees
Appendix B — Statutes and Directives
Appendix C — Acronyms
Appendix D — Glossary
Appendix E — Acknowledgements
Current information indicates that, regardless of location, American assets and citizens will continue to be targets of terrorist activities. Terrorists have demonstrated their willingness to employ non-traditional weapons to achieve their ends. One such class of non-traditional weapons is biological agents. Biological agents pose new challenges to both law enforcement and public health officials in their efforts to minimize the effects of a biological attack and apprehend those responsible for the attack. In the past, it was not uncommon for law enforcement and public health officials to conduct separate and independent investigations. However, a biological attack requires a high level of cooperation between these two disciplines to achieve their respective objectives of identifying the biological agent, preventing the spread of the disease, preventing public panic, and apprehending those responsible. The lack of mutual awareness and understanding, as well as the absence of established communication procedures, could hinder the effectiveness of law enforcement's and public health's separate, but often overlapping, investigations. Due to the continued likelihood of biological attacks, the effective use of all resources during a biological incident will be critical to ensure an efficient and appropriate response.
The purpose of this handbook is as follows:
To provide an introduction to epidemiological and criminal terrorist investigations so public health and law enforcement personnel have a better understanding of each other's information requirements and investigative procedures.
To identify potential conflicts law enforcement and public health personnel will encounter during their respective biological incident investigations and to provide potential solutions that can be adapted to meet the needs of the various jurisdictions and agencies throughout the United States.
To enhance the appreciation and understanding of each discipline's expertise by all parties.
This handbook has been developed to maximize resources and facilitate communication and interaction among law enforcement and public health officials. Additionally, it seeks to foster a greater understanding among law enforcement and public health personnel in an effort to minimize potential barriers to communication and information sharing during an actual biological event.
Law enforcement and public health officials are encouraged to read the entire handbook and not limit their review to just their respective sections. This is critical because law enforcement and public health communities have two common concerns:
1. Early identification of the criminal event or public health emergency, and2. The time sensitivity associated with obtaining information.
Even with common concerns, each group may be hesitant to provide
specific types of information to the other because of actual or perceived
information-sharing limitations. Identifying and resolving the potential
barriers to a free flow of information in advance will facilitate the timely
exchange of critical information when dealing with an actual
event.
Prior to the development of this handbook, a group of experts from the law enforcement and public health disciplines was assembled to participate in a workshop to identify and discuss actual and perceived barriers to a free flow of information between the two communities. The working group identified ways to reduce barriers with a view toward improving communication among public health and law enforcement investigators.
Public Health Barriers
During the public health and law enforcement workshop, the participants identified two principal barriers to sharing patient information. The first potential barrier is that the public health community is concerned it will be held legally liable for the release of patient information without consent. Some legal issues associated with confidentiality issues are listed below.
Public health officials will normally obtain patient information from medical practitioners. The issue of whether or not this information is confidential and legally "privileged" must be reconciled.
Public health officials may take clinical samples from patients
to identify the magnitude of the affected population. Law enforcement officials
may want to have access to these clinical sample results as part of a criminal
investigation. A review of the applicable state and federal statutes should
be conducted to determine the actual limitations and the exceptions that
may exist. The process for allowing this information to be shared with law
enforcement should be researched and a procedure developed to comply with
the legal requirements to share the information. The procedures may range
from merely establishing that certain conditions exist which permit disclosure
of the information to requiring a court order. In some jurisdictions, the
public health officials take the position that the isolates (a chemical
substance or microorganism in an uncombined or pure state) belong to the
state and, therefore, there is no legitimate expectation of privacy or privilege.
Law enforcement officials might want to obtain specific information from health records at hospitals, Health Maintenance Organizations (HMOs), or the Centers for Medicare and Medicaid Services. A determination should be made whether state or federal privacy statutes prevent the disclosure of this information without a court order.
Law enforcement officials might wish to obtain patient information from individual health care providers. A determination should be made about what information can be provided without subjecting the health care provider to professional or personal liability. It should be determined what circumstances necessitate a court order for release of the required information.
A second potential barrier to the exchange of patient information is based on issues of ethics and trust. Patients provide detailed information to the medical community with the tacit understanding that physicians and public health professionals will retain that information in confidence. The public health community has expressed concern that providing confidential patient information to the law enforcement community, regardless of reason or intent, may jeopardize their future ability to obtain data that is critical to identify and control diseases of any type. Additionally, protecting the confidentiality of information is one of the elements of the code of conduct for medical and public health professionals.
The "doctor-patient" privilege is a statutory privilege and varies from state to state. It is the privilege of the patient, not the physician, to assert that privilege. In general, the three elements listed below must be present for the privilege to exist.
The information must be given with the expectation that it will not be disclosed and must be given in the usual context of a professional relationship.
The purpose of the professional relationship is to maintain confidentiality.
The possible injury to the professional relationship from the disclosure must be greater than the expected benefit to justice or the public in obtaining the information.
Disclosure of patient information in response to a subpoena will insulate physicians, hospitals, and public health officials from legal liability for the disclosure.
Law Enforcement Barriers
The law enforcement community also has two primary concerns regarding the exchange of investigative information. First, they may be reluctant to provide information that may jeopardize the safety of confidential informants or the security of classified sources. Information that law enforcement personnel obtain from informants is frequently so sensitive that, if the information were exposed, the suspects would be able to determine exactly who had provided the information to law enforcement officials. As a result, the more people who have access to the sensitive information, the greater the possibility that the information source will be exposed. While not discounting the need for closely held, informant-provided information, public health officials would like to receive an alert from law enforcement that a heightened awareness needs to be in effect. This alert may or may not require the disclosure of sensitive information but, nevertheless, it would allow public health officials to be on the lookout for unusual or unexplained illnesses, and to monitor what may otherwise initially be overlooked as a signal that there has been a biological release.
Second, the law enforcement community is concerned that the suspects may avoid detection as a result of the exchange of sensitive information. For example, should law enforcement personnel inform the public health community to look for a specific individual or group, the number of individuals who know the specifics of the case will obviously increase. As in any investigation, the more people who have access to sensitive information, the more opportunities exist for inadvertent disclosure of the information. As a result, there is a greater opportunity for the sensitive information to inadvertently leak back to the suspected perpetrators, thus giving them the advanced warning needed to facilitate the destruction of evidence and to possibly avoid detection.
Media Issues
While not intentional, the media may hinder the investigation by releasing information that may cause public panic or compromise law enforcement sources. Public health officials and law enforcement officials need to develop a working relationship with the media to help ensure timely and useful information is shared with the media to keep the public accurately informed but not overly alarmed. This can be accomplished by issuing public announcements. It is paramount that public health officials and law enforcement authorities coordinate their media information and have one lead spokesperson (from either agency) to deal with the media. The designated lead spokesperson will help to ensure the accuracy of the information being disseminated to the public; based upon the expertise of the lead spokesperson to answer technical questions specific to either medical or law enforcement issues, the lead spokesperson may also help avoid the release of sensitive information. With the public fear and the psychological impact of a biological attack, the media will aggressively seek information from the investigators. Establishing a Joint Information Center (JIC) with a lead spokesperson will aid both the public health and law enforcement officials in dealing with the media and providing timely and accurate information.
The response to a biological attack involves federal law enforcement agencies, federal public health agencies, and other federal, state, and local agencies. In an effort to define the roles and responsibilities of the federal agencies involved in the response to terrorism incidents, two Presidential Decision Directives (PDD), PDD 39 and PDD 62, were issued.
Presidential Decision Directive 39
In June 1995, PDD 39 (the United States Policy on Counter-Terrorism) was issued. This Presidential Directive, built upon previous directives for combating terrorism, further elaborated a strategy, an interagency coordination mechanism, and a management structure to be undertaken by the federal government to combat both domestic and international terrorism in all its forms. This authority includes implementing measures to reduce our vulnerabilities, deterring terrorism through a clear public position, responding rapidly and effectively to threats or actual terrorist acts, and managing the consequences of terrorist incidents involving weapons of mass destruction (WMD). While PDD 39 discusses additional federal roles and responsibilities, it directs that the FBI has lead responsibility for the operational response to a terrorist threat or incident, which includes biological attacks. Within this role, the FBI functions as the on-scene manager for the U. S. Government. PDD 39 also identifies the Federal Emergency Management Agency (FEMA) as the lead agency to provide federal consequence management response and support to state and local governments affected by a terrorist incident.
Presidential Decision Directive 62
In May 1998, PDD 62 was issued. PDD 62 reaffirms the policy in PDD 39 and details a systematic approach to fighting terrorism by applying a program management approach to U. S. counter-terrorism efforts. PDD 62 established the office of the National Coordinator for Security, Infrastructure Protection, and Counter-Terrorism, which was charged with the responsibility to oversee a broad variety of relevant policies and programs, including areas such as counter-terrorism, protection of critical infrastructure, preparedness, and consequence management for weapons of mass destruction (WMD).
Since the issuance of PDD 39 and 62, a Concept of Operations Plan (CONPLAN) was developed and agreed to by the various federal agencies involved in the response to terrorism incidents. The CONPLAN provides overall guidance to federal, state, and local agencies concerning how the federal government will respond to potential or actual terrorist threats or incidents that occur in the United States, particularly incidents involving WMD. The CONPLAN outlines an organized and unified capability for a timely and coordinated response by federal agencies to a terrorist threat or act. It establishes conceptual guidance to assess and monitor an emerging threat; to notify appropriate federal, state, and local agencies of the nature of the threat; and to deploy the requisite advisory and technical resources to assist the Lead Federal Agency (LFA) in facilitating interagency/ interdepartmental coordination of a crisis and consequence management response. Lastly, it defines the relationships between structures under which the federal government will marshal crisis and consequence management resources to respond to a threatened or actual terrorist incident.
The response to a biological incident is executed under two broad responsibilities: crisis management and consequence management.
Crisis Management
Crisis management is predominantly a law enforcement function and includes measures to identify, acquire, and plan for the use of resources needed to anticipate, prevent, and/ or resolve a threat or act of terrorism. During a terrorist incident, a crisis management response may include traditional law enforcement missions such as intelligence, surveillance, tactical operations, negotiations, forensics, and investigations, as well as technical support missions such as agent identification, search, render safe procedures, transfer and disposal, and limited decontamination. In addition to the traditional law enforcement missions, crisis management also includes assurance of public safety and health.
The laws of the United States assign primary authority to the federal government to prevent and respond to potential or actual acts of terrorism. Based on the situation at the time, a federal crisis management response may be supported by technical operations and by consequence management activities that would operate concurrently.
Consequence Management
Consequence management is predominantly an emergency management function and includes measures to protect public health and safety, restore essential government services, and provide emergency relief to governments, businesses, and individuals affected by the consequences of terrorism. In an actual or potential terrorist incident, the Federal Emergency Management Agency (FEMA), using structures and resources of the Federal Response Plan (FRP), will manage a consequence management response. These efforts will include support missions as described in other federal operations plans such as predictive modeling, protective action recommendations (PAR), and mass decontamination.
The laws of the United States assign primary authority to the state and local governments to respond to the consequences of terrorism; the federal government provides assistance as required. Those involved in the response to a biological threat or attack should be familiar with the CONPLAN.
