Integrating Web-Based Emergency Management Collaboration Software into Airport Operations--A Primer (2013)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

13 C H A P T E R 2 When considering whether or not to purchase, implement, and/or upgrade a WBEMCT, airport managers will need to take a wide array of issues into account, including the following: • The specific management needs of the airport based on its unique environment and circumstances; • The aptitude and interest among key personnel to sustain a commitment to training through the initial learning curve to achieve competence and comfort with the system; • The nature of the relationships with partners in the community, their needs, and their current use of web-based systems; • The features and capabilities of available web-based systems; • How those features would best serve airport management in real-world operations in terms of saving time and money; improving accuracy, accountability, and security; enhancing connec- tivity to individuals and agencies in the community; upgrading safety and emergency manage- ment procedures, and so forth; • The types and pricing levels of available systems; • Maintenance costs; • How closely the vendors are willing to work with the airport in choosing a WBEMCT, training personnel, and the like; and • Available funding. At any point during the decision-making process, managers may decide that the timing is not right for purchasing and/or implementing a WBEMCT. However, the decision-making process has value in and of itself, as it helps managers define their needs and environment in specific detail, leading to a more solid understanding of how to best meet those needs in the future. This chapter identifies the personnel and agencies that ought to be involved in determining an airport’s needs for developing a WBEMCT, as well as how the chosen system can best be acquired. Pertinent stakeholders would be identified and consulted and a cost breakdown matrix developed to identify systems that need to be integrated into the WBEMCT, keeping in mind that integrating more systems entails higher probable cost. The chapter ends with an overview of system integration, security, staffing, and a process guide for using this primer. Communication with Internal and External Stakeholders Internal Stakeholders (Within the Airport) Airport emergency managers or operations managers are generally the primary point of contact between airport personnel and emergency management agencies. The airport emer- gency manager must have knowledge of the emergency management tools available to connect Areas of Consideration Prior to the Acquisition and Utilization of a WBEMCT

14 Integrating Web-Based Emergency Management Collaboration Tools into Airport Operations—A Primer with EMAs when requesting additional assets or reporting the status of incidents affecting the airport. When an event necessitates the need for an IC, communication between the IC and the sup- port staff or EOC is imperative. The designation of the role of IC will vary from incident to incident. Typically a representative from law enforcement or ARFF will be the on-scene IC; very rarely will the police chief or ARFF chief serve as IC. At some airports, operations personnel serve in the IC role. ICs should be familiar with the available WBEMCTs, as providing key situational awareness to airport officials and EMAs is paramount during incident management. Airport security con- cerns must involve key entities such as ARFF, law enforcement, the Federal Bureau of Investiga- tion (FBI), etc. In addition to first responders, other key stakeholders involved in response and recovery may include the following: • Passenger airlines, • Cargo operators, • TSA, • CBP, • FAA, • Concessionaires, and • Other airport tenants and contractors. Airport directors and their deputies provide support and necessary resources during an inci- dent. Executives need to understand how best to utilize these systems and what their specific roles should be during an event. A good reference for an introduction to the Incident Command System (ICS) can be found on the FEMA Emergency Management Institute Independent Study website: http://training.fema.gov/EMIWeb/IS/IS100b.asp. Additionally, the Emergency Data Exchange Language (EDXL)-SitRep Specification (Appendix D.1 ICS209 Web Form Example) provides a sample ICS form using situation reporting data for completion. Lastly, the public affairs representative needs to be aware of information available on emer- gency management systems in order to ensure accurate and timely messaging to the airport terminal, the media, and the public. External Stakeholders (Outside the Airport) City and county EOC personnel need to be aware of significant activities within the airport and should be familiar with the airport’s emergency management systems. Federal stakeholders who might utilize information from these web-based collaboration tools include the following: • FEMA and the DHS, • FAA under the U.S. Department of Transportation, • Centers for Disease Control and Prevention under the U.S. Department of Health and Human Services, and • U.S. Department of Defense. Cost (Initial, Maintenance/Upgrades, Ongoing Operational Costs) Even though available (or unavailable) funding imposes obvious limitations, in order to develop the software solution most capable of increasing efficiencies and meeting the needs of the airport, ideally requirements will be determined before funding is considered. After defining

