The Role of EMS in Intelligence Gathering

It is Tuesday afternoon and you are halfway through your shift for All-City EMS, an ALS provider operating in an urban EMS system, when you are dispatched to a “party feeling sick.” When the first responder BLS engine company arrives, they report back that they are assisting ventilations and preparing to give intranasal Narcan, an opiate antagonist to an unconscious patient. When you arrive, you learn the patient is a known heroin user; however, this time seems to be different. The patient has taken his “usual” quantity of heroin, but it requires 28 mg—nearly 14 times the usual dose of Narcan and the supply from four additional EMS units special called to the scene—to sustain adequate spontaneous respirations while transporting the patient to the hospital. After the call, you and your partner discuss the incident and both agree this was unusual. You come to the conclusion that perhaps there is some bad heroin being sold in the area, agreeing that this user should not have had the negative reaction he experienced.

We have all had responses like the one described above, when either during or after the fact our sixth sense reinforced something wasn’t right. This could be the result of a strange patient presentation, such as a peculiar burn, out-of-the-ordinary medical etiology, or chemically induced agitated delirium; something odd at the incident that seems out of place in the house or at the scene; or a concern for the well-being of a patient because of the overbearing “family member,” for example. You want to share that information with your colleagues and help enhance their situational awareness. What if, however, this strange event was occurring regionally, or even nationally? This cross-jurisdictional trending of suspicious activity and emerging incidents presents a challenge for EMS, but in the words of the Ghostbusters, “Who ya gonna call”?

Information Sharing

The National Network of Fusion Centers and the Nationwide Suspicious Activity Reporting (SAR) Initiative (NSI) are two programs in which these out-of-the-ordinary incidents could be shared.

In recent years, the Department of Homeland Security (DHS) has worked to promote the fusion center program—a collaborative, unified effort in support of enhancing an information-sharing environment (ISE) between partners and stakeholders. Fusion centers are uniquely situated to empower front-line law enforcement, public safety, fire service, emergency response, public health, critical infrastructure protection and private sector security personnel to understand local implications of national intelligence, enabling local officials to better protect their communities. State and major urban area fusion centers conduct analysis and facilitate information sharing while assisting law enforcement and homeland security partners in preventing, protecting against and responding to crime and terrorism. Across the United States, more than 70 “fusion centers” serve in the receipt, gathering, analysis and dissemination of threat-related information between the federal government and state, local, tribal, territorial (SLTT) and private sector partners. With locations in every state and many major urban areas, fusion centers are recognized by DHS and Department of Justice (DOJ) as critical elements that are in a position to enhance responder and decision maker situational awareness with a multidiscipline expertise.¹

In recent years, the fusion centers have segued from the traditional criminal intelligence environment to a more all-hazards approach, incorporating nontraditional partners such as EMS, fire, public health and emergency management entities. The input from these nontraditional partners has not only allowed for the gathering of new intelligence into the centers but has created a new “outside-the-box” analysis of the aforementioned data, enabling a more thorough analysis of the threats faced by the communities we respond within. Likewise, with this bidirectional flow of communication, fusion centers are able to receive threat information from the federal government; produce and disseminate relevant local context intelligence and training products for jurisdictions, creating a picture of the national threat level; and gather tips, leads and SAR from multiple jurisdictions and stakeholders to determine emerging trends, all of which improve responder situational awareness and safety as it relates to the efforts of homeland security.

The NSI is an online training strategy supporting a multifaceted approach designed to improve effectiveness of the SLTT entities reporting of suspicious activity. The NSI recognizes that although specific job responsibilities differ from our law enforcement colleagues, “hometown security partners”—including partners in EMS, fire, emergency management and public safety telecommunication—and those tasked with protecting the nation’s critical infrastructure are important to the effort and serve as workforce multipliers, acting as extra eyes and ears on the street. This standardized process promotes an ISE and provides training for first responders or “first preventers,” such as indicators of terrorism or preoperational surveillance.

The Maryland Coordination and Analysis Center (MCAC), a state fusion center, outlined in the “How to Help” section of its website a few preoperational indicators, including:

• Surveillance activity, e.g. note-taking, use of binoculars, cameras or maps that appears out of context.
• Theft of uniforms, official vehicles, access badges or other resources that can be used to gain entry to restricted or protected areas.
• Stockpiling/storage of weapons or explosives, or explosive making materials, e.g. volatile chemicals, fertilizer, propane tanks.
• Attempts to test physical security.
• Presence of individuals who loiter or do not appear to belong in an area for an extended time, and/or change or hide their behavior in the presence of law enforcement/security personnel.²

It is important to recognize that any of these indicators independent of each other are likely to be easily explained; however, if the same subject is reported in several different jurisdictions taking part in similar or even different activities, this collaborative effort of reporting to a fusion center can identify an emerging pattern of nefarious activity. The proper authorities can investigate, potentially preventing or deterring a domestic attack on our soil.