Lead Federal Agency Designation (LFA)
As mandated by the authorities referenced above, the operational response to a terrorist threat will employ a coordinated interagency process organized through a LFA concept. PDD-39 reaffirms and elaborates on the U. S. Government's policy on counter-terrorism and expands the roles, responsibilities, and management structure to combat terrorism. Lead federal agency responsibility is assigned to the Department of Justice and is delegated to the FBI for threats or acts of terrorism that take place in the United States or in international waters that do not involve the flag vessel of a foreign country. Within this role, the FBI Federal On-Scene Commander (OSC) will function as the on-scene manager for the United States Government until such time as the crisis abates and the LFA authority shifts to FEMA to address ongoing consequence management activities. All federal agencies and departments, as needed, will support the Federal OSC. Threats or acts of terrorism that take place outside of the United States or its trust territories, or in international waters and involve the flag vessel of a foreign country, are outside the scope of the CONPLAN.
In addition, these authorities reaffirm that FEMA is the lead agency of the federal government for consequence management within U. S. territory. FEMA retains authority and responsibility to act as the lead agency for consequence management throughout the federal response. FEMA will use the FRP structure to coordinate all federal assistance to state and local governments for consequence management. To ensure that there is one overall LFA, PDD-39 directs FEMA to support the Department of Justice (as delegated to the FBI) until the Attorney General transfers the LFA role to FEMA. At such time, the responsibility to function as the on-scene manager for the U. S. Government transfers from the FBI Federal OSC to the FEMA Federal Coordinating Officer (FCO).
Common Goals of Public Health and Law Enforement
Public Health and Law Enforcement share common goals:
To protect the publicTo prevent or stop the spread of disease
To identify those responsible for a threat or an attack
To protect their respective employees during their response and investigations
The means by which the two disciplines strive to achieve common goals, as well as other discipline-specific goals, are set forth in the following sections.
Public health personnel, through their epidemiological investigations, whether triggered by normal surveillance or report of an outbreak, have the following basic goals:
To protect the public.
Public health professionals utilize surveillance of health trends
and medical information to establish methods to protect the public from health
threats. Vaccine programs, medical studies, disease surveillance, and education
all play a role in preventing serious health emergencies.
To stop the spread of disease.
One of the most basic missions of public health is the prevention of illness
in the population. While physicians focus on curing the sick and promoting
health in the individual, public health practitioners strive for health promotion
and disease prevention in the population. Epidemiologists use survey techniques
and data analysis to determine the source, mode of transmission, and population
at risk for the illness under investigation to limit the spread of the outbreak.
To protect the public health personnel
One major consideration during these investigations is the protection of the public health personnel. Since epidemiologists and interviewers must routinely come in contact with potentially infectious individuals, it is important that the proper protective protocol is provided for these individuals during their investigation.
Epidemiologists use investigative techniques to determine the
cause and extent of disease outbreaks. Successful investigations require
the meticulous accumulation of information in the field. The field investigation
of disease outbreaks is the element of public health that will most resemble
law enforcement investigations because of the types
of information collected and the means by which it is collected. Outbreak
investigations, along with disease surveillance, are the areas that will
most likely produce information of interest to law enforcement personnel.
The following is a brief synopsis of the elements of an outbreak investigation. The elements are listed sequentially, although in reality, some elements occur simultaneously or in a different order depending on the availability of personnel and the nature of the outbreak.
Detect Unusual Event
The first indication of an outbreak is often an unexpected increase in the number of patients with similar symptoms. An outbreak is defined as the occurrence of more cases of a specific illness or syndrome than expected in a certain location during a certain time period. For example, 100 cases of flu in a 24-hour period via surveillance of physician-reporting in a large city during flu season would not be unexpected. The same number of cases outside of the flu season may be considered unusual and would probably be investigated. With some biological agents, such as smallpox, a single suspected case anywhere at any time would be considered a potential outbreak. When an unusual event emerges, public health officials must determine if the reported cases or syndromes are actually related, and if so, determine if the cases exceed the number historically seen for that location and time of year. In order to make those determinations, additional data is needed from expanded public health surveillance.
Expand Public Health Surveillance
Public health surveillance is defined as the ongoing collection, analysis, and interpretation of health data for use in the planning, implementation, and evaluation of public health practices. A surveillance system must include the capacity for collecting and analyzing data, as well as the means to disseminate the data to individuals or groups involved in disease prevention and control activities. The manner in which various public health agencies will communicate among themselves during an actual biological event should be determined before a biological attack actually occurs.
Ideally, a surveillance system will detect a rise in the incidence of a disease to provide sufficient time for the health care system to limit the impact of the disease on the public by initiating early treatment and prevention to decrease morbidity and mortality. For example, early detection of contagious diseases, such as plague or smallpox, and an aggressive vaccination program would greatly reduce the spread of the disease and the number of people affected.
In light of the current potential for a biological terrorist attack, some cities and states have set up surveillance programs that track a variety of health care indicators. It should be noted that these newer medical surveillance systems are not guaranteed to detect an outbreak of disease. Some health care indicators found in surveillance systems may include the following:
The number of upper respiratory disease cases seen in emergency departmentsThe number of ambulance runs within an allotted period of time
The number of antibiotics or over-the-counter drugs sold at pharmacies
The first confirmed case of an epidemic is referred to as the "index case." Once the index case is identified, there is a great need to identify new cases, unreported cases, and contacts. The search will include interviewing family members, associates, co-workers, and other possible contacts of the index case. The significance of interviewing co-workers and associates of the index case is to eliminate certain possibilities and focus on others. For example, if interviews of co-workers of the index case prove to be negative (no one else at work affected), then investigators may be able to eliminate the workplace as the source of the disease. If interviews of the associates of the index case shared an experience such as eating at the same place or attending the same organized event, and the associates have signs of the disease as well, the focus of the investigation may be placed on the common event.
Hospitals, ambulatory clinics, and possibly private health practitioners in the area affected should be contacted in order to determine if anyone with a similar illness is currently, or was recently, in the hospital or received medical treatment for a similar illness. This step is critical since early recognition of patterns of illness by health practitioners is the most effective step in identifying and limiting an outbreak.
Confirm the Diagnosis
Diagnosing the potential disease agent begins with medical personnel obtaining medical histories and physical examinations of the affected individuals. A medical history is the notation of medical conditions during a physical examination and can include information on recent events, symptoms, travel, or any unusual circumstances that may have contributed to the illness. Based on this information, the physician or public health official may request clinically appropriate laboratory tests to aid in the diagnosis. Physicians are likely to make an initial diagnosis and initiate treatment before test results are available since early treatment increases the probability that the patient will recover from the illness.
Identify and Characterize Additional Cases
This element of the investigation has many similarities to a law enforcement investigation and is often referred to loosely as "shoe leather epidemiology" due to the time and resources necessary to conduct the interviews in order to obtain the necessary case and contact( s) information. It is at this stage in an epidemiologic investigation that a case definition is refined, sources for cases scoured, additional cases are identified, and the initial descriptive epidemiology is worked out. These interviews require extensive time and personnel. Interviewees may be contacted multiple times as investigators collect additional information. Information collected by public health investigators can include the following:
Demographic dataClinical data (signs and symptoms, duration, onset, etc.)
Exposure history (travel, meals, and significant events; all based on the type of illness suspected)
Case contacts and knowledge of other cases
In addition to interviewing personal contacts of the index case and other cases, public health officials will attempt to identify all the cases of the disease by using a set of medical criteria. For example, public health officials may solicit media assistance to notify everyone with a certain type of skin rash and fever to report to their health practitioner for an examination.
Collect Specimens
Diseases are often initially diagnosed by clinical evidence. This process can be imprecise based on the nature of the illness and definitive diagnosis usually requires laboratory analysis of medically relevant samples.
The materials that typically are collected to support an epidemiological investigation include food, water, biological samples (tissues, blood, sputum, etc.), and environmental samples (dusts, powders, surface swabs, etc.). The collection of biological samples can be complicated, requiring specialized training and equipment. Some tests require living intact materials, necessitating transport of materials on ice and/ or extremely rapid delivery. Additionally, not all laboratories can conduct the necessary analyses. Therefore, transport out of state may be required.
Reporting
The time necessary for a confirmatory diagnosis can range from hours to days depending upon the suspected organism and the types of tests necessary. All states require some reporting of specific diseases, but there is not a standardized list for all states. Reporting can be by the attending physician, the supporting infectious disease laboratory, hospitals, or public health officials. The Centers for Disease Control and Prevention (CDC) is currently publishing guidelines for reporting diseases likely to be associated with biological terrorism.
The definitive diagnostic test of a disease agent in a bioterrorist incident is often referred to as a "gold standard test" and is performed by a designated, certified laboratory. The test will vary depending on the agent. The term "gold standard test" has varying interpretations and acceptance because of reliability issues and accuracy due to the implication of it being 100% definitive. Public health officials may develop a strong hypothesis about the cause of the outbreak as they accumulate additional clinical laboratory and intelligence information. However, most senior health officials will wait for the definitive results prior to confirming the diagnosis if biological terrorism is suspected. The principal reason for waiting for confirmation is that different analytical methods have different specificities. For example, some vendors claim that their field assay tests quickly indicate the presence of a biological agent; however, the lack of reliability and accuracy of these field assay tests make the use of an approved laboratory test critical. A field assay test combined with the clinical symptoms might suggest a particular biological agent is present, but the field assay test alone cannot determine with absolute certainty that a particular biological agent is or is not present.
Lab tests vary in their ability to correctly identify agents. Cross-reactivity with other organisms, indirect measures such as antibodies, and other factors can complicate these procedures. Until the public health officials obtain the results from the confirmatory diagnostic test, the diagnosis would be considered unconfirmed or suspected.
Develop and Implement Intervention Plans
The ultimate aim of the above procedures is to identify the disease agent and its origin and to develop and implement a plan to control the epidemic and protect the public's health. However, implementation of the intervention plan usually cannot wait for confirmation of the disease if the intervention plan is to be successful. Many illnesses, such as anthrax, can be treated successfully if antibiotics are provided early in the course of the illness. Also, steps involving quarantine or isolation, if required to control spread of disease, must be implemented early in an outbreak to be effective.
As with the public health community, during a biological attack, the law enforcement community has a set of primary goals. These goals include the following:
To protect public safety.
The overriding goal of law enforcement is to protect the public from terrorist threats or attacks. Preventing an attack or apprehending a terrorist after an attack to prevent additional events.
To prevent a criminal act.
The role of law enforcement begins with taking steps to prevent
a terrorist from successfully executing an attack.
Through ongoing surveillance and intelligence gathering techniques, law
enforcement personnel seek to obtain information that identifies potential
terrorists, their targets, and methods of attack before an incident can be
executed. It is necessary to safeguard the sources of the intelligence
information and the means in which it was gathered to avoid the inadvertent
disclosure of sources and collection techniques, especially during ongoing
productive operations.
Inadvertent release of sensitive information may compromise not only the specific threat being investigated, but also future investigations.
To identify, apprehend, and prosecute the perpetrators.
Once a biological attack occurs, law enforcement personnel seek
to obtain sufficient evidence and information to first identify and then
apprehend the individual or individuals responsible for the attack. Collection
of evidence includes interviewing victims and witnesses as well as obtaining
and preserving physical evidence. A criminal investigation into a biological
attack is not complete until there is a successful prosecution and conviction
of those responsible for the attack. Law enforcement personnel must follow
strict evidence collection procedures to obtain sufficient admissible evidence
needed to achieve a conviction. Any abnormalities such as a break in the
chain of custody in the
collection or maintenance of the evidence may prevent the use of the
incriminating evidence at the trial.
To protect law enforcement personnel.
Law enforcement personnel are likely to encounter situations where they may be at risk for exposure to a biological agent. Since some biological agents can be both infectious and contagious, law enforcement personnel must take precautions and wear appropriate personal protective equipment (PPE) when responding to and investigating a biological attack. Sufficient information about the suspected or known biological agent must be obtained to help determine the safety precautions necessary to protect the investigators. Ideally, the FBI's Hazardous Materials Response Unit (HMRU) or field office Hazardous Materials Response Team (HMRT) will be involved in the collection of biological agents for evidence.
