Biological Incident Operations:

A Guide for Law Enforcement

Cleared for public release, distribution is unlimited.

September 2004

Homeland Defense Business Unit

Edgewood Chemical Biological Center
U.S. Army Research, Development and Engineering Command
 Disclaimers
The opinions or recommendations expressed in this document are a consensus of
the authors and do not necessarily reflect the official position of the U.S.
Department of Defense.

Any mention of commercial products is for information purposes only; it does not
imply recommendation or endorsement by the U.S. Department of Defense or the
U.S. Army Edgewood Chemical Biological Center (ECBC).

This material may be copied and distributed freely by any emergency response
organization. Proper acknowledgement of the ECBC Homeland Defense Business
Unit shall be included in any reproduction and redistribution of these materials.

ii
 Executive Summary
Biological terrorism continues to pose a significant threat to the public sector, including the
potential for massive loss of life. Given September 11, 2001, the anthrax incidents and the
current ‘War on Terrorism,’ it is imperative that emergency responders plan to respond to a
biological terrorism incident. The time-critical nature of a biological incident requires that local
and national law enforcement agencies develop plans to address the specific needs of an affected
community in order to be effective.

The U.S. Army Edgewood Chemical Biological Center (ECBC), formerly the U.S. Army Soldier
and Biological Chemical Command (SBCCOM), Homeland Defense Business Unit operates
programs designed to improve the ability of U.S. communities and military installations to
respond to terrorism incidents involving the use of weapons of mass destruction (WMD). These
programs started with the Domestic Preparedness Improved Response Program (IRP), which
addressed response issues relating to the civilian emergency response community, and continues
through the Military Improved Response Program (MIRP), which focuses on military installation
emergency response considerations.

To help law enforcement agencies better

understand the response needs and causative factors
associated with an act of biological terrorism, the
IRP and then the MIRP have developed a
foundational biological incident guide for law
enforcement. This guide is derived from
information gained predominantly from workshops,
exercises, after-action reports, and research
performed by the programs. The information
provided serves as a foundation for any law
enforcement agency that is developing plans for a
response to a biological weapons incident.
Therefore, this guide is applicable as a reference tool for both military and civilian law
enforcement departments.

This guide provides an overview of the problems faced

by law enforcement that are associated with a
biological terrorism incident and specific
recommendations for recognizing, preventing, and
managing these problems. The guide begins with a
brief overview of key aspects of biological terrorism
that must be considered throughout planning, training,
and response. The guide goes on to address such issues
as Incident Awareness, Information/Intelligence,
Personal Protection, Incident Response, Incident
Investigation, Tactical Operations, Incident Control,
and the Mobilization of Assets.

iii
Various agencies are currently reviewing and/or developing plans for WMD response operations.
With this in mind, this guide does not claim to be totally definitive or exhaustive in all aspects of
the subject. Rather, it is intended to provide one basic document for pre-planning purposes,
particularly for those agencies without definitive protocols. The guide is written to promote
interagency cooperation and to assist planners, administrators, investigators, responders, and
emergency management personnel to better prepare for and execute law enforcement activities
related to a biological incident. The content of this document will be of particular interest to
anyone involved in preparedness for terrorism.

Edgewood Chemical/Biological Center

U.S. Army Research, Development and Engineering Command
Attn: Mr. Pete Farlow
5183 Blackhawk Road
Aberdeen Proving Ground, Maryland 21010

World Wide Web

http://www.ecbc.army.mil/hld

iv
 Acknowledgements

The U.S. Army Edgewood Chemical Biological Center wishes to acknowledge the following
persons who have generously lent their time and considerable expertise to the development of
this law enforcement planning guide.

LAW ENFORCEMENT TECHNICAL WORKING GROUP INITIAL GUIDE

DEVELOPMENT TEAM
SALVATORE BIANCA, Baltimore City Crime Laboratory, Baltimore, Maryland
MATTHEW BLAIS, National Terrorism Preparedness Institute, St. Petersburg, Florida
ROBERT GIANNELLI, New York City Police Department, New York City, New York
JOHN HASENEI, Maryland State Police, Pikesville, Maryland
KATHLEEN KUKER, Federal Bureau of Investigation, Washington, D.C.
CHRISTINE REESE, District of Columbia Metropolitan Police Department, Washington, D.C.
JEANINE SANTA, National Domestic Preparedness Office, Federal Bureau of Investigation,
Washington, D.C.
SCOTT STINER, Pinellas County Sheriff’s Office, Pinellas County, Florida
IAN VABNICK, Federal Bureau of Investigation, New York City, New York
MARK VANBAALEN, Department of State Police, Office of the Fire Marshall, Baltimore,
Maryland
MICHAEL WASER, Emergency Services Unit, New York City Police Department, New York
City, New York
CRAIG WATZ, Federal Bureau of Investigation, Washington, D.C.

FINAL REVIEW PANEL

ROBERT GIANNELLI, New York City Police Department, New York City, New York
CHRISTINE REESE, District of Columbia Metropolitan Police Department, Washington, D.C.
SCOTT STINER, Pinellas County Sheriff’s Office, Pinellas County, Florida
IAN VABNICK, Federal Bureau of Investigation, New York City, New York

HOMELAND DEFENSE BUSINESS UNIT IRP STAFF

GREGORY MROZINSKI, Team Leader, ECBC, Improved Response Program, Aberdeen
Proving Ground, Maryland
PETE FARLOW, Team Leader, ECBC, Improved Response Program, Law Enforcement
Functional Group, Aberdeen Proving Ground, Maryland

v
CHUCK CRAWFORD, ECBC, Improved Response Program, Aberdeen Proving Ground,
Maryland
JOHN SIEGMUND, Program Leader, Titan Corporation, Edgewood, Maryland
DAVID DICKSON, Deputy Program Manager, Titan Corporation, Edgewood, Maryland
MARCI CATLETT, Research Analyst, Titan Corporation, Edgewood, Maryland
LYNN STADTERMAN, Editor, Titan Corporation, Edgewood, Maryland

vi
 Preface

This guide is based on the findings of a multi-agency working group, comprised of 12

representatives from the staff of major academic centers and research, government, military, law
enforcement, and emergency management institutions and agencies. The process used in
development and validation of the guide has involved extensive literature research, a series of
working group sessions, and expert peer review.

The authors have made every effort to ensure accuracy of the information contained in this
report, however they cannot be responsible for any errors found herein. The opinions and/or
recommendations expressed in this document are an informal consensus of the working group
participants and do not necessarily reflect the official position of the U.S. Department of
Defense.

This document has been approved for public release. The document may be freely reviewed,
abstracted, reproduced and translated, in part or in whole, but is not for sale nor is for use in
conjunction with commercial purposes. U.S. Government agencies (Federal, State, and local)
may request an official copy of this report from Mr. Pete Farlow, ECBC, at (410) 436-5781.
Contractors may request a copy of this report through their sponsoring government agency.

vii
THIS PAGE IS INTENTIONALLY LEFT BLANK

viii
 Table of Contents

Executive Summary ..................................................................................................................... iii

Acknowledgements ........................................................................................................................v

Preface.......................................................................................................................................... vii

Table of Contents ......................................................................................................................... ix

1. Introduction..............................................................................................................................1
1.1 Improved Response Programs
1.2 Law Enforcement Technical Working Group (LETWG)
1.3 LETWG Approach
1.4 Assumptions
1.5 Organization

2. Biological Incident Overview ..................................................................................................5

2.1 Agent Characteristics
2.2 Types of Agents
2.3 Methods of Dissemination
2.4 Likely Culprits
2.5 Possible Targets
2.6 Types of Incidents
2.7 Recent BW Incidents

3. Biological Terrorism Awareness ..........................................................................................14

3.1 Indicators of Biological Terrorism Activity
3.2 Indicators of a Biological Incident

4. Biological Incident Information/Intelligence.......................................................................16

4.1 Sources of Information
4.2 Gathering Intelligence
4.3 Biological Incident Threat Assessment

5. Personal Protection Measures ..............................................................................................22

5.1 Medical Prophylaxis
5.2 Isolation Precautions
5.3 Personal Protective Equipment
5.4 Decontamination
5.5 Training

ix
 Table of Contents
(continued)

6. Proposed Response to a Credible Threat..............................................................................27

6.1 Role of Law Enforcement
6.2 Initial Actions

7. Proposed Response to a Suspect Material/Package/Device ...............................................29

7.1 Role of Law Enforcement
7.2 Initial Assessment
7.3 Initial Actions

8. Incident Investigation ............................................................................................................34

8.1 Evidence Collection
8.2 Laboratory Support
8.3 Witness Interviews

9. Tactical Entry of a Suspected Biological Production/Storage Site....................................38

9.1 Task Force Approach
9.2 Operational Considerations
9.3 Decontamination Support
9.4 Medical Support
9.5 Perimeter Security
9.6 Training
9.7 Rehearsals

10. Incident Control .....................................................................................................................42

10.1 Public Notification/Information
10.2 Physical Control Measures
10.3 Control of Response Assets

11. Community Outreach............................................................................................................47

11.1 Concept Overview
11.2 Role of Law Enforcement
11.3 Resources
11.4 Techniques
11.5 Personal Protective Equipment

12. Mobilization of LE Assets .....................................................................................................50

12.1 Concept Overview
12.2 Event Levels
12.3 Response Zones

x
 Table of Contents
(continued)

13. Summary................................................................................................................................52

14. References...............................................................................................................................53

Appendices:

A CDC List of Threat Agents ............................................................................................. A-1

B Biological Agent Data Summaries...................................................................................B-1

C Performance Objectives Matrix .......................................................................................C-1

List of Figures

Figure 1 Estimated Cost of Operations Against a Civilian Population Per km2 ....................5
Figure 2 Relationships of Air Contaminant Sizes ..................................................................9
Figure 3 Distribution of Motivation for Biological Terrorism Incidents .............................10

List of Tables

Table 1 Biological Quick Reference Chart .......................................................................B-8

xi
Introduction 1
The purpose of this guide is to introduce and then discuss recommended techniques and
strategies to assist law enforcement organizations with preparing for and responding to an
incident of biological terrorism. This document was written to provide a basis for standard
operating procedure (SOP) planning, and to assist commanders, coordinators, and responders at
all levels to better manage the consequences of a biological terrorism incident.

Although this planning guide is instructive in addressing

issues surrounding the management of a biological Additional program
incident, the authors recognize that local logistical and chemical/biological response
legal conditions may dictate the use of alternative guides and reports are
procedures. Further, it is not our intent to say that available on the ECBC Web
biological incident response strategies and procedures that site at:
differ from the practices in this guide will necessarily http://www.ecbc.army.mil/hld
invalidate or detract from an effective response.

The authors encourage law enforcement planners and responders to develop and continually
update their knowledge, skills, and abilities with respect to biological-incident preparedness and
response through training. In fact, we believe that successful implementation of this guide can
be realized only if responders possess basic (and in some cases advanced) training in the
fundamentals of weapons of mass destruction (WMD) incident operations.

The authors acknowledge that most law enforcement agencies will be faced with the dilemma of
responding to an incident beyond that which their resources allow. It remains however, one of
the primary responsibilities of law enforcement to assess the situation at hand and, after judging
the seriousness of the incident and availability of resources, to advise on the appropriate level of
response required. Because of the potentially devastating consequences of biological terrorism,
pre-incident planning, early recognition and a rapidly integrated mutual aid network are critical.

The authors also recognize that the size of the community, availability of resources, and the level
of expertise vary greatly from jurisdiction to jurisdiction. Therefore, the experts who have
proposed this guide strongly suggest that agencies unable to perform some or all of the tasks
referenced herein seek assistance from other agencies in order to properly plan for and respond
to a biological terrorist incident. Assistance may take the form of securing additional training,
pooling resources, forming partnerships with neighboring jurisdictions, and/or seeking additional
funding through a variety of resources available through various appropriation bills and Federal
grants. Many organizations around the country already have programs in WMD preparedness.
Much of the information in this guide is derived from such sources, including many of the
references listed in the back of this document.

Based on this guide, agencies may determine that improvements are needed in their training and
policies concerning biological incident operations. This guide may be a justification for
strengthening an agency’s/community’s resources.

1
1.1. Improved Response Programs
The Domestic Preparedness Improved Response Program (IRP) was created in response to the
National Defense Authorization Act of 1996, otherwise known as the Nunn-Lugar-Domenici
Act.1 The IRP supported research, evaluation and demonstration programs, technical
development, and information dissemination for emergency responder chemical/biological (C/B)
incident response guidance and planning. In October 2000 the IRP transitioned from the
Department of Defense (DoD) to the Department of Justice. DoD then formed the Military
Improved Response Program (MIRP) to address similar response considerations that are unique
to military units and installations. Specific activities of the two programs are:

• Sponsoring special projects and research and development programs that are focused on
improving and strengthening the national domestic preparedness to C/B terrorism

• Conducting national demonstration projects that employ innovative or promising

approaches for improving preparedness to C/B terrorism

• Developing new strategies, techniques, and technologies to improve C/B weapons

defense and incident response operations

• Recommending actions that can be taken by Federal, State, and local governments as
well as private organizations to improve domestic preparedness to C/B terrorism

• Developing new methods of C/B weapons defense and reduction of national vulnerability

Program objectives are guided by the priorities and the needs of the emergency response
communities. To ensure utility, the programs actively solicit the views of emergency response
professionals, health care providers, and researchers in the continuing pursuit of answers that
inform policymakers.

1.2. Law Enforcement Technical Working Group (LETWG)

The IRP established a LETWG to address the needs of the law enforcement community. The
working group was charged with studying the role of law enforcement as they relate to biological
incident response operations. Part of this effort involved identifying consensus-based guidelines
to improve the overall effectiveness of such a response. The IRP team leader solicited
participation from Federal, State, and local law enforcement agencies and institutions.
Candidates from these organizations were identified based on their specific knowledge and
expertise in various law enforcement functions. Of the candidates, 12 individuals were invited to
serve as members of the LETWG.

1
National Defense Authorization Act of FY 97

2
1.3. LETWG Approach
In the development of this guide, the LETWG focused on the law enforcement activities that
were developed as part of the Biological Weapons IRP program. The BWIRP conducted a series
of multi-agency workshops that focused on identifying improved approaches to managing the
consequences of biological terrorism. One product of this effort is a template for providing an
integrated response following a biological attack against a civilian population. The Integrated
Response Template was designed to provide the framework for a systematic, coordinated, and
effective response to the affected community of a large-scale incident. The template organizes
critical response activities and serves as an outline by which local emergency service
communities can design their own plans. The information provided in this guide expands on the
law enforcement activities identified in the IRP’s Integrated Response Template.2

The authors of these guidelines have made considerable effort to integrate proven effective
concepts to maximize application while minimizing the training required for implementation.

1.4. Assumptions
In developing these guidelines, the LETWG applied the following assumptions:

• A biological incident can range from a threat against a single individual to an incident
involving hundreds of thousands of casualties and/or fatalities.

• During a biological incident, the actual infected casualties and psychosomatic victims or
“worried well” will likely overwhelm the emergency medical system and hospitals.

• Communities will activate emergency plans to care for victims, manage traffic flow, and
mitigate mass panic and civil unrest.

• During a response to biological terrorism, it may be necessary to supplement local law

enforcement personnel with officers from other jurisdictions, State, and Federal agencies
to conduct investigations, and provide security and traffic control.

• A simple system will be needed that rapidly integrates law enforcement and public health
resources to facilitate incident investigation and victim management.

• Specialized tactical police units will be required to operate in a potentially contaminated

environment.

1.5. Organization
No two incidents are alike, and each will require resources, tactics, and strategies tailored to its
particular characteristics, however, some fundamental considerations and response activities are
commonly applicable when planning for such an event. The information contained in this guide

2
U.S. Army SBCCOM Biological Warfare Improved Response Program, 1998 Summary Report

3
provides an overview of the problems associated with a biological incident and specific
recommendations for recognizing, preventing, and managing these problems.

At the end of this document is a list of references used in researching this report and several
appendices containing related information.

4
Biological Incident Overview 2
Biological terrorism is the intentional or threatened use of viruses, bacteria, fungi, or toxins from
living organisms to produce death or disease in humans, animals, or plants.3 Biological agents
are microorganisms (or a toxin derived from it) which cause disease in man, animals, or plants or
which cause the deterioration of material.4 Biological weapons have the unique ability to inflict
large numbers of casualties over a wide area with minimal logistical requirements, and thus they
are classified as weapons of mass destruction (WMD).

Among the different classes of WMDs, several inherent factors make biological weapons an
ideal choice for carrying out acts of terrorism.5 Such factors include:

• The relative ease and low cost of producing the agents

• The use of biological weapons are difficult to detect when covertly disseminated
• The effects are generally delayed
• The potential to selectively target human, animals, or plants

Unfortunately, all of these factors conspire to make civilian communities highly vulnerable to
today’s ambitious terrorist. Experts emphasize that we should continue to vigilantly plan before
another major incident occurs, as most or all information needed to develop biological weapons
is available in open scientific literature, via the Internet, public libraries, and other sources.
Biological weapons also pose a financial advantage, as was clearly illustrated by a 1969 panel of
experts, which estimated the cost of operations against civilian populations at $1/km2 for
biological weapons, versus $600/km2 for chemical, $800/km2 for nuclear, and $2000/km2 for
conventional weapons.6

2000
Biological
Cost in Dollars

1500 Chemical

1000 Nuclear

Conventional
500

Figure 1. Estimated Cost of Operations Against a Civilian Population per km2.