Real-World Events

EMS is no stranger to this environment. We work in a dynamic and ever-changing world and, in many instances, are first to identify suspicious activity, some of which can be linked to international terrorism, domestic terrorism or homegrown violent extremists. Some examples include:

• In January 2014, paramedics found a male subject at a Glen Burnie, MD, home complaining of burns of a “chemical or mechanical reaction.” As first responders talked with the patient, they “became suspicious of his story, suspicious of his injuries and suspicious of his distinct chemical odor.” This report generated a multiagency investigation by both police and fire marshals, resulting in the discovery of chemicals, including stockpiled glass jars labeled “ammonium chloride,” “potassium chlorate” and “sulfur”; fuses; guns; bomb-making materials; and how-to manuals with titles such as “Boobytraps,” “Deadly Brew,” “Highly Explosive Pyrotechnic Compositions” and “The Poor Man's James Bond.”³
• In fall 2012, several Florida-based EMS and fire agencies responding to emergency incidents recognized the same subject on each of their scenes. When questioned, the subject reported to be a certified EMT in North Carolina wanting to assist with on-scene efforts. The subject attempted to impersonate a public official and presented responders with credentials, including a generic EMT badge. Each of these instances subsequently was reported to the Orlando-based Central Florida Information Exchange (CFIX). The CFIX collaborated with the North Carolina Information and Analysis Center (ISAAC) in Raleigh, NC, to verify the subject did not hold valid credentials in North Carolina. This information allowed CFIX and partner agencies to further investigate and resolve the incident concerning the identified subject.
• In March 2013, two female paramedics encountered a non-English speaking patient during a routine call for EMS. During the encounter, the patient appeared to have concerns about receiving care from female medics. A bystander neighbor arrived on scene and familiarly conversed with the patient in a foreign language. The bystander explained the cultural concerns about the female medics providing care for the patient and then made what appeared to be multiple attempts to access and/or survey the EMS equipment purporting to be assisting with the care for the patient. The bystander took specific interest in the operation and contents of the ambulances exterior cabinets and cab. After the encounter, the medics reported the incident to their agency Field Liaison Officer who worked with the North Carolina Information and Analysis Center (ISAAC) to identify and link the suspicious activity to the individuals.

Each of these instances can be categorized into one or more of the above preoperational indicators having a potential connection to terrorism or crime. Around the globe, ambulances, uniforms and credentials are stolen and used in tactics by terrorists to carry out attacks. For example, in September 2013, an ambulance in Iraq arrived at an active scene of a detonated suicide bomber. After proceeding into the middle of the incident where many responders were working, it detonated as a secondary device, killing six and injuring 62.⁴ As a discipline, we should attempt to safeguard these items as a function of an agency’s physical and operational security.

Additional Advantages

One of the additional advantages is the fusion center can provide responders with information that can be helpful in promoting situational awareness in strategic and tactical plans. This could include information about (a) emerging public health issues such as communicable diseases and outbreaks in a community; (b) emerging illicit drugs, such as acetyl fentanyl-laced heroin, as described in the opening scenario, and bath salts, as well as the implications these may have on the responders’ operations and safety; (c) various trainings about applicable gang activity, sovereign citizens, extremist groups, etc.; (d) multidisciplinary threat and risk assessments as jurisdictions and agencies prepare for large-scale events and mass gatherings; and (e) information about crime trends, such indicators of human trafficking, that could enhance awareness for SAR.

• Emerging Public Health Issues—EMS responders are likely to be on the frontlines when it comes to a bioterrorism attack. It could be either an overt attack, where it’s immediately known to be an attack, or of a covert nature, where it may take hours, days or weeks to see a pattern of results. Either way, the larger healthcare community will be involved. Chemical, biological, radiological, nuclear and explosives (CBRNE) all have a public health nexus. This could include organophosphate exposures, nerve agents, ricin or improvised explosive devices (IEDs). On a local level, consideration for outbreaks of a variety of diseases—e.g., at healthcare facilities such as skilled nursing facilities or assisted living facilities—can be tracked and shared with responders.
• Illicit Drugs—Would it have been helpful to have been aware of the fentanyl-laced heroin discussed in the opening scenario? Of course, but trending can only be done with EMS assistance. Sharing a recognition by EMS of an increased frequency or variation of presentation are helpful to multiple disciplines, including law enforcement agencies, public health (to advise emergency departments), and mostly medical directors and administration of EMS agencies. In the case of the heroin, an altered treatment modality will be necessary with the large volume of narcan necessary to adequately treat the patient and it is likely your agency will have to prepare based on the actionable intelligence by increasing available stock. On the other side of the spectrum, new street drugs that could induce agitated delirium, such as bath salts, are important to be aware of for safety purposes of responders. Having the ability to recognize the symptoms and understanding the cornerstone of treatments, including chemical restraint, is key.
• Gangs and Extremists—There are plenty of groups out there who, to further their ideologies or beliefs, could potentially act in a manner that could be violent. EMS routinely enters neighborhoods and, more specifically, homes of patients. Although EMS providers are not expected to be crime fighters, nor should we alter our approach to patient care, it is important for purposes of situational awareness to have the ability recognize indicators of gang activity and extremists. Knowing what turf you are on will allow for recognition if something is out of place—like the wrong “colors” parading around. Also, in some cases, extremists are anti-government, and a paramedic in a uniform with a badge making inquiries—even if they’re just routine assessment questions—could be misconstrued and enough to provoke an event. The fusion center could put together trainings utilizing the multidiscipline representation specific to the needs of EMS, such as an awareness level course with specific context to local response areas. Additionally, protests pose a challenge and certain groups choose to use one platform to share their thoughts. This could transition a peaceful gathering into a violent encounter. It is important to communicate with a fusion center, evaluating credible threats, risks and vulnerability from a multidisciplinary standpoint.
• Threat and Risk Assessments (TRAs)—It is important for EMS agencies to have a seat at the planning table for special events and mass gatherings. However, without a good multidisciplinary assessment of what is faced, leaders and decision makers are simply making blind plans. Consider an interagency approach, using the fusion center framework to evaluate credible threats of transnational, domestic and local concerns; issues and implications with the event faced by other jurisdictions before the event arrives in your area; and the current intelligence from the local environment, including factors such as weather, effects on traffic patterns, political issues, social issues, economical issues or technological issues.
• Crime Trend Information—While it is important to emphasize EMS is not expected to—and shouldn’t—act on criminal behavior, maintaining awareness of your surroundings and scenes and then reporting your findings could be the missing link to preventing, deterring or solving a crime, including terrorism. Through information sharing, the fusion center can provide training and local context indicators of items to look for as they relate to crimes. For example, it is likely that EMS will encounter a victim of human trafficking before law enforcement does. By having the ability to recognize this as a possibility, notifications can be made to the proper authorities, potentially saving that patient’s life beyond that single transport to the hospital. Similarly, by learning about indicators of clandestine labs, such as home methamphetamine or mobile/one pot methamphetamine labs, EMS can potentially get out of a volatile and dangerous environment and summon the appropriate authorities.