Averting a Biological Attack
Preventing a biological attack is the first line of defense and is the ultimate goal of law enforcement. In reality, not every biological attack can be prevented; therefore, appropriate federal, state, and local agencies must be prepared to respond to an incident after-the-fact or during an ongoing event. The first step in preventing and preparing for a biological attack is to attempt to identify potential terrorists or terrorist organizations likely and capable of executing a biological attack. This information allows law enforcement officials to identify potential targets and possible modes of attack.
Criminal Investigation Process
Individuals conducting criminal investigations must operate within the applicable laws governing the investigations and the ensuing prosecution. As information is compiled, a thorough understanding of the elements necessary to prove each offense being pursued will help guide the investigators to identify any missing or weak evidence. A brief summary of the criminal investigation process is provided below. While the steps are presented sequentially, some aspects of the investigation may occur simultaneously.
Threat Assessment -- Real or Hoax
Law enforcement personnel may be confronted with a non-credible threat (hoax), threatened biological release, announcement that a release of a biological agent has occurred (overt), or an unannounced release of a biological agent (covert).
In the case involving a claim that a biological agent either has or will be released, the FBI, in consultation with recognized experts, will conduct a threat assessment to determine whether the biological threat is credible. If the threat is credible, law enforcement must take action to prevent or minimize the effect of the biological attack. If the threat is deemed not to be credible, law enforcement personnel will initiate an investigation to identify and prosecute those responsible for the threat. Under federal law (18 U. S. C. §2332a and 18 U. S. C. 175), a threat involving a disease-causing organism is a criminal act, whether or not the perpetrator actually possesses the biological agent.
In an unannounced (covert) biological attack, the medical community will diagnose the effects of the biological agent on patients seeking medical attention from their private practitioners and hospital emergency rooms. In a covert biological attack, the public health care surveillance system will be the key to identifying unexplained illnesses across the population or similar symptoms being reported by private practitioners and hospitals. As soon as the public health community suspects that there is probably no natural cause for a disease outbreak, law enforcement personnel should be contacted in order to initiate a preliminary criminal investigation. If public health officials and law enforcement have forged a working relationship prior to an unannounced biological attack, it is more likely that the public health officials will feel more comfortable contacting law enforcement early in their epidemiologic investigation, permitting a cross-check preliminary inquiry to determine whether there is a likelihood of a biological attack.
Gather Evidence
The process of gathering evidence during the investigation of a biological incident will involve collection of physical evidence such as samples of biological agents or materials, dissemination devices, human body specimens (such as blood, secretions, hair, skin, DNA), clothing of both victims and suspects, documents, photographs, and witness statements. Law enforcement personnel must consider a variety of issues to ensure evidence they have gathered can ultimately be used in a criminal prosecution. The list below provides a summary of some of the key issues law enforcement personnel must consider.
Chain of Custody
The process of chain of custody presents an issue of significant
concern for law enforcement personnel during a criminal investigation. The
chain of custody is the methodology used to track and maintain control and
accountability of all evidentiary items. This includes initial collection
of the evidence through the final disposition of the specimens. Both law
enforcement and public health personnel must provide accountability at each
stage of collecting, handling,
testing, storing, transporting the evidentiary items, and reporting any test
results. Failure to properly maintain the chain of custody may prevent the
evidence in question from being introduced at trial.
A distinction can be made between collecting evidence for public
safety verses for criminal prosecution. In some instances, there may be an
overriding need by authorities to identify the agents or materials as soon
as possible to ensure the proper response is implemented and steps can be
taken to protect the responders and the public. In this
instance, the need for rapid collection and testing to save lives outweighs
the normal evidence collection procedures.
Delivery of Biological Samples to Appropriate Laboratory
Not all forensic labs that process criminal evidence are equipped to test for biological agents. The FBI and the CDC have established the Laboratory Response Network (LRN) that identifies labs across the country with expertise to conduct appropriate analyses with the approved equipment, qualified personnel, and accepted practices. Only labs approved by both the FBI and the CDC should be used to test biological agents or materials. Submitting evidentiary biological samples to a non-approved lab will not only delay proper analyses, but may result in unintentional contamination of the samples.
Documents
Original documents should be obtained when possible. Issues of authenticity and admissibility arise if copies are relied upon when original documents are available.
Witness Statements
Witness descriptions of dissemination devices, vehicles, suspects, odors, tastes, sounds, and other specific information must be obtained as soon as possible after a biological incident. The information a witness has to provide is "time sensitive" and the sooner the information can be obtained, evaluated, and disseminated, the more value it has to investigators. As time passes from when the witness actually heard, saw, felt, smelled, or tasted something, the potential increases for information "contamination." This can occur as witnesses hear others describe what they saw, heard, felt, smelled, or tasted. Memories fade and the influence of what others say can greatly erode the accuracy of the recollection of a witness.
Evaluate Evidence
As evidence is gathered and collected, an ongoing evaluation of the evidence must be part of the investigative process. An understanding of the types of evidence and the rules governing the admissibility of the evidence will lead to better evaluations of the evidence as the investigation progresses. While not intended to be all-inclusive, Table 1 identifies and provides a brief explanation of some of the types of evidence collected during the investigative process.
In a terrorist incident, law enforcement personnel will need the results of any analyses or tests on evidence in order for them to properly focus their investigation. In major criminal investigations, law enforcement officers are accustomed to a quick turnaround on lab results if the investigation involves a death or is a high profile crime. In a biological terrorism event, the time required to positively identify the agent may be considerably longer which may delay the progress of the investigation.
Like other investigations, during a biological event, the investigators never know what nuance or piece of information will be
Law Enforcement 33
33 Page 34 35
28 28
Law Enforcement
T TY YP PE E OF OF E EV VI ID DE EN NC CE E EX EXP PL LA AN NA AT
TI IO ON N EX EXA AM MP PL LE E
Ci Cir rc cu um ms st ta an nt ti ia al l
Ev Evi id de en nc ce e
Facts, if proven, allow the
fact-finder to draw conclu-sions.
In most jurisdictions,
circumstantial evidence has
the same probative value as
direct evidence.
Suspect was treated for cutaneous
anthrax at or about the same time
a release of anthrax was attempted.
Suspect is found in possession of a
delivery device similar to type of
device believed to have been used
to disseminate biological agent.
Di Dir re ec ct t Ev Evi id de en nc ce e Documents, records, physi-cal evidence,
notes, comput-er
data, videotapes, or other
types of information that
directly relate to the case.
Vehicle rental agreements, pur-chase
receipts, phone records,
eyewitness statements.
Tr Tra ac ce e Ev Evi id de en nc ce e Minute particles of matter which can
be examined
microscopically, physically
and/ or chemically.
Biological agent or material
residue.
H He ea ar rs sa ay y E Ev vi id de en nc ce e Statements offered to prove
the truth of the matter
asserted and the declarant is
unavailable for cross-exami-nation.
A person who did not personally
witness a suspect engaging in a
particular manner but is report-ing
the observation based upon
what someone else told him or
her, and the person who actually
made the observation is not testi-fying
or available for the oppos-ing
party to cross-examine.
Ey Eye ew wi it tn ne es ss s
T Te es st ti im mo on ny y
Observation or sensation
personally seen, smelled,
heard, felt, or tasted.
Witness reporting smelling a par-
ticular odor or hearing a specific
sound or seeing someone.
T Ta ab bl le e 1 1. . T Ty yp pe es s o of f Ev Evi id de en nc ce e
Co Col ll le ec ct te ed d D Du ur ri in ng g an an In Inv ve es st ti ig
ga at ti iv ve e Pr Pro oc ce es ss s 34
34 Page 35 36
2 29 9
Law Enforcement
the crucial break needed to identify, arrest, and convict those
responsible
for the criminal act.
From the beginning of a criminal investigation into a biological
attack until the case is submitted to a jury for a verdict, all facts collected
during the investigation must be verified and inconsistencies must be
resolved and submitted to the prosecutor in the format and manner
desired. Documents must be carefully analyzed to ensure they have been
thoroughly reviewed and the information contained in the documents is
interpreted correctly. Sometimes information contained in statements
or reports is subject to differing interpretations. Investigators must
examine the evidence for conflicting interpretations and resolve these
issues as soon as possible or be prepared to explain the contradictions.
It is equally important to develop a mechanism to submit all
information, statements, lab reports, documents, photos, and other
evidentiary items to the prosecutor in an organized manner to ensure all
of the facts are identified well in advance of the trial. Additionally,
sufficient time should be allowed to permit the prosecutor to meet with
the investigators and witnesses as needed to review all reports, evidence,
and anticipated testimony.
A Ap pp pr re eh he en nd d S Su us sp pe ec ct ts s
Once a bioterrorism threat has been prevented or a biological attack
occurs and the threat to the public is either reduced or eliminated,
identifying and building a prosecutable case against those responsible for
the attack is the top priority for law enforcement personnel. Suspecting
or even knowing who is responsible for the biological attack is different
than having sufficient evidence to charge and prosecute the perpetrators.
There will be tremendous pressure on law enforcement personnel
following a biological attack, especially when human lives are lost, to
identify, locate, and arrest the guilty person( s). 35
35 Page 36 37
3 30 0
Law Enforcement
During the apprehension of a suspect or group of suspects, law
enforcement personnel involved in the arrest need to take precautions
against possible injury from the perpetrator( s). By the time law
enforcement personnel are prepared to make an arrest, the perpetrator( s)
will have already demonstrated or professed the willingness to kill or
injure large numbers of innocent citizens. It is also possible that the
arresting officers will be confronted with either a contaminated
environment or contaminated evidence. While apprehending the
suspects is a major phase of the investigative process, the safety of the
arrest team and innocent bystanders is paramount. Appropriate
personal protective equipment (PPE) must be utilized to prevent
contamination from the presence of biological agents.
R Re en nd de er r T Te es st ti im mo on ny y
Each potential government witness should be available to meet
with the prosecutor prior to testifying at trial. It is important for the
prosecutor to have the opportunity to evaluate how each witness may
appear to the jury. Additionally, any issues, problems, discrepancies, or
gaps in the evidence or testimony can be discussed and resolved. To
avoid lost evidence or rulings of inadmissibility, law enforcement
officers must know and have access to all sources of information and
evidence so inconsistencies or discrepancies can be investigated and
addressed. 36
36 Page 37 38
J J
O O
I I
N N
T T
O O
P P
E E
R R
A A
T T
I I
O O
N N
S S
JOINT
OPERATIONS 37
37 Page 38 39
Joint Operations
3 31 1
J JO OI IN NT T I IN NV VE ES ST TI IG GA AT TI IV VE E I IN NF FO OR RM
MA AT TI IO ON N
The successful execution of the criminal and epidemiological
investigations during a biological incident will depend upon the efficient
use of all available resources. When possible, public health and law
enforcement personnel should work in teams and jointly conduct
interviews with victims and witnesses. Prior to the actual interview with
a witness or victim, the joint investigation team should decide which
person will begin the interview and the other member of the
interview
team should allow the lead interviewer to complete his or her interview
without interruption or disruption to the flow of the questioning. It is
recommended that the epidemiological interview proceed first during a
joint interview; however, the order of the interviews must be decided on
a case-by-case basis.
When joint interviews are not possible, the separate investigative
communities should be aware of the types of information their
counterpart is seeking. Public health personnel could obtain and
provide information from their epidemiological investigation to law
enforcement personnel that would benefit a criminal investigation.