Areas of Consideration Prior to the Acquisition and Utilization of a WBEMCT 15 the optimal WBEMCT capability, management can then identify how to best fund the purchase of necessary hardware and software. Table 2 and Figure 4 highlight the relationship between costs and requirements. Figure 4 provides another view of the requirements process. Funds determine available capa- bility. Airports can obtain systems through their emergency management agencies or install a locally hosted system that may be expanded into a fully integrated system on site. The more systems integrated into the WBEMCT, the higher the final cost. Table 3 provides a checklist to walk operators through the decision-making process, incor- porating input from both internal and external stakeholders and exploring options for funding. Current Systems and Integration Effective emergency management requires the following core functional capabilities: • Evacuation management; • Victim tracking; • Facility availability reporting (e.g., hospitals); • Resource management; Capability Server Initial Operating Cost Annual Maintenance Cost Airport officials have access to existing city, county, or state web- based system Located within municipal emergency management agency From no cost up to $25,000 based on airport requirements From no cost up to $25,000 Subscription Services Some support to develop or customize dashboard screens unique to airports Most systems include weather data as part of GIS maps Located at vendor site Up to $25,000 based on airport requirements Up to $25,000 Dashboard screens developed for airport use and GIS maps to help form a COP Most systems include weather data as part of GIS maps Same system that is used by municipal emergency management agency Some integration with airport Located at airport, with backup server at airport (or off-site) $25,000—$100,000 Up to $25,000 systems Dashboard screens developed for airport use and GIS maps help form a COP System is integrated with (dissimilar) emergency management system Most systems include weather data as part of GIS maps Server located at airport with backup server at airport or off-site $100,000— $300,000 or more, depending on level of integration $25,000—$100,000 Fully integrated system with dashboard screens, GIS maps, CAD, communications, weather, security cameras, door alarms, radio frequency identification badges Server at airport ties into redundant backup server at airport or off-site $100,000– $300,000 or more, depending on integration requirements $50,000–$100,000 or more, depending on system enhancements Table 2. Cost matrix.

16 Integrating Web-Based Emergency Management Collaboration Tools into Airport Operations—A Primer • Event/situation reporting; • Alerting and broadcasting; and • Intelligent message distribution. Various local and distributed services may need to be interconnected through computer net- works to achieve all of these capabilities. As a result, interoperability is key when exploring options and determining best solutions. Airports should look for systems that support standardized data structures and protocols and can be integrated with other web-based systems, mass notifica- tion systems, and other web-based communication tools that comply with accepted standards. Full integration of the various systems located within the airport will require establishing con- tracts with software vendors and choosing products that coordinate with the airport’s systems of interest; this is especially true when looking to integrate disparate or standalone systems. If a WBEMCT used by an airport implements a common alerting protocol (CAP), it may be more easily integrated with emergency management applications. Systems that adhere to the same standards can interoperate without additional costs; con- versely, non-interoperable systems will need to convert messages, requiring additional effort, tools, and costs. If a WBEMCT used by an airport implements EDXL standards such as CAP or Figure 4. Requirements considerations.

Areas of Consideration Prior to the Acquisition and Utilization of a WBEMCT 17 resource management (RM), interoperability with other EDXL-compliant emergency manage- ment applications is ensured. The EDXL family of open standards produced by the Emergency Management Technical Committee at the Organization for the Advancement of Structured Information Standards (OASIS; www.oasis-open.org/committees/emergency) makes it possible to share information among emergency response and management service providers. It covers a growing range of the emergency management core functions. (For an overview of products that support EDXL standards, see www.oasis-emergency.org/products). However, complete conversion may not always be possible in both directions. Some web- based systems establish non-standard protocols for sharing information with stakeholders using e-mail or data-sharing techniques, while other systems do not inherently have these capabilities. Either case may prevent broader scale interoperability. System Security Airport IT managers need to understand and apply airport system administrator rules to new systems being installed at their airport. This is especially true of WBEMCTs, which may contain sensitive security information (SSI) or proprietary information generally considered for official use only. As such, WBEMCTs should be considered mission critical software, and IT managers Action Responsibility Done Convene Internal Meeting with Airport Stakeholders 1 Consider inviting pertinent airport and local, state and federal emergency management partners Airport Senior Manager (as appropriate) 2 Determine requirement for standalone system, or system linked to city/county system Airport Emergency Manager 3 Identify the requirements column (refer to Figure 4) Airport Senior Manager (as appropriate) 4 Identify integration requirements—which in-house systems need to be incorporated into emergency management system (e.g., security cameras, door alarms, ID badges) Airport Senior Manager (as appropriate) Convene Meeting with External Stakeholders 1 Consider inviting pertinent airport and local, state and federal emergency management partners Airport Emergency Management, Public Safety Staff, Operations Staff (as appropriate) 2 Discuss or review airport emergency action plan to understand information required by city/county emergency management agency and support required by airport Airport Emergency Management 3 Identify and validate the functional capabilities of the local emergency management system(s) Airport Emergency Management 4 Determine whether city/county system will satisfy airport requirements Airport Emergency Management 5 Evaluate ability to integrate airport systems into city/county system Airport Emergency Management Funding Considerations sdnuf snoitarepo yfitnedI 1 snoitpo tnarg yfitnedI 2 3 Identify other funding sources (e.g., DHS, FAA) 4 Identify options for city/county emergency management agencies to fund or support airport system Airport Finance Airport Finance Airport Finance Airport Finance Table 3. Checklist for airports considering implementation of a web-based collaboration tool.