Conclusion

Although each state or major urban area fusion center has differing methods for reporting of suspicious activity, the general principal remains the same. In many cases, an agency liaison receives training and represents the fusion center on behalf of a specific agency. This person serves as a contact for the agency to report information locally to be filtered into the fusion center and, in return, receives intelligence to disseminate back to the agency. Some states refer to this person as a field liaison officer (FLO), some are intelligence liaison officers (ILO), and others use the term terrorism liaison officer (TLO). Further, most fusion centers have a “hotline” phone number or e-mail address to report suspicious activity. The increased number of reports from a wider number of jurisdictions and disciplines will result in a more enhanced ability to recognize patterns and trends. These patterns and trends may then be used to develop actionable intelligence and situational awareness for EMS responders. An EMS responder should feel confident that their ability to recognize suspicious activity is likely to be strong and indicators should not be dismissed as insignificant.

The paradigm shift can be made from “first responders” to “first preventers” with ease. As EMS straddles the line between public safety and healthcare, there is much value that can be added to the intelligence community with a bidirectional relationship in both the training of EMS providers in the field and receiving SAR at the fusion center from EMS. EMS is frequently summoned for service at a variety of settings between residences and businesses, crossing all demographics. With little time, or the misconception that it is unnecessary to “sanitize” an incident prior to EMS being called, odds of EMS stumbling on a scene with signs of suspicious activity are likely. EMS personnel are skilled at recognizing dangerous or suspicious environments, and often have a good sense of community concerns due to their frequent interaction with the public. Further, the ability of EMS personnel to determine veracity of statements and patient history, especially in the situations when the stated history is inconsistent with the signs and symptoms, or physical evidence, makes us excellent candidates to act as intelligence sensors.⁵

References

1. U.S. Department of Homeland Security. State and Major Urban Area fusion Centers, https://www.dhs.gov/state-and-major-urban-area-fusion-centers.
2. Maryland Coordination and Analysis Center. Terrorism Indicators, https://www.mcac.maryland.gov/how_to_help/TerrorismIndicators.html.
3. Wood P. Glen Burnie man accused of making explosives had potential for ‘destruction and terror.’ Baltimore Sun, https://www.baltimoresun.com/news/maryland/anne-arundel/glen-burnie/bs-md-ar-explosive-update-20140107,0,7124657.story.
4. EMS World. Ambulance Packed with Bombs Explodes in Iraq, 6 Dead, www.emsworld.com/news/11182343/ambulance-packed-with-bombs-explodes-in-iraq-6-dead.
5. Petrie M. The Use of EMS Personnel as Intelligence Sensors: Critical Issues and Recommended Practices. Homeland Security Affairs, 2007 Sep; 3(3), www.hsaj.org/?article=3.3.6.

Seth J. Komansky, MS, NRP is an advanced practice paramedic and the medical intelligence officer for the Wake County EMS System in Raleigh, NC. He was tasked with the implementation and management of Wake County’s Medical Intelligence Unit. In addition, he serves as the EMS Field Liaison Officer Coordinator to the North Carolina Information Sharing and Analysis Center (NC ISAAC), the state's Fusion Center managed by the NC State Bureau of Investigation. 

Raphael M. Barishansky, MPH, MS, CPM, is director of EMS for the Connecticut Department of Public Health. A frequent contributor to and editorial advisory board member for EMS World, he can be reached at rbarishansky@gmail.com.