Conversely, the law enforcement community could provide data to
public health personnel that would benefit an epidemiological
investigation. The objective of the joint investigation and joint
interviews of victims and witnesses is to maximize the efficiency of both
public health and law enforcement investigators through the exchange of
real-time information.
I IV V. . J JO OI IN NT T O OP PE ER RA AT TI IO ON NS S 38
38 Page 39
40
In order to facilitate the joint investigation process, an initial list of
information has been developed to assist law enforcement and public
health personnel in understanding and asking appropriate questions.
E EF FF FE EC CT TI IV VE E I IN NF FO OR RM MA AT TI IO ON N E EX XC CH
HA AN NG GE E
One of the goals of this handbook is to encourage public health
officials and law enforcement officials to notify and involve each other
early in an investigation even if it turns out to be a non-criminal event.
It is essential to establish key pre-incident communication mechanisms
between the law enforcement and the public health communities. The
communication mechanisms are especially important for the expeditious
exchange of information in an actual biological incident. This exchange
of information requires law enforcement and public health personnel to
be familiar with one another, and to know which people in each agency
need and should receive the information.
W WM MD D R Ro ol le es s a an nd d R Re es sp po on ns si ib bi il li it
ti ie es s
To facilitate the sharing of information between law enforcement
and public health officials, a process and structure similar to an
Emergency Operations Center (EOC) or Joint Operations Center
(JOC) that brings together all the elements necessary to respond to a
WMD incident could be used as a model. It is essential to involve the
appropriate agencies to fully benefit from personal interaction and
ongoing dialogues with those who will be responding to an actual
biological attack.
The concept of an EOC or JOC model provides a framework to
structure and foster a communication capability that bridges the two
communities. One way to maximize this framework is to form a WMD
Working Group from the agencies that are part of the EOC or JOC.
The critical value of the WMD Working Group is that ongoing
Joint Operations
3 32 2 39
39 Page 40
41
3 33 3
Joint Operations
T Ta ab bl le e 2 2. . I In nf fo or rm ma at ti io on n I Im mp po or
rt ta an nt t t to o P Pu ub bl li ic c H He ea al lt th h P Pe er rs so
on nn ne el l
D Du ur ri in ng g a an n I In nv ve es st ti ig ga at ti io on n I In nt
to o a a B Bi io ol lo og gi ic ca al l A At tt ta ac ck k
P PE ER RS SO ON NA AL L/ /F FA AM MI IL LY Y H HE EA AL LT TH H I IN
NF FO OR RM MA AT TI IO ON N
What does the victim think made him or her ill?
When (date/ time of onset) did the victim start feeling sick?
Does the victim know of anyone else who has become ill or died (e. g., family,
coworkers, etc.)?
Has the victim had any medical treatment in the last month? What is the name
of the
healthcare provider? Where was the victim treated?
Does the victim have any allergies to medications?
Is the victim's disease contagious?
When did the victim first seek treatment for the illness?
What are the laboratory results?
Who collected, tested, analyzed, and had access to the samples?
A AC CT TI IV VI IT TI IE ES S I IN NF FO OR RM MA AT TI IO ON N
A AG GE EN NT T D DI IS SS SE EM MI IN NA AT TI IO ON N I IN NF FO OR RM
MA AT TI IO ON N
Has the victim detected any unusual odors or tastes?
Has the victim noticed any sick or dead animals?
M ME ED DI IC CA AL L I IN NF FO OR RM MA AT TI IO ON N
P PE ER RS SO ON NN NE EL L S SA AF FE ET TY Y I IN NF FO OR RM MA AT TI
IO ON N
What precautions should criminal investigators take?
What physical protection from the disease/ agent is needed?
Is the agent communicable by person-to-person exposure? How is the disease
spread?
Where does the victim live and work/ go to school?
Did the victim attend a public event (i. e., sporting event, social function,
visit a restaurant,
etc.)?
Has the victim or the victim's family members traveled more than 50 miles
in the last 30 days?
Has the victim or the victim's family members had any contact with individuals
who had been
in another country in the last 30 days?
E EP PI ID DE EM MI IO OL LO OG GI IC CA AL L I IN NV VE ES ST TI IG GA AT
TI IO ON N I IN NF FO OR RM MA AT TI IO ON N
Who is the point of contact in the public health community?
Where should the sick be referred?
What makes this case suspect?
What is the spectrum of illness the law enforcement community could be seeing
(case
definition)? 40
40 Page 41
42
3 34 4
Joint Operations
T Ta ab bl le e 3 3. . I In nf fo or rm ma at ti io on n I Im mp po or
rt ta an nt t t to o L La aw w E En nf fo or rc ce em me en nt t P Pe er
rs so on nn ne el l
D Du ur ri in ng g a an n I In nv ve es st ti ig ga at ti io on n I In nt
to o a a B Bi io ol lo og gi ic ca al l A At tt ta ac ck k
P PE ER RS SO ON NA AL L I IN NF FO OR RM MA AT TI IO ON N
Victim's name
Victim's age/ date of birth
Victim's sex
Victim's address
Victim's social security number
Victim's driver's license number
Victim's occupation/ employer
Victim's religious affiliation
Victim's level of education
Victim's ethnicity/ nationality
Record any personal property (bag & tag)
Common denominators among victims/ patients (i. e., race, socio-economic
status, socio-political
groups and associations, locations, events, travel, religion, etc.)
Whether the person has traveled outside of the United States in the last
30 days
Whether the person traveled away from home in the last 30 days
The person's normal mode of transportation and route to and from work everyday
The person's activities for the last 30 days
T TR RA AV VE EL L I IN NF FO OR RM MA AT TI IO ON N
I IN NC CI ID DE EN NT T I IN NF FO OR RM MA AT TI IO ON N
Whether interviewee heard any unusual statements (i. e., threatening statements,
information
about biological agents)
Did the victim see an unusual device or anyone spraying something?
Were there any potential dispersal devices/ laboratory equipment/ suspicious
activities?
Identification of the biological agent; is the agent's identity suspected,
presumed, or
confirmed?
The victim's account of what happened or how he/ she might have gotten sick
The time/ date of exposure. Is the time/ date suspected, presumed, or confirmed?
The number of victims. Is the number suspected, presumed, or confirmed?
Whether there is a cluster of casualties. Is the cluster suspected, presumed,
or confirmed?
The potential methods of exposure (e. g., ingested, inhaled, skin contact)
The exact location of the incident. Is this location suspected, presumed,
or confirmed?
Whether the biological event is a single incident or involves multiple releases.
Is this
suspected, presumed, or confirmed?
The case distribution. What are the names, dates of birth, and addresses
of the cases?
The types of physical evidence that should be sought
Any witnesses to a suspicious incident. What are their names, dates of birth,
and addresses? 41
41 Page 42
43
3 35 5
Joint Operations
T Ta ab bl le e 3 3 ( (C Co on nt ti in nu ue ed d) )
Who is the point of contact in the law enforcement community?
To whom should potential witnesses be referred?
Any chain of custody needs
S SA AF FE ET TY Y I IN NF FO OR RM MA AT TI IO ON N
What makes this case suspect?
The presence of any information that would indicate a suspicious event
Any safety or security issues for the public health personnel
C CR RI IM MI IN NA AL L I IN NV VE ES ST TI IG GA AT TI IO ON N I IN NF
FO OR RM MA AT TI IO ON N
relationships are developed and fostered between the public health
community and the law enforcement community before a biological
incident occurs.
Additionally, the WMD Working Group enables the various
jurisdictions to identify what information will be exchanged, when it
will be exchanged, and to whom it will be provided, based on individual
and departmental needs. Ideally, the WMD Working Group would
conduct regularly scheduled meetings to maintain a working
relationship and a productive comfort level with one another.
Planning, training, and exercising prior to an actual biological
attack can foster the public health officials' comfort level of involving
law enforcement early on in their epidemiological investigation.
Without an established working relationship, it is possible that the
public health officials may be reluctant to involve law enforcement until
they are certain that an incident is an actual biological attack. However,
determining criminal intent (i. e., bioterrorism) requires a joint
FBI/ Public Health assessment.
Two scenarios have been provided to help response officials
understand the function and processes of the WMD Working Group. 42
42 Page 43
44
3 36 6
S Sc ce en na ar ri io o 1 1 describes the recommended information
flow if the law enforcement community is the first to
identify a potential biological incident.
S Sc ce en na ar ri io o 2 2 provides guidance in the event the public
health community is the first to suspect a biological
incident. The process provided was designed to allow
maximum flexibility for the affected jurisdictions. It
should be noted that regardless of where the
information enters the system, the information flow
moves up the information chain. Additionally, each
group identified in Figures 1 and 2 should be a
conduit for information to the group immediately
above and below it.
S Sc ce en na ar ri io o 1 1: : L La aw w E En nf fo or rc ce em me en
nt t C Co om mm mu un ni it ty y H Ha as s I In nt te el ll li ig ge en nc
ce e
o of f T Th hr re ea at t t to o R Re el le ea as se e B Bi io ol lo og gi
ic ca al l A Ag ge en nt t ( (F Fi ig gu ur re e 1 1) )
The local FBI office develops information of a possible biological
threat and notifies FBI Headquarters. FBI Headquarters conducts a
threat assessment based on the information provided from the
preliminary information from the field. (In a suspected biological
incident the FBI Threat Assessment will consist of conference calls
between FBI Headquarters, the local field office, the relevant state or
local public health officials, the FBI Hazardous Materials Response Unit
[HMRU], and other federal agency experts such as CDC, the U. S.
Department of Agriculture [USDA], or the Food and Drug
Administration [FDA].) During the FBI Threat Assessment, a
consensus is reached which indicates the likelihood that an intentional
biological release has occurred, or will occur. FBI Headquarters returns
a credible threat assessment to the local FBI office and provides guidance
to the local FBI office for conducting further investigations to validate
the intelligence.
Joint Operations 43
43 Page 44
45
3 37 7
Joint Operations
F Fi ig
gu ur re
e
1 1. .
L La aw
w
E En nf
fo or rc
ce em me
en nt t
C Co om
mm mu un
ni it ty
y
I Id de
en nt ti
if fi ie
es s
B Bi io
ol lo og
gi ic ca
al l
I In nc
ci id de
en nt t 44
44 Page 45
46
3 38 8
Joint Operations
Once a credible threat has been established through the FBI Threat
Assessment process, the CDC will pass that information to the state
health departments. Again, depending on the quality and sensitivity,
certain information may be retained within agencies that currently
possess it. At this point, the local FBI office would coordinate with the
state or local emergency management agency to convene the WMD
Working Group and begin to exchange pertinent information.
Depending on the extent and quality of the intelligence or investigative
results, the information may be held at this level (i. e., not disseminated
to local health care providers), pending further investigation.
S Sc ce en na ar ri io o 2 2: : D Di is se ea as se e E Em me er rg ge
es s a an nd d i is s I Id de en nt ti if fi ie ed d T Th hr ro ou ug gh
h
t th he e P Pu ub bl li ic c H He ea al lt th h C Co om mm mu un ni it ty
y ( (F Fi ig gu ur re e 2 2) )
Local hospitals/ practitioners observe unusual symptoms in their
patients. Based on a preliminary diagnosis, physicians begin to treat the
patients. Once the public health officials receive and analyze the patient
medical data, they can determine if there are any triggers suggestive of
a
potential biological incident. When local health officials observe these
triggers that indicate a potential biological attack, they should
coordinate with the emergency management agency and the state health
department to activate the WMD Working Group, which includes the
FBI WMD Coordinator for that geographical jurisdiction.
