ExecSummary

In April 2007, the Legislative Program Review and Investigations Committee voted to undertake a study of Homeland Security in Connecticut. The focus of the study was on the actions taken by the state Department of Emergency Management and Homeland Security (DEMHS) and its predecessor agencies to improve the status of the state's homeland security and related emergency management efforts. Specifically, the study focused on recent assessment, planning, and implementation activities related to improving the state's ability to prevent, protect against, respond to, and recover from terrorist attacks.

What precisely constitutes homeland security and how the nation should go about it has developed over a very short period of time and continues to evolve. Much of the direction and funding received by DEMHS for this function comes from the federal government. As such, it is important to note that several state endeavors depend on the cooperation of or direction from agencies and organizations not under the direct control of DEMHS.

Overall, Connecticut has made progress in the area of homeland security and is better prepared than it was in the autumn of 2001. For example, federal, state, and local law enforcement agencies are now better connected and informed through a statewide central resource that collects, analyzes, and disseminates criminal and terrorism-related intelligence. A multi-jurisdictional law enforcement task force on terrorism serves to streamline investigations and responses to terrorism-related allegations. Critical infrastructure identification and prioritization are on-going, while assessment and protection efforts are being implemented. Further, a significant amount of DEMHS attention is focused on improving the redundancy and resiliency of Connecticut's emergency communications systems, though true interoperability is several years away.

Although DEMHS has achieved substantial progress since its inception in 2005, the following program review study conclusions suggest the need for further development and improvement in certain areas:

● It is not clear how active DEMHS will be in performing critical infrastructure assessments, and ensuring mitigation activities are performed and business continuity plans are in place for the state's most critical assets.

● Most of the basic objectives related to establishing an intelligence center in Connecticut have been met. However, certain administrative matters such as staffing levels, training, reporting structures, and internal auditing mechanisms need to be addressed.

● Several initiatives, as outlined in the statewide communications interoperability plan, are needed to provide a coordinated approach to resolving long-standing inadequacies in public safety communications systems.

● DEMHS does not provide a unified reporting system so that stakeholders, policy makers, or the general public can know the status of its goals. Some DEMHS goals tend to be short-term and/or do not convey a vision of where the department wants to be in the future.

Additional enhancements that would better ensure the prevention, protection, and response capabilities of the state are needed. Many improvements have already been identified by DEMHS and are in various stages of implementation. The aim of the program review recommendations, listed below, is the refinement of the systems in place.

1. DEMHS needs to clearly document the critical infrastructure eligibility guidelines and provide that information to each municipality.

2. DEMHS should encourage greater participation by municipalities in the infrastructure program by reinforcing with municipal leaders the importance of the program and the impact it has on the funding of regional priorities. In addition, DEMHS should investigate the feasibility of providing an electronic means for municipalities to access and update infrastructure information through a secure internet portal.

3. DEMHS should investigate the use of other validated infrastructure assessment tools to better accommodate the categorizing, analyzing, and reporting needs of the department.

4. To improve Connecticut's infrastructure protection efforts and to better understand any barriers to reducing vulnerabilities in certain business sectors, DEMHS should:

a. develop a specific implementation plan that outlines DEMHS intentions, goals, and responsibilities in assessing and mitigating vulnerabilities as well as in tracking the status of public and private sector security efforts at Connecticut's most critical infrastructure sites;

b. track core activity measures, such as, but not limited to, the number of assets, systems, and networks by sector, and the number of completed vulnerability assessments;

c. develop a system to capture information about the usefulness of facility assessments performed by the department and the extent to which mitigating recommendations have been implemented by both public and private facility owners, including improvements made through grants awarded to ferry, port and transit operators in the state; other measures to consider include percentage of high-risk assets that have developed protective strategies, percentage that have implemented mitigation strategies, and percentage that have continuity of operations plans.

d. report results of b and c in an aggregated and non-identifiable format in DEMHS' annual report; and

e. convene a task force composed of coordinating council members, public safety officials, private sector facility owners, and other appropriate stakeholders to investigate the need for the regulation of security improvements or the development of incentives for certain critical infrastructure facilities, such as those that handle extraordinarily hazardous substances, transportation facilities, or other critical infrastructure.

5. In conjunction with the risk-based funding methodology, DEMHS should consider adjusting the regional funding formula to include a factor or factors that take(s) into account the preparedness needs of each region as initial regional organizational objectives are met. In developing the information about preparedness needs, DEMHS should conduct a comprehensive all-hazard risk and vulnerability assessment of large scale disasters and catastrophes that can plausibly be expected to occur in Connecticut to assist in identifying the individual needs of regions.

6. Similar to the recommendation above, DEMHS should develop a system to capture information about the usefulness of the buffer zone protection program assessments performed by the department and the extent to which mitigating recommendations have been implemented and report the results in an aggregated format in DEMHS' annual report.

7. To formalize appointments and ensure continued cooperation, the appointment of ILOs and RILOs shall be codified into statute. Furthermore, the number of ILO appointments should be relative to the size or population of the community.

8. Formal clarification regarding the reporting structure for the state liaison intelligence coordinator position is needed.

9. DEMHS shall further expand its private sector outreach efforts particularly to small businesses and security personnel of major critical infrastructures.

10. Basic statistical information regarding the Tips Hotline should be generated (i.e., the number of calls received and the outcome of the calls) and provided to the members of the CTIC policy board on a periodic basis. In addition, the annual number of hotline calls received should be reported on the DEMHS website and its other various public relations materials

11. Whenever feasible and appropriate, CTIC personnel should have more involvement in the joint tabletop, functional, and full-scale homeland security exercises throughout the state. Furthermore, as an administrative matter, CTIC should track the participation rate and training level of all of its personnel particularly for CTIC sponsored events.

12. The CTIC policy board should establish a mechanism for ongoing monitoring of the center's operations, procedures, and policies to ensure that all information and intelligence needs of the shareholders are being met. The evaluation mechanism should also provide CTIC product users feedback opportunities.

13. Connecticut should have a continued presence on the JTTF with additional assignments when staff resources are available.

14. A mass notification system, such as Reverse 911, should be a required homeland security fund purchase for municipalities. DEMHS should work with OSET to ensure the cost to towns for databases is minimal. DEMHS, along with DOIT, should have a role in managing the mass notification system contract and tracking who has acquired it.

15. A DEMHS public information officer position should be authorized and filled. Public service announcements and campaigns should be developed and revamped when necessary.

16. DEMHS should, when revising its state homeland security strategies and internal strategies, ensure that the goal statements provide a clear picture of what the department is trying to achieve and make certain all objectives have dates of accomplishment and meaningful performance measures. In addition, on at least an annual basis, DEMHS needs to develop a unified goals document that communicates the status of its goals and the results of its performance to the Emergency Management Homeland Security Coordinating Council and the legislature.

17. The Department of Emergency Management and Homeland Security with the cooperation of DPS shall implement the provisions of C.G.S. Section 28-1a (e) relating to the creation of interagency memorandums of understanding.

18. DEMHS shall notify the appropriations committee and the appropriate committees of cognizance in a timely manner of the status of federal grant funding when grant awards are less than what the department had applied for.

19. DEMHS, through a sub-committee of the coordinating council, should develop a plan to address the need for an alternative emergency operations center (EOC) no later than January 2009. In particular, the plan should outline all necessary EOC specifications and requirements and whether the alternatives currently being considered (e.g., mobile command center, Rentschler, Southbury) are viable and reasonable options. Once site requirements are determined, DEMHS, in conjunction with DPW, should identify potential alternative methods and/or locations available for the EOC.