Many of the processes for creating biological weapons are also fairly forgiving in terms of levels
of purity and quality control required to produce weaponizable agents. Although “low-tech”
3
Centers for Disease Control and Prevention, Bioterrorism: An Overview Bioterrorism:
Bioterrorism Preparedness and Response Program
4
NATO Handbook on the Medical Aspects of NBC Defensive Operations. A-Med-P6 Part II Biological
5
Office of Emergency Preparedness, Proceedings of the Seminar on Responding to the Consequences of Chemical
and Biological Terrorism
6
Defense Protective Services, 10-90 Gold NBC Response Plan

5
approaches or less-than-optimal production procedures may take somewhat longer or may
endanger the health of production personnel, they are nonetheless fully capable of making
significant quantities of agent in a short time span.

One of the greatest advantages in choosing biological weapons is that it is extremely difficult to
defend against them since a cloud of biological agent is colorless, odorless, and silent.
Currently, biological detection technology is limited, thus without prior intelligence, it is
probable that a biological attack could be carried out well before anyone is aware that it has
taken place. Compounding the problem, many health and medical providers are not aware of the
early signs associated with such an attack since many of the early symptoms of a biological agent
exposure are similar to flu-like symptoms. As a result, considerable time may elapse before the
extent of the exposure is appreciated, and appropriate protection and treatment measures are
implemented.

2.1. Agent Characteristics

Although there are many types of disease-causing biological agents, only a relatively small
number have characteristics suitable for a biological attack. Meaning, not all disease-causing
agents can be successfully used as a biological weapon. Intrinsic features of biological agents
influence their potential for use as a weapon, such as: 4

• Infectivity: The infectivity of an agent reflects the relative ease with which
microorganisms establish themselves in a host species. Pathogens with high infectivity
cause disease with relatively few organisms, while those with low infectivity require a
larger number. High infectivity does not necessarily mean that the symptoms and signs
of disease appear more quickly, or that the illness is more severe.
• Virulence: The virulence of an agent reflects the relative severity of disease produced by
that agent. Different microorganisms and different strains of the same microorganism
may cause disease of different severity.
• Toxicity: The toxicity of an agent reflects the relative severity of illness or incapacitation
produced by a toxin.
• Pathogenicity: Pathogenicity reflects the capability of an infectious agent to cause
disease in a susceptible host.
• Incubation period: A sufficient number of microorganisms or quantity of toxin must
penetrate the body to initiate infection (the infective dose), or intoxication (the
intoxicating dose). Infectious agents must then multiply (replicate) to produce disease.
The time between exposure and the appearance of symptoms is known as the incubation
period. This is governed by many variables including: the initial dose; virulence; route of
entry; rate of replication; and host immunological factors.
• Transmissibility: Some biological agents can be transmitted from person to person
directly. Indirect transmission (for example, via arthropod vectors) may be a significant
means of spread as well. In the context of BW casualty management, the relative ease
with which an agent is passed from person to person (that is, its transmissibility)
constitutes the principle concern.
• Lethality: Lethality reflects the relative ease with which an agent causes death in
susceptible population.

6
 • Stability: The stability of an agent is affected by various environmental factors, including
temperature, relative humidity, atmospheric pollution, and sunlight.

Unique to many of these agents, and distinctive from their chemical counterparts, is the ability to
multiply in the body over time and actually increase their effect following the initial
dissemination. With certain agents, only a few particles would be needed to cause infection that
could potentially lead to an epidemic. Victims of a biological attack generally do not display any
immediate signs or symptoms. The effects of these agents are not immediate, as most biological
agents need time to grow and replicate in the body to cause disease. This factor is beneficial to
the terrorist, as it allows them more time to escape apprehension.

2.2. Types of Agents

The classification of biological agents is important to investigators and care providers in terms of
detection, identification, prophylaxis (pre-symptom medication), and treatment. The Centers for
Disease Control and Prevention (CDC) has prepared a list of agents that pose the highest threat
to a civilian population (see Appendix A - CDC List of Threat Agents). Additional biological
agent information is provided in Appendix B (Biological Agent Data Summaries).

Biological agents that may be used in terrorist attacks, are generally classified as:5

2.2.1 Bacteria are single cell, free-living organisms. Bacteria can vary in size and shape and
some have the capability of forming spores. Spores are much hardier since they are more
capable of surviving in environments, (e.g. ultraviolet light, heat, etc.) which would
destroy other bacteria. The diseases that bacteria produce can often be treated with
specific antibiotic therapy. Bacteria are the causative agent of anthrax, brucellosis,
tularemia, plague, and numerous other diseases.

2.2.2 Viruses are organisms that require living cells in which to grow and replicate, therefore,
they are dependent on a living host to cause their effects. Viruses are the simplest type of
microorganism, about 100 times smaller than bacteria. Viruses are the causative agent of
Smallpox, Influenza, Venezuelan Equine Encephalitis, and hemorrhagic fevers. The
diseases that viruses produce generally due not respond to antibiotic therapy but may be
treatable by antiviral compounds or by immune serum globulins.

2.2.3 Toxins are poisonous substances produced and derived from living plants, animals, or
microorganisms; some toxins may also be synthetically manufactured. Toxins are not
living organisms; they are nature’s version of chemical agents. Unlike manmade
chemical agents, toxins are not volatile and they do not tend to cause a persistent
environmental hazard. Significant toxins are Botulinum Toxin, Staphylococcus
Enterotoxin Type B (SEB), and Ricin. Toxin effects typically develop faster than other
forms of biological agents and must be countered by specific antitoxins or select
pharmacological agents.

2.3. Methods of Dissemination

7
When an agent is not contagious, as with most biological agents, it is necessary to have a
dissemination mechanism that spreads the agent to the intended target, to cause disease or
incapacitation. Large-scale dissemination of biological agents requires some sophistication to be
effective; however, anything from a piece of fruit to a ballistic missile can be used to disseminate
a biological agent. Following the initial release of an agent, the same routes of entry pertinent to
natural spread of diseases are also relevant to an exposed population (that is, through inhalation,
ingestion, or broken skin surfaces). Experts believe that the most devastating method of
dissemination is delivering agents by generating an aerosol, infecting people as they breathe.
Other routes of entry are thought to be less critical than inhalation but they are nonetheless
potentially significant.7,8 An example of unintentional dissemination of a biological agent
occurred in the anthrax mailings (October 2001) when anthrax spores cross-contaminated
machinery, postal bags, and other letters as the mail traveled through the postal system. Once a
biological agent is disseminated it can be introduced into the human body through the following
four methods.

2.3.1 Airborne Inhalation. The natural motion of breathing provides with each breath a
continuous, immediate and direct path of entry for infectious organisms or particles into
the body via the lungs and subsequentially the circulatory system. Infectious organisms
ranging from 1 to 5 microns in size, when inhaled, can penetrate the body's natural air
filtering processes and have the best chance to cause infection. Figure 2 provides a
comparison of the sizes of different air contaminants and which ones are visible to the
naked eye, through an optical microscope, or scanning electron microscope (SEM).
Many biological organisms that are used as warfare agents are naturally occurring in
nature. These organisms normally infect humans through natural means, i.e. ingestion,
inhalation, or via a vector, e.g. an insect bite. In the normal means of infection these
organisms have a well-documented disease progression (clinical symptoms). When these
organisms are weaponized and artificially introduced to humans (i.e. a terrorist attack)
then the normal, well-documented signs and symptoms may not manifest in the same
manner as a natural infestation.

Aerosol delivery systems aim to generate invisible clouds of particles or droplets that can
remain suspended in air for long periods. Aerosol dissemination is accomplished by one
of two basic methods: point- or line-source dissemination. Point-source dissemination
refers to a stationary release. Line-source dissemination involves spraying an agent from
a moving aerosol generator. In either case, the resulting cloud can be transported by the
wind over long distances. Agricultural insecticide spray systems are extremely effective
for generating a biological cloud with ideal characteristics. A less efficient method of
aerosol dissemination can be accomplished using explosives; however, such devices
generally destroy a large percentage of the agent through heat and shock.

7
T.Dashiell, W. Patrick, F. Sidell, Chem-Bio Handbook
8
U.S. Army MRIID, Medical Management of Biological Casualties Handbook

8
 9
Figure 2. Relationships of Air Contaminant Sizes

2.3.2 Ingestion. To date, the largest and most effective terrorism attacks using biological
agents have involved the contamination of food.10 Direct contamination of food and
water or product tampering can be used as a means to disseminate biological agents. In
general, only uncooked food is vulnerable, because the heat generated during cooking
readily destroys most biological agents. This method of attack is most suitable for
limited targets or assassination. Dilution, filtration, and chlorination processes associated
with a community’s water system significantly prevent the likeliness of a successful
attack in the public water system. Contamination of an individual water supply, such as
water just before it enters a specific building, is a more feasible scenario. It is also
possible that food or other ingested products can become indirectly contaminated as a
result of an aerosol attack.

2.3.3 Skin Contact-Exposure. An important difference between biological agents and

chemical agents is that unlike chemical agents, aerosolized biological agents generally do
not penetrate the skin and thus do not represent a significant contact hazard. Mucous
membranes and damaged skin, such as an open cut or abrasion, however, constitute
potential breaches through which biological agents may pass. Personal hygiene, such as,
washing with soap and water and proper waste disposal measures significantly reduces
the potential of infection by this route.

2.3.4 Vector Transmission. Many diseases are naturally transmitted to humans by insects,
thus it is possible to spread some biological warfare agents by releasing infected natural
(or unnatural) insects such as mosquitoes, ticks, or fleas. These live vectors can be
produced in large number and infected by allowing them to feed on infected animals,
blood, or artificially produced sources of agent. Experts believe that this method of
dissemination is less likely to be used because the process is complex, difficult to control,
and relatively unreliable for attacks against specific targets.

9
DHHS (NIOSH), Publication 2003-136, Guidance for Filtration and Air-Cleaning Systems to Protect Building
Environments from Airborne Chemical, Biological, or Radiological Attacks
10
Carus, S., Bioterrorism and Biocrimes: The Illicit Use of Biological Agents in the 20th Century

9
2.4. Likely Culprits
As the military and economic gaps between nations grow and as some disadvantaged nations
seek a balance of power, there may be a tendency by these nations to overcome their
disadvantage by choosing terrorism and the use of weapons of mass destruction. This threat,
however, is by no means limited to state-sponsored terrorists. The potential for non-state-
sponsored biological terrorism was demonstrated after the 1995 attack on the Tokyo subway,
when members of the Japanese religious cult Aum Shinrikyo were found to have experimented
with biological warfare agents.

Likely practitioners of biological terrorism may include foreign state-sponsored terrorist groups,
domestic extremist groups, and independent terrorists. History has shown that in most instances,
terrorists planning mass murder do not attempt indiscriminant acts. They do not seek the random
removal of people, but rather, the elimination of particular people or groups. However, this
pattern did not hold true in the “Attacks on America” of September 11, 2001. Motivations for
carrying out acts of biological terrorism include political views, moral beliefs, racial prejudice,
and religion.5 A report published by the Monterey Institute of International Studies describes the
results of a comprehensive review of 33 alleged incidents involving biological agents from 1960
to January 1999.11 The review uncovered a number of reasons that have led terrorists and
criminals to become interested in using biological weapons. The distribution of the motives is
illustrated below.
Assassination or Murder
Eco-Terrorism Animal Rights
Political
Anti-Abortion

Mass Murder

Anti-Government

Industrial Sabotage

Further Extremist Objectives

Revenge

Figure 3. Distribution of Motivations for Biological Terrorism Incidents, 1960—Jan. 31, 1999 (33 cases)

Experience tells us that there are signs that law enforcement can watch for in individuals or
groups considering acts of terrorism.12 These signs include:

• Disgruntled individuals that might routinely have access to medical or research

laboratory facilities

• Notions or beliefs of racial supremacy, ethnic hatred, or religious fanaticism

11
Tucker, Jonathan B., Historical Trends Related to Bioterrorism: An Empirical Analysis
12
National Terrorism Preparedness Institute, Evidence, Detection, and Preservation for Weapons of Mass
Destruction

10
 • A deep-rooted hostility toward a specific ethnic group or government

• Isolation psychology, social and geographic, as manifested in structures like compounds

and mountain redoubts (although such isolation is also possible in an urban setting)

• Evidence of paranoid or conspiratorial thinking and the belief that the group or individual
is under imminent attack

• Apocalyptic or doomsday thinking

• The presence of a charismatic leader who demands and receives absolute obedience

2.5. Possible Targets

Biological agents can be used against a variety of targets, including military and civilian
personnel, crops, and livestock. Experts and strategists believe that the targets of the future will
be entire communities, industry, and economic systems as opposed to buildings and airplanes.
This is not to say that such traditional targets are out of the question. Terrorists tend to choose
targets that offer little danger to themselves, with the exception of militant extremists, who are
willing to lose their lives in the conduct of a terrorist attack, as evidenced by the pilots of the
hijacked planes on 9/11. Some terrorists may also be sent on a mission to release a biological
agent without full knowledge of what they are doing. As a result, the terrorist may be among
those exposed and dying from the agent. They target areas with relatively easy public access.
Sophisticated terrorists look for visible targets where they can avoid detection before and after an
attack.5 The most probable targets for biological terrorism include mass gatherings, such as:

• Large religious or political events

• Mass transit centers (i.e. subway systems and airports)
• High-profile government facilities or landmarks
• Multinational events or conferences
• Sporting or festive events
• Large metropolitan areas
• High-profile consumer products, “product tampering” i.e. the incident in 1982 when
cyanide was placed in Tylenol® bottles.

2.6. Types of Incidents

An attack using biological agents can present in three different ways: a threat, a package or item
suspected of containing a biological agent, or a covert release. The challenge is developing plans
that can address all three different types of attack.

2.6.1 Credible Threat. The first form of biological terrorism is the delivery of a credible
threat. This is perhaps the most likely scenario and due to the catastrophic consequences
of a full-scale attack, officials will be forced to make difficult decisions regarding the
appropriate level of response. (see Chapter 6 - Response to a Credible Threat)

11
2.6.2 Suspect Package/Letter. Terrorists may also deliver a package claiming to contain a
biological agent, utilize the postal service or other mail delivery services to forward
contaminated letters, causing widespread exposure to people, machinery and property.
While many of these packages contain only inert material, responders must assume a
hazard exists. Therefore, bomb disposal and hazardous material specialists should assess
any suspect item to determine the nature and extent of the hazard (see Chapter 7 -
Response to a Suspect Package or Letter).

2.6.3 Actual Release. The third type of attack is an actual release of a biological agent. Such
an attack will likely be carried out covertly. While technically the most difficult, this is
one of the most effective uses of a biological weapon. Disseminating a biological agent
without warning reduces the time available to successfully treat victims, thereby
increasing the overall impact, while providing the terrorist the best chance to escape.

2.7. Recent BW Incidents

A former U.N. Security Council staff member, Jessica Stern, indicated that incidents of terrorism
increased fivefold since the 1970s (even before the attacks of 2001) and the number of people
killed per attack had doubled.13 The following comprises a list of some of the notable incidents
involving the use of biological agents that occurred prior to the anthrax mailing of 2001:6

• In 1972, a plot was uncovered involving a fascist group in the U.S. called the “Order of
the Rising Sun.” This group was planning to use 30kg to 40kg of typhoid to contaminate
the Chicago and St. Louis water supplies.
• In 1984, two followers of the Rajneesh Bagwhan produced and disseminated salmonella
bacteria via the salad bars of local restaurants to affect the outcome of a local election.
No one was killed, however, 715 persons were sickened by the attack. The FBI
investigation resulted in the arrest of a nurse who produced the bacteria and a sect
member who disseminated it.
• In 1994, The Aum Shinrikio cult of Japan attempted without success to disperse anthrax
from a tower on Tokyo. This act went unnoticed until the investigation of an unrelated
incident uncovered documents detailing the attack.
• In 1996, officials at St. Paul Medical Center in Dallas, Texas determined that bacteria
from a microbiology laboratory was implanted in doughnuts and muffins and served to
workers. Twelve people became ill.
• In 1997, a petri dish found in the mailroom of the B’nai B’rith headquarters was labeled
to indicate the presence of Bacillus anthracis (anthrax) and Yersinia pestis (plague).
Washington DC emergency personnel responded to the incident. As a result, a three-
block area in downtown Washington DC was cordoned off and personnel who came in
contact with the suspect material were decontaminated and sent to the hospital. Analysis
of the suspect material showed the substance contained no hazardous material. Other
recent biological hoaxes like the B’nai B’rith incident have also disrupted communities
across the country.

13
Chandler, David & Landrigan, India, A Journalist Guide to Covering Bioterrorism

12
 • In 1998, three men were arrested for threatening to kill Federal agents and State officials
with biological agents in Olmito, Texas. The men claimed to represent the Republic of
Texas, a militant organization that claims sovereignty over Texas.