Once the Working Group has been assembled (virtually or in
person), information will be exchanged concerning the potential threat
or the unusual phenomenon observed in the health system. Based on
the information provided to law enforcement through the WMD
Working Group, a decision will be made regarding whether or not a
criminal investigation is warranted. In most cases, an epidemiological
investigation will be initiated to determine the source of the unusual
circumstance observed in the health system. The benefit of conducting 45
45 Page 46
47
3 39 9
Joint Operations
F Fi ig
gu ur re
e
2 2. .
M Me ed
di ic ca
al l
/ /
P Pu ub
bl li ic
c
H He ea
al lt th
h
C Co om
mm mu un
ni it ty
y
I Id de
en nt ti
if fi ie
es s
B Bi io
ol lo og
gi ic ca
al l
I In nc
ci id de
en nt t 46
46 Page 47
48
4 40 0
joint interviews should be considered at this point; however, the known
facts of the situation at the time will drive this decision.
I In nf fo or rm ma at ti io on n E Ex xc ch ha an ng ge e T Tr ri ig gg
ge er rs s
During an incident, certain information, or a specific event should
trigger the exchange of information between the law enforcement and
the public health communities. For example, the law enforcement
community conducts criminal investigations every day. In recent years,
there have been numerous biological hoaxes. What should prompt the
law enforcement community to contact the public health community
and involve them in the investigation of such an event? Similarly,
epidemiological investigations take place routinely. Most
epidemiological investigations have nothing to do with terrorism per se.
At what point in an investigation should the public health community
be prompted to contact law enforcement? Both communities are
legitimately concerned about overreacting and further stretching their
already over-burdened infrastructure and resources.
Many factors could lend clues to a potential use of biological
weapons. The difficulty of trying to use definitive criteria is that almost
all biological agents mimic other diseases in their early presentation.
Furthermore, many classic bioterrorism agents are rare, non-endemic, or
eradicated diseases; general practitioners may not recognize the disease
until it has progressed to the more serious and unique symptoms
associated with it. In some cases, there may be a reluctance to report this
"unknown" illness until a diagnosis is made. The following tables
provide a preliminary list of factors that could trigger public health
(Table 4) or law enforcement (Table 5) communities to exchange
information. These tables are not intended to be all-inclusive for the
potential triggers. Each jurisdiction may want to mutually add or
remove triggers to suit their individual needs. These lists are intended
to provide a starting point to tailor or improve individual jurisdictional
Joint Operations 47
47 Page 48
49
4 41 1
Joint Operations
Any specimen samples submitted to public health for analysis that
tests positive
for a potential bioterrorism-related organism
Large numbers of patients with similar symptoms or disease
Large numbers of unexplained symptoms, diseases, or deaths
Higher than expected morbidity and mortality associated with a common dis-ease
and/ or failure of patients to respond to traditional therapy
Single case of disease caused by an uncommon agent (i. e., Burkholderia
mallei
or B. pseudomallei, smallpox, viral hemorrhagic fever, anthrax)
Multiple unusual or unexplained disease entities in the same patient
Disease with an unusual geographic or seasonal distribution (i. e., tularemia
in a
non-endemic area or influenza in the summer)
Unusual "typical patient" distribution (i. e., several adults with an unexplained
rash)
Unusual disease presentation (i. e., inhalational vs. cutaneous anthrax)
Similar genetic type among agents from temporally or spatially distinct sources
Unusual, atypical, genetically engineered, or antiquated strain of a biological
agent
Endemic disease with unexplained increase in incidence (i. e., tularemia,
plague)
Simultaneous clusters of similar illness in non-contiguous areas, domestic
or
foreign
Disease agents transmitted through aerosol, food, or water; suggestive of
sabo-tage
Ill persons presenting near the same time; point source with compressed epi-demic
curve
No illness in persons not exposed to common ventilation systems (have sepa-rate
closed ventilation systems) where illness is seen in those persons in close
proximity
Death or illness among animals that may be unexplained or attributed to a
bio-logical
agent that precedes or accompanies illness or death in humans
T Ta ab bl le e 4 4. . P Pu ub bl li ic c H He ea al lt th h T Tr ri ig
gg ge er rs s
needs and wishes. The most important aspect of this information is to
overcome the hesitation or reluctance to share information before all of
the facts are known (an event that would definitely trigger the
notification). The early notification will be seen as providing an early
warning and will not be viewed negatively. 48
48 Page 49
50
4 42 2
Joint Operations
T Ta ab bl le e 5 5. . L La aw w E En nf fo or rc ce em me en nt t T
Tr ri ig gg ge er rs s
Any intelligence or indication that any individual or group is unlawfully
in
possession of any biological agents
Seizure of any bio-processing equipment from any individual, group, or
organization
Seizure of any potential dissemination devices from any individual, group,
or
organization
Identification or seizure of literature pertaining to the development or
dissemination of biological agents
Any assessments that indicate a credible biological threat in an area
A HAZMAT response which involves the presence of biological agents
S SH HA AR RI IN NG G S SE EN NS SI IT TI IV VE E I IN NF FO OR RM MA AT
TI IO ON N
I In nf fo or rm ma at ti io on n M Ma at tr ri ic ce es s
The timely exchange of information is critical to an effective
response to a biological incident. Yet, there are concerns within law
enforcement and public health communities about the types of
information that each group will freely exchange. Both communities
feel that there are circumstances that may necessitate withholding
certain types of information from each other.
In order to help lower barriers to the free exchange of information,
the following set of matrices (Table 6 and Table 7) were developed to
assist members of the public health and law enforcement communities
to understand the types of information each seeks and potential means
to obtain that information. Each of the categories in the matrices is
defined below.
K Kn no ow wn n I In nf fo or rm ma at ti io on n. . Information that
each group has
during the specific phase of the biological incident. 49
49 Page 50
51
4 43 3
Joint Operations
T Ta ab
bl le e
6 6. .
P Pu ub
bl li ic
c
H He ea
al lt th
h
a an nd
d
M Me ed
di ic ca
al l
( (H Ho
os sp pi
it ta al
l
/ /
E EM MS
S) )
I In nf
fo or rm
ma at ti
io on n
P Pr re
e--S Su
us sp pi
ic ci io
on n
o of f
a a
B Bi io
ol lo og
gi ic ca
al l
I In nc
ci id de
en nt t
( (R Ro
ou ut ti
in ne e
P Pu ub
bl li ic
c
H He ea
al lt th
h
C Ca ar
re e
S Su ur
rv ve ei
il ll la
an nc ce
e) )
Surveillance
data
regarding
reportable
diseases
Aggregate
information about the individual cases; nursing home aggregate
data
Medical
findings
(unusual
symptoms) All personal
information/ patient health data Potential recognition of sus-pect bioterrorism
agents SAME AS ABOVE Analysis of the incident Aggregate patient data; state
public health lab results Medical examiner findings Clinical data/ confirmation
and data on disease Contact information on other potential cases via interviews
Potential
biological
agents
being
cultured
in
the
area
Potential
disease
agents;
list
of
suspect
bioterrorism agents National Alert list of groups and agents Agreement about
what information can be released
Can
freely
provide
aggregate
data
(numbers
and
types)
Can
freely
provide
assessments
and
analyses
without
personal
information
Medical
examiner
provides
data
on
fatalities
to
prosecutor;
no
subpoena
necessary
Prosecutor
can
request
post-mortem
data;
no
sub-
poena
necessary No specific case
data
released
Hospital/ EMS
does
not
report
to
law
directly;
immediately
report
up
the
chain
to
public
health
Follow
state
laws
for
reporting
diseases
Analyses
freely
provided
to
all
response
groups
Public
health
will
take
steps
to
ensure
release
of
information A subpoena
ensures
the
release
of
information
and
legally
protects
public
health
from
liability
Prosecutors
can
obtain
medical
examiner
informa-
tion Information
is
reported
to
CDC
Report
to
local
health
department
Require
patient
permission
for
additional
lab
test-
ing
Medical
community
infor-
mation Threat
assessments Agent dissemination method Specific case data (i.
e.,
potential
targets,
agent
characteristics) Any information
on
the
biological
agent
I I
n nc ci
id de en
nt t
M Ma an
na ag ge
em me en
nt t
SAME
AS
ABOVE
SAME
AS
ABOVE
SAME
AS
ABOVE
Authority
to
quarantine
Extent
and
nature
of
out-
break
SAME
AS
ABOVE
SAME
AS
ABOVE
SAME
AS
ABOVE
Update
on
the
outbreak
A AC CT
TI IO ON
NS S
N NE EE
ED DE ED
D
I IN NF
FO OR RM
MA AT TI
IO ON N
K KN NO
OW WN N
I IN NF
FO OR RM
MA AT TI
IO ON N
P PH HA
AS SE E
S Su us
sp pi ic
ci io on
n
o of f
a a
B Bi io
ol lo og
gi ic ca
al l
I In nc
ci id de
en nt t
R Re ec
co ov ve
er ry y
f fr ro
om m
t th he
e
B Bi io
ol lo og
gi ic ca
al l
I In nc
ci id de
en nt t 50
50 Page 51
52
4 44 4
Joint Operations
T Ta
ab bl le e
7 7. .
L La
aw w E
En nf fo or
rc ce
em me en
nt t I
In nf fo
or rm
ma at ti io
on n
P Pr
re e-
-S Su
us sp pi
ic ci
io on n
o of f
a a
B Bi
io ol lo
og gi ic
ca al l
I In
nc ci id
de en nt t
General
information (white
noise) Data
concerning potential terrorist groups
Data
concerning potential biological agents Specific case data Suspect name( s),
location(
s)
Group
names( s),
capabilities
Sources of
threat·
Methods of
attack
Information regarding a
"nor-mal
day" in
the
medical com-munity
(i.
e.,
number of ED
patients,
number of
EMS
runs, etc.)
Information about any
unusu-al
diseases Patient
information
Law
enforcement will openly
reveal
general
information No specific case
information will be
revealed
SAME AS
ABOVE
The
FBI
WMD
Interagency Threat
Assessment
will
notify the
public
health
community; this
information will be For
Official Use
Only
(FOUO) and will
not be
released to the
public
unless
specified by FBI
Patients are
potential victims
of a
biological incident Personal information (i.
e.,
name,
address, social
security
number of
victim/
patient)
Agent type
and
strain
Agent
symptomology
I In
nc ci id
de en nt t
M Ma
an na ag
ge em
me en nt t
Specific case
data
with
more
detailed
information Investigation methods and
source data Potentially
have
suspect in
custody SAME AS
ABOVE
SAME AS
ABOVE
Location of
victims
Medical threat
assessment
Special and
routine lab
infor-
mation for
prosecution Epidemiological data (contact
lists)
Law
enforcement will alert
public
health offi-
cials
and
the
WMD
working group
and
share
known
information to
minimize the
public
health risk Provide
threat
information after CDC
review
All
potential suspects Ongoing victim
report, list of
victims, patient
information,
regular
release of
information
Any
information on any
crim-
inal
activity,
regardless of time
frame
A AC
CT TI IO
ON NS S
N NE
EE ED
DE ED D
I IN
NF FO
OR RM
MA AT TI
IO ON N
K KN
NO OW
WN N I IN
NF FO
OR RM
MA AT TI
IO ON N
P PH
HA AS SE E
S Su
us sp pi
ic ci
io on n
o of f
a a
B Bi
io ol lo
og gi ic
ca al l
I In
nc ci id
de en nt t
R Re
ec co
ov ve er
ry y f
fr ro
om m
t th
he e B
Bi io ol
lo og gi
ic ca al l
I In
nc ci id
de en nt t 51
51 Page 52
53
4 45 5
N Ne ee ed de ed d I In nf fo or rm ma at ti io on n. . Information that
each group
needs to obtain to effectively conduct its investigation
during the specific phase of the biological incident. It
is the information that the public health community
would need from the law enforcement community or
the law enforcement community would need from
the public health community.
