Response Considerations: Incidents Involving Crowds Following the 2020 National Election Period

First responders have encountered several unprecedented challenges in 2020, including the ongoing COVID-19 pandemic, pandemic-related illness and loss of life, protest-related unrest and violence, catastrophic wildfires, hurricanes, and significant fiscal setbacks. Despite these historic challenges, our nation’s first responders have demonstrated exceptional courage, endurance, and an unyielding commitment to serving our communities.

As Election Day approaches, the potential for unrest and other election-related problems exist. This document has been prepared to provide an overview of the current situation and underscore the need for ongoing interagency collaboration and operational coordination during this period. It is important that our nation’s first responders stay focused on the mission of serving our communities and public safety partners and resist any inclination to be drawn into emotionally heated debates in the workplace. We must remain unified.

The United States Intelligence Community has highlighted in numerous briefings and intelligence products the sustained efforts on the part of foreign and domestic actors to exploit the polarized political climate, protest-related unrest, and the negative economic impacts of COVID-19. The coming weeks will present numerous opportunities for domestic violent extremists (DVEs) to carry out acts of violence at mass gathering events and venues, including polling places and protests. Several conceivable threats during this time from foreign and domestic actors are discussed below.

Cyber Attacks

Election-related cyber-attacks may be carried out by domestic and foreign actors with a range of end goals. These goals may include efforts to sow discord, promote or disparage one or the other candidate, undermine confidence in the electoral process, or exploit interests in high-profile events and reports to deploy malware via phishing emails.

The successful deployment and activation of ransomware is a potential cyber-attack scenario that can significantly impact operations and be extremely costly to recover from. Cybercriminals have evolved new tactics aimed at enticing individuals to open messages and attachments, including election-themed email aimed to appeal to curiosity or political interests. Messages containing malware concealed in attachments from cybercriminals masquerading as known and trusted brands or agencies may play into successful intrusions in the weeks ahead. A high level of vigilance is recommended.

Cyber attacks have successfully crippled or disabled 911 call operations in the past. In view of this, fire departments are encouraged to development and maintain redundant communications capabilities. Additionally, it is vital for departments to maintain an awareness of cyber security threats and ensure that IT staff keep all systems and networks up to date with recommended patches and other cyber security measures.

Unrest

A contested election outcome could result in protests or unrest from both sides. As has been seen in recent protest-related unrest, perceived or actual injustices are frequently exploited by violent opportunists that go on to carry out unlawful and violent activities, including looting, vandalism, arson, and assault on first responders or community members.

Fire and law enforcement officials should plan for large-scale protests, provide support for peaceful demonstrations that are protected by the First Amendment, and develop plans to manage violent elements. These plans should factor the possibility that unrest could go on for an extended time.

Shooting Incidents

Firearms have factored into many recent acts of violence during protests and as a part of protest-related unrest. Conflicts between protestors and armed counter-protestors are becoming increasingly common and have resulted in shooting incidents. Several law enforcement officers have been killed by DVEs. Other DVE plots to carry out targeted shootings have been disrupted, and several elected officials have received death threats. These events highlight the potential for firearms-related violence in the coming days and weeks. And we also cannot dismiss the potential for lone-wolf attacks aimed at exploiting the symbolism of the election period, or simply to take advantage of the large crowds that may be found at polling places or gathered to protest or celebrate.

Vehicle Rammings

According to the United States Department of Homeland Security, between May and August 2020, there have been at least 12 incidents nationwide involving individuals charged with vehicle-ramming attacks targeting civilians or law enforcement officers at lawful protests. Although these incidents appear to have occurred spontaneously and resulted in few significant injuries, from 2014 through 2017, terrorists carried at least 17 known vehicle ramming attacks worldwide, resulting in 173 fatalities and hundreds of injuries.

Vehicle rammings are low-tech attacks and allow an attacker to minimize the likelihood of detection by law enforcement while retaining the ability to inflict multiple casualties, particularly if a large vehicle and high speed are used to target a crowd. Unprotected or open area public assemblages, protests or celebrations may present an attractive opportunity to an attacker seeking to carry out a vehicle ramming attack.

Terrorist Attacks

Although there is no precedent for a terrorist attack by a foreign terrorist organization (FTO) targeting a United States election location or process, recent tactics, techniques, and practices (TTPs) employed by FTOs highlight their focus on “soft” targets. ISIS, Al-Qaeda, and other FTOs continue unabated in their ambition to strike within the homeland. As such, it is advisable to remain vigilant during high-profile events, particularly when large crowds will be present, and the security posture will be relatively low.