Following the terrorists’ attacks of September 11th on New York and Washington, D.C., a wave
of biological attacks involving anthrax release was unleashed during October 2001 in Florida,
New York, New Jersey, and Washington, DC. As difficult as it may be to carry out a biological
attack may be, the anthrax attacks through the U.S. mail demonstrated that with access to a
highly refined agent, a damaging bioterror attack could be delivered with only an envelope and a
stamp.12 Before October 2001, the last case of inhalation anthrax in the United States had
occurred in 1976. Identification of inhalation anthrax in a journalist in Florida marked the
beginning of the first confirmed outbreak associated with intentional anthrax release in the
United States.14

From October 4 to November 2, 2001, the Centers for Disease Control and Prevention (CDC)
and State and local public health authorities reported 10 confirmed cases of inhalation anthrax
and 12 confirmed or suspected cases of cutaneous anthrax in persons who worked in the District
of Columbia, Florida, New Jersey and New York.13 The non-distinctive nature of the initial
phase of inhalation anthrax presented a diagnostic challenge. Targets of the first mailings were
all media related - Tom Brokaw of NBC News, The New York Post, and American Media
(publishers of tabloids). Politicians Senator Tom Daschel (D-South Dakota) and Senator Patrick
Leahy (D-Vermont) were the intended targets of the second mailing. Eight of 10 patients were in
the initial phase of illness when they first sought care. Of these eight, six received antibiotics
with activity against B. anthracis on the same day, and all six survived. Four patients, including
one with meningitis, were exhibiting sudden/severe onset of signs of illness when they first
received antibiotics with activity against B. anthracis, and all four died.14

14
CDC & et.al, Bioterrorism-Related Inhalation Anthrax: The First 10 Cases Reported in the United States

13
Biological Terrorism Awareness 3
An act of terrorism can happen anywhere, at any time, and when you least expect it. No
jurisdiction (urban, suburban, or rural) is totally immune. As first responders, law enforcement
personnel must familiarize themselves with the threat and characteristics of biological weapons
to better prepare for and protect against their use or mitigate the effects after their use. To stand
the best chance of providing a timely and effective response, law enforcement personnel must
also be able to recognize the warning signs associated with biological terrorism.

3.1. Indicators of Biological Terrorism Activity

While conducting routine police work, officers should be aware of indicators of possible
biological terrorism activity. Pre-incident warning signs include:15

• Unusual references to the terms, “bacteria, bugs, germs, microbes, microorganism,

poison, toxin, venom, or virus.” (Particularly with regard to their use as a weapon)

• Unusual references to the terms, “antidote, biohazard, bacteriological, culture, infectious

material, respirators, spores, vaccine, or vector”

• Attempts to purchase or obtain information concerning biological cultures or spores from

medical or research suppliers

• Information concerning the theft or attempted theft of biological cultures or spores from
university or medical research facilities

• Unusual purchases of laboratory supplies or specialized microbiology or medical

equipment (addresses of medical mail order companies)

• Attempts to acquire vaccines or medical antidotes against poisons or disease

• Possession or attempts to acquire specialized protective breathing apparatus or protective

suits

• Possession or attempts to acquire security plans or maps of research facilities, including

university and private labs

• Possession or attempts to acquire technical information or maps of public water supply

lines, storage tanks, or building ventilation systems

• Reports of suspicious medical research activities such as reports of rats, mice, rabbits,
sheep, goats, or eggs at an inappropriate location

15
FBI Bomb Data Center, Biological Materials and Hazards

14
3.2. Indicators of a Biological Incident
The most important factor in saving lives in response to a biological incident may be in the
ability of the law enforcement, medical, and public health communities working together to
determine that an attack occurred prior to victims presenting symptoms at medical facilities.
This is a difficult task since biological agents are odorless and tasteless and generally have no
immediate effects.

Communities must instead recognize the telltale signs of a biological terrorism incident, such as:4

• Reports of an explosion that causes little damage or devices that disperse a mist or
powder with no immediate effects

• Reports or observations of unscheduled spraying (time/location inconsistent with normal

pesticide spraying)

• Discovery of abandoned spraying equipment or

discarded protective suits, biohazard bags, or
laboratory equipment (i.e. incubator, fermenter,
or containers with biological labels) are indicators
that may identify the use or development of
biological agents

• The presence of unusual swarms of biting insects, as they may be used as a mechanism
for dissemination

• Observation of unusual numbers sick or dying animals, often of different species. Most
biological warfare agents are capable of infecting a wide range of hosts and sometimes
animals are more susceptible, therefore some animals may be affected before humans

• Any unexplained outbreak of respiratory or flu-like illness

15
Biological Incident Information/Intelligence 4
Information sharing between law enforcement and the public health organizations is absolutely
critical to a community’s biological terrorism preparedness effort and may be enhanced with
liaison officers with formal staff relationships. The success or failure of a timely response will
depend upon the speed and accuracy of the diagnostic efforts, together, with the transmittal of
timely information from organizations involved in public health surveillance and criminal
investigation. Communities should develop formal interagency partnerships to identify
information/intelligence requirements and open lines of communication, ensuring information is
accessible and appropriately monitored. Communities should also implement mechanisms to
facilitate rapid alert notifications and sharing of public health information with necessary law
enforcement organizations. In some cases law enforcement organizations might even consider
incorporating public health surveillance information into their routine intelligence reporting
activities.2

4.1. Sources of Information

Most communities have mechanisms already in place that can be useful sources of incident-
related information. By implementing an integrated monitoring and reporting system, these
sources may provide an early recognition of a biological incident. Once a public health event
has been detected, such a system can continue to gather and assess information in support of the
incident investigation effort. Important sources of incident information include:

4.1.1 Public Health Officials. The first indication of a biological incident will probably be the
presence of acutely ill patients with an unexplained illness. Unfortunately, it is possible
that such an occurrence will initially be mistaken for a bad flu season. In an attempt to
identify the source and cause of unusual illness, public health officials will investigate
such factors as disease pattern. In a suspected biological incident, these efforts can result
in a great deal of information that is useful to criminal investigators. Public health
information can be used to focus and prioritize law enforcement investigation activities.

Community public health officials routinely investigate and analyze disease patterns.
The resulting disease pattern following a biological terrorism attack is likely to have
characteristics that differ from those of a naturally occurring outbreak. In contrast to
natural outbreaks that increase over a period of weeks or months, a biological incident
may produce a large number of sick in hours to days (usually 48-72 hours). Additional
indicators of an unnatural health event include:

• If the distribution of sick individuals is aligned with the prevailing wind direction

• If there is an unusually high prevalence of respiratory symptoms in diseases that are

typically not acquired through inhalation

• If the rate of severely ill is extremely high among sick individuals

16
 • If the agent identified is not conducive with the natural parameters associated with the
disease

4.1.2 Clinical Diagnostic Laboratories. General policies already exist for identification and
reporting suspected cases of rare infectious disease illness. Medical laboratories are
required to notify public health agencies when any patient is diagnosed with a disease
caused by any of the threat agents. Medical laboratories can provide advanced
notification by monitoring the volume of tests ordered, or by reporting any occurrences
where a patient is diagnosed with disease caused by a potential terrorist agent.
Laboratories may be more likely to identify unusually high occurrences of a particular
syndrome, because they receive specimens from multiple medical providers. Many
public health agencies already monitor for rapid increases in lab test ordering above
seasonally expected levels.

4.1.3 911 Call Center can provide information on the volume of calls and types of EMS
responses. Any increase in the volume of calls above seasonally expected levels with no
obvious explanation could signify the occurrence of a public health event. The nature of
the 911 calls can be analyzed for patterns. Mapping the geographic distribution of calls
may point to the possible source of agent release.

4.1.4 Medical Examiner reviews death certificates and may investigate unexplained deaths.
The medical examiner can provide information on reported deaths and those caused by a
potential biological agent exposure or any suspicious deaths in previously healthy
individuals. Any rapid rise above seasonally expected levels with no obvious explanation
might be an indication of an unnatural public health event.

4.1.5 Hospital Emergency Departments are effective sites for incident information because
high volumes of patients are seen 24 hours a day, and emergency departments are
frequently the primary sites of health care delivery for a large part of the population.
Hospital administrators or infection control staff can provide information on changes in
hospital admissions and emergency department visits that suggest suspicious
circumstance.

4.1.6 Animal Control/Veterinary Clinics/Zoos are more familiar with and more likely to
recognize zoonotic diseases. Since many biological agents are natural sources of disease
in animals, non-human species may be the first victims of a biological terrorism attack.
Animal care and animal control professionals can provide information regarding recent
disease outbreaks among animals.

4.1.7 Pharmaceutical Distributors servicing a particular community may recognize an

unseasonably rapid increase in the number of over-the-counter and prescription
medication sales, which might be the first indications of an incident in progress. Anti-
diarrheal sales can reflect food-borne or water-borne illness, while flu medication can
reflect illness with flu-like symptoms. Many diseases associated with potential biological
agents initially present with flu-like symptoms.

17
4.2. Gathering Intelligence
Intelligence is a crucial component of law enforcements’ efforts to combat terrorism and the
collection, analysis, and dissemination on terrorist threats is among the highest priorities. Local
jurisdictions absolutely need access to the information necessary to protect the public and
themselves, even when that information is classified.

The Department of Homeland Security, through the Directorate of Information Analysis and
Infrastructure Protection (IAIP), will merge under one roof the capability to identify and assess
current and future threats to the homeland, map those threats against our vulnerabilities, issue
timely warnings and take preventive and protective action. The Directorate will fuse and analyze
information from multiple sources pertaining to terrorist threats, such as the National Security
Agency, the Central Intelligence Agency, and the FBI. The Department of Homeland Security
will coordinate and, as appropriate, consolidate the federal government’s lines of communication
with State and local public safety agencies and with the private sector, creating a coherent and
efficient system for conveying actionable intelligence and other threat information. The IAIP
Directorate will also administer the Homeland Security Advisory System.16

4.2.1 Federal. Although the collection of intelligence

information can come from many sources, the FBI remains
the principle agency that monitors the activities of terrorist
groups within the United States. The FBI’s ability to
collect information – whether through physical
surveillance, electronic surveillance, or human source
development – represents one of its greatest weapons in
the war on terror. The following are key initiatives
undertaken to improve FBI intelligence and analytical
capacities in the wake of the September 11 attacks.17

The Office of Intelligence is the centerpiece of the FBI’s efforts to upgrade its analytical
and intelligence capabilities so that it can prevent acts of terror. This office works to
create professional development opportunities for analysts and ensure that quality
analytical products and intelligence are shared both inside and outside the FBI. Since the
events of September 11, the FBI has quadrupled the number of strategic analysts at
Headquarters specifically focused on international terrorism.

Counterrorism Watch (CT Watch) is the FBI’s 24-hour global command center for
terrorism prevention operations. Staffed by highly trained and experienced personnel and
using sophisticated technology, it is the focal point within the FBI for gathering and
managing all domestic and international terrorism threats. Incoming threats are given an
initial review by CT Watch staff; those deemed credible are passed on to FBI
investigators for urgent action.

16
Department of Homeland Security, DHS Organization, Information Analysis and Infrastructure Protection,
www.dhs.gov
17
Federal Bureau of Investigation, War on Terrorism, Counterterrorism

18
 Intelligence-Law Enforcement Coordination. The PATRIOT Act and a Federal court
decision in November 2002 have broken down what has been known as “the wall” that
legally separated law enforcement and intelligence functions. As a result, coordination
and information sharing between the law enforcement community and intelligence
agencies have been greatly improved.

As the lead law enforcement agency for investigating acts of domestic and international
terrorism, the FBI relies on a vast array of partnerships across the nation and around the
world to disrupt and defeat terrorists. These relationships have been steadily enhanced
through a series of groundbreaking initiatives since September 11.17

Joint Terrorism Task Forces (JTTFs). JTTFs are teams of State and local law
enforcement officers, FBI Agents, and other Federal agents and personnel who work
shoulder-to-shoulder to investigate and prevent acts of terrorism. These task forces are
important “force multipliers” in the war on terror, pooling multi-agency expertise and
ensuring the timely collection and sharing of intelligence absolutely critical to prevention
efforts.

National Joint Terrorism Task Force (National JTTF). The National JTTF was created in
2002 at the FBI command center in Washington, D.C. Nearly 30 agencies are
represented, spanning the fields of intelligence, public safety, and Federal, State, and
local law enforcement. The National JTTF collects terrorism information and
intelligence and funnels it to the JTTFs, various terrorism units within the FBI, and
partner agencies.

Office of Law Enforcement Coordination. This office, formed in December 2001 was
established to improve the longstanding relationships with State, municipal, county, and
tribal law enforcement on a national level. Recognizing that State and local police
officers outnumber FBI Agents 60 to 1, the FBI is committed to folding its law
enforcement partners into the war on terror by sharing information more fully and
coordinating more closely. This office serves as a cornerstone of that effort, helping the
FBI open channels of communication and be more responsive to the needs of law
enforcement at the State and local levels.

4.2.2 Local. To enhance the intelligence effort, local law enforcement agencies should
actively encourage health officials to make early notifications to police, regarding any
suspicious public health events or medical cases, rather than waiting for the results of a
comprehensive investigation or definitive diagnosis. In addition, communities might
consider designating a law enforcement liaison to public health investigations to monitor
and assess suspicious health events. The findings of an epidemiological investigation
may be very helpful to focus and prioritize the subsequent criminal investigation. If this
approach is adopted, law enforcement investigators must be sure to avoid hindering the
public health investigation process, as such efforts are an equally important part of the
incident response. Law enforcement investigators should also become familiar with local

19
 patient confidentiality statutes, as they may dictate the level of access to particular types
of patient information.

4.3. Biological Incident Threat Assessment

Effective threat assessment is an on-going process that must continue through all phases of
preparedness and response. Threat and risk assessments are grounded in a relatively new
approach to thinking about and dealing with security issues called risk management. Risk
management is the deliberate process of understanding “risk” (…the likelihood that a threat will
harm an asset with some severity of consequences, …and deciding on and implementing actions
to reduce vulnerability). Risk management principles acknowledge that, (1) while risk generally
cannot be eliminated, it can be reduced by enhancing protection from validated and credible
threats and (2) although many threats are possible, some are more likely to occur than others.
Threat and risk assessment is a deliberate, analytical approach that results in a prioritized list of
risks that can be used to select countermeasures to create a certain level of protection or
preparedness (i.e. threat-asset vulnerability combinations). Generally, because threats are
dynamic and countermeasures may become outdated, it is a sound practice to periodically
reassess threat and risk.

The critical first step in a sound threat assessment process is the threat analysis. The analysis
should identify and evaluate each threat in terms of capability and intent to attack an asset, the
likelihood of a successful attack, and its consequences. To perform a realistic threat assessment,
a multidisciplinary team of experts would require valid threat data from intelligence, law
enforcement and public health communities. Available threat data is often general, without
clarification, and can be difficult to use. However, a multidisciplinary team of experts can use
the information to develop threat scenarios, then validate and adjust the scenarios with respect to
their plausibility and likeliness. The result of the threat assessment process can be used to define
preparedness requirements and focus response efforts.

In addition to the very deliberate threat assessment process associated with preparedness
activities, a biological incident will require a rapid threat assessment process to be conducted
immediately upon recognition to evaluate the validity, extent, and seriousness of a particular
threat. This process must be a joint effort from the onset. Ideally, local communities should
have a pre-established, multidisciplinary, incident assessment team. The team should consist of
a small group of experts and executive decision makers, as follows:

• Local Law Enforcement

• Public Health
• Emergency Management
• FBI field office
• Community’s Senior Elected Officials

At a minimum, the incident assessment process should include consultation with the FBI’s
WMD Operations Unit, and the local and State health departments. Although immediate
notification is mandated under PDD-39, these agencies may have essential information and
intelligence that others do not have. To facilitate this process, the FBI maintains specially

20
trained local office WMD Coordinators that will provide rapid threat assessments, coordinate
federal response and participate in the Unified Incident Command. Immediately upon
notification of a potential incident, the local WMD Coordinator will contact the WMD
Operations Unit at FBI Headquarters in Washington, D.C. The WMD Operations Unit will
contact other Federal agencies to assemble a team that will provide expert technical and
diagnostic support. Assessment resources include:18

• Centers for Disease Control and Prevention (CDC)

• U.S. Army Medical Research Institute for Infectious Disease (USAMRIID)
• Food and Drug Administration (FDA)
• Environmental Protection Agency (EPA)
• Federal Emergency Management Agency (FEMA)

Emergency managers must keep in mind that incident assessment is a continuous process,
beginning prior to and continuing throughout the response. Considerable effort must be placed
on establishing effective communication networks (interoperability) and gathering and analyzing
information throughout an incident.

18
Federal Bureau of Investigation, Chemical/Biological Incident Contingency Plan

21
Personal Protection Measures 5
Personal protection is critical to minimizing the risk of exposure. All responders, including law
enforcement must exercise good judgment and effective protection measures to continue to
operate and avoid becoming additional victims.

5.1. Medical Prophylaxis

Medical prophylaxis or immunization is the only means of providing continuous protection
against some biological agents. Depending on identification of the agent, medical treatment in
the form of antibiotics, antitoxins, or antiviral medications should be administered to at-risk
persons by an appropriate medical authority. Vaccines against a number of potential agents are
available and are most effective when administered prior to an exposure. Law enforcement
planners can expect that following a large incident, a portion of the law enforcement force and
their families will be among the victims. Law enforcement agencies should coordinate with
local medical facilities and the local public health agency (who will coordinate with the Centers
for Disease Control and Prevention (CDC)) to determine if medical prophylaxis medications are
available. The Department of Homeland Security and the Department of Health and Human
Services jointly manage the Strategic National Stockpile of critical prophylaxis and treatment
medications to augment local health care resources during times of disaster. Finally, emergency
planners should seek to establish priority for law enforcement to receive such medications to
ensure an effective police force is sustained throughout an incident.19,20

5.2. Isolation Precautions8,21

The management of victims following a suspected or confirmed bioterrorism event must be well
organized and handled. Law enforcement officers must take necessary precautions to prevent
exposure or transfer of disease. Information in this section relates to interaction between law
enforcement officers and victims/patients with a known or suspected exposure or illness relating
to bioterrorism. Law enforcement officers investigating a crime scene where a potential
biological agent has been or is suspected to have been released should follow the personal
protective equipment procedures outlined in section 5.3 below.