A Ac ct ti io on ns s. . Steps that should be taken by each
community to obtain the information or to identify
what information can be readily obtained (i. e., public
health to obtain law enforcement information). In
the stated example, the law enforcement community
identifies requirements for the public health
community to obtain the information from the
criminal investigation.
In the workshop where public health and law enforcement experts
were assembled to identify potential barriers to the exchange of
information, the law enforcement and public health personnel were
asked to identify the information they would either possess or need
according to the four different phases listed below.
P Pr re e--S Su us sp pi ic ci io on n. . Both communities may be
receiving
unusual information, but there is nothing to raise
suspicion of a criminal act or a disease outbreak.
S Su us sp pi ic ci io on n. . The law enforcement community has
information that leads it to believe a criminal act may
be committed or has been committed, or the public
health community suspects an outbreak of a
Joint Operations 52
52 Page 53
54
4 46 6
biological agent. Law enforcement personnel would
initiate measures to identify, acquire, and plan the use
of resources needed to anticipate, prevent, and/ or
resolve a biological attack.
I In nc ci id de en nt t M Ma an na ag ge em me en nt t. . Measures
to protect public
health and safety, restore essential government
services, and provide emergency relief to
governments, businesses, and individuals affected by
the consequences of terrorism.
R Re ec co ov ve er ry y. . Gradual return to normal operations.
In general, law enforcement and public health communities appear
to be more hesitant to share information in the early stages (Pre-Suspicion
and Suspicion) of the incident than they are in the latter stages
(Incident Management and Recovery). In most instances, each
community is reluctant to exchange sensitive information based solely
on the incomplete criminal or epidemiological investigative information
it would have in the first two phases. Because of this, there appears to
be two general phases:
1. Pre-confirmation of a criminal act or diagnosis of a
bioterrorist incident, and
2. Confirmation of a criminal act or diagnosis of a
bioterrorist incident.
Once the public health community has made a diagnosis or the law
enforcement community has confirmed a criminal act, both groups
appear to be more willing to exchange information. The underlying goal
throughout this handbook is to foster early notification of the law
Joint Operations 53
53 Page 54
55
4 47 7
enforcement community by the public health community and vice
versa. Actual biological attack investigations have demonstrated that the
sharing of information can and does occur willingly when the threat is
real and not an abstract concept.
P Pu ub bl li ic c I In nf fo or rm ma at ti io on n R Re el le ea as se
e
The media will have a significant impact on the response and the
public reaction to a biological incident. As a result, each community
should use a single point of contact (spokesperson), to be identified by
each jurisdiction, to coordinate and disseminate the response to queries,
which will help ensure that the appropriate information, especially
sensitive information, is released to the media at the proper time. The
matrix in Table 8 below provides general guidance concerning a
jurisdiction's interaction with the media.
R Re ec co om mm me en nd da at ti io on ns s t to o I Im mp pr ro ov ve
e t th he e I In nf fo or rm ma at ti io on n E Ex xc ch ha an ng ge e
As noted above, the law enforcement and public health
communities are more willing to exchange information once they have
confirmed the existence of a criminal act or a biological agent. However,
an exchange of available information in the early stages of a biological
incident is critical to effectively apprehend the perpetrators and contain
the outbreak. The matrices (Tables 6-7) provide some guidance on how
to obtain sensitive information. However, the steps required to obtain
the information may cause both communities to lose valuable time in
their investigations. The table below (Table 9) provides some guidance
on how individual jurisdictions can improve information sharing. The
recommendations in Table 9 are intended to be general so that any
jurisdiction can tailor the recommendations based on local needs.
Joint Operations 54
54 Page 55
56
T Ta ab bl le e 8 8. . R Re el le ea as se e o of f I In nf fo or rm ma
at ti io on n t to o t th he e M Me ed di ia a / / P Pu ub bl li ic c
P PH HA AS SE E I IN NF FO OR RM MA AT TI IO ON N F FO OR R T TH HE E
M ME ED DI IA A
W WH HO O R RE EL LE EA AS SE ES S
T TH HE E I IN NF FO OR RM MA AT TI IO ON N
P Pr re e--S Su us sp pi ic ci io on n
o of f a a B Bi io ol lo og gi ic ca al l
I In nc ci id de en nt t
NA NA
S Su us sp pi ic ci io on n o of f
a a B Bi io ol lo og gi ic ca al l
I In nc ci id de en nt t
Confirm something unusual
Need to provide rumor
control
Prepare to respond to
inquiries
Do not release any threat
assessments
Designate a single point of con-tact
for law enforcement and
for the public health agencies to
coordinate between them
Points of contact work together
on any response to query
Develop agreed-upon rules of
public release
I In nc ci id de en nt t
M Ma an na ag ge em me en nt t
Alert media to the com-municability
of the biolog-ical
agent (if known or
suspected)
Confirm and announce
any protective actions
Provide rumor control
Use risk/ crisis communica-tion
to address the psycho-logical
issues of biological
terrorism
SAME AS ABOVE
FBI and public health agencies
coordinate response; develop a
joint public health and a law
enforcement press release
R Re ec co ov ve er ry y f fr ro om m
t th he e B Bi io ol lo og gi ic ca al l
I In nc ci id de en nt t
Focus on closure issues
Media/ public needs reas-surance
things are back to
"normal"
Emphasis on local law enforce-ment
and public health actions
in support of the community
Focus on the federal investiga-tion
and prosecution
4 48 8
Joint Operations 55
55 Page 56
57
4 49 9
Joint Operations
T Ta ab bl le e 9 9. . I In nf fo or rm me ea at ti io on n E Ex xc ch
ha an ng ge e R Re ec co om mm me en nd da at ti io on ns s
1. E Es st ta ab bl li is sh h I In nf fo or rm ma at ti io on n E Ex
xc ch ha an ng ge e G Gr ro ou up p — This group can be created from
an existing group,
such as the WMD Working Group, and consists of all the potential players
that may be
involved in a response to a biological incident. This forum permits each
response group to
identify who can provide what information to them and to whom they should
provide
information. Moreover, this group helps foster personal ties between response
officials,
facilitating less formal information-exchange relationships.
2. D De ev ve el lo op p C Cl lo os se e P Pe er rs so on na al l R Re el
la at ti io on ns sh hi ip ps s — Strong personal ties between the law
enforcement
personnel and the public health personnel tend to foster more information
exchange. Law
enforcement and public health personnel have indicated that they would be
more likely to
provide information to their counterparts early in process if they have worked,
talked, or met
with them on a regular basis and trusted them.
3. I In nc cl lu ud de e a an n E Ep pi id de em mi io ol lo og gi is st
t i in n t th he e C Cr ri im mi in na al l I In nv ve es st ti ig ga at
ti io on n — This individual could be a
member of the law enforcement staff or someone detailed to the law enforcement
staff on a
part-time basis. Law enforcement and public health personnel indicate that
this liaison could
help identify criminal information needed by the public health community
and provide the
necessary information to the law enforcement community.
4. E En nh ha an nc ce e t th he e B Bi io ol lo og gi ic ca al l I In nc
ci id de en nt t A Aw wa ar re en ne es ss s o of f t th he e E Em me er
rg ge en nc cy y R Re es sp po on ns se e C Co om mm mu un ni it ty y —
This
can be done through training courses or professional associations. Building
this awareness
helps to heighten the community awareness of the potential triggers that
would prompt the
exchange of information early in an incident.
5. P Pr re e--E Es st ta ab bl li is sh h A Ag gr re ee em me en nt ts s
o on n S Se en ns si it ti iv ve e I In nf fo or rm ma at ti io on n —
Establishing agreements that identify
the rules for the exchange and release of information could alleviate some
of the concerns
raised by both communities. These agreements should identify what information
will be
shared and how it will be restricted to limit unintentional release to
unauthorized personnel.
6. P Pr re e--E Es st ta ab bl li is sh h L La ab b T Te es st t A Ag gr
re ee em me en nt ts s — These agreements provide guidance as to how
the
public health community should conduct lab testing for the prosecution of
the suspects.
These agreements would establish what circumstances would necessitate specific
lab tests for
criminal investigations. The FBI and CDC have established the Laboratory
Response
Network (LRN), which identifies labs across the country with expertise to
conduct the
appropriate analyses with the approved equipment and accepted processes.
7. C Co on nd du uc ct t C Ch ha ai in n o of f C Cu us st to od dy y T Tr
ra ai in ni in ng g — This training should be designed to inform the
public health community to identify when they need to initiate the chain
of custody for
evidence in a biological incident. This information helps to ensure evidence
has been
handled properly for the eventual prosecution of the criminal case. 56
56 Page 57
58
S S
U U
M M
M M
A A
R R
Y Y
SUMMARY 57
57 Page 58
59
Summary
5 51 1
This handbook provides recommendations and is intended to
increase the reader's awareness of issues surrounding the effective
coordination of criminal and epidemiological investigations. Individual
jurisdictions should modify this guidance to accommodate their
individual needs and the special characteristics of their emergency
response procedures. The recommendations stated in this handbook
should not be viewed as policy directives from the federal government
for immediate implementation.
The primary goal of this handbook is to promote the sharing of
information and to encourage law enforcement and public health
personnel to establish effective information exchange procedures to
improve their criminal and epidemiological investigations by being
better prepared to save lives, avoid panic, and work together for
successful prosecutions and convictions of the terrorists responsible for
waging biological attacks on the citizens of the United States.
V V. . S SU UM MM MA AR RY Y 58
58 Page 59
60
A A
P P
P P
E E
N N
D D
I I
C C
E E
S S
APPENDICES 59
59 Page 60
61
Appendix A — Decision Trees
A A--1 1
A Ap pp pe en nd di ix x A A — — D De ec ci is si io on n T Tr
re ee es s
Each jurisdiction's response capabilities differ; hence, responses to a
biological incident will vary. However, there are common key decisions
that each jurisdiction is likely to make when confronted with an actual
biological attack. The decision points that have been identified are
general and are intended to assist law enforcement and public health
personnel in responding to a biological incident in a consistent manner.
The decision trees that follow help ensure that critical decisions, actions,
or steps are not omitted in a jurisdiction's response. Additionally, the
decision trees help direct where and when the law enforcement and
public health communities should integrate their investigations.
The following two decision trees (covert and overt biological
terrorism flow charts) reflect how law enforcement and public health
officials would respond to either a covert (unannounced) biological
terrorism incident or an overt (announced) biological terrorism
incident. The public health community would be the likely entity to
identify and trigger investigations during an unannounced (covert)
incident. Once the public health community triggers the investigations,
activities would be the same or similar to those that would occur during
an announced (overt) incident. Many of the steps in the decision trees
would occur simultaneously. 60
60 Page 61
62
A A--2 2
Appendix A — Decision Trees 61
61 Page 62
63
A A--3 3
Appendix A — Decision Trees 62
62 Page 63
64
Appendix B — Statutes and Directives
B B--1 1
A Ap pp pe en nd di ix x B B — — S St ta at tu ut te es s a an
nd d D Di ir re ec ct ti iv ve es s
1 10 0 U US SC C § §3 38 82 2 Emergency situations involving chemical
or biological
weapons of mass destruction
1 18 8 U US SC C § §3 32 2 Destruction of aircraft or aircraft
facilities
1 18 8 U US SC C § §3 37 7 Violence at international airports
1 18 8 U US SC C § §8 81 1 Arson within special maritime and
territorial jurisdictions
1 18 8 U US SC C § §1 11 13 3C C Torture
1 18 8 U US SC C § §1 17 75 5--1 17 78 8 Biological Weapons
Anti-Terrorism Statute of 1989
(BWAT)
1 18 8 U US SC C § §1 17 75 5( (b b) ) Exemption for development,
production, transfer,
retention, or possession of biological agent, toxin, or delivery system for
prophylactic, protective, or other
peaceful purposes
1 18 8 U US SC C § §2 22 29 9 Chemical Weapons Convention
Implementation Act
of 1998
1 18 8 U US SC C § §2 22 29 9F F Definition -Chemical Weapons
1 18 8 U US SC C § §3 35 51 1 Congressional, Cabinet, and Supreme
Court assassina-tion,
kidnapping, and assault
While not intended to be all-inclusive, the following table of federal
terrorism and WMD statutes is provided to give the investigator a
starting point in finding the applicable laws governing acts of terrorism.