Recent terrorist attacks have employed stabbings, mass shootings, improvised explosive devices, vehicle rammings, and combinations of these tactics.

Chemical or Biological Agent Dispersal, and White Powder Mailings

Although the use of chemicals and biological agents has been rare in attacks carried out by DVEs, pepper spray has been used by counter-protestors against protestors, and numerous extremist posts have encouraged the dispersal of liquids mixed with the saliva of individuals infected with COVID-19. During periods of unrest, a wide range of TTPs have been used, including throwing bottles containing urine and feces at law enforcement officers and protestors.

A frequent disruption tactic has been to mail letters containing white powder to designated locations or individuals. Most of these mailings have been harmless, but all white powder mailings must be taken seriously, because it cannot be known if the white powder contains a harmful biological or chemical agent, such as anthrax, ricin, or fentanyl, until the powder has been thoroughly analyzed.

Arson

Countless buildings and vehicles were targeted by violent opportunists during the recent protest-related unrest. In many instances, the buildings and vehicles were targeted specifically due to their affiliation with the government or law enforcement, some even being painted with specific markings to indicate that they should be targeted for arson attacks. To the extent possible, fire personnel should be made aware of any buildings that have been identified as targets for arson, which can facilitate operational planning.

Interagency Collaboration and Operational Coordination

Preparedness for, and response to any of the above scenarios, will benefit from close coordination with other public safety agencies. Unified planning and training will go a long way in protecting fire personnel and other first responders, while optimizing an effective response to incidents or unrest. Unified planning is also vital to ensure that all elements of incident command and response factor the potential for exposure to COVID-19 and the development of practical countermeasures to reduce the potential for contamination.

Due to the dynamic nature of the threats associated with the unrest environment, and the possibility that Hot, Warm, and Cold Zones may not be known or designated, operational planning should consider designating law enforcement units to escort fire department resources into areas that may be impacted by unrest. Combined law enforcement and fire department task forces and Rescue Task Forces (RTFs) may be formed as needed to perform fire suppression and emergency medical duties within impacted areas.

Response Considerations to Potential Unrest during the COVID-19 Pandemic

The below listed considerations have been developed to provide guidance to IAFC members to address potential gaps they may encounter when responding to incidents or unrest involving large crowds during the COVID-19 pandemic. The aim is not to develop new policies, rather, to provide useful considerations to address the unique challenges that may be encountered during incidents that may take place in the climate of the COVID-19 pandemic. A few considerations follow.

1. Maintain situational awareness.
   1. As new information is developed, stay informed.
   2. Maintain awareness of local mass gathering events, and public reactions (including large celebrations or protests). Be alert to the potential for hospital overcrowding.
   3. Monitor the climate and sentiments in the community. Is it largely peaceful or are tensions increasing? Are individuals or groups present at mass gatherings that seek to incite or carry out disruptions or violence? Indicators frequently exist prior to violent eruptions.
   4. Maintain channels of communication with law enforcement or fusion center partners regarding threat information.
   5. Share information as appropriate with field commands and other personnel.
   6. Social media feeds can be valuable sources of information regarding current or planned unrest activity but should be used with caution. Foreign and domestic actors may seek to sensationalize events or disseminate inaccurate or false reports, particularly via social media. It may be necessary to vet reports before sharing or acting on information. NOTE: During periods of unrest, personnel should exercise caution with the use of social media and avoid any posts that may reveal operational activities since these may be monitored by and exploited by violent opportunists.
   7. Be alert to the presence of cyber threats disguised as legitimate sources of information.


2. Unified Command is the recommended framework for developing comprehensive incident objectives and strategies.
   1. The command structure for incidents involving mass gatherings and large crowds tend to be law enforcement-centric. However, a Unified Command will contribute to the development of comprehensive incident objectives and strategies to best meet the needs of community members and first responders by factoring social distancing guidelines, modified patient care directives, and other priorities. The development of a single unified Incident Action Plan (IAP) will go a long way in anticipating the unique needs of incidents in this climate.


3. Provide unified messaging and consider developing a Crisis Communications Plan.
   1. Communities need and expect accurate and timely information during a crisis. Depending on the nature of the situation, first responder agencies should be prepared to provide prompt and accurate information and direction, utilizing effective information channels.
   2. A Joint Information System (JIS)/Joint Information Center (JIC) can be developed, virtually if necessary, to develop and manage a Crisis Communications Plan.