Illnesses caused by biological events are generally not transmitted from person to person and re-
aerosolization of these agents is unlikely, however, victims should be managed in a manner that
minimizes direct contact. All victims, including symptomatic patients with suspected or
confirmed bioterrorism-related illnesses, should be managed utilizing Standard Precautions.
Standard Precautions are designed to reduce transmission from both recognized and
unrecognized sources of infection and are recommended regardless of the victims’ diagnosis or

19
U.S. Department of Health and Human Services, Health and Medical Services Support Plan for the Federal
Response to Acts of Chemical and Biological Terrorism
20
U.S. Department of Health and Human Services, CDC Strategic Planning Group, Morbidity and Mortality Weekly
Report
21
CDC Bioterrorism Working Group, Bioterrorism Readiness Plan: A Template for Healthcare Facilities

22
presumed infection status. In the case of certain diseases or syndromes (e.g. small pox and
pneumonic plague), additional precautions may be needed to reduce the likelihood for
transmission (see below).

Standard Precautions prevent direct contact with body fluids (including blood), secretions,
excretions, nonintact skin (including rashes), and mucous membranes. Law enforcement should
be routinely using Standard Precautions when investigating traffic accidents with injury or
crimes where they may come into contact with blood or other body fluids. The following
Standard Precautions are taken from the Bioterrorism Readiness Plan: A Template for Healthcare
Facilities, CDC, and are modified slightly for law enforcement.

• Handwashing. Hands are washed with plain or antimicrobial-containing soaps after

touching blood, body fluids, excretions, secretions, or items contaminated with such body
fluids, whether or not gloves are worn. Hands are washed immediately after gloves are
removed, between contact with other victims/patients, and as appropriate to avoid
transfer of microorganisms to other victims/patients and the environment.
• Gloves. Clean, non-sterile gloves are worn when touching blood, body fluids, excretions,
secretions, or items contaminated with such body fluids. Clean gloves are put on just
before touching mucous membranes and nonintact skin. Gloves are changed between
tasks. Hands are washed promptly after removing gloves and before leaving a
contaminated area.
• Masks/Eye Protection or Face Shields. A mask and eye protection (or face shield) are
worn to protect mucous membranes of the eyes, nose, and mouth while performing tasks
that may cause splashes of blood, body fluids, excretions, or secretions.
• Gowns. A gown is worn to protect skin and prevent soiling of clothing during activities
that are likely to generate splashes or sprays of blood, body fluids, excretions, or
secretions. Selection of gowns and gown materials should be suitable for the task and
amount of body fluid likely to be encountered. Soiled gowns are removed promptly and
hands are washed to avoid transfer of microorganisms to other victims/patients and
environments.

Additional precautions for handling victims associated with a suspected or confirmed infection
with Pneumatic Plague or Smallpox.

Pneumatic Plague. Droplet Precautions should be used in addition to Standard Precautions.

• Droplet Precautions are used for victims known or suspected to be infected with
microorganisms transmitted by large particle droplets, generally larger than 5 microns in
size, that can be generated by the infected victims during coughing, sneezing, talking, or
during respiratory-care procedures.
• Droplet Precautions require law enforcement officers to wear a surgical-type mask when
within 3 feet of the infected victim. Based on local policy, some healthcare facilities
require a mask be worn to enter the room of a patient on Droplet Precautions.

Smallpox. For victims with suspected or confirmed smallpox, both Airborne and Contact
Precautions should be used in addition to Standard Precautions.

23
 • Airborne Precautions are used for victims known or suspected to be infected with
microorganisms transmitted by airborne droplet nuclei (small particle residue, 5 microns
or smaller in size) of evaporated droplets containing microorganisms that can remain
suspended in air and can be widely dispersed by air currents.
• Airborne Precautions require law enforcement officers to wear respiratory protection
when entering the victim’s room. (Appropriate respiratory protection is based on facility
selection; police must meet the minimal NIOSH standard for particulate respirators, N95)
• Contact Precautions are used for patients known or suspected to be infected or colonized
with epidemiologically important organisms that can be transmitted by direct contact
with the patient or indirect contact with potentially contaminated surfaces in the victims’
immediate area.
• Contact Precautions require law enforcement officers to:
¾ Wear clean gloves upon entry into a victims’ room.
¾ Wear gown for all victim contact and all contact with the victims’ environment.
Gown must be removed before leaving the victims’ room.
¾ Wash hands using an antimicrobial agent.

5.3. Personal Protective Equipment

Personal protective equipment is any clothing or apparel (such as, gloves, respirator and overalls)
that will minimize an officer’s risk of exposure. PPE should always be worn if there is a
possibility officers could become contaminated with hazardous material. Officers should be
aware however, that PPE is also the one protective measure that hinders law enforcement
operations the most. Use of PPE limits an officer’s visibility (especially peripheral vision),
communications ability, and dexterity. Fortunately, in a biological incident, sophisticated PPE is
only essential for law enforcement officers that are conducting tactical or evidence collection
operations. Law enforcement agencies should attempt to procure funding to purchase and
maintain the necessary protective clothing and equipment, from the various Federal assistance
programs that provide funding to local law enforcement agencies. Law enforcement planners
should also recognize that using PPE requires specialized training in its use. Officers must be
aware that the equipment does not eliminate the hazard. If the equipment fails, exposure will
occur. To reduce the possibility of failure, equipment must be properly fitted and maintained in
a clean and serviceable condition.8,21

The Centers for Disease Control and Prevention (CDC) and the National Institute for
Occupational Safety and Health (NIOSH) published interim recommendations for emergency
responder use of PPE against biological agents. These recommendations are as follows:22

When using respiratory protection, the type of respirator is selected on the basis of the hazard
and its airborne concentration. For a biological agent, the air concentration of infectious
particles will depend upon the method used to release the agent. Current data suggest that the
self-contained breathing apparatus (SCBA) which first responders currently use for entry into

22
CDC and NIOSH, Interim Recommendations for the Selection and Use of Protective Clothing and Respirators
Against Biological Agents

24
potentially hazardous atmospheres will provide responders with respiratory protection against
biological exposures associated with a suspected act of biological terrorism.

Protective clothing, including gloves and booties, also may be required for the response to a
suspected act of biological terrorism. Protective clothing may be needed to prevent skin
exposures and/or contamination of other clothing. The type of protective clothing needed will
depend upon the type of agent, concentration, and route of exposure.

The interim recommendations for personal protective equipment, including respiratory protection
and protective clothing, are based upon the anticipated level of exposure risk associated with
different response situations, as follows:

• Responders should use a NIOSH-approved, pressure-demand SCBA in conjunction with

a Level A protective suit in responding to a suspected biological incident where any of
the following information is unknown or the event is uncontrolled:
¾ The type(s) of airborne agent(s);
¾ The dissemination method;
¾ If dissemination via an aerosol-generating device is still occurring or it has
stopped but there is no information on the duration of dissemination, or what the
exposure concentration might be.
• Responders may use a Level B protective suit with an exposed or enclosed NIOSH-
approved pressure-demand SCBA if the situation can be defined in which:
¾ The suspected biological aerosol is no longer being generated;
¾ Other conditions may present a splash hazard.
• Responders may use a full facepiece respirator with a P100 filter or powered air-
purifying respirator (PAPR) with high efficiency particulate air (HEPA) filters when it
can be determined that:
¾ An aerosol-generating device was not used to create high airborne concentration,
¾ Dissemination was by a letter or package that can be easily bagged.

5.4. Decontamination
Decontamination is the disinfection or sterilization of infected articles that makes them suitable
for use. Decontamination removes and/or neutralizes biological agents on contaminated surfaces
and plays an important role in controlling the spread of the disease. Items can be
decontaminated by mechanical, chemical and physical methods:4

5.4.1 Mechanical decontamination involves measures to remove but not necessarily neutralize
an agent. An example of this is rinsing an item with water or using a brush to remove
agent.

5.4.2 Chemical decontamination renders biological agents harmless by the use of disinfectants.
Examples of this method is careful washing with soap or bleach solutions. Careful

25
 washing with soap and water removes most biological contamination from a surface,
including skin and hair, and is often sufficient to avert contact infection.

To ensure complete decontamination of contaminated buildings or rooms, they should be

decontaminated with disinfectant gases or liquids in aerosol form (i.e. para-formaldehyde
or ozone). These methods are not appropriate for decontaminating people.

5.4.3 Physical decontamination renders biological agents harmless through physical means,
such as heat (i.e. autoclave) and radiation (i.e. sunlight). These methods are only suitable
for decontaminating durable equipment items.

By the time victims become ill as a result of a biological incident, it is unlikely that
decontamination of exposed individuals or property will be necessary. With the exception of
spore forming anthrax, natural processes of drying and exposure to sunlight will effectively
destroy biological agents. However, decontamination will remain critical in scenarios that
involve an announced attack or any operations in environments that may possess residual hazard.
Most communities have access to specialized hazardous material (HAZMAT) response teams.
These personnel are specifically trained and equipped to manage accidents involving toxic
materials and dangerous goods. HAZMAT units are also proficient at providing
decontamination support and should be incorporated into any law enforcement operation that
may require decontamination activities.

5.5. Training
The most important aspect of personal safety is training. It is imperative that law enforcement
personnel are properly trained and equipped for dealing with biological incidents. Awareness
training will give law enforcement the best chance to survive and operate effectively in this
environment. By definition, biological agents are considered to be hazardous materials. The
Occupational Safety and Health Administration (OSHA) requirements for HAZMAT emergency
response can be found in 29 CFR 1910.120 (q). The training requirements identified in these
regulations are task specific. It is recommended that all law enforcement personnel receive an
appropriate level of HAZMAT training based on the functions they may be required to perform
in response to a biological incident.

The Department of Transportation (DOT), under the Hazardous Materials Transportation Act
(HMTA), has published a document, titled the “Guidelines for Public Sector Hazardous
Materials Responders,” that identifies the required training recommended for each type of
emergency responder. In addition to traditional HAZMAT training, specialized WMD response
training is also recommended. This training is available through a variety of sources including,
the Department of Defense, various Federal and State Academies, commercial vendors, and
colleges and universities. Recommended minimum training for law enforcement is referenced in
the Performance Objectives Matrix (Appendix C).

26
Proposed Response to a Credible Threat 6
6.1. Role of Law Enforcement
The role of law enforcement responding to a credible threat includes the following:23

Making proper notifications

• Assessing the situation
• Removing people from harm’s way
• Establishing a crime scene and scene security
• Stabilizing the incident
• Determining the credibility of the threat
• Searching for additional hazards (be cognizant of secondary devices)
• Initiating the criminal investigation and gathering information
• Securing evidence

6.2. Initial Actions

Recommended strategy for responding to a telephonic or letter threat (with no other indication of
agent release).7

• Responders should approach this incident as a routine law enforcement investigation,

similar to a bomb threat. Be aware of any persons or vehicles leaving the scene.

• Protective equipment, decontamination and/or prophylaxis treatment might not be

required unless additional hazards or risks are indicated.

• Law enforcement response should include local police and local FBI to perform an on-
scene assessment.

• Notify the local Health Department and other necessary agencies in accordance with
standard operating procedures. The incident may require a health investigation.

• Identify persons potentially at risk of exposure; they should be evacuated and evaluated
by medical/public health professionals.

• Treat as a crime scene (identify, establish, protect, and secure).

• Perform information gathering at the scene.

• Perform threat assessment to determine the credibility of the threat.

23
National Domestic Preparedness Office, On-scene Commander’s Guide for Responding to Biological/Chemical
Threats

27
• Have bomb squad evaluate the letter to ensure no dispersal mechanism/device inside.

• Double bag the letter and place it in a suitable evidence container (i.e. an evidence paint
can).

• Establish a proper “chain of custody” and maintain appropriate documentation. Follow

the FBI plan for laboratory analysis as directed by the local FBI field office.

• Perform a search to confirm no indication of agent or additional letter or device is

present. Attention should be focused on appliances or devices foreign to the
surroundings.

• Assess the building ventilation system to rule out forced entry or tampering.

• Consider whether full HAZMAT response is needed unless a device or suspicious

material is present or individuals are symptomatic.

28
Proposed Response to a Suspect 7
Material/Package/Device 23, 24, 25

7.1. Role of Law Enforcement

The role of law enforcement for responding to a suspect material/package/device include the
following:

• Making proper notifications

• Assessing the situation
• Removing people from harm’s way
• Being cognizant of secondary devices
• Securing the perimeter, setting up operations areas, and establishing hazard control zones
(i.e. Hot, Warm, and Cold Zones)
• Assisting with control and identification of the agents involved
• Facilitating the rescue, decontamination, triage, treatment and transport of victims
• Stabilizing the incident
• Avoiding contamination
• Establishing a crime scene and scene security
• Initiating the criminal investigation and gathering information
• Securing evidence

7.2. Initial Assessment

When a suspect material, device or package is reported law enforcement officers must collect
information in order to perform an initial assessment of the credibility of the threat law
enforcement officers should assess the hazard by:

• Gathering information from the reporting party, bystanders, witnesses and any other first
responders.
• Determining who has physically had contact with the package.
• Conducting an initial evaluation of the package; consider using binoculars while standing
a safe distance away from the suspicious package.

The following questions are designed to help law enforcement officers gather key information
regarding a package or device that may contain biological material.

• Individual reporting the item

¾ Obtain the name, date of birth, address, and telephone number of individual.

24
Paul Maniscalco & Hank Christen, Terrorism Response Field Guide for Law Enforcement
25
International Association of Fire Chiefs, Model Procedures for Responding to a Package with Suspicion of a
Biological Threat

29
 ¾ Is there a suspect package or envelope?
¾ Is the suspect package at a residence or business? If it is a business, obtain the
business name, address, and type of business.
¾ What is the occupation/employment of the individual? What are the individual’s
duties?
¾ Has the individual received threats by mail or telephone before? If yes, get details.
¾ Why does the individual think that he/she would be targeted?
• Envelope/Package:
¾ Who or what is listed as the addressee on the envelope/package?
¾ Who or what is listed as the return address on the envelope/package? Is the victim
familiar with the sender?
¾ Is the envelope/label typewritten or handwritten?
¾ Does the envelope/package have a postmark? Where?
¾ Does the envelope/package have a stamp? What kind of stamp? How many? Is
there a meter strip?
¾ What kind of envelope/package (business, personal, etc.)?
¾ How was the envelope/package sealed (tape, adhesive, etc.)?
¾ Are there any additional markings on the exterior of the envelope/package?
¾ Are there any stains on the exterior of the envelope/package? Describe.
• Note/Letter:
¾ Obtain summary of content of letter.
¾ Is there an overt threat contained within the letter? Provide exact wording.
¾ Are there any stains visible on the letter?
• Foreign Material Within the Envelope/Package:
¾ Describe the material found within the envelope/package.
→ Solid material:
∗ What is the color of the material?
∗ Describe granule size and shape (e.g. similar to sugar or powder).
∗ Does the material have an obvious odor? Do not purposely inhale the product.
∗ Did the material appear to become airborne upon opening?
→ Liquid:
∗ Describe the container size, type, and material (e.g. glass or plastic).
∗ What is the color of the liquid?
∗ Describe any odor. Do not purposely inhale the product.
∗ Is the liquid transparent or opaque?
∗ Is the liquid leaking from the container?
• Exposure:
¾ When was the envelope/package received (date and time)?
¾ What was the mode of delivery (USPS, FedEx, etc.)?

30
 ¾ Where is the envelope/package or letter currently located?
¾ What areas of the body were exposed to the material?
¾ Was there a spill? If so, how large?
¾ How many others had contact with the envelope/package or product?
• Health:
¾ Is the victim experiencing any physical symptoms? What are the symptoms?
¾ How long after exposure did the symptoms occur?
¾ Has the victim already seen a doctor? If yes, obtain the name and contact information
for doctor.
• Notifications:
¾ Has the victim notified the local police?
¾ Has the victim notified the fire department?
¾ Has the victim notified the hazardous material teams?
¾ Has the victim notified any other authority?

7.3. Initial Actions

Recommended strategy for responding to a suspect material/package/device that indicates a
release of biological agent.

• Responders should approach this incident as a public safety response, similar to a

HAZMAT/crime scene. Priority must be to save lives and preserve health above all other
activities.

• Appropriate protective equipment, decontamination and/or prophylaxis treatment

measures must be considered for all victims and responders.

• Treat as a HAZMAT/crime scene (identify, establish, protect, and secure).

• Establish Hot, Warm, and Cold Zones. The size of the hazard control zones should be
based on the assessed threat. Depending on the scenario, the initial Hot Zone may range
from the desktop in an office to an entire building depending on the situation.

• Shut down the building ventilation system if there has been a substance release.

• If the situation involves suspect mail in a mail processing facility, turn off any high-speed
mail processing equipment that may have handled the suspicious package.

• Law enforcement response should include local police, local/regional bomb squad, local
evidence collection team, and the local FBI to perform an on-scene assessment. (The FBI
may assume control of the evidence collection process).

31
• Notify the local Health Department and other necessary agencies in accordance with
standard operating procedures. The incident may require a health investigation.

• Identify and isolate persons who have been exposed or who were potentially exposed.
These persons should be rapidly evacuated, decontaminated, and evaluated by
medical/public health professionals. Do not evacuate the building unless an immediate
threat is evident.

• Perform a threat assessment to determine the credibility of the threat and potential
hazards. This may be done in conjunction with the FBI WMD coordinator, the FBI
Counter-Terrorism Division’s Weapons of Mass Destruction Operations Unit, the FBI
Laboratory Division, Hazardous Materials Response Unit (HMRU) and appropriate
Federal agencies.

• Establish perimeter security denying entry into the crime scene.

• Take steps to preserve evidence. Ensure that samples collected are separated into
separate quantities for field screening and laboratory analysis. Do not consume all
suspect material during field screening.

• Follow local protocols for evaluating risk regarding potential explosive device(s). An
explosive hazard takes precedence over other hazards.