63
63 Page 64
65
B B--2 2
Appendix B —Statutes and Directives
1 18 8 U US SC C § §8 83 31 1 Prohibited transactions involving
nuclear materials
1 18 8 U US SC C § §8 84 42 2( (i i) ) Explosives without detection
agents ( (4 4) )( (l l) )( (m m) )( (1 1) )& & ( (n n) )( (1 1) )
1 18 8 U US SC C § §8 84 42 2( (p p) ) Teaching WMD
1 18 8 U US SC C § §8 84 44 4 Penalties for threats or use of
explosives to damage ( (e e) ), , ( (f f) ), , ( (i i) )
or destroy U. S. property
1 18 8 U US SC C § §8 87 71 1--8 87 79 9 Extortion and threats
1 18 8 U US SC C § §9 92 21 1 Destructive device
1 18 8 U US SC C § §9 93 30 0( (c c) ) Possession of firearms and
dangerous weapons in fed-eral
facilities
1 18 8 U US SC C § §9 95 56 6 Conspiracy to kill, maim, injure,
or damage per
sons or property in a foreign country
1 18 8 U US SC C § §1 11 11 11 1 Murder (includes use of poison)
1 18 8 U US SC C § §1 11 11 12 2 Manslaughter (lesser included
offense of §1111)
1 18 8 U US SC C § §1 11 11 14 4 Protection of officers and employees
of the United
States
1 18 8 U US SC C § §1 11 11 16 6 Murder or manslaughter of foreign
officials, official
guests, or internationally protected persons
1 18 8 U US SC C § §1 12 20 03 3 Hostage taking
1 18 8 U US SC C § §1 13 36 61 1 Government property or contracts
1 18 8 U US SC C § §1 13 36 62 2 Communication lines, stations,
or systems
1 18 8 U US SC C § §1 13 36 63 3 Buildings or property within special
maritime and ter-ritorial
jurisdictions 64
64 Page 65
66
B B--3 3
1 18 8 U US SC C § §1 13 36 65 5( (g g) )( (3 3) ) Tampering
with consumer products
1 18 8 U US SC C § §1 13 36 66 6 Destruction of an energy facility
1 18 8 U US SC C § §1 17 75 51 1 Presidential and Presidential
staff assassination,
kidnapping, and assault penalties
1 18 8 U US SC C § §1 19 95 56 6 Laundering of monetary instruments
1 18 8 U US SC C § §1 19 95 58 8 Use of interstate commerce in
the commission of
murder-for-hire
1 18 8 U US SC C § §1 19 99 92 2 Wrecking trains
1 18 8 U US SC C § §2 21 15 51 1--2 21 15 56 6 Sabotage
1 18 8 U US SC C § §2 21 15 52 2 Fortifications, harbor defenses,
or defensive sea areas
1 18 8 U US SC C § §2 21 15 55 5 Destruction of national-defense
materials, nation
al-defense premises, or national-defense utilities
1 18 8 U US SC C § §2 21 15 56 6 Production of defective
national-defense material,
national-defense premises, or national-defense utilities
1 18 8 U US SC C § §2 22 28 80 0 Violence against maritime navigation
1 18 8 U US SC C § §2 22 28 81 1 Violence against fixed platform
1 18 8 U US SC C § §2 22 28 84 4 Sabotage of nuclear facilities
or fuel
1 18 8 U US SC C § §2 23 33 31 1--2 23 33 39 9B B Terrorism (Chapter
113B)
1 18 8 U US SC C § §2 23 33 32 2a a Use of Weapons of Mass Destruction
Statute
4 42 2 U US SC C § §2 20 01 11 1--2 22 28 84 4 Atomic Energy Act
of 1954
4 49 9 U US SC C § §4 46 65 50 02 2 Aircraft piracy
Appendix B — Statutes and Directives 65
65 Page 66
67
B B--4 4
Appendix B —Statutes and Directives
4 49 9 U US SC C § §6 60 01 12 23 3 Criminal penalties
for pipeline destruction or damage
5 50 0 U US SC C § §2 23 30 01 1--2 23 36 67 7 Defense Against
Weapons of Mass Destruction 66
66 Page 67
68
Appendix C — Acronyms
C C--1 1
A Ap pp pe en nd di ix x C C — — A Ac cr ro on ny ym ms s
AAR After Action Review/ Report
ACH Acetylcholine
AHF Argentine Hemorrhagic Fever (Arenaviridae)
AST Aspartate Aminotransferase (liver enzyme)
BIDS Biological Integrated Detection System
BNICE Biological Nuclear Incendiary Chemical Explosive
BOLO Be On The Lookout
BW Biological Warfare or Biological Weapon
BWAT Biological Weapons Anti-Terrorism
CBIRF Chemical Biological Incident Response Force (U. S. Marines
and Sailors)
CCHF Congo-Crimean Hemorrhagic Fever
CDC Centers for Disease Control and Prevention
CI Confidential Informant
CMS Centers for Medicare and Medicaid Services
CNS Central Nervous System
COM Communication
CONPLAN Concept of Operations Plan (Federal)
CSF Cerebrospinal Fluid
CST Civil Support Team (National Guard)
DHHS U. S. Department of Health and Human Services
DMAT Disaster Medical Assistance Team
DMORT Disaster Mortuary Response Team
DMSO Dimethyl Sulfoxide
The following list of acronyms is provided to help the investigator
become familiar with some of the acronyms that may be encountered
during an investigation involving WMD agents. Not all of these
acronyms appear in this handbook. 67
67 Page 68
69
C C--2 2
DNA Deoxyribonucleic acid
DoD Department of Defense
DOJ Department of Justice
DOS Department of State
DOT Department of Transportation
DOT-ERG DOT Emergency Response Guide
DPH Department of Public Health
ED Emergency Department
EHF Ebola Hemorrhagic Fever (Filoviridae)
EI Epidemiological Investigation
EMS Emergency Medical Services
EOC Emergency Operations Center
ER Emergency Room
FCO Federal Coordinating Officer
FDA U. S. Food and Drug Administration
FEMA Federal Emergency Management Agency
FOUO For Official Use Only
FRP Federal Response Plan
HAZMAT Hazardous Materials
HAZMIT Hazard Mitigation
HCFA Health Care Financing Administration (renamed to Centers
for Medicare and Medicaid Services)
HEPA High Efficiency Particle Arrestor
HFRS Hemorrhagic Fever with Renal Syndrome; aka Korean
Hemorrhagic Fever or Epidemic Hemorrhagic Fever
HMO Health Maintenance Organization
HMRT FBI Hazardous Materials Response Team
HMRU FBI Hazardous Materials Response Unit
HPS Hantavirus Pulmonary Syndrome
HQ Headquarters
HVAC Heating, Ventilating, and Air Conditioning
ICS Incident Command System
JIC Joint Information Center
JOC Joint Operations Center
LD Lethal Dosage needed to kill at least 50% of the persons
within the target area
Appendix C — Acronyms
50 68
68 Page 69
70
C C--3 3
LFA Lead Federal Agency
LRBSDS Long Range Biological Standoff Detection System
LRN Laboratory Response Network
MMRS Metropolitan Medical Response System
MO Modus Operandi (Method of Operation)
NAERG North American Emergency Response Guide
NBC Nuclear Biological Chemical
NMRT National Medical Response Team
OSC On-Scene Commander
PAR Protective Action Recommendation
PCR Polymerase Chain Reaction
PDD Presidential Decision Directive
PIO Public Information Officer
POC Point of Contact
ppb Parts Per Billion
PPE Personal Protective Equipment
ppm Parts Per Million
PSA Patient Staging Area
PT/ pt Patient
RVF Rift Valley Fever
SBCCOM (U. S. Army) Soldier and Biological Chemical Command
SCBA Self-Contained Breathing Apparatus
SEB Staphylococcal Enterotoxin B
SEMA State Emergency Management Agency
SEMO State Emergency Management Office
SEOC State Emergency Operations Center
SITREP Situation Report
SLUDGEM Salivation, Lacrimation, Urination, Defecation, Gastric
Distress, Emesis, and Miosis
SRA Safe Refuge Area
SRBSDS Short Range Biological Standoff Detection System
TDS Time, Distance, and Shielding
TEU Technical Escort Unit (U. S. Army)
UC Unified Command
USAMRIID U. S. Army Medical Research Institute of Infectious Diseases
USC United States Code
Appendix C — Acronyms 69
69 Page 70
71
C C--4 4
USDA U. S. Department of Agriculture
VEE Venezuelan Equine Encephalitis
VHF Viral Hemorrhagic Fever
WHO World Health Organization
WMD Weapons of Mass Destruction
Appendix C — Acronyms 70
70 Page 71
72
Appendix D — Glossary
D D--1 1
A Ap pp pe en nd di ix x D D — — G Gl lo os ss sa ar ry y
A Ac ce et ty yl lc ch ho ol li in ne e ( (A AC CH H) ) Neurotransmitter
substance
A Ac ct ti iv ve e i im mm mu un ni iz za at ti io on n Act of artificially
stimulating the body to produce
antibodies against infectious diseases
A Ad de en no op pa at th hy y Swelling of the lymph nodes
A An nt th hr ra ax x [ [B Ba ac ct te er ri ia a] ]* * Caused by the bacteria
Bacillus anthracis
A An nt ti it to ox xi in n Antibody formed in response to and capable
of
neutralizing a biological poison
A As st th he en ni ia a Weakness or debility
A At ta ax xi ia a Inability to coordinate muscle activity during
voluntary movement; incoordination of the gait
B Bl lo oo od d a ag ga ar r Mixture of blood and nutrient agar, used for
the
cultivation of many medically important
microorganisms
The following glossary is provided to help the investigator become
familiar with some of the terms that may be encountered during an
investigation involving WMD agents. Not all of these terms appear in this
handbook.
* These terms refer to the causative agent (i. e., bacteria, virus, toxin,
or rick-ettsia)
for the specified disease. 71
71 Page 72
73
D D--2 2
B Bo ot tu ul li in nu um m T To ox xi in n Toxin produced by
Clostridium botulinum
[ [T To ox xi in n] ]* * (found in non-acidic meat samples, vegetable
cans, and in soil)
B Br ra ac ch hy yc ca ar rd di ia a Slow heart beat
B Br ru uc ce el ll lo os si is s Caused by infection with number of
Brucella
( (U Un nd du ul la an nt t F Fe ev ve er r) ) bacteria, notably
Brucella suis, Brucella abortus,
[ [B Ba ac ct te er ri ia a] ]* * and Brucella melitensis
C Ch hi ik ku un ng gu un ny ya a V Vi ir ru us s Virus communicated
to humans from the bite of
[ [V Vi ir ru us s] ]* * the Aedes aegypti mosquito. It can also cause
infec-tion
in primates by being aerosolized.