18 Integrating Web-Based Emergency Management Collaboration Tools into Airport Operations—A Primer will need take all appropriate security measures and establish standard oper- ating procedures to ensure that daily usage of the system is in compliance with regulatory requirements associated with SSI and/or proprietary information. To enhance system survivability, some vendors offer products that provide the ability to maintain a server at the airport with a backup server at another location, or even in a different city, and some vendors offer SaaS, where net- work data resides at the vendor location. At least one vendor maintains net- works on each coast. Nearly all systems require the use of a valid username and password for access, and most web-based systems have functional accounts where certain information is restricted or acces- sible only to those persons or agencies with a valid need to know. These functional accounts are based on emergency management naming schemes or functions such as operations, plans, or security. Web-based systems maintain historical records to show who entered data at what time, so incidents can be traced back to the source, which helps maintain accountability and reliability of the data source. Virtually all of the systems evaluated require an airport system administra- tor who can ensure that those persons or agencies with a valid need to know and who are consequently granted access meet the requirements for entering data into the system. Accounts are generally set up based on roles within the airport, and individuals are granted access to dashboard screens or maps as appropriate to their function within the system. Systems that contain sensi- tive law enforcement information, such as the National Law Enforcement Telecommunications System, grant access strictly on a need-to-know basis. Cyber security is broadly defined as “the protection of personal or sensitive information stored in a computer or in a digital memory device.” Cyber security is also concerned with the protection of physical information technology assets (hardware) from random attacks targeted to destroy or disable computer networks and workstations. The Radio Technical Commission for Aeronautics DO230D Integrated Security Systems for Airports standards address cyber security issues, and a proposed ACRP project for fiscal year (FY) 2013 seeks to address airport cyber security concerns in detail. Airport IT staff work every day to protect users from malware, spyware, and more serious viruses that can wipe out a system. Ascertaining a threat and its source is an ongoing challenge, so IT managers need to remain vigilant in their cyber security efforts and work with software developers to enhance airport security. Cyber security threats can come from a variety of sources, such as social networks and cross-site scripting web attacks. An airport’s network consists of a number of disparate software applications. Sound cyber security measures are vital to making these applications available to those who need them while restricting access to potential threats. Nearly all of the applications evaluated utilize secure socket layer (SSL) protection procedures to enhance cyber security measures. Airport IT managers can consult several sources when seeking to boost cyber security mea- sures, including recent DHS-approved government guidelines on open-source cyber security tools for securing information shared across the Internet. Government agencies required to use cryptographic software validated to Federal Information Processing Standards now have access to Open Secure Socket Layer (Open SSL v2.0), which is free, publicly available security software that meets federal security guidelines. The Pittsburgh Airport emergency manager serves as one of the system administrators for their web-based system. At other airports, the IT manager or the IT department fulfills this role. The Texas Division of Emergency Man- agement uses 35 jurisdictional servers within its Interoperability Project.

Areas of Consideration Prior to the Acquisition and Utilization of a WBEMCT 19 Staffing Web-based systems provide enhanced capability for the rapid sharing of information between departments and agencies both on and off the airport. Fewer phone calls, less messaging, and improved accuracy contribute to greater efficiency in communication among all stakeholders. IT staff should expect a slightly increased workload resulting from the installation and mainte- nance requirements of web-based systems. The typical expected increase is 0.5 full-time equivalents for those systems that reside within the airport network infrastructure. SaaS applications will result in a negligible increase in staffing requirements, as those systems are maintained by the vendor. Different airports address their needs for system administrators in different ways. For exam- ple, the PIT Emergency Manager is one of the system administrators for the airport’s web-based system. At other airports, the IT manager or IT department head fulfills this function. Airports that use web-based SaaS systems rely on the vendor’s system administrator. Several airports use web-based systems within their communications centers, dispatch centers, or airport command center. The ARFF chief, police chief, and their staffs also have access to these capabilities. During critical events, ICs and EOC may require additional personnel for data entry. This will require extra training and associated costs. Training Airport personnel who connect through the city, county, or state system often receive very little training or support for their unique requirements. Software vendors often provide system administrator training for IT staff and can train any and all stakeholders at an airport. They can provide a wide variety of training resources, from computer-based tutorials and online resources to on- or off-site classes. Vendors generally employ the train-the-trainer method of instruction, so that designated employees who receive training can train others in the office. Nearly all web- based systems have online user manuals, and all offer advanced system administrator training. Operations personnel need to be aware of the following concerns regarding training: • It takes time to work with a vendor to train staff on new software releases. Based on the informa- tion provided by vendors and airport users, airport operators and IT staff can generally expect to spend 1 to 3 hours of training every quarter, depending on the impact of changes to a system. • New version releases—generally one to two major updates annually—provide challenges to ensuring that all users receive appropriate training. • WBEMCTs are not typically accessed on a daily basis. Currently, most users only log on periodi- cally or during exercises. Since in these cases using these tools is not an ingrained habit, the tools can be less likely to be accessed when actually needed. For those who want to fully benefit from the capabilities that these systems can offer, daily use and/or regular training and refreshing helps create familiarity with the system and enhances proficiency, especially during critical situations.