• If an explosive device is not ruled out, coordinate local efforts with the local/regional
bomb squad and the local FBI office.

• If an explosive device is ruled out, evaluate for potential radiological, then chemical, then
biological materials.

• If a radioactive source material appears to be present, follow local plans for requesting
additional technical support. (i.e. Department of Energy Nuclear Emergency Search
Team - NEST)

• If radioactive material is ruled out, sample the material for laboratory analysis. Positive
identification of the suspect material is necessary to determine appropriate treatment
measures for exposed individuals. Law enforcement should facilitate the transport and
processing of these samples if required.

• Follow Evidence Response Team (ERT) protocols for documenting the crime scene.
Ensure a proper “chain of custody” is maintained, as all samples are considered evidence.

• Determine what individuals require decontamination. Decontamination should only be

necessary for individuals who came in direct physical contact/inhalation with the alleged
biological material.

• Remove and double-bag exposed individuals’ clothes and/or provide on-site shower.

32
 • Individuals not directly exposed can be directed to remove clothing at home, where they
can be laundered unless directed by law enforcement to be bagged for evidence purposes.

• Coordinate threat assessment with the local health officer. The local health officer needs
the information to decide whether or not to transport exposed individuals to a medical
facility for immediate medical evaluation.

Post-Decontamination considerations:

• Perform information gathering at the scene. Law enforcement should interview all
potential victims and document their names and contact information.

• Perform a search to confirm no indications of an additional device(s) are present.

Attention should be focused on appliances or items foreign to the surroundings.

• Decisions to provide treatment for biological agents should be made by public health
officials.

• Consider the mental health needs of the victims and responders involved in the incident.

• Ensure that the results of the samples tested are relayed to the victims and responders as
soon as they are available.

• If all explosive, radiological, chemical, and biological hazards are ruled out, the response
should continue as a routine law enforcement investigation.

33
Incident Investigation 8
Homeland Security Presidential Directive (HSPD) 5 states, “The Secretary of Homeland Security
is the principal Federal official for domestic incident management.” In the case of a law
enforcement response, the Attorney General retains the lead and the Secretary of Homeland
Security will facilitate required actions, consistent with their respective authorities.”26

PDD-39 designates the Department of Justice (DOJ) as the overall Lead Federal Agency (LFA)
for threats or acts of terrorism that take place within the United States until the Attorney General
transfers the overall LFA role to the Department of Homeland Security. In accordance with the
Federal Response Plan, pending further revision of the National Response Plan, DOJ delegates
the overall LFA role to the FBI.27

The FBI derives its fundamental legal jurisdiction to deter, investigate, direct, organize, and
prepare for a WMD incident from an assortment of Federal statutes and executive branch
directives. Some of these include the following:

• Title 18, USC, 1365 - Tampering with Consumer Products

• Title 18, USC, Section 871-879 - Extortion and Threats
• Title 18, USC, Sections 371-373 - Conspiracy
• Title 18, USC, Sections 175-178 - Biological Weapons Anti-Terrorism Act
• Title 18, USC, Section 2332 (a) - Weapons of Mass Destruction

Pursuant to its jurisdictional responsibility, the FBI will respond to all WMD incidents by
marshalling specialized FBI and other Federal resources to support the Special Agent in-Charge
(SAC) when faced with a potential WMD incident. Recent legislation has made the use, attempt
to use, or conspiracy to use a weapon of mass destruction a Federal offense.

In 1990, the Biological Weapons Anti-Terrorism Act was signed into law. This statute makes it
illegal to manufacture or possess biological agents for use as a weapon or to assist a foreign
government in development of such a weapon. It also contains extraterritorial provisions, as well
as the ability to seize and destroy biological weapons material.

PDD-39 also acknowledges that local law enforcement agencies will be the initial responders to
WMD incidents. The investigation on a biological terrorism incident will be complex. To be
successful, the incident investigation will require extensive coordination, cooperation, and
communication amongst agencies from all levels of government (local, State, and Federal).
Local law enforcement can expect to do some, all, or any part of the incident investigation;
therefore, communities must be prepared (via careful planning, coordination, and training) to
play an active role.

26
U.S. Department of Homeland Security, Initial National Response Plan, Sept 2003
27
Federal Emergency Management Agency, Federal Response Plan, Interim 2003

34
8.1. Evidence Collection
Identification and collection of physical evidence is undoubtedly one of the most important
factors of an investigation, however, such actions should never take precedence over the incident
health and safety response efforts. Although the FBI will maintain primary jurisdiction over a
biological incident crime scene, local law enforcement may be tasked with supporting and
facilitating the efforts to obtain environmental samples and transporting them to appropriate
laboratories for analyses. In a biological incident, a critical part of the initial health and safety
response will include the identification of the disease-causing agent. Responders must carry out
a timely collection of initial diagnostic samples while being careful not to destroy potential
evidence.

The high level of technical training required for gathering legally defendable evidence and the
need for timely diagnostic and evidence collection necessitates that evidence collection
personnel are trained and equipped to operate in a contaminated environment. To establish this
capability, it is recommended that local forensic technicians familiarize themselves with
environmental crime scene and “sick-building syndrome” investigation procedures. Technicians
will quickly discover that many routine aspects of evidence collection will be significantly
impacted by the use of personal protective equipment.

When approaching a suspected biological crime scene, investigators should continue to initiate
standard crime scene procedures. These activities include:28

• Isolating and securing the scene

• Conducting an initial walk-thru and prioritizing evidence collection activities
• Documenting and photographing the scene
• Collecting, preserving, inventorying, packaging, and transporting the evidence
• Performing a final survey of the scene

Focusing the investigation on the recovery of physical evidence material such as the attack
delivery system, sample evidence, or bio-manufacturing material is key.

8.1.1 Delivery System. Recovery of the dissemination device used to carry out the attack
should be handled as hazardous material and include analysis for agent residue. Evidence
teams must exercise appropriate protection measures and packaging procedures when
handling these items.

8.1.2 Environmental Samples. Residual agent can be exploited for detection and
identification purposes and may be the best opportunity for identifying the agent prior to
victims becoming ill. Unfortunately, locating sources of residual agent may be next to
impossible and agent analysis is also technologically demanding. The FBI maintains
specially trained and equipped Evidence Response Teams (ERT) and a Hazardous

28
National Institute of Justice, Technical Working Group on Crime Scene Investigation, Crime Scene Investigation:
A Guide for Law Enforcement

35
 Material Response Unit (HMRU) to provide on-scene coordination of the evidence
collection effort.

Unlike some chemical agents, biological aerosols disseminated outdoors by line source
do not leave an agent residue (anthrax spores can be an exception near the line of
release). On the other hand, aerosols generated by point source are more apt to produce
residual evidence, but only in the immediate vicinity of dissemination.7 Aerosolized
biological agents released inside a building or subway tunnel will ultimately settle out of
the air, depositing on surfaces, such as carpet and other flooring, furniture, wall
coverings, and window ledges.

One of the most likely sources of trace evidence, following an aerosol agent attack, is the
heating ventilation air conditioning systems (HVAC) used by an affected facility. If an
indoor release is suspected, the HVAC and air duct systems should be shut down to
prevent spread of the agent. These systems are also likely to contain the source of the
release. Evidence teams should put specific emphasis on the following HVAC
components: filters and supply registers, cooling towers, condensation pan, and
humidification units.

8.1.3 Other Considerations. Protective suits, biohazard bags, and laboratory equipment (i.e.
incubators, fermenters, or containers with biological labels) may also be significant
sources of trace evidence, and should be handled appropriately. Locations where
evidence of associated biological terrorism materials has been identified may possibly
require tactical personnel to secure it while investigators gather evidence. Law
enforcement agencies should also be prepared to accompany non-law enforcement
personnel into contamination areas to collect evidence samples and establish the
necessary chain of custody. Packaging and labeling of contaminated material such as the
dissemination device and environmental samples should be in accordance with standard
Department of Transportation (DOT) procedures. However, ultimately all evidence
collection must be conducted in accordance with established protocols of the FBI and in
accordance with the diagnostic laboratory that will process the evidence. Finally,
responders should not initiate site remediation activities until the crime scene
investigation has been completed.

8.1.4 Clinical Evidence. As soon as a major disease outbreak or biological attack is

suspected, public health officials will likely contact medical facilities to standardize a
process for collection, preservation, and testing of incident-related clinical samples. If it
is determined that such samples are potential evidence, criminal investigators should
coordinate with the public health officials and the Medical Examiner to make sure
appropriate measures are taken to obtain the clinical laboratory test results.8 Medical
examiners should already have established protocols that support this activity (i.e.
toxicology reports), however clinicians may have patient confidentially concerns when
providing such information. Policy makers should consider establishing procedures with
the medical community to obtain clinical sample test results similar to existing “Rape
Kit” protocols.

36
8.2. Laboratory Support
Investigators must follow local, State, and Federal statutes for the collection of evidence to
ensure admissibility. Law enforcement planners should work with the FBI and public health
officials to predetermine an appropriate diagnostic laboratory to process BW incident related
environmental samples. CDC, in collaboration with the Association of Public Health
Laboratories and the Federal Bureau of Investigation (FBI), established the Laboratory Response
Network (LRN) to develop Federal, State, and local public health laboratory capacity to respond
to bioterrorism events. Law enforcement officers should prioritize, or triage, evidence samples
to reduce the volume of samples forwarded for laboratory analysis. Only those samples with a
relatively high threat level should be forwarded for further testing. According to the CDC,
during the anthrax incidents [2001], laboratories within the LRN tested more than 120,000
samples, the bulk of which were environmental samples.29 It was the volume of these
environmental samples, rather than the volume of clinical samples, that overwhelmed the
laboratories. Among the environmental samples, there were white powder samples that arrived
without any assessment by law enforcement as to the level of threat they posed. Officials should
all consult with legal authorities to determine laws regarding collection and handling of such
evidence. Evidence collection personnel should familiarize themselves with the designated
laboratory identification and packaging procedures for the laboratory being used.

8.3. Witness Interviews

Information obtained from witnesses can corroborate other evidence (i.e. physical evidence and
accounts provided by other witnesses) in the investigation. Therefore, it is important that this
information be accurately documented, as well as witnesses’ names and contact information. In
situations involving large numbers of witness interviews, investigators may wish to consider
taking a Polaroid® picture and thumb print of each interviewee to verify identities. Initially,
investigators should question witnesses regarding the presence of unusual circumstances, items,
people, or vehicles. Witnesses may have unknowingly observed the attack in progress,
observing individuals wearing PPE, unusual spraying/mist, or they may have discovered an
appropriate delivery system.

Investigators should actively solicit information from potential witnesses. This may include
conducting interviews of all suspected victims. It is recommended that investigators work with
medical providers and public health investigators to prioritize patient interviews, interviewing
the sickest patients first. The ECBC Criminal and Epidemiological Investigation Handbook
(www.ecbc.army.mil/hld) further outlines the joint law enforcement and public health
investigative process. Victims may also be a source of physical evidence. Individuals exposed
near the source of dissemination may have articles of clothing with suspicious residue from
which an infectious agent is subsequently identified. Investigators should collect any articles
suspected of being contaminated as evidence, seal them in a biohazard container or bag, and
label the container appropriately. Finally, investigators should always be aware that the
perpetrators of the incident might be among the victims.

29
U.S. General Accounting Office, Bioterrorism. Public Health Response to Anthrax Incidents of 2001

37
Tactical Entry for a Suspect BW Production/Storage Site 9
The apprehension of criminal subjects will be a priority in any terrorist event. In a biological
incident, the role of local law enforcement may include performing high-risk search and arrest
operations of well-armed individuals who may possess biological agents. The difficulties
associated with suspect apprehension is compounded by the additional hazards associated with
the agent and the protective measures that must be taken to ensure officer safety. Such
operations will require specialized tactical units to function in cumbersome protective clothing.
Law enforcement personnel, who are physically fit, outfitted with protective clothing, armed
with specialized weapons, and properly trained in dealing with hazardous materials and
biological agents, will greatly assist in overall incident resolution.

9.1. Task Force Approach

Undoubtedly, tactical operations associated with a biological incident will require the integration
of multiple agencies to support the tactical team. The primary jurisdiction in the event of a
biological incident falls to the Special Agent in Charge (SAC) of the local FBI field office. All
organizations participating in the task force will take directions from the SAC. Suggested
participants for a tactical operations task force include:

• SWAT Unit
• Unified Command and Control Element
• EOD Support
• Evidence Response Team
• HAZMAT/Decontamination Support
• Medical Support Team
• Perimeter Security

In addition, several Federal support agencies including, the FBI Hazardous Material Response
Unit, ATF, and the U.S. Army Technical Escort Unit can also be expected to arrive in support of
this type of operation. Establishing an effective direction and control system will be crucial to
the success of these operations, and will necessitate careful interagency planning, coordination,
and cooperation.18 Command structures must be clearly defined and should be consistent with
the Incident Command System (ICS).

9.2. Operational Considerations

The following operational considerations should be considered when conducting tactical
operations that involve potential biological hazards.

9.2.1 Setting Priorities. Mission priorities should include protecting responders as well as the
public. The presence of a bomb or an armed suspect presents an immediate threat to
tactical personnel. Tactical commanders should consider the priority of effort when
planning these operations. The following approach is recommended:

38
 1) Neutralize the armed suspects
2) Neutralize the explosive threat
3) Neutralize the agent threat

9.2.2 Agent Release. After protection of the officers performing the apprehension, the
paramount concern is release of the agent into the environment and surrounding
community. Tactical planners should consider measures to mitigate the chance for
unintentional agent release. HVAC systems within a building should be shut off to
reduce the spread of agent throughout a building and into the surrounding area.
Additional safeguards can be taken by shutting windows and doors to rooms as the
tactical team clears them. HAZMAT units have procedures for estimating potential
downwind hazard areas. These projections can be helpful for planning and developing
evacuation contingencies.

The identification of hazard zones should be made prior to commencement of operations;

however, physical marking of the zones may not be possible for security reasons. Once
the target has been secured, hazard zones should be marked until hazard assessment
teams determine the exact extent of any contamination.

9.2.3 Specialized Equipment. Specialized equipment such as PPE or the

need to eliminate use of standard equipment may be necessary to
function in a contaminated environment. Using personal protective
equipment requires hazard awareness and training on the part of the
user. Officers must be aware that the equipment does not eliminate
the hazard. If the equipment fails, exposure will occur. To reduce the
possibility of failure, equipment must be properly fitted and
maintained in a clean and serviceable condition. PPE can also be
particularly hindering to tactical operations, and thus, consideration
must be given as to how the use of such equipment will impact the
mission. Some considerations include:

A. Visibility - Most commercial protective suits (i.e. level A, B, and

C) are bright colored. This clearly eliminates the advantage of the
dark tactical suits. The one exception to this is the charcoal impregnated/lined
protective suits (i.e. Saratoga® Hammer, Chemical Protective Undergarments, etc.).

B. Stealth - Most commercial suits are also made of materials that are fairly noisy when
worn. Additionally, the blowers on powered air-purifying respirators (PAPRs) are
noisy. Both of these clearly eliminate the ability of officers to move undetected
through a location.

C. Dexterity - Suits, boots and gloves all affect the ability of the wearer to feel their
environment and equipment. Protective equipment for tactical officers should be
tested and used by team members in a variety of training missions before choosing
what final equipment to adapt.

39
 D. Vision - Use of a respirator limits an officer’s vision (especially peripheral vision).
Respirators come in a variety of styles. Officers should select a style that provides
the best field of vision and allows for the use of shoulder-fired weapons.

E. Communication - Wearing any respirator seriously degrades the ability to

communicate not only with other team members but also the suspects. Voice
amplification devices are available for use with most respirators. Without such
systems, hand and arm signals may be required to communicate.

F. Compatibility - The PPE selected for tactical operations must be compatible with the
officers’ tactical equipment. Wearing a respirator may hinder the use of some
shoulder-fired weapons and low-light (night vision) devices. Suits must also be able
to withstand the mission of the team and not be torn/ripped by the equipment worn
over them.

9.3. Decontamination Support

Decontamination is essential for all personnel and equipment operating in the hazard area.
Tactical operations should include personnel decontamination support by Fire or HAZMAT
units. Integration with these agencies will require close coordination. Specific considerations
must be addressed, such as, the decontamination and security of the tactical team’s specialized
equipment and weapons, and procedures for decontamination of suspects. Other
decontamination considerations include:

• Building or area (site remediation)

• Evidence (containers and labels must be able to survive decontamination)
• Personal effects

9.4. Medical Support

An emergency medical team and a public health official should be on scene for immediate
consult regarding any possible agent located, team member exposure, and release of agent that
may occur as a result of the operation. It is recommended that tactical medics assigned to SWAT
teams be trained to coordinate this support. Pre- and post-incident medical screening should be
conducted for all personnel. Post-incident screening should include screening apprehended
suspect(s). Planners may consider conducting a baseline blood draw on all task force personnel
for follow-on medical surveillance.

9.5. Perimeter Security

The initial task in the execution of tactical operations is isolating the operational area. Once the
area is isolated, time is on the side of law enforcement. Tactical commanders should take
appropriate measures to ensure the task force is provided an adequately sized operational area to
conduct the mission and ensure public safety. Although personnel assigned to provide perimeter

40
security would generally be operating in areas considered safe from exposure, these personnel
should possess appropriate equipment to provide immediate respiratory protection, if needed.

9.6. Training and Exercises

Task force members must conduct individual and team training to develop and maintain
technical proficiency. It is recommended that SWAT members be cross-trained to operate in a
HAZMAT environment. Tactical exercises involving PPE should also be practiced as part of the
teams training. Recommended training for tactical personnel should include:

• Orientation to biological agents and toxins

• Orientation to PPE, with specific emphasis on how the protective equipment affects
traditional operations

• Individual and team communications while wearing PPE (both hand signals and
electronic communication devices)

• Decontamination procedures (integrated with fire and HAZMAT support)

• Arrest and control methods (including handcuffing) while wearing PPE

• Team movement in PPE.