Chikungunya is Swahili for "that which bends up"
describing the stooped posture of those afflicted
with the severe joint pain associated with the dis-ease
C Ch ho ol le er ra a [ [B Ba ac ct te er ri ia a] ]* * Caused by infection
of the bacteria Vibrio cholera
C Co oa ag gu ul lo op pa at th hy y Disease affecting the coagulability
of the blood
C Co oc cc co ob ba ac ci il ll lu us s A short, thick bacterial rod of the
shape of an oval
or slightly elongated coccus
C Co on ng go o--C Cr ri im me ea an n Tick-borne disease (viral hemorrhagic
fever)
H He em mo or rr rh ha ag gi ic c F Fe ev ve er r found in the Crimea and
parts of Africa, Europe,
V Vi ir ru us s ( (C CC CH HF F) ) and Asia. Contact with infected animals
and in
some healthcare settings can transmit disease to
humans (Bunyaviridae)
Appendix D — Glossary 72
72 Page 73
74
D D--3 3
C Cu ut ta an ne eo ou us s Relating to the skin
C Cy ya an no os si is s A dark bluish or purplish coloration of the skin
and mucous membrane due to deficient oxygena-tion
of the blood
D Di is st ta al l Situated away from the center of the body, or from
the point of origin; specifically applied to the
extremity or distant part of a limb or organ
D Dy ys sa ar rt th hr ri ia a A disturbance of speech and language due to
emo-tional
stress, to brain injury, or to paralysis, inco-ordination,
or spasticity of the muscles used for
speaking
D Dy ys sp ph ha ag gi ia a, , d dy ys sp ph ha ag gy y Difficulty in swallowing
D Dy ys sp pn ne e
a Shortness of breath/ difficulty breathing
E Ed de em ma a An accumulation of an excessive amount of watery
fluid in cells, tissues, or cavities
E En nc ce ep ph ha al li it ti is s Inflammation of the brain
E En nd do ot to ox xe em mi ia a Presence of endotoxins in the blood
E Ep pi is st ta ax xs si is s Bleeding from the nose
E Er ry yt th he em ma a Redness of the skin caused by capillary dilation
E Ex xa an nt th he em ma a Skin eruption occurring as symptom of acute viral
or coccal disease
Appendix D — Glossary 73
73 Page 74
75
D D--4 4
F Fo om mi it te e Items such as articles of clothing or eating utensils
that may harbor a disease and are capable of trans-mitting
the disease
G Gl la an nd de er rs s [ [B Ba ac ct te er ri ia a] ]* * An infection caused
by the bacteria Burkholderia
mallei (formerly known as Pseudomonas mallei)
H Ha an nt ta av vi ir ru us s [ [V Vi ir ru us s] ]* * Viral disease
(Hantavirus Pulmonary Syndrome)
transmitted to humans by the inhalation of dust
contaminated with rodent excreta (Bunyaviridae)
H He em ma at te em me es si is s Vomiting blood
H He em ma at tu ur ri ia a Blood or red blood cells in the urine
H He em mo op pt ty ys si is s Spitting blood from the lungs or bronchial
tubes
because of pulmonary or bronchial hemorrhage
H Hy yp po ot te en ns si io on n Low blood pressure
H Hy yp po ot th he er rm mi ia a Low body temperature
M Me ei io os si is s Constriction of the pupil
M Me el li io oi id do os si is s [ [B Ba ac ct te er ri ia a] ]* * Caused
by infection with the bacteria
Burkholderia pseudomallei
M Mo on nk ke ey yp po ox x [ [V Vi ir ru us s] ]* * Naturally occurring
relative of variola (smallpox)
virus and is found in Africa
M My ya al lg gi ia a Muscular pain
M My yd dr ri ia as si is s Dilation of the pupil
Appendix D — Glossary 74
74 Page 75
76
D D--5 5
P Pl la ag gu ue e ( (B Bl la ac ck k D De ea at th h) ) Caused by infection
with the bacteria Yersinia
[ [B Ba ac ct te er ri ia a] ]* * pestis (formerly known as
Pasturella pestis); bubon-ic
plague is spread by rats to humans by bite of
infected flea; pneumonic plague results from
inhalation of the organism
P Po ol ly ym me er ra as se e C Ch ha ai in n Technique for the amplification
of DNA; used in
R Re ea ac ct ti io on n ( (P PC CR R) ) diagnostic procedures to identify
biological
agents.
P Pr ro os st tr ra at ti io on n Marked loss of strength; extreme weakness
P Pr ru ur ri it tu us s Itching
P Pu ul lm mo on na ar ry y E Ed de em ma a Fluid in the lungs
P Py yr ro og ge en ni ic c Causing fever
R Rh hi in no or rr rh he ea a Watery discharge from the nose
R Ri ic ci in n [ [T To ox xi in n] ]* * Toxin made from the mash remaining
after pro-cessing
Castor beans
R Ri ic ck ke et tt ts si ia a ( (Q Q f fe ev ve er r) ) Caused by the rickettsia
Coxiella burnetii
[ [R Ri ic ck ke et tt ts si ia a] ]* *
R Ri ic ck ke et tt ts si ia a ( (T Ty yp ph hu us s — — Epidemic
typhus (acute onset) is caused by
e en nd de em mi ic c o or r e ep pi id de em mi ic c) ) Rickettsia typhi.
Endemic typhus (slower onset
[ [R Ri ic ck ke et tt ts si ia a] ]* * and milder) is caused by Rickettsia
prowazekii
S Sa ax xi it to ox xi in n [ [T To ox xi in n] ]* * Toxin produced by
marine dinoflagellates
S Sm ma al ll lp po ox x [ [V Vi ir ru us s] ]* * Caused by the Orthopox
virus (variola major and
variola minor)
Appendix D — Glossary 75
75 Page 76
77
D D--6 6
S St ta ap ph hy yl lo oc co oc cc cu us s One of the toxins and most
likely BW weapon of
E En nt te er ro ot to ox xi in n B B ( (S SE EB B) ) those produced by
Staphylococcus aureus
[ [T To ox xi in n] ]* *
T Ta ac ch hy yc ca ar rd di ia a Rapid heart beat
T Tr ri ic ch ho ot th he ec ce en ne e Toxin produced by filamentous fungi
M My yc co ot to ox xi in ns s [ [T To ox xi in n] ]* * (molds) of the genera
Fusarium, Myrotecium,
Trichoderma, Stachybotrys, and others; mycotoxins
have been referred to as "yellow rain"
T Tu ul la ar re em mi ia a ( (r ra ab bb bi it t f fe ev ve er r Caused
by the bacteria Francisella tularensis
o or r d de ee er rf fl ly y f fe ev ve er r) ) [ [B Ba ac ct te er ri
ia a] ]*
T Ty yp ph ho oi id d F Fe ev ve er r Caused by infection with the bacteria
[ [B Ba ac ct te er ri ia a] ]* * Salmonella typhi
V Va ar ri io ol la a [ [V Vi ir ru us s] ]* * Synonym for smallpox
V Ve en ne ez zu ue el la an n E Eq qu ui in ne e Virus is communicated to
humans by mos-E
En nc ce ep ph ha al li it ti is s ( (V VE EE E) ) quitoes
[ [V Vi ir ru us s] ]* *
V Vi ir re em mi ia a Presence of virus in the blood
Z Zo oo on no os si is s Disease of humans acquired from animal source
Appendix D — Glossary 76
76 Page 77
78
Appendix E — Acknowledgements
E E--1 1
A Ap pp pe en nd di ix x E E — — A Ac ck kn no ow wl le ed dg ge
em me en nt ts s
This handbook was the result of contributions and input from a
host of individuals. Special thanks to the following individuals and their
respective departments and agencies for their participation and
contributions to the development of this publication. Contributors are
listed in alphabetical order.
James T. Barry
Special Agent
Federal Bureau of Investigation
Baltimore Field Office
John A. Bellamy
Special Agent
Federal Bureau of Investigation
Miami Field Office
Eddy A. Bresnitz, MD, MS
State Epidemiologist/ Assistant Commissioner
New Jersey Department of Health & Senior Services
Julie Casani, MD, MPH
Epidemiology & Disease Control Program
Community Public Health Administration
Maryland Department of Health & Mental Hygiene 77
77 Page 78
79
E E--2 2
Michael DeZearn
Improved Response Program Team
U. S. Army Soldier and Biological Chemical Command
Aberdeen Proving Ground, Maryland
Timothy A. Dixon
Associate Manager
Battelle Edgewood Operations
Bel Air, Maryland
Michael K. Elliott
Homeland Security
Battelle Edgewood Operations
Bel Air, Maryland
Cindy R. Friedman, MD
Medical Epidemiologist
CDC/ Anthrax Response Unit
Washington, DC
William Greim, MS, MPH
Program Management Officer
Bioterrorism Preparedness and Response
National Center for Infectious Diseases
Centers for Disease Control and Prevention
Atlanta, Georgia
Katharine N. Harmon, PhD
Hazardous Materials Response Unit
Federal Bureau of Investigation
Quantico, VA
Appendix E — Acknowledgements 78
78 Page 79
80
E E--3 3
Stacey Noem
Special Agent
Criminal Investigation Division
Environmental Protection Agency
Washington, DC
David A. Olshack
Supervisory Special Agent
Federal Bureau of Investigation
WMD Countermeasures Unit
Washington, DC
Bradley A. Perkins, MD
Chief, Meningitis & Special Pathogens Branch
Division of Bacterial & Mycotic Diseases
National Center for Infectious Diseases
Centers for Disease Control and Prevention
Atlanta, Georgia
Philip H. Perkins, MS, MPH, COL U. S. Army (Ret)
Director, Military Public Health and Emergency Preparedness
Battelle Edgewood Operations
Bel Air, Maryland
Segaran P. Pillai, PhD, SM (AAM)
Director, Florida Department of Health
Bureau of Laboratories
Miami, Florida
Appendix E — Acknowledgements 79
79 Page 80
81
E E--4 4
Eli Richardson
Special Agent
WMD Coordinator
Federal Bureau of Investigation
Newark Field Office
Martin L. Sanders
Research Scientist
Battelle Edgewood Operations
Bel Air, Maryland
Robert M. Scripp
WMD Countermeasures Unit
Federal Bureau of Investigation
Washington, DC
Darin L. Steele, PhD
ORISE Postdoctoral Fellow
Hazardous Materials Response Unit
Federal Bureau of Investigation
Quantico, Virginia
Richard Stryker
Special Agent
Federal Bureau of Investigation
Philadelphia Field Office
Appendix E — Acknowledgements 80
80 Page 81
E E--5 5
Craig S. Watz
Supervisory Special Agent
WMD Operations Unit
Federal Bureau of Investigation
Washington, DC
Thomas L. York, PhD
Director, Bureau of Analytical Services
Commonwealth of Virginia
Department of General Services
Division of Consolidated Laboratory Services
Richmond, Virginia
William A. Zinnikas
Special Agent
WMD Coordinator
Federal Bureau of Investigation
New York Field Office
Appendix E — Acknowledgements 81
1 2
3 4 5
6 7 8
9
10 11 12
13 14 15
16 17 18
19
20 21 22
23 24 25
26 27 28
29
30 31 32
33 34 35
36 37 38
39
40 41 42
43 44 45
46 47 48
49
50 51 52
53 54 55
56 57 58
59
60 61 62
63 64 65
66 67 68
69
70 71 72
73 74 75
76 77 78
79
80 81