4. Ensure that COVID-19 mitigation guidelines are being followed at all incident locations, including the Incident Command Post (ICP), Staging Areas, and Treatment Areas.
   1. ICPs and other command and coordination locations should have a larger footprint to allow for recommended social distancing.
   2. The ICP may need to be protected by yellow (fire line) tape, and access points designated to discourage uncontrolled access.
   3. Access points to the ICP may need to provide PPE (i.e., facemasks, gloves, eye protection, etc.) for staff that arrive without such items. Hand sanitizer should also be readily accessible.
   4. Signage may need to be developed in advance stipulating the need for social distancing.
   5. Members in Staging Areas should remain with their companies and maintain social distancing and use of PPE in all interactions with other first responders.
   6. Treatment Areas should have a larger footprint to allow for social distancing. g. Facemasks or oxygen masks may need to be placed on all patients to reduce exposure.


5. A Safety Officer should be assigned to review the IAP for safety implications, develop a Medical Plan, monitor social distancing and PPE practices, present safety messages, and suggest adjustments as needed to prevent unsafe acts.


6. Provide for personnel relief and rehabilitation
   1. During periods of unrest, personnel may be required to work for extended periods of time. Consider the need for adequate relief and rehabilitation arrangements for personnel who may be engaged in operational or support activity longer than routine practices allow.


7. Identify unsafe areas during mass gatherings and incidents involving large crowds.
   1. Maps or diagrams may be useful to identify areas that may be densely populated and not safe for the sustained presence of fire personnel.
   2. If Hot, Warm, and Cold Zones have been designated, ensure that the boundaries are current and regularly updated. As stated below, fire department personnel should only enter Warm Zones when accompanies by law enforcement.
   3. Take advantage of available aerial footage of the incident area (e.g., news media coverage).


8. Consider needed adjustments to Rescue Task Force (RTF) operations.
   1. If an incident develops that requires the use of RTFs, modifications may need to be made to provide for social distancing and additional PPE (e.g., facemasks, etc.). No modifications should be made that would deprive fire or EMS personnel of law enforcement protection within a Warm Zone.
   2. Consider measures to ensure secure ingress and egress to and from areas impacted by unrest.


9. Ensure that emergency/gross decontamination provisions for first responders and civilians are in place that harmonize with the guidance of departmental and public health authorities.
   1. It may be necessary to prepare for the presence of individuals or groups that may attempt to throw possibly contaminated substances at first responders. If indicated, put in place provisions for rapid decontamination.
   2. It is recommended to develop specific decontamination provisions for law enforcement officers that may be targeted.
10. To help fire departments provide service to their communities in uncertain environments, the IAFC has both compiled the following resources.
    1. Fire and Emergency Medical Services Response to Civil Unrest - This document, prepared by the U.S. Fire Administration and the National Highway Traffic Safety Administration, provides information about protecting personnel, apparatus and stations, along with how to safely operate during a period of civil unrest.
    2. Fire and EMS Civil Unrest Response - The U.S. Fire Administration (USFA) and the National Highway Traffic Safety Administration's Office of Emergency Medical Services worked together to compile these best practices to assist you with your response to civil unrest incidents in your community. Fire and EMS personnel should follow the general guidance in this section to prepare personnel, the station, apparatus and the community for emergency response in a challenging environment.
    3. Violent Extremists & Terrorists Exploit Civil Unrest & Public Assemblies in the U.S. - This two-page report summarizes the civil unrest threat and includes resources for local public safety agencies’ use.
    4. Protecting Infrastructure During Public Demonstrations -This DHS document provides guidance and resources to prevent and mitigate the opportunity for unlawful acts during public demonstrations.
    5. Urban Fire Forum Civil Unrest White Paper - This 2016 joint IAFC-NFPA-Metro Chiefs document provides information about working with your community, developing unified command with law enforcement, force protection, and operations during periods of civil unrest.
    6. Urban Fire Forum Draft Standard Operating Procedure - This 2016 document provides a draft SOP to help fire and EMS departments respond to incidents of civil unrest.
    7. IAFC Terrorism Response – A Checklist and Guide for Fire Chiefs and Community Preparedness Leaders - This IAFC document provides a framework to help fire and EMS departments prepare for, respond to and recover from acts of terrorism and other large-scale incidents.
    8. IAFC Checklist for Active Shooter Response - This IAFC resource is a two-page document to help incident commanders when they arrive on scene at an active shooter incident.
    9. IAFC Active Shooter Toolkit - This members-only IAFC resource provides access to reports, briefings and other information to help fire and EMS departments prepare for active shooter incidents.
    10. IAFC Homeland Security Intelligence Guide for Fire Chiefs - This guide provides information to help fire and EMS chiefs contact federal, state and local homeland security and law enforcement partners to access information about threats to their community.

View Resource (PDF)