• Firearms manipulation and qualification in PPE

• Multi-agency drills requiring tactical personnel (in PPE) to assist non-law enforcement
entities with evacuation, victim decontamination operations, and recovery of evidence
within contaminated areas

9.7. Rehearsals
Rehearsals are key multipliers in the success of any tactical operation. Given the additional
constraints (i.e. PPE Æ limited visibility, reduced communications) of a biological situation their
importance significantly increases. Conduct of suspect apprehension should only commence
after all tactical team members and support teams are prepared, briefed, and rehearsed.
Rehearsals should be conducted in a similar location (building type, floor plan etc.) from the
actual location. They should be conducted in the full protective gear that will be worn in the
actual mission to enhance the associated drawbacks of operating in PPE. Complete operations
through decontamination should be practiced so all team members and the support teams are
fully aware of their mission and requirements.

41
Incident Control 10
Incident-control activities will become a law enforcement responsibility out of necessity.
Emergency managers fearing the outbreak of widespread civil unrest will likely call upon law
enforcement organizations to institute strict public control measures. Experts suggest that law
enforcement will make best use of their resources by focusing their control efforts on facilitating
the response rather than attempting to institute martial rule. History generally supports this
conclusion, as victims of large disasters and terrorist acts have tended to act altruistic, offering
assistance to response efforts, and generally behave rationally.30 Whatever the case, law
enforcement organizations cannot assume compliance or unrest; they must be prepared to deal
with such possibilities as:

• Spread of rumors and misinformation

• Social tension
• Mass flight
• Civil disturbance
• Mass isolation

The sheer magnitude and urgency associated with a large-scale biological incident will also
necessitate special tactics and coordination of an enormous amount of resources. Strategies for
control of the affected area and population are organized into two elements: Public
Information/Notification, and Physical Control Measures. Together, these two elements help
maintain order, instruct the population, and facilitate an organized emergency response.

10.1. Public Notification/Information

Law enforcement agencies may be called upon to assist with warning the public and
disseminating emergency information to isolated populations and motorists. Public information
and rumor control are vital for informing the population in ways that enhance crucial activities of
the response to prevent panic and maintain public cooperation. The public will have a genuine
need for incident information. Citizens will require accurate, factual information to enhance
their chance of effectively responding at the individual and family level. Without a clear and
honest dialogue with the public, potential victims will have unrealistic expectations and will be
more prone to taking actions that hinder the response. Fortunately there are several mechanisms
available to rapidly disseminate information to the public.

10.1.1 Media. A biological incident will generate intense media interest. As a result, the media
will be both a help and a hindrance. From the onset, the media should be considered an
essential participant in disseminating official information and updates, as well as an
information source for the criminal investigation (i.e. photos and video). When handled
properly, the media can be a valuable asset to law enforcement by:31

30
H. Fisher III, Behavioral Response to Chemical and Biological Terrorism
31
Federal Emergency Management Agency, Emergency Information Field Guide

42
 • Helping to instill confidence in the community that all levels of government are
working together to care for victims and apprehend the perpetrators

• Helping promote a positive understanding of the incident response, disaster

mitigation, and public control activities

• Helping disseminate timely and accurate information and instructions to the

public as well as to other responders

• Helping manage expectations and rumor control so victims have a clear

understanding of all response and recovery services available to them

10.1.2 Emergency Alert System (EAS). The EAS is an automated system that replaced the old
Emergency Broadcast System (EBS). EAS is technologically more advanced, faster, and
more dependable. EAS is a digital system that has the following capabilities:

• Accesses television and cable stations

• Accesses radio and weather radio stations
• Has provisions for hearing and visually impaired
• Can provide multilingual alert messages
• Can target specific geographic areas
• Can interface with computers
• Can be activated and updated from multiple locations (EOCs, JICs, remotely)

10.1.3 Reverse 911. Law enforcement efforts may have the need to provide specific
notification or instruction to households in a specific community. Reverse 911 is an
automated system that delivers a prerecorded message via the telephone to all homes in a
designated geographical area. This system can be used to provide information such as,
where to go for medical care, what route to use, whether to evacuate, or what to do if they
have information regarding the attack.

10.1.4 Hotlines/Helplines. Toll-free phone numbers can be established and operated to provide
help instructions, gather investigation tips, or summon home-based victim assistance.
Establishing special incident hotlines/helplines and promoting their use should help
reduce 911 call volume, allowing the 911 system to continue to function.

10.1.5 Neighborhood Canvas. The most thorough and by far the most time consuming and
resource intensive method for disseminating information is the neighborhood canvas.
This technique involves teams of officers going door-to-door within a designated area,
providing instruction and information packets (i.e. self-help fact sheets). The advantage
of this method is it allows decision makers continuous feedback regarding numbers of
sick, specific community needs, incident-related rumors, and insight to the cause and
magnitude of the incident.

10.1.6 Other. The magnitude of the incident may require law enforcement to consider
innovative means of communications to inform the public. (i.e. Internet Web sites,

43
 aircraft banners, police patrol public address systems, and billboards). Whatever the
mode of communication used, information must be presented in a clear and trustworthy
manner.

10.2. Physical Control Measures

As mentioned earlier, physical control efforts should be geared toward facilitating the response.
Emergency responders must be provided a controlled environment in which to operate to
function effectively. High priority control measures include: providing security at medical
facilities and mass transit centers, maintaining traffic ingress and egress routes, and conducting
high visibility patrols.2

10.2.1 Provide Security at Vital Installations. Unimpeded government operations are

essential to maintaining control. Public transportation, communication, and other public
services and utilities must continue. Disruption of such services will further increase
public anxiety and the possibility of civil unrest or violence. Law enforcement must take
proactive measures to ensure that vital installations such as the following are protected:

• Large transportation nodes

• Community medical centers
• Alternate care facilities
• Pharmacies
• Medical distribution sites
• Government facilities
• Mobilization centers
• Mortuary facilities

During a biological incident, victims will converge on medical facilities in overwhelming

numbers. Medical facilities, in cooperation with law enforcement agencies, should
make provision to queue their patrons in zig-zag lines, around buildings, and on
sidewalks. In this way, patrons can claim a particular space, feel less anxious about their
ability to enter in an orderly fashion and can better judge the length of time it will take
them to enter, as they progress in a line. Using a queue also prevents the potential hazard
of a mob rushing the entry point to the facility. This sense of urgency or anxiety is the
crucial factor that must be removed to minimize the potential for crowd disorders outside
of a facility.

10.2.2 Provide Traffic Control of Ingress and Egress Routes. Following a biological
incident, panic may cause some individuals to flee from the area of attack, even when
there is no longer any danger of exposure. Uncontrolled mass flight will make it almost
impossible to bring critical response personnel and materials to an affected community.
Planners must recognize that a biological incident may require large numbers of
personnel and equipment to maintain unrestricted access in and out of the affected
community. Law enforcement may be tasked to clear corridors (traffic lanes) for the
ingress and egress of emergency equipment and escort fire, EMS, and response units to
and through affected areas. Predetermined traffic control points should be established to

44
 assist with directing civilian traffic and response vehicles. Non-essential traffic should be
detoured around the affected area and alternate routes provided. Vehicles, cones, flares,
barriers, and signs can be used to restrict access and direct arriving emergency personnel
to staging areas. Traffic routing information should be included in the official public
information bulletins.

10.2.3 Patrol the Affected Area. Patrols may be needed to maintain control. Patrols provide a
visual presence reducing the likelihood of panic and civil unrest. Patrols also allow law
enforcement a flexible means to react to civil disturbance incidents.

10.2.4 Passes. Experience has proven that there are instances where special passes are needed
in a disaster area to control access to those with legitimate reasons for being in the area.
Only under extraordinary circumstances should passes be required after a biological
incident. The decision to require passes will rest with the local policy makers and
direction for use of passes should be coordinated through the EOC. Law enforcement
personnel may issue passes or direct those seeking admittance to an access control center
(i.e. police department. or staging area) to obtain them. Common sense and discretion
must be used in issuing/not issuing passes, as over enforcement can severely hamper
relief efforts as much as under enforcement.

The following vehicles and their occupants may be exempt from pass requirements:
Marked utility company vehicles, military, city/county/State government vehicles, and
relief organizations (i.e. Red Cross, Salvation Army) vehicles. However, consideration
must be given to the intelligence information that has been gathered in recent years
pertaining to terrorist plans to obtain emergency response and public official vehicles and
uniforms. Many emergency passes are already in existence (i.e. press cards and medical
personnel identification) and should be honored unless a reasonable question arises as to
their authenticity. If such questions arise, individuals should be directed to an access
control center for consideration of a temporary pass.

10.2.5 Use of Force. Use of force must always be “objectively reasonable” under the
circumstances and consistent with the law. At the outset, peace officers should be
acquainted with the law as it relates to the lawful detention of subjects for “quarantine” as
directed by local health officials. Most states only address the authority for peace
officers to lawfully detain persons in situations involving unusual or suspicious activity
relating to criminal activity, and not based solely on a public safety or health threat. Such
public safety law is usually reserved for the local Director of Health Services. It is
recommended that if current State/local law does not authorize law enforcement officers
to detain persons for public health or safety reasons involving biological terrorism, then
obvious legislative amendments should be sought. As to force, it is recommended that
every effort be used to avoid a physical altercation. Reality dictates that force may be
necessary to control uncooperative individuals.

45
10.3. Control of Response Assets
With significant influx of aid expected, resource managers should plan to provide measures for
controlling the arrival and implementation of response assets. Law enforcement should be
prepared to support such control activities as:

10.3.1 Points of Arrival. These are locations (typically an airport, train station, or bus station)
within or near the disaster area, where newly arriving response personnel, supplies, and
equipment are directed. Law enforcement can expect to assist with meeting and escorting
arriving assets from the points of arrival to their initial destinations, such as mobilization
centers, and staging areas.

10.3.2 Mobilization Centers. A mobilization center is a designated location for receiving and
processing assets prior to their movement to an appropriate staging area. Law
enforcement may be required to assist with activities such as credentialing personnel and
security.

10.3.3 Staging Areas. At staging areas personnel, equipment, and supplies are assembled for
immediate deployment to an operational site. Once again, law enforcement personnel
may be needed to provide security and escort assets to their operational site.

46
Community Outreach32 11
The ultimate success of the response will depend on the effectiveness of the medical system.
Hospitals will be inundated following a large biological incident. Officials will be forced to
make life and death decisions based on limited information, regarding the appropriate utilization
of response resources. A well-orchestrated community outreach network could be initiated to
ease the burden on medical facilities and gather incident information. In the case of an attack
that produces catastrophic numbers of casualties in a large metropolitan area, officials may
instruct law enforcement to coordinate a door-to-door survey of the community. The initial
purpose of this effort would be to assess the situation and gain a better understanding of the
scope and magnitude of the event. Later, as disaster medical response resources are made
available, the outreach would be used to help identify and coordinate assistance and care for
individuals that are unable to seek out medical aid on their own. A community outreach effort
might also be used to distribute incident information and medications. Although this response
strategy is manpower intensive, it can be particularly useful to prevent a person-to-person spread
of disease. In situations that involve disease that is considered contagious, it would generally be
best to isolate individuals from one another and avoid mass gatherings. In such a scenario,
authorities might instruct citizens to stay at home and receive assistance via the community
outreach.2

11.1. Concept Overview

Law enforcement, first responder, and community health resources can be integrated to provide
an active community outreach network. This process relies on the rapid mobilization of
manpower from a number of pre-existing organizations combined with a unified public
information campaign. Specific operational objectives for this effort may include the following:

• Identify operational boundaries of the affected area (what jurisdictions require disaster
aid)

• Actively search out and identify the sick, focusing on identification of the severely ill or
those unable to seek out medical care on their own

• Contact all potentially affected persons within a 24-period

• Provide interactive control of the affected population

• Lessen the community’s feeling of isolation and helplessness by mobilizing volunteers

and giving them an opportunity to participate in the response effort

32
U.S. Army Soldier and Biological Chemical Command, Improved Response Program, Criminal and
Epidemiological Investigation Handbook, U.S. Army Soldier Biological and Chemical Command, 2003 Edition.

47
11.2. Role of Law Enforcement
The community outreach will need to be mobilized rapidly, therefore, law enforcement may be
assigned the initial lead in the outreach effort, until a more appropriate lead for sustained
outreach operations can be designated. The lead agency will be required to oversee critical
activities such as:

• Soliciting mutual aid and volunteer support resources

• Developing a strategy to conduct a comprehensive neighborhood canvas
• Standardizing the processes for information collection and dissemination
• Establishing and maintaining communication networks and information flow
• Organizing and instructing survey teams
• Assigning geographical areas of responsibility

11.3. Resources
11.3.1 Community Police Officers. Police officers work in a regular sector and have
established relationships with the community. They know their local area residents, and
the residents know the officers. These personnel should be used to manage and direct the
survey teams.

11.3.2 Community Organizations. Social groups and church organizations will be able to
identify residents, assist law enforcement in locating victims/casualties, assist with
language barriers/ religious beliefs/ local customs. These citizens can augment survey
teams or assist with coordinating homebound care.

11.3.3 Uniform Services/Utilities. Solicit help from the members of U.S. Postal Service
(USPS), public works personnel, sanitation workers, and newspaper delivery service.
They can provide information about mail buildup or papers on lawns, no answers during
meter readings or no garbage left for pickup. Any of these can be indications that
someone is not at home or unable to call for assistance.

11.3.4 Neighborhood Watch Programs. In many communities this is an existing crime

prevention program. In the case of a BW incident, these civilians can assist police by
monitoring the neighborhood and its residents. They can go house to house and assist the
outreach program by checking on victims/casualties. Also, they can assist with security
in their neighborhoods.

11.4. Techniques
11.4.1 Organization of Survey Teams. With the assistance of the health department and
volunteer groups, police will begin organizing 8-10 man survey teams and assigning each
team a specific canvas area or sector.

11.4.2 Breakdown of Effort. A large incident will likely necessitate dividing the affected area
into smaller, more manageable sectors of responsibility. As needed these sectors can be

48
 further divided and assigned to individual survey teams. The community outreach effort
should be able to make good use of existing sector methods such as: police patrol areas,
fire station response zones, school districts, and mail routes.

11.4.3 Survey Form. In addition to providing care, the community outreach can be an
important tool for rapidly collecting incident information. As survey teams identify
individuals who may have been part of the bioterrorism incident, both law enforcement
and public health investigators will begin conducting interviews. Criminal investigators
and public health investigators should work together to establish a information gathering
tool that supports the joint needs of each investigation to include the criminal
investigation and public health surveillance.

11.4.4 Marking System. To enhance the efficiency of the community outreach effort a door
marking system may be used. Such a system can be useful to indicate whether a survey
team has performed a recent visit and whether residents have received their information
or medication. Some examples are colored door stickers, door handle hangers, and
colored tape.

11.5. Personal Protective Equipment (PPE)

PPE for workers performing community outreach must be in accordance with the personal
protection measures outlined in Section 5.

49
Mobilization of Assets 12
A biological incident has the potential to result in situations that will deplete most communities’
law enforcement resources. Therefore, it is necessary that communities develop plans for
coordinating and providing assistance to ensure an effective and efficient response. The
following describes a mobilization strategy that might be activated to coordinate and deploy
State/region-wide law enforcement response resources. The strategy is a based on the Florida
Sheriffs’ Association Statewide Task Force - Emergency Mobilization Plan.

12.1. Concept Overview

To prevent an overwhelming burden on a few jurisdictions during a large-scale emergency or
disaster, a State or regional law enforcement entity may organize a mutual aid system whereby
an operationally feasible percentage of committed resources can be mobilized and deployed to
locations where assistance is requested. Under such a system, a large geographic area such as a
State or region is organized into response zones (each is typically made up of several counties).
All jurisdictions participating in the mutual aid system (State or region-wide) agree to commit a
percentage of their sworn personnel to be dispatched at the request of the State/regional
coordinator. This percentage is based upon the magnitude and severity of the event.

At the time a large-scale emergency or disaster occurs, or is predicted, and assistance is needed
or anticipated, the affected community may request assistance through a State/regional law
enforcement coordinating entity. The State/regional law enforcement coordinator would have
the capability and authority to conduct a State/region-wide “call-up.” To execute the “call-up,”
the coordinator would make an initial assessment of the situation and assign an event level that
dictates the percentage of committed resources by responding agencies. This “call-up” would
then be issued to participating organizations of the law enforcement mutual aid network. During
the event, the coordinator will continuously evaluate the situation and adjust up or down and
reassign the levels, if and when changes in the magnitude of the event occur.

12.2. Event Levels

Descriptions of the recommended event levels and the corresponding percentages of emergency
mobilization or “call-up” are as follows:

Level 1 - Minor Event/Emergency. Defined as an event with a potential of minimal

consequence limited to usually one county or small area involving cross-jurisdictional or multi-
county overlap, and an event that is unlikely to deplete the affected counties total resources, but
where special equipment and/or personnel are needed.

Call-up: The State/regional coordinator issues assignments to address specific support requests.
Deployed assets will generally be committed for less than one week.

50
Level 2 - Major Emergency/Disaster. Defined as an event with a potential of major
consequence, usually involving more than one county, though only one county may be affected,
but more often involving several counties. The event would likely result in the depletion of law
enforcement resources in each county affected.

Call-up: The State/regional coordinator issues a State/region-wide call-up. Each jurisdiction

mobilizes 5% of their available resources for up to two weeks, to support the response.

Level 3 - Catastrophic Emergency/Major Disaster. Defined as an event with a potential of

catastrophic consequence, usually involving more than one county with massive destruction in
the affected counties. The magnitude of the event is such that it would definitely deplete law
enforcement resources in the counties affected.

Call-up: The state/regional coordinator issues a state/region-wide call-up. Each jurisdiction

mobilizes 10% of their available resources for up to four weeks, to support the response.

It is important to note that the “call-up” percentages represent the total available sworn law
enforcement strength committed by each jurisdiction should an event as described occur. It does
not mean, however, that the total percentage committed would actually be deployed. “Call-up”
only places designated assets on “stand-by” status to facilitate the response. The actual
deployment of assets will be based on the specific needs of the affected community.

12.3. Response Zones

Creating response zones within the State/region provide the mutual aid coordinators flexibility
and control in the response. Assets can be mobilized by zone in a time-phased manner, reducing
the likeliness of over-committing resources to a particular event. Designating response zone
coordinators will also help create a defined command and communication structure to assist with
alert notifications and information dissemination.

51
Summary 13
History has demonstrated that the threat of biological terrorism is real. Recent events within the
United States have involved the use of biological agents against individuals and/or groups of
people. The threat of terrorism is constantly evolving. As intelligence and emergency response
forces seek better ways to deter and respond to terrorism so do the terrorists continue to identify
vulnerabilities in our preparations and ability to respond. As a result, response plans, to include
national planning and guidance, continue to change.

This guide is intended as a foundation for law enforcement agencies to gain a better
understanding of the threat of biological terrorism and the issues that are associated with these
agencies in preparing for and responding to such events. It is meant to supplement current
information provided to law enforcement agencies and thereby assist these agencies in
developing their internal policies and procedures for responding to these types of incidents.

The information in this guide is current as of its publication; however, agencies are urged to
continue to review changes to policies and plans as they relate to preparing for and responding to
incidents involving the terrorist use of biological agents. Such new policies and plans may come
from, but are not limited to, the Department of Homeland Security, Centers for Disease Control
and Prevention, and the Federal Bureau of Investigation.

52
References 14
Bioterrorism-Related Inhalation Anthrax: The First 10 Cases Reported in the United States,
National Terrorism Preparedness Institute,
(http://www.cdc.gov/ncidod/EID/vol7no6/jernigan.htm).

Bioterrorism Working Group, Bioterrorism Readiness Plan: A Template for Healthcare

Facilities, 1999, Association for Professionals in Infection Control and Epidemiology
Bioterrorism Task Force and Centers for Disease Control and Prevention.

Bomb Data Center, Biological Materials and Hazards, 1998, Student Manual, Indianhead, MD,
Federal Bureau of Investigation.

Carus, S., Bioterrorism and Biocrimes: The Illicit Use of Biological Agents in the 20th Century,
Working Paper, Washington D.C., 2000, Center for Proliferation Research, National
Defense University.

Centers for Disease Control and Prevention (CDC), Bioterrorism: An Overview Bioterrorism,
Bioterrorism Preparedness and Response Program

CDC Strategic Planning Group, Morbidity and Mortality Weekly Report, Volume 49 - No. RR-4,
Biological and Chemical Terrorism: Strategic Plan for Preparedness and Response, 2000,
Atlanta, GA, U.S. Department of Health and Human Services.

Chandler, David & Landigan, India, A Journalist’s Guide to Covering BioTerrorism, 2002 Radio
and Television News Director’s Foundation.

Chemical/Biological Incident Contingency Plan, 1998, Federal Bureau of Investigation.

Dashiell, T., W. Patrick, F. Sidell, Chem-Bio Handbook, 1998, Alexandria, VA, Jane’s
Information Group.

Department of Health and Human Services, Guidance for Filtration and Air-Cleaning Systems to
Protect Building Environments from Airborne Chemical, Biological, or Radiological
Attacks, National Institute for Occupational Safety and Health, Publication 2003-136,
2003.

Emergency Information Field Guide, 1998, Federal Emergency Management Agency.

Emergency Mobilization Plan, 1999, Florida Sheriffs’ Association Statewide Task Force.

Evidence Detection and Preservation for Weapons of Mass Destruction, National Terrorism
Preparedness Institute, 1999, Student Manual, St. Petersburg, FL, St. Petersburg Junior
College.

53
Federal Response Plan, 2003, Federal Emergency Management Agency.

Fischer III, H., Behavioral Response to Chemical and Biological Terrorism, 1998, Information
Paper, Domestic Preparedness Office.

FM 8-9 NATO Handbook on the Medical Aspects of NBC Defensive Operations AmedP-6 (B)
Part II - Biological, 1996, U.S. Army.

Health and Medical Services Support Plan for the Federal Response to Acts of Chemical and
Biological Terrorism, 1996, Department of Health and Human Services.

Initial National Response Plan, 2003, U.S. Department of Homeland Security.

Information Analysis and Infrastructure Protection, Department of Homeland Security, DHS

Organization www.dhs.gov.

Interim Recommendations for the Selection and Use of Protective Clothing and Respirators
Against Biological Agents, Centers for Disease Control and Prevention & National
Institute for Occupational Safety and Health, 2001.

Maniscalco, Paul and Christen Hank, Terrorism Response Field Guide for Law Enforcement.

Medical Management of Biological Casualties Handbook, 1996, U.S. Army Medical Research
Institute of Infectious Diseases.

Model Procedures for Responding to a Package with Suspicion of a Biological Threat, 2004,
International Association of Fire Chiefs.

National Domestic Preparedness Office, On-scene Commander’s Guide for Responding to

Biological/Chemical Threats, 1999, Washington D.C., National Institute of Justice Office
of Science and Technology.

Office of Emergency Preparedness, Proceedings of the Seminar on Responding to the

Consequences of Chemical and Biological Terrorism, 1995, Washington D.C., U.S.
Public Health Service.

Technical Working Group on Crime Scene Investigation, Crime Scene Investigation: A Guide
for Law Enforcement, 1999, Washington D.C., National Institute of Justice.

10-90 Gold NBC Response Plan, 1998, Defense Protective Services.

“Title XIV: Amendment to Defense Against Weapons of Mass Destruction, Subtitle A:

Domestic Preparedness,” National Defense Authorization Act of FY 97: Nunn-Lugar-
Domenici Pub Law No. 104-201, 1996. U.S. Congress.

54
Tucker, Jonathan B., Historical Trends Related to Bioterrorism: An Empirical Analysis,
Monterey, California, 2000, Monterey Institute of International Studies.

U.S. Army Soldier Biological and Chemical Command, Biological Warfare Improved Response
Program, 1998 Summary Report. U.S. Army Soldier and Biological Chemical Command,
Biological Warfare Improved Response Program, 1999.

U.S. Army Soldier Biological and Chemical Command, Improved Response Program, Criminal
and Epidemiological Investigation Handbook, U.S. Army Soldier and Biological
Chemical Command, 2003 Edition.

U.S. Army Soldier Biological and Chemical Command, Improved Response Program,
Community Outreach/Mass Prophylaxis Pamphlet: A Mass Casualty Care Strategy for
Biological Terrorism Incidents, U.S. Army Soldier and Biological Chemical Command,
2002.

United States General Accounting Office, Bioterrorism. Public Health Response to Anthrax
Incidents of 2001, 2003, GAO-04-152.

War on Terrorism, Counterterrorism, Federal Bureau of Investigation

www.fbi.gov/terrorism/counterterrorism/analysis.

55
 Appendix A

CDC List of Threat Agents

A-1
 CDC List of Threat Agents

Category A
Agents in this category are considered the highest threat to national security because they
• Can be easily disseminated or transmitted person-to-person;
• Cause high mortality, with potential for major public health impact;
• Might result in public panic and social disruption; and
• Require special action for public health preparedness.

Anthrax (Bacillus anthracis)

Smallpox (Variola major)
Plague (Yersinia pestis)
Botulism (Clostridium Botulinum toxin)
Tularemia (Francisella tularensis)
Filoviruses;
− Ebola hemorrhagic fever
− Marburg hemorrhagic fever
Arenaviruses;
− - Lassa (Lassa Fever)
− - Junin (Argentine hemorrhagic fever)

Category B
Agents in this category are considered the second highest threat to national security because they
• Are moderately easy to disseminate;
• Cause moderately high mortality, and
• Require specific enhancements of CDC’s diagnostic capacity and enhanced disease
surveillance.

Q fever (Coxiella burnetti)

Brucellosis (Brucella species)
Epsilon toxin (Clostridium perfringens)
Staphylococcus Enterotoxin B (SEB)
Burkholderia mallei (Glanders)
Solmonella species
Shigella dysenteria
Alphaviruses;
− Venezuelan encephalomyelitis
− Eastern and Western encephalomyelitis
Ricin toxin (Ricinus communis)
Escherichia coli
Vibrio cholerae
Criptosporidium parvum

A-2
Category C
Agents in this category are considered the third highest threat to national security because they:
• Easily obtainable;
• Easily produced and disseminated, and
• Have the potential to cause high morbidity and mortality with major health impact.

Nipah virus
Hantaviruses
Tickborne hemorrhagic fever viruses
Tickborne encephalitis viruses
Yellow fever
Multidrug-resistant tuberculosis

A-3
 Appendix B

Biological Agent Data Summaries

B-1
Bacterial Agents:

• Anthrax
¾ Route of Entry: Anthrax naturally occurs in cattle, sheep, and other hoofed
animals. It is normally transmitted to man through cuts or abrasions in the
arms and hands. Other routes include ingestion and inhalation.
¾ Symptoms:
o Inhalation: The early symptoms are chills, fever, nausea, and swelling of
lymph nodes. Victims begin to feel better and then get worse with major
pulmonary involvement.
o Absorption (Cutaneous): Intense itching followed by painless papular to
vesicular lesions which become black edematous scabs.
o Ingestion: Abdominal pain, nausea, vomiting, severe diarrhea, GI
bleeding and fever.
¾ Incubation Period:
o Inhalation: The incubation period is one to six days up to six weeks.
o Absorption: One to twelve days.
o Ingestion: One to seven days.
¾ Transmission: Non contagious.
o Inhalation: In spore form, it can be transmitted to man through the
respiratory tract, where it is a much greater threat, the mortality rate can
reach 80-90 percent.
o Absorption: Direct contact with skin lesions.
o Ingestion: None.
¾ Etiology: Anthrax bacteria can form spores that make the organism more
resilient.
¾ Treatment: Treatment involves the use of antibiotics and vaccine and
treating the specific symptoms. Once symptoms of the disease develop,
treatment is supportive but often unsuccessful. Ciprofloxacin (500 mg q
12h) or Doxycycline (100mg q 12h) and additional antibiotics.

• Plague
¾ Route of Entry: Plague is normally transmitted to humans from either the
bite of an infected flea or by inhaling the organism. It can also be
aerosolized and be transmitted to man through the respiratory tract causing
pneumonic plague. There are three forms of plague; bubonic, pneumonic
and septicemic plague.
o Bubonic/Septicemic: The most common type in nature is transmitted
from rats to man from the bite of an infected flea. The bites are usually
on the lower extremities.
o Pneumonic: Inhalation/aerosol.
¾ Symptoms: Early symptoms are high fever, chills, headache, spitting up
blood and shortness of breath.
o Bubonic: “Run down” feeling, high fever, staggering gait, delirium,
mental confusion, shock, coma, and tender lymph nodes (buboes).

B-2
 o Pneumonic: High fever, chills, headache, bloody sputum, chest pains,
nausea and vomiting, abnormal lung sounds, rapidly to chest pain.
Advanced: Purpuric skin lesions, copious watery or purulent sputum,
and respiratory failure in one to six days. Circulatory collapse, bleeding,
diathesis, and death.
o Septicemic: Symptoms same as bubonic without buboes and spreads to
central nervous system, lungs and elsewhere.
¾ Incubation Period:
o Bubonic/Septicemic: two to six days.
o Pneumonic: Occurs within two to three days.
¾ Transmission: Contagious.
o Bubonic/Septicemic: Droplet and lesion secretions precautions.
o Pneumonic: Droplet precautions until 48 hours of effective antibiotic
therapy.
¾ Etiology:
o Bubonic: Occurs after skin inoculation, the bacteria are transported to
regional lymph nodes and then into the blood infecting secondary
organs, such as the lungs, spleen, liver, and brain.
o Pneumonic: Aerosol inhalation of the highly contagious Yersinia pestis
from BW agent dissemination source or from respiratory droplets from
another infected patient. Almost 100% of untreated victims will die.
o Septicemic: Is a generalized infection in the blood from the bacteria
(bubonic plague) escaping through the lymph nodes or lungs. In 2.5
percent of the cases, plague septicemia may develop directly without a
clinically apparent lymph infection.
¾ Treatment: Involves using antibiotics treating specific symptoms.
o Bubonic/Septicemic: Streptomycin, tetracycline, chloramphenicol are
effective if administrated early within 24 hours of onset of symptoms.
o Pneumonic: Treatment is early administration of antibiotics within 24
hours of onset of symptoms. Streptomycin or doxycycline for 10 – 14
days is effective.

• Cholera
¾ Route of Entry: Ingestion, inhalation.
¾ Symptoms: A sudden onset of watery rice diarrhea, nausea, and vomiting.
If untreated, it will lead to severe dehydration and death.
¾ Incubation Period: One to five days.
¾ Transmission: Non contagious. Enteric precautions and careful hand
washing.
¾ Etiology: Adhere to the intestinal mucousa causing fluid loss.
¾ Treatment: Fluid and electrolyte replacements and antibiotics.

• Tularemia
¾ Route of Entry: Inhalation absorption, ingestion.
¾ Symptoms: Tularemia may appear in several forms. These are
ulceroglandular (skin lesion noted), glandular (fever and tender lymph

B-3
 nodes), typhoidal oculoglandular (fever, weight loss and possibly
pneumonia), pharyngeal (ulcers confined to the throat) and pneumonic
(pneumonia).
¾ Incubation Period: Three to five days.
¾ Transmission: Non-contagious.
¾ Etiology: This is a zoonotic disease, that humans acquire after contact of
their skin or mucous membranes with tissues or body fluids of infected
animals or from tick or mosquito bites.
¾ Treatment: Antibiotics.

• Q fever
¾ Route of Entry: Inhalation and ingestion.
¾ Symptoms: Q fever presents itself with flu-like symptoms with fever lasting
up to two weeks. It eventually ends with a pneumonia illness that is
incapacitating for long periods of time. Fever, cough, and pleuritic chest
pain as early as 10 days after exposure. May resemble a viral illness or
atypical pneumonia.
¾ Incubation Period: 14 to 26 days.
¾ Transmission: Non-contagious. Aerosol droplet.
¾ Etiology: This is a zoonotic disease, which humans acquire after inhalation
of infected aerosols. It causes death of host cells allowing the organism to
circulate throughout the body causing flu-like symptoms throughout the
body. This leads to a chronic infection usually endocarditis.
¾ Treatment: Can resolve without antibiotics. Treatment is tetracycline or
doxycycline orally for five to seven days.

Toxins
Toxins are non-living poisonous chemical compounds that are produced by living
organisms such as animals, plants, and microorganisms. These agents are thousands of
times more lethal than standard chemical agents, but unlike chemicals, are not typically
volatile or able to cause illness through skin absorption. As a result, toxins are not
prone to person-to-person transmission. The toxicity of these agents varies by their
route of entry (inhalation vs. ingestion vs. subcutaneous). There are numerous naturally
occurring toxins. The two categories discussed in this handbook are neurotoxins and
cytotoxins. Neurotoxins, which attack the nervous system, are fairly fast acting and can
act in a manner opposite to that of the nerve agents, because they prevent nerve-to-
muscle stimulation. Symptoms such as mental confusion, loss of balance, vision
problems, tremors, or seizures are common. Cytotoxins are cell poisons that are slower
acting and can have a variety of symptoms including vomiting, diarrhea, rashes,
blisters, jaundice, bleeding, or general tissue deterioration.
There are numerous other modes of action of toxins, which will not be discussed in this
guideline.

• Botulinum Toxin A
¾ Route of Entry: Inhalation.

B-4
 ¾ Symptoms: Symptoms usually begin 24-72 hours after ingestion or
inhalation of the toxin; blurred vision, mydriasis (dilated pupils), diplopia
(double vision), ptosis (drooping eyelids), photophobia (light sensitivity),
dysphagia (difficulty swallowing), and dysphonia (difficulty speaking),
weakness, dizziness, dry mouth and throat, begin to appear. A delay in
symptoms may range from 6 to 7 days however, depending on the amount
of toxin. After exposure to the toxin, a descending paralysis (head-to-toe)
and bulbar palsies become the characteristic symptoms. A bulbar palsy is a
cranial neuropathy that produces a loss of function in the nerves that
originate from the brain stem. Treatment is supportive. Botulism patients
frequently require prolonged ventilator support (sometimes lasting for
weeks) during definitive care.
¾ Incubation Period: Two to eight days.
¾ Transmission: Non contagious.
¾ Etiology: Botulinum is a neurotoxin. It normally affects victims after the
ingestion of improperly canned food. It results in a disease called botulism.
¾ Treatment: Includes antitoxin and supportive measures.

• Ricin
¾ Route of Entry: Inhalation and ingestion.
¾ Symptoms: May include nausea, vomiting, bloody diarrhea, abdominal
cramps, breathing difficulty, renal failure, and circulatory collapse
depending on the route of exposure. Victims can linger 10-12 days before
death or recovery, depending upon the dose received. Initial symptoms
usually appear 24-72 hours after exposure. Shock typically ensues with
death occurring in 3 days. Ricin is 6-9 times more toxic than Sarin.
¾ Incubation Period: Inhalation: 8 to 24 hours with respiratory failure in 36
to 72 hours (dependent on dosage). Ingestion: 24 to 72 hours.
¾ Transmission: Non-contagious. Wear a mask to prevent inhalation.
¾ Etiology: The toxin attaches to cell surfaces of a variety of tissues,
particularly the stomach lining, if ingested, or the moist, upper respiratory
tissues, if inhaled. Ricin inhibits protein synthesis and causes necrosis of
the lower airway epithelium and severe pulmonary edema. If Ricin is
ingested, it causes gastrointestinal hemorrhage with necrosis of the liver,
spleen, and kidneys. When injected, the toxin acts to destroy local tissue
areas, muscles and lymph nodes and the blood vessels in the body leading to
death.
¾ Treatment: Includes general supportive care including fluid support of the
circulatory system and respiratory support. There is no antitoxin currently
available.

• Staphylococcal Enterotoxin B (SEB).

¾ Route of Entry: Ingestion, Inhalation.
¾ Symptoms: Victims become severely incapacitated. Victims will present
with flu-like symptoms of chills, headache, and a non-productive cough. If
ingested, they will have severe nausea, vomiting and diarrhea.

B-5
 ¾ Incubation Period: Inhalation three to 12 hours.
¾ Transmission: Non contagious.
¾ Etiology: Stimulates production of T cells.
¾ Treatment: Supportive care, gastric lavage, charcoal, or cathartics.

Viruses
Viruses are the simplest type of microorganism and are composed of only genetic
material (RNA or DNA) surrounded by a protein coat. Viruses are much smaller than
bacteria and lack a system for their own metabolism, needing a host to survive. This
host can be plant, animal, insect, bacteria, or human. Many viruses attack specific
types of cells and use the host cell’s chemical energy and protein synthesizing
capabilities to replicate. The virus brings about changes in the host cells resulting in
diseases including cancer and death. In some cases, the exact mechanism by which
viruses produce effects is not completely understood. A few viruses can be treated with
antiviral drugs, but vaccination, when available, is the most effective means of
preventing infection. Certain viruses have characteristics that would make them
particularly well suited for use as biological agents. These include:

• Smallpox
The smallpox virus causes an overt clinical disease only in humans. There are
no animal reservoirs of the virus in nature. This was the major reason why the
disease was selected for global eradication in 1980, and it is the only disease to
date that has earned this distinction. The U.S stopped its civilian vaccination
program in 1981. Despite eradication, concerns over clandestine stockpiles of
smallpox still remain.
¾ Route of Entry: Inhalation and absorption.
¾ Symptoms: Malaise, fever, rigors, vomiting, headache, backache, skin
lesions (maculae-papules-pustular vesicles) on face, neck, palms, soles, and
extremities synchronously.
¾ Incubation Period: 7 to 17 days. Quarantine patients 16 to 17 days after
exposure.
¾ Transmission: Contagious. Aerosol and skin contact.
¾ Etiology: Smallpox is essentially a disease of tissue destruction. Smallpox
and Monkey pox are closely related viruses, naturally transmitted by the
aerosol route, and produce clinically indistinguishable human disease.
Airway exposure to the virus is followed by viral replication in the regional
lymph nodes of the airways, and organism proliferation in the blood occurs
7 to 17 days later with the onset of an influenza-like syndrome with fever,
rigors, vomiting, headache, and backache. Two to three days later lesions
begin to appear. The virus disseminates to the spleen, liver and lungs, and
an initial mild rash is followed 2 to 3 days later by an erupting rash on the
face, arms, and hands. The mortality rate can reach 30%.
¾ Treatment: There is an effective vaccine; however, without this protection
the aerosolized virus presents a respiratory threat. Treatment involves

B-6
 supportive therapy and antibiotics (tetracycline, doxycycline, ciproflaxin or
erythromycin) for diarrhea and shedding organism.

• Venezuelan Equine Encephalitis (VEE)

There are eight distinct viruses, which belong to the VEE complex, that have
been associated with human disease. VEE normally occurs in northern South
America, Central America, Mexico, Trinidad and Florida. The virus can be
killed by heat and disinfectants.
¾ Route of Entry: Inhalation and Injection.
¾ Symptoms: Malaise, spiking fevers, rigors, severe headache, photophobia,
myalgia, nausea, vomiting, cough, sore throat, diarrhea.
¾ Incubation Period: One to five days.
¾ Transmission: Non-contagious. Blood and body precautions.
¾ Etiology: Causes inflammation of the meninges.
¾ Treatment: Supportive care, anticonvulsants, analgesics. Recovery in one
to two weeks.

• Viral Hemorrhagic Fevers

The Viral Hemorrhagic Fevers (VHF) are a diverse group of illnesses caused by
a variety of viruses with a wide range of morbidity and mortality. In spite of the
diverse and variable forms of clinical disease, the VHFs share a common
generalized clinical presentation, with the vascular bed being the target organ.
VHFs include Yellow Fever, Ebola, Marburg, Lassa Fever, Rift Valley Fever
and Dengue Fever.
¾ Route of Entry: Inhalation, absorption.
¾ Symptoms: Symptoms of Viral Hemorrhagic Fever are elevated
temperature, easy bleeding, small skin spots caused by hemorrhaging, rash,
malaise, muscle pain, headache, vomiting and diarrhea. Full-blown cases
will evolve into shock and generalized mucous membrane hemorrhage with
involvement of the neurological, respiratory, or pulmonary, and central
nervous systems.
¾ Incubation Period: Four to 21 days.
¾ Transmission: Contagious. Strict barrier nursing practices, mask-gown-
gloves, in conjunction with isolation. Contact hazard with blood and other
secretions.
¾ Etiology: They are very stable viruses that are highly infectious as fine-
particle aerosols. In most cases, the target organ is the vascular bed causing
micro-vascular damage and changes in the vascular permeability. This
causes the patients to bleed throughout the body. This condition is known
as disseminated intravascular coagulation (DIC).
¾ Treatment: There are vaccines for some of these.

B-7
 Signs / Routes of Incubation/Untreated Person-to– Treatment
Type of
Symptoms Infections Mortality Person
Agent
Transmission

Bacteria
Anthrax
Inhalation Flu-like symptoms, Inhalation, absorption, 1 to 6 days None Antibiotics
fever, chest pains ingestion. (Up to 6 weeks) Ciprofloxacin
possible 1 – 2 days Untreated mortality: 100% (500 mg q 12h) or
improvement, rapid Method of Doxycycline
respiratory failure and dissemination: (100mg q 12h)
shock. Meningitis Aerosol. and additional
may develop. antibiotics.

Intense itching
Absorption followed by painless 1 to 12 days Direct contact with
popular lesions to Untreated mortality: less than skin lesions –
vesicular lesions to 5% infection through
scabs surrounded by absorption.
edema.

Abdominal pain,
Ingestion nausea, vomiting, 1 to 7 days None.
severe diarrhea, GI
bleeding and fever.
Plague
Bubonic plague Malaise, high fever, Transmission by 2 to 10 days Possible inhalation - Antibiotics:
staggering gait, vector (flea bite). Untreated mortality: 50% secretions and Streptomycin
delirium, mental lesions precautions. (30mg/kg/d IM in
confusion, shock, divided dose x 10
coma, and tender days),
lymph nodes Doxycycline
(buboes). (200mg IV then
Droplet precaution 100mg q 12h x 10
Pneumonic High fever, chills, Transmission: 2 to 3 days until 48 hours of days),
plague headache, hemoptysis, Inhalation /aerosol. Untreated mortality: 50 - 90% effective antibiotic Chloramphenicol
chest pains, nausea therapy. (1g IV q 6h)
and vomiting, stridor, Pneumonic: Fatal
rapidly to dyspnea. unless initiated
Advance:P purpuric within 24 hours of
skin lesions, copious symptoms.
watery or purulent
sputum, respiratory
failure in 1 to 6 days.
Death respiratory
failure, circulatory
collapse and bleeding
diathesis.

Symptoms same as See bubonic See bubonic

Septicemic bubonic without See bubonic
plague buboes and spreads to
central nervous
system, lungs and
elsewhere.
Cholera Asymptomatic to Ingestion 1 to 5 days Enteric precautions Fluid and
severe with sudden Covert or aerosol and careful hand- electrolyte
onset. Vomiting, dissemination. Untreated mortality: 50% washing employed. replacement.
abdominal distention Antibiotics to
and pain with little or shorten diarrhea.
no fever followed
rapidly by diarrhea. (5
to 10 liters per day)

B-8
 Signs / Routes of Incubation/Untreated Person-to– Treatment
Type of
Symptoms Infections Mortality Person
Agent
Transmission
Q Fever Fever, cough, and Inhalation and 14 to 26 days Aerial droplet Can resolve
pleuritic chest pain as ingestion. precaution with without antibiotic
early as 10 days after Covert or aerosol Untreated mortality: less than coughing. treatment.
exposure. May dissemination. 1% Antibiotic to
resemble a viral shorten duration.
illness or atypical – tetracycline
pneumonia. (500mg q 6h) or
doxycycline
(100mg q 12h).

Toxins
Botulinum Toxin No fever, excess Inhalation and Inhalation: 24 to 72 hours None *Botulinum
A mucus in throat, dry ingestion. Aerosol (12-80 hours). Antitoxin from
(Botulism) mouth and throat, Ingestion: 12 to 72 hours (2-8 Public Health
blurred/double vision, days). sources.
difficulty moving
eyes, mild pupil Mortality with respiratory Supportive care
dilation, difficulty assistance 5%. Progression and ventilator
speaking, dysphagia, from onset to respiratory support.
dizziness, intermittent failure in as little as 24 hr.
ptosis, unsteady gait,
systematic descenden
flaccid paralysis and
developing respiratory
failure.
Ricin Weakness, fever, Inhalation: Aerosol Inhalation: 8 to 24 hours with Mask to prevent No antitoxin
cough, and about 18 Ingestion: Aerosol respiratory failures in 36 to 72 inhalation. available.
24 hours after aerosol Injection hours (dependent on dosage). Dependent on
exposure hypothermia Ingestion: 24 to 72 hours route of exposure.
hypotension and Inhalation:
cardiovascular Appropriate
collapse. treatment for
Ingestion: Nausea, pulmonary edema
vomiting, bloody and respiratory
diarrhea, abdominal support.
cramps, breathing
difficulty, renal Ingestion: Gastric
failure, and decontamination
circulatory collapse. with lavage and
super-activated
charcoal, followed
by cathartics such
as magnesium
citrate.

Injection:
Supportive care
and respiratory
support.
Staphylococcal Fever, chills, Inhalation: Aerosol Inhalation: 3 to 12 hours None No antitoxin
Enterotoxin B headache, myalgia Ingestion. Mortality: Most patients available.
(SEB) and non-productive recover after one to two Supportive care
cough, dyspnea and weeks
retrosternal chest Ingestion: gastric
pain. High dose: lavage, super-
Septic shock and activated
death. charcoal,
Ingestion: Above plus cathartics
nausea, vomiting and
diarrhea.

B-9
 Signs / Routes of Incubation/Untreated Person-to– Treatment
Type of
Symptoms Infections Mortality Person
Agent
Transmission
Viruses
Smallpox Malaise, fever, rigors Inhalation: 7 to 17 days Strict isolation, Strict isolation.
vomiting, headache, Aerosol/airborne Quarantine: 16 to 17 days inhalation hazard in Supportive care.
backache, skin lesions Absorption: Close after exposure. close contact.
(maculae-papules- contact with vesicles Contact with skin Previous
pustular vesicles) on or secretions. lesions until scab vaccination does
face, neck, palms separate and fall off not contain
soles and extremities or secretions– lifelong
synchronously. immunity.
Venezuelan Malaise, spiking Inhalation: Aerosol 1 to 5 days Blood and body Supportive care.
Equine fevers, rigors, severe Vector: Mosquitoes Mortality rate: less than 1% fluids precaution. Anticonvulsants,
Encephalitis headache, analgesics.
(VEE) photophobia, myalgia, Recovery in one
nausea, vomiting, to two weeks.
cough, sore throat,
diarrhea.
Viral Febrile illness: easy Direct Contact 4 to 21 days Strict barrier Antibiotics.
Hemorrhagic bleeding, petechiae, Uncertain. Untreated mortality 40 to nursing practices Supportive care.
Fevers (VHF) hypotension and Aerosol 90% (mask-gown-gloves)
Yellow Fever shock, flushing of the in conjunction with
Ebola face and chest, edema. isolation.
Marburg Malaise, myalgiae, Contact hazard with
Lassa Fever headache, vomiting, blood and other
Rift Valley Fever diarrhea. secretions.
Dengue Fever

Table B-1. Biological Quick Reference Chart

B-10
 Appendix C

Performance Objectives Matrix

C-1
 Performance Objectives Matrix
Performance Requirements
Legend for requirements: { -basic level z advanced level specialized
Competency level Awareness Operations Technician/ Incident
Employees Responders Specialist Command
Examples Facility workers, Initial Incident Incident Incident
hospital support firefighters, response teams, response team Commanders
personnel, police officers, EMS, basic specialists,
janitors, security 911 operators/ HAZMAT technicians,
guards dispatchers personnel on EMS
scene advanced, and
Areas of Competency Ref. medical
specialists
1. Know the potential for terrorist use of NBC C, F,
weapons: M,
- What nuclear/biological/chemical (NBC) m, G { z z z z
weapons substances are. { z z  z
- Their hazards and risks associated with them. { z z z z
- Likely locations for their use. { z z z z
- The potential outcomes of their use by a z z z z
terrorist.
- Indicators of possible criminal or terrorist z  z
activity involving such agents.
- Behavior of NBC agents.
2. Know the indicators, signs, and symptoms for C, F, { z z  z
exposure to NBC agents and identify the agents M, m
from signs and symptoms, if possible.
2a. Knowledge of questions to ask caller to elicit G, m z
critical information regarding an NBC incident. (911 only)

2b. Recognize unusual trends which may indicate G, m z z  z

an NBC incident.
3. Understand relevant NBC response plans and C, F, { z z z z
standard operating procedures (SOP) and your M, m
role in them.
4. Recognize and communicate the need for C, m, { z z z z
additional resources during an NBC incident. G
5. Make proper notification and communicate the C, F, { z z z z
NBC hazard. M, m
6. Understand: C, F,
- NBC agent terms. m { z z z z
- NBC toxicology terms. z z z
(EMS-8 only)

7. Individual protection at an NBC incident: C, F,

- Use self-protection measures. M, m { z z  z
- Properly use assigned NBC protective z  z
equipment. z  z
- Select and use proper protective equipment.
8. Know protective measures and how to initiate F, M { z z z z
actions to protect others and safeguard property in
an NBC incident.
8a. Know measures of evacuation of personnel in M, G z z z
a downwind hazard area for an NBC incident.

C-2
 Performance Requirements
Legend for requirements: { -basic level z advanced level specialized
Competency level Awareness Operations Technician/ Incident
Employees Responders Specialist Command
9. CB decontamination procedures for self, C, F,
victims, site/equipment, and mass casualties: M, m
- Understand and implement. { self z z  z
z  z
- Determine.
10. Know crime scene and evidence preservation F, M, { z z z z
at an NBC incident. m (except 911)

10a. Know procedures and safety precautions for F, G, z z  z

collecting legal evidence at an NBC incident. m
11. Know federal and other support infrastructure C, F, { { z 
and how to access in an NBC incident. M, m (911 only)

12. Understand the risks of operating in C, F, { z z z

protective clothing when used at an NBC incident. m
13. Understand emergency and first aid F, M { z  {
procedures for exposure to NBC agents and
principles of triage.
14. Know how to perform hazard and risk C, F, z  z
assessment for NBC agents. M, m
15. Understand termination/all clear procedures C, F, z z z
for an NBC incident. m
16. Incident Command System/Incident C, F,
Management System M
- Function within role in an NBC incident. z z 

- Implement for an NBC incident.
17. Know how to perform NBC contamination C, F, z  z
control and containment operations, including for M, m
fatalities.
17a. Understand procedures and equipment for G, m z  z
safe transport of contaminated items.
18. Know the classification, detection, C, F, {  z
identification, and verification of NBC materials M, m
using field survey instruments and equipment, and
methods for collection of solid, liquid, and gas
samples.
19. Know safe patient extraction and NBC F, m z  {
antidote administration. (medical only) (medical
only)

20. Know patient assessment and emergency M, z 

medical treatment in an NBC incident. m, G (medical only) (medical
only)

21. Be familiar with NBC related public health G z z {

and local EMS issues. (medical only) (medical
only)

C-3
 Performance Requirements
Legend for requirements: { -basic level z advanced level specialized
Competency level Awareness Operations Technician/ Incident
Employees Responders Specialist Command
22. Know procedures for patient transport F, G z z {
following an NBC incident. (medical only) (medical
only)

23. Execute NBC triage and primary care. G z 

(medical only) (medical
only)

24. Know laboratory identification and diagnosis G 

for biological agents. (medical
only)

25. Have the ability to develop a site safety plan C, F  

and control plan for an NBC incident.
26. Have ability to develop an NBC response G, m z
plan and conduct exercise of response.
Legend for references:
C - 29 CFR 1910.120 (OSHA Hazardous Waste Operations and Emergency response)
M - Macro objectives developed by a training subgroup of the Senior Interagency Coordinating Group
m - Micro objectives developed by U.S. Army Chemical & Biological Defense Command
G - Focus Group workshop
F - NFPA Standard 472 (Professional Competence of Responders to Hazardous Materials Incidents) and/or
NFPA Standard 473 (Competencies for EMS Personnel Responding to Hazardous Materials Incidents